993 commits

Author	SHA1	Message	Date
Shaojin Wen	97925919ac	test(managed-agent): add the FG12f MCP stream-gap gates (#14592) ... * docs(managed-agent): draft the FG12b and FG12e fault-gate designs Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): correct the FG12b and FG12e designs after audit Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): address the FG12b and FG12e design review * test(managed-agent): add the FG12b MCP store fault gates The eight-case ledger and a test-only faulting record store wrapper are in place and compile clean. The class is not yet green on JDK 21 + MariaDB: store-reject-settled, -releasing, -drained, -released and -reload-chain still fail. The shared fork budget re-pin (hostedForkHealthySeconds, CI fork literal, pom and workflow comments) is not done; only the roster entry is updated. * docs(managed-agent): close the remaining FG12b/e review findings * test(managed-agent): re-pin the FG12b fork budget The FG12b store-failure class is green 8/8 on JDK 21 + MariaDB (49.0 s measured). Re-pin hostedForkHealthySeconds to 4858 s, the CI fork to 5468 s, the Verify step to 102 minutes, and the job step sum to 182, with the workflow, pom and meta-test comments updated in the same diff. * test(managed-agent): harden the FG12b store fault gates Round 1 audit fixes: the settled cell asserts the dispatch_started record and zero response rows after the failed commit, reopens the stopped authority with the original operation/runtime pins, and reaches that rollback assertion under a skip-rejection mutation (red: expected dispatch_started, was settled). The released cell pins the exact owner-release path and requires two confirmed 200/released releases, with exactly one resend on the next detach. Owner/storage retention now compares the exact runtime-session/generation identity, reload-chain asserts the settled rev 2 and no duplicate chain, and the static gate is cleared in teardown. Local evidence is MariaDB 10.11, not the lane's MySQL 8.4.6. Budget: 120 s allowance for the measured 50.3 s class -> healthy 4878 s, fork 5488 s, Verify 102 minutes. * docs(managed-agent): design the FG12f stream gap gates * test(managed-agent): hold the MCP fixture call until the test releases it * style(managed-agent): format the FG12b design tables * docs(managed-agent): correct the FG12b budget provenance and release cell * test(managed-agent): drop the unused FG12c helpers from the FG12b class * style(managed-agent): realign the FG12b design tables * test(managed-agent): add the FG12f MCP stream-gap gates One MCP tool call is parked inside the stdio fixture while a client reads the Session stream, the client is cut mid-call, and the resumed client must continue the same ledger exactly once. The public route resumes with Last-Event-ID and the WebShell route with afterSequence, so a cursor that is ignored replays and reddens the union on a duplicate instead of timing out. The third case replaces the configuration while the call is held and pins that the running Session keeps its revision, its server and one contiguous stream. * docs(managed-agent): re-pin the FG12f budget to the merged base The parent branch merged main's event-stream liveness gates, which added 440 s to the shared fork's healthy sum before this class. The measurement is unchanged (104.6 s, 210 s budgeted) but the totals it lands on are now 5803 s healthy, 6403 s fork and a 117-minute Verify step. * test(managed-agent): drive the real MCP configuration route in the FG12f replacement case The third case now posts the Harness-private configuration route while the call is held, so the committed configuration generation advances to revision 2 and the released call keeps reading it; the immutable Agent-definition append it used before never reached the replace path. All three cases also pin the fixture's physical effect: one mcp.effect record and one durable proof row, so a resume that re-invokes the tool reddens even when the published completion is unchanged. * test(managed-agent): pin the FG12f replacement case to the public definition route The Harness-private configuration route requires the client id the Broker mints for the Harness session, which a Spring-created Session never exposes, so the case answered 404. The case now commits a new MCP server revision through the public definition route while the call is parked and pins that the running Session keeps revision 1, the replacement is stored once, one server start exists, and the fixture's physical append happens exactly once. * docs(managed-agent): narrow the FG12f replacement case to what it pins The case commits a new MCP server revision while the call is held; it does not replace the running Session's MCP connection. The Harness-private configuration route cannot carry that here because it requires the client id the Broker mints, which a Spring-created Session never exposes, so it answers hosted_session_not_found. The design now records runtime connection replacement as a gap instead of claiming it. * test(managed-agent): re-pin the FG12f budget to the merged-base measurement The three cases measure 121.1 s on the merged base rather than the 104.6 s they measured before it, so the class is budgeted at 2x (242 s): the healthy sum becomes 5985 s, the fork 6585 s and the Verify step stays at 120 minutes. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: 易良 <1204183885@qq.com>	2026-10-18 18:34:21 +00:00
Shaojin Wen	6239c94ca0	test(managed-agent): add FG12b Hosted MCP store fault gates (#14569) ... * docs(managed-agent): draft the FG12b and FG12e fault-gate designs Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): correct the FG12b and FG12e designs after audit Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): address the FG12b and FG12e design review * test(managed-agent): add the FG12b MCP store fault gates The eight-case ledger and a test-only faulting record store wrapper are in place and compile clean. The class is not yet green on JDK 21 + MariaDB: store-reject-settled, -releasing, -drained, -released and -reload-chain still fail. The shared fork budget re-pin (hostedForkHealthySeconds, CI fork literal, pom and workflow comments) is not done; only the roster entry is updated. * docs(managed-agent): close the remaining FG12b/e review findings * test(managed-agent): re-pin the FG12b fork budget The FG12b store-failure class is green 8/8 on JDK 21 + MariaDB (49.0 s measured). Re-pin hostedForkHealthySeconds to 4858 s, the CI fork to 5468 s, the Verify step to 102 minutes, and the job step sum to 182, with the workflow, pom and meta-test comments updated in the same diff. * test(managed-agent): harden the FG12b store fault gates Round 1 audit fixes: the settled cell asserts the dispatch_started record and zero response rows after the failed commit, reopens the stopped authority with the original operation/runtime pins, and reaches that rollback assertion under a skip-rejection mutation (red: expected dispatch_started, was settled). The released cell pins the exact owner-release path and requires two confirmed 200/released releases, with exactly one resend on the next detach. Owner/storage retention now compares the exact runtime-session/generation identity, reload-chain asserts the settled rev 2 and no duplicate chain, and the static gate is cleared in teardown. Local evidence is MariaDB 10.11, not the lane's MySQL 8.4.6. Budget: 120 s allowance for the measured 50.3 s class -> healthy 4878 s, fork 5488 s, Verify 102 minutes. * style(managed-agent): format the FG12b design tables * docs(managed-agent): correct the FG12b budget provenance and release cell * test(managed-agent): drop the unused FG12c helpers from the FG12b class * style(managed-agent): realign the FG12b design tables --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: 易良 <1204183885@qq.com>	2026-10-19 01:08:35 +08:00
Shaojin Wen	b6debf84a3	test(managed-agent): drop the FG13d hook-cancel reply through a broker proxy (#14555) ... * test(managed-agent): drop the hook-cancel reply through a broker proxy Front the embedded broker with the existing forwarding proxy and arm a DROP on the hook-cancel control reply. The owner already aborted, so the gate must resolve the same cancellation through a later status poll, drain the unit exactly once, and never issue a second physical Hook call. * test(managed-agent): budget the FG13d dropped-reply cancel cell The class gains a fourth fixture, so the shared Hosted fork grows by 150 s: healthy 4908, fork 5518, Verify 105 minutes and job 200, with the three pinned comments kept in step. * docs(managed-agent): record the FG13d dropped-reply cancel case and witness	2026-10-18 16:12:46 +00:00
Shaojin Wen	46bf492d05	feat(managed-agent): bound half-open Hosted event streams behind a keepalive capability (#14135) (#14512) ... * feat(managed-agent): bound half-open Hosted event streams behind a keepalive capability (#14135) The Harness advertises its events-route keepalive as event-keepalive/1, and the Java client arms the idle watchdog only against a Harness that advertises it, so a rolling upgrade never aborts the quiet streams of an older Harness. The abort is now the typed HostedHarnessStreamIdleException: the coordinator retries it through the existing re-attach path and never settles or cancels the Turn on silence alone. The watchdog ticks every tenth of the bound, so an abort lands 45 to 49.5 s after the last byte. HostedEventStreamLivenessIT runs the probes on the packaged chain behind a TCP relay that holds the events connection half-open or stalls it, and the hosted-harness-mysql fork budget grows to 4793 s. A design note records the numbers, the capability, the outcome and the other Hosted streams. Closes #14135 * test(managed-agent): frame relayed requests and see virtual-thread readers in the liveness gate The event-stream relay classified a connection, rewrote its Host header and matched keepalives within single reads, so a request or a keepalive split across TCP segments escaped the stall and half-open injection or the cadence count. It now buffers each request head, forwards the body by its Content-Length, matches keepalives across reads, and records and resets a request it cannot frame. HostedEventStreamRelayTest pins each split. The half-open probe checked reader release with Thread.getAllStackTraces(), which leaves out the virtual threads Turn readers run on. It now reads a JDK thread dump, and first requires that dump to show the parked reader. * test(managed-agent): count each keepalive one relay read carries (#14135) The relay recorded one stamp per read that held a keepalive, so two keepalives in one read counted once, and the split-keepalive case could report a size of 1 whenever the pieces happened to land together. It now counts every match in the read window; the carried tail is a byte shorter than a keepalive, so none counts twice. A new case sends two keepalives in one write. * test(sdk-java): park the published-window probe mid-interval (#14135) The watchdog's ticks run from the stream's creation, and the probe parked right after it. A 2000 ms bound is a whole number of half-budget 1000 ms ticks, so that park sat on a tick of the mutant too, and wherever the scheduler ran a few ms late (macOS) the mutant aborted at ~2000 ms and passed. Parking 300 ms in puts the park mid-interval for both ticks: the shipped 200 ms tick aborts at 2100 ms and a 1000 ms tick at 2700 ms, so the limit drops to 2400 ms.	2026-10-18 14:14:37 +00:00
Shaojin Wen	1296186086	test(managed-agent): add the FG11b Harness-side automation store-fault gates (#14446) (#14564) ... A third method of HostedAutomationFaultGatesIT, with four cases: - store-transport: the store commits a manual run's revision 1 and its answer to the Harness is lost; the store client's retry meets the commit the store holds, and the run fires once with no restart; - revision-1 / revision-2: the journal refuses one revision of a manual run's fire; after the store client's three attempts the caller gets a retryable 503 automation_operation_unknown, the Session writes nothing more until it is reloaded, and after a cold restart the same key fires the same run once; - projection: the schedule mirror's projection of an update is refused inside the commit's transaction, so the revision rolls back with it; after a restart the retry commits revision 2 once. Only this method fronts the Session Store with a relay and runs a 15 s writer lease, so a restarted Harness takes the Session over quickly. Four mutation witnesses are red, one of them a bundle patch of the Harness's write latch. Found while writing it: right after a restart the public routes pass the cold Harness's writer conflict through as 409 managed_session_writer_conflict, which the gate retries through. Also folds in #14551's two teardown nits: each trigger drop gets its own try, and the refusal table is dropped too. The method measures 62.1-72.4 s and is budgeted at ~145 s: the healthy sum moves to 5033 s and the fork to 5643 s, inside the Verify step's 105 minutes.	2026-10-18 13:07:01 +00:00
qqqys	bd63f900c7	feat(workflow): discover trusted ancestor workflows in local sessions (#14369) ... * feat(workflow): discover trusted ancestor workflows in local sessions * fix(workflow): enforce ancestor trust authority and preserve scoped loading * test(workflow): use discovery fixture agent type for initialization * test(workflow): support partial settings fixtures in ACP trust mock * test(acp): provide operator trust view in worktree fixtures * fix(workflow): preserve safe discovery on root I/O errors --------- Co-authored-by: qqqys <266654365+qqqys@users.noreply.github.com>	2026-10-18 19:54:22 +08:00
Shaojin Wen	d1c6f02ff6	test(managed-agent): add the FG11b Spring-side automation store-fault gates (#14446) (#14551) ... * test(managed-agent): add the FG11b Spring-side automation store-fault gates (#14446) A second method of HostedAutomationFaultGatesIT, on the FG11a boot, with six cases sharing one minute boundary: - occurrence-insert: a refused occurrence record fires nothing, and the slot fires once after the refusal drops; - occurrence-settle: a refused settle keeps the occurrence firing and re-driven against the same run, one run chain and one model Turn; - watermark: a refused watermark advance re-derives the slot every tick, and its recorded decision stands; - receipt-claim / receipt-settle: a refused request receipt relays nothing, or re-drives the same operation id once it drops; - revision-race: a fire parked while an update commits revision 2 meets automation_revision_stale and is re-pinned and fired once, never skipped. Refusals are tenant-fenced MySQL triggers (the FG9b/FG10c pattern); the relay gains a hold that parks an operation before the Harness. Six mutation witnesses are red; one single-layer watermark mutation is equivalent and recorded. The Harness-side store faults are slice 2. The method measures 30.8-64.5 s locally and is budgeted at ~130 s: the healthy sum moves to 4738 s and the fork to 5348 s, inside the Verify step's 100 minutes. * test(managed-agent): pin FG11b's recovered occurrence to the refused slot (#14446) Review round 1: occurrence-insert took the first recorded scheduled occurrence after the refusal dropped, without checking it was the slot the trigger refused. A regression that skipped past the refused slot, letting the watermark advance, would pass on the next minute's fire. The refusal row now records what it refused (the occurrence key, or the watermark slot). occurrence-insert and occurrence-settle check that every refusal names one slot and that the slot they recover is that one. A/B with a mutation that swallows the refused decision so the watermark advances past it: the previous assertions stayed green (163.3 s, the next minute fired in its place); the new ones go red at "every refusal is the one slot's record". --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-18 08:53:49 +00:00
Shaojin Wen	9ef35af42e	fix(ci): classify host lock starvation as infrastructure (#14550) (#14552) ... The main CI watcher and the PR scan share one infrastructure-signature list. A per-host SDK Java test lock starving past its flock budget carried no signature, so main run 39104863059 filed #14550 for a lane in which no test ever ran. The annotation names a lock budget, not an assertion: several runner instances share one HOME on the ECS pool, so a fast-tier job can wait behind sibling Maven holds that outlast its own acquisition budget. Main runs now rerun that class once instead of filing, and a red check on a PR is reran once; the existing attempt-2 guard still files when the starvation is not transient. The new pattern also covers the E2E and release docker lock messages, which share the same starvation semantics.	2026-10-18 08:43:20 +00:00
Shaojin Wen	5dc4b0e501	test(managed-agent): add the FG13d stopped-worker cancel gate (#14541) ... * test(managed-agent): pin the FG13d cancel against a stopped worker SIGSTOP the durable worker while the command holds, then cancel through the Harness route. The owner cannot answer the lookup, so the record must stay recovery_blocked/outcome_unknown and keep the unit populated instead of inventing an end. Adds 150 s to the shared fork budget and records the matching mutation witness in the design. * test(managed-agent): hold the stopped-worker fixture indefinitely SIGSTOP freezes the worker, not the fixture's own hold timer: a 60 s hold would end during the two 30 s owner lookups, kill the child and write the allow, so a correct implementation could fail on scheduling. Hold until teardown instead, matching the worker-kill cells. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-18 08:03:03 +00:00
Shaojin Wen	7a2ce9b99a	test(managed-agent): add the FG11a automation lost-reply fault gates (#14446) (#14534) ... * test(managed-agent): add the FG11a automation lost-reply fault gates (#14446) The first packaged lane that turns automation on: in-JVM Spring with the scanner running, a real Harness behind a relay that drops one committed answer, real MySQL and a model stub. Eight cases share one boot and one minute boundary: - create-reply, update-reply (a newer update lands meanwhile), noop-update-reply and retire-reply: the retry answers the committed revision and never commits again or over a newer one; - manual-run-reply and scheduled-fire-reply: the re-drive meets the same arun_ run, with one run chain and one model Turn; - reconcile-reply: a lost reconcile answer leaves the slot skipped under its own refusal, never unknown; - public-reply: a lost public 202 replays the receipt without a second Harness operation. Five mutation witnesses are red; one equivalent mutation is recorded in the design. The fixture runs one Turn per Session first: the automation verbs only load a Session on the Harness, so one created without input is refused 404 managed_session_not_found. The class measures 46.3-85.0 s locally; it is budgeted at ~170 s, so the shared fork's healthy sum moves to 4359 s and its timeout to 4969 s, inside the Verify step's 95 minutes. * test(managed-agent): keep FG11a's clocked cases off the scanner until armed (#14446) Review round 1: - The scanner ran from boot, so a minute boundary between a definition's create and its armed fault, or its held manual run, let a slot fire first: attempts 0 for scheduled-fire-reply, 409 automation_run_skipped for reconcile-reply. SchedulerHold now parks the scanner's only thread while the three clocked cases set up; manual runs fire on the request thread and are unaffected. - assertOneRun collected every fire and run command of the schedule, so a legitimate second slot on a slow runner read as a duplicate. The exactly-once checks are now scoped to the occurrence under test. - The design docs give the Verify step's 95 minutes, describe both fixes, and say a first red skips the later cases, which are re-run per case.	2026-10-18 07:22:12 +00:00
Shaojin Wen	e5ceeb4bea	test(managed-agent): add the FG13d Hook cancel and timeout fault gates (#14533) ... * test(managed-agent): add the FG13d Hook cancel and timeout fault gates Extend the packaged Hook rig with a descendant that ignores SIGTERM, and pin two arms against the real stack: a cancel must escalate to cgroup.kill after the grace and settle cancelled only once the unit is empty; a 2 s timeout must kill the unit, keep the output unapplied, and block the tool. The class adds 200 s to the shared fork budget and is registered in the pinned Hosted class list. * test(managed-agent): drop the unused FG13c helpers from the FG13d class The new class was copied from the owner-restart rig, so it carried the Harness-kill, worker-kill and status helpers those cells used. This slice cancels through the Harness route and waits on JDBC, so those helpers are dead; removing them keeps the class to what it exercises. * docs(managed-agent): cite the whole Hook unit terminate() range in the FG13d design * test(managed-agent): check the drained unit at the first terminal observation The cells waited for the terminal record and only then waited out the descendant, so a regression that settled early while the drain continued still passed. Inspect the first terminal observation instead: the descendant must be gone and the unit empty at that instant, and document the early-terminal mutation witness.	2026-10-18 06:40:11 +00:00
Shaojin Wen	193e365290	test(managed-agent): add the FG12c MCP restart fault gates (#14447) (#14524) ... * test(managed-agent): add the FG12c MCP restart fault gates (#14447) Kill the packaged Harness, the durable Runtime worker and the stdio MCP server, and prove that the surviving generation never mints a second owner, never resends a control and never fabricates a settled result. The fixture parks a held resource read until a release file appears and records stdin close, so the worker-kill cells assert the child's fate. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): close FG12c review gaps and re-pin the fork budget Wait for dispatch_started and a held configure before killing the Harness; drive a real recovery on the same Session after an idle worker kill and assert the identity is unchanged; validate the operation status response and its published result instead of discarding the lookup. The five cases now measure 49 s, so the healthy sum moves to 3938 s and the CI fork to 4548 s. * fix(managed-agent): wait for the refused recovery acquire in FG12c A 202 only admits the prompt; the MCP refresh and acquire run later in the turn's declarations. The idle-worker cell now waits for the recovery acquire to be refused with 409 by the dead generation before it reads the configuration identity, so a fast assertion cannot observe only the pre-crash state. A direct 409/503 refusal must name a recovery error. * test(managed-agent): harden the FG12c witnesses against false-green paths Sequence the proxy wire so baseline markers cannot race an in-flight relay; pin the idle-worker recovery acquire to the dead generation's 409 body; count invokes and server starts in the worker/stdio cases; and pair the configure status answer with the persisted record state. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): close the FG12c round-2 high findings Wait for the successful status entry in the recorded wire instead of the relay-entry control, so a slow responder cannot produce a false red; and require a direct 409/503 refusal to be backed by the dead generation's own refusal. Wait for the fixture to exit before asserting it is gone. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): accept both dead-generation acquire refusals The killed worker can refuse the recovery acquire with 409 'Runtime generation is no longer live' or 503 'Managed Runtime process is not alive.'; accept both, anchored to the :acquire request. Require the configure status answer to be terminal before pairing it, and await the durable worker registration before killing it. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): make the FG12c status witness terminal-aware Select the first terminal status answer instead of locking the first 200 (which can be running), stop requiring an acquire that a pre-admission refusal never issues, and accept the third legitimate dead-generation refusal message. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): sync the FG12c budget with the merged FG13c ledger Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): only retry the dead writer lease on reload Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-18 06:06:25 +00:00
Shaojin Wen	a703a76ae2	test(managed-agent): add the FG13c Hook owner-restart fault gates (#14449) (#14490) ... * test(managed-agent): add the FG13c Hook owner-restart fault gates (#14449) * test(managed-agent): tighten the FG13c hook fault gates after audit * test(managed-agent): address the FG13c review findings * test(managed-agent): settle the FG13c harness-kill hook after a Turn cancel * test(managed-agent): address the FG13c review census * test(managed-agent): reconcile the FG13c hook before the terminal wait * test(managed-agent): tighten the FG13c fresh-prompt reconcile after audit * test(managed-agent): drop the stale SIGTERM claim from the FG13c fixture * test(managed-agent): settle the FG13c Harness-kill Hook via the Harness status route The public prompt cannot trigger reconciliation: the control plane's active-Turn gate answers 409 in insertTurnCommand before any Harness dispatch, and the cancelled Turn never leaves CANCELLING. Re-attach the Session to the replacement Harness with the passive recovery load and read the operation through the authenticated hooks/operations route, which asks the record's original runtimeSessionId and settles it from the receipt the worker still holds. * test(managed-agent): pin the FG13c kill window and the settled owner The Harness-kill cell could pass without proving anything if the Hook had already allowed before the kill: the old Harness would have settled the record and the status read would see a terminal one. Hold longer and refuse to kill while an allow is already on disk. Assert after settlement that the binding still names the same worker and generation, which is what the design claims. * test(managed-agent): reuse the replacement attachment instead of forcing a load A Session the coordinator already attached is resident with a Hook-pending Turn, so a second passive load of it is refused with takeover_unsupported; the forced call sat outside the wait and exited the cell before the status route could run. Probe the status route first, reuse whatever attachment serves it, and ask for a passive re-attach only on 404, at most once a second. * test(managed-agent): keep a refused re-attach inside the wait untilAsserted retries an AssertionError, not a RuntimeException, so a takeover_unsupported refusal would still have exited the cell. Swallow it at the call site and report the message on the assertion instead. * test(managed-agent): send the Harness contract headers on the Hook status probe Every /session route runs the hosted-harness contract middleware, so the status probe needs X-Qwen-Harness-Protocol-Version and the boot id of the process it is talking to. The identity now carries both from the attachment ref, and a stale generation counts as an attachment that cannot serve the route, like a missing Session. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-18 13:03:10 +08:00
Shaojin Wen	53a76e4088	test(managed-agent): hold every Hosted IT class to the shared fork budget (#14148) (#14521) ... The guard on the shared hosted-harness-mysql failsafe fork read only seven of its nineteen classes. A ceiling raised in any of the other twelve, or a new Hosted*IT class, stayed green until the fork was killed on main. Two classes declared no ceiling at all. - Discover every Hosted*IT class the fork's include picks up, in any package, and pin the list, so a new class lands on a red that asks for its runtime in hostedForkHealthySeconds. - Hold each class to the per-ceiling rule the FG7-FG10 letters already used; the team lead and member command classes keep the summed rule. - Require a ceiling on every case, and give the two untimed classes one (HostedCommittedEventLineReplayIT 180 s, HostedWorkspaceRecoveryWorkerIT 120 s). - Cite the lane measurement beside the allowance: the nineteen classes ran 3085 s on run 39087108383, under the 3874 s allowance. - Reuse the class discovery in the Spring context check.	2026-10-18 12:16:48 +08:00
Shaojin Wen	2d05b041a0	test(managed-agent): add the FG12a MCP reply-loss fault gates (#14447) (#14499) ... * test(managed-agent): add the FG12a MCP reply-loss fault gates (#14447) * test(managed-agent): stop the FG12a fixture's durable worker (#14447) * test(managed-agent): address the FG12a gate review (#14447) * test(managed-agent): stop the FG12a workers off Linux too (#14447) * test(managed-agent): reuse the shared worker teardown on every host (#14447) --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-18 03:28:00 +00:00
Shaojin Wen	b3c5d3ed1e	fix(managed-agent): keep a crash-blocked workflow run unknown and honestly notified, gated by FG10d (#14165) (#14506) ... * fix(managed-agent): keep a crash-blocked workflow run unknown and honestly notified, gated by FG10d (#14165) FG10d, the last FG10 letter, SIGKILLs the packaged Harness under an attached workflow run, with its agent() request in flight and with its work done but the child Turn's settlement swallowed at the store, then starts a cold one. The run must never be re-executed or settled as if observed: the Turn parks marked hosted_workflow_recovery_blocked, the cold load refuses, and the record settles recovery_blocked over outcome_unknown with one blocked notification to the lead. The gate found two defects in that honest-settlement path: - A retained close debt wrote the walk done and its CHILD_RESULT row delivered whatever the arm proved, so the unknown the recovery-blocked arm and the give-up chain intend read as a delivered result wherever the host cannot close the child at once. The debt now parks under the walk's own classification (retainCloseDebt), as classify does. - settleRecoveryBlocked rendered the parent's notification from the record it replaces, so under <status>blocked</status> the result line read "run running (unknown)". It now renders the blocked revision. The store proxy gains a SWALLOW disposition and the class a killHarness helper. The Hosted fork's healthy allowance composes 3743 + 131 = 3874 s and the fork moves 4353 -> 4484 s; the Verify step and job ceiling hold. The relay design gains FG10d's section; the a+d design points at it. * fix(managed-agent): release a parent whose child walk retired unknown, and sweep FG10d's review nits (#14165) Session resource collection held a retired parent while a CHILD_SESSION_START walk was not done/orphaned, but the relay's `unknown` is just as terminal and is never rewritten, so the hold had no release; the close-debt fix carried it to hosts without close capability. The collector now treats `unknown` as terminal; an owed close rides its own CHILD_SESSION_CLOSE row and reads no parent resource. Also: pin the give-up arm's no-close classification, refuse a close row in retainCloseDebt itself, correct the give-up javadoc and test comment that still described the old either/or, and sweep the stale four-letter and FG10d-selector text in the IT header, the CI comment and both designs.	2026-10-18 02:00:49 +00:00
Shaojin Wen	948caad58f	ci(sdk-java): run the EventTransport gate lanes on the ECS pool (#14472) ... * ci(sdk-java): run the EventTransport gate lanes on the ECS pool The broker and multi-node EventTransport lanes were pinned to hosted runners because the RocketMQ cluster bound fixed ports. Their trusted runs now route like the MariaDB lane, behind the same trust clause and MAINTAINER_ECS_RUNNER_DISABLED kill-switch, and are made safe on a shared, reused pool host: - A new step picks free ports for the NameServer, broker and proxy (with the broker's listenPort - 2 and + 1 companions free too) and exports them; rocketmq-lite-broker.sh already reads them from the environment, and the gates take the proxy endpoint from the same variable. - Both lanes install and verify against a job-local Maven repository seeded from the host-shared ~/.m2, so the fixed SDK coordinates never round-trip through it, and set up Maven on the pool. - The multi-node lane's MySQL moves from a service container to a job-owned container with native AIO off and a tmpfs datadir (#14416), removed on every outcome. Node comes from the pool's own install, libfaketime is installed only when the host lacks it, and the unnecessary `corepack enable` is dropped. - Both lanes gain the pool's pre-checkout hygiene steps, and their job ceilings absorb the setup stretch a loaded host adds. hosted-harness-mysql stays hosted: it delegates a cgroup v2 root at a fixed /sys/fs/cgroup path through sudo, and its failover E2Es spawn native mysqld from the hosted image's MySQL server packages. The routing matrix, per-job ports (the chooser runs for real), the MySQL container contract, job-local Maven repos and pool hygiene are pinned in the workflow meta-tests. * ci(sdk-java): move the RocketMQ port chooser to a script and record the size Lint & Static failed the workflow-size ratchet: sdk-java.yml grew 21571 bytes over its recorded 74834. The duplicated inline port chooser moves to .github/scripts/choose-rocketmq-ports.mjs, which both lanes run and the broker lane's test still executes for real. The remaining growth is real. Every pool job in this file carries the ownership heal, the stale .qwen sweep (pinned byte-identical to ci.yml) and the .git recreation. These run before checkout, so they cannot live in a repository script, and the two newly pooled lanes need one copy each. The job-owned MySQL container and its cleanup make up most of the rest. Record 93793 bytes.	2026-10-18 00:15:56 +08:00
Shaojin Wen	910a2909a7	ci(sdk-java): run the Hosted failover arms in their own job (#14467) ... * ci(sdk-java): run the Hosted failover arms after an unrelated Verify failure The 15 failover E2E steps had no if:, so any failing test in the Verify step skipped them all. Since #14181 merged, four consecutive main runs failed Verify on four different tests, and the seven G3 Step 3 arms have never executed in CI. The MySQL install step now runs whenever the Managed Agent dependencies installed, and first checks that the server jar was packaged; each arm runs when that step succeeded. A failing arm still fails the job. * ci(sdk-java): move the Hosted failover arms into their own job Conditions on the arm steps let them run after an integration-test failure, but they still waited behind the 80-minute Verify step and depended on its packaged jar. The fifteen arms, the MySQL binaries install, the runner-only QWEN_E2E_REGISTER_STORAGE and the Step 3 evidence upload now form hosted-failover-e2e, which bundles the CLI, installs the SDK and packages the server with -DskipTests itself, with no needs: on the Hosted MySQL job. Each arm still runs when an earlier one failed. The Hosted MySQL job ceiling drops from 325 to 175 minutes; the new job has 165. The pins move with the steps, the long-answer arm joins the arm table, the SpotBugs staging count goes to five, and D11, the Step 3 design, the server README and the runner's Linux-only hint name the new job. * docs(managed-agent): point the remaining failover-arm references at the new job The D11 Status header, the 275/290 ceiling of the Step 3 slice and the ubuntu-only lane note still named the Hosted MySQL job as where the failover arms run, and so did the G1 failover design, the Broker fault gates scope and the review-corrections gate list (whose Workspace file-tool Turn and durable-store adapter do stay in that job, so the sentence splits). Point-in-time notes keep their history and add where the arms run now. The Hosted MySQL report upload has to precede the two steps that run `clean verify` on the module, or it ships an empty artifact with only a warning; the test now pins that order. `--big-output` joins the mode flags each failover row must own alone.	2026-10-17 14:48:59 +00:00
Shaojin Wen	7eb6e00441	test(managed-agent): add the FG10c/FG10e workflow relay store-failure and cancellation fault gates (#14165) (#14473) ... * test(managed-agent): add the FG10c/FG10e workflow relay store-failure and cancellation fault gates (#14165) Slice 2 of FG10b/c/e/f on HostedWorkflowRelayFaultGatesIT. No production code changes. FG10c refuses, at the store, the lead's result revision and the child_acceptance insert that lands the notification, armed only after the subagent hold let the lead's own Turn settle and the child Turn complete, so the refusal latches an idle lead and never crosses a running workflow Turn. While latched the record never advances and nothing is delivered; after the trigger drops and the Harness restarts cold, the relay's retry finishes the walk once and the script never runs again. FG10e cancels the workflow task with its agent() request held: the child Turn ends CANCELLED, the record settles cancelled/stop_requested, the held answer never reaches the child journal and no notification lands. A lost cancel reply replays the admitted cancel under the same key, and a cancel of a settled task answers 409 task_action_unavailable. The four-letter class measures 181.2-181.6 s, so the Hosted allowance composes 3545 + 198 = 3743 s: fork 4155->4353 s, Verify step 85->90 min, job 330->335 min. The design records the landed letters, the mechanics and five mutations (two narrower ones equivalent). * test(managed-agent): witness that a workflow cancel aborts the held subagent request (#14165) FG10e's cancel-subagent-in-flight case observed only the run settling cancelled, which the sandbox's abort race produces even when the stop never reaches the agent() dispatch. The held subagent request is now a live SSE stream (headers at once, a comment every 250 ms), and the case asserts the request was aborted while the hold was still closed. A mutation handing createProductionDispatch a fresh signal instead of the run controller's turns the case red at the new witness; the case without it stayed green. Recorded as mutation 9 in both design docs. Also correct the store retry bound's quoted source line in both relay gate classes and take the task id from ManagedExtensionProjection.taskId.	2026-10-17 13:49:09 +00:00
Shaojin Wen	b6195e1bba	fix(ci): run the trusted web-shell browser smoke on the ECS pool (#14471) ... * fix(ci): run the trusted web-shell browser smoke on the ECS pool The web-shell E2E smoke is the second-largest user of the hosted ubuntu pool: on 2026-10-17 it took about 27% of hosted minutes, two thirds of that from same-repo PRs, while the hosted pool sat at its 20-job org cap and the ECS pool idled. #11250 moved the job hosted after four pool attempts failed in run 34081409590. Three of them ran the smoke with Playwright's unpinned default of half the host's cores, 8 workers against hosted's 2, and timed out broadly on visibility and clock waits across long-standing tests. The fourth's transcript gate took 73 s against its 60 s budget while npm install alone took 28 min on that host. Route the job like test's again, so trusted runs use the pool and untrusted fork PRs stay hosted, and pin the smoke at 2 workers, the hosted default, so a pool job no longer scales its browser count to the host. Drop the comments that described the pool steps as retained for a future reroute. * fix(ci): recreate runner Git metadata before the smoke checkout The smoke job now checks out on the reused ECS workspace, so it needs the same pre-checkout .git removal as test, lint_and_static, integration_cli and integration_no_ak. Otherwise actions/checkout reuses whatever the previous job left, including a broken shallow boundary or a live post-checkout hook. Hold the job to that rule in qwen-runner-checkout-workflow.test.js. * fix(ci): install WebKit's system libraries on pool hosts that lack them The first pool run of the web-shell smoke (run 39030597470, ecs-qwen-hk3-11) passed 272 of 286 tests in 10.6 min at 2 workers, and the transcript gate took 17.8 s against its 60 s budget. All 14 failures were mobile-webkit browser launches: the host lacked GTK 4, GStreamer, libwoff2 and about 40 more WebKit libraries, which Playwright's install step had already reported in its host validation. When that validation reports missing libraries, run Playwright's install-deps for Chromium and WebKit through sudo -n. An APT_CONFIG adds a dpkg lock timeout and the hosted step's network timeouts. The packages persist, so each host installs them once and later jobs skip apt. The install step gets the hosted step's 30-minute bound.	2026-10-17 21:36:32 +08:00
Shaojin Wen	20de6bf12e	fix(ci): give the hosted Test lane the same 120-minute ceiling as ECS (#14474) ... * fix(ci): give the hosted Test lane the same 120-minute ceiling as ECS The full unit suite no longer fits 60 minutes on GitHub-hosted runners. Those runners take fork PRs from untrusted authors and everything when the ECS kill-switch is on. On 2026-10-17, of the hosted full-profile Test runs that ended on their own, 13 passed in 45-59 minutes and 17 were cancelled at exactly 60 while still passing tests. Job 117375307261 is a typical run: install 7.4 min, cli 32.5 min, core 10.2 min, then cancelled six minutes into web-shell with the root scripts tests still to run. Each cancellation burns 60 hosted minutes and usually a manual rerun. Drop the per-pool split and use 120 on both pools. The test step's own 110-minute cap still bounds a genuine hang. * ci: record the Test lane's fixed 120-minute ceiling in the CI budget check-ci-budget sums only fixed timeout-minutes and counts an expression as a job without a fixed timeout. Turning the test job's per-pool expression into a fixed 120 therefore moves ci.yml from 180 minutes with five expression timeouts to 300 with four. The effective ECS ceiling is unchanged; the hosted one rises from 60 to 120 as intended.	2026-10-17 13:21:35 +00:00
易良	1ab68e951e	feat(ci): gate Managed Agent changes on a full SDK Java run before merge (#14397) ... * feat(ci): gate Managed Agent changes on a full SDK Java run before merge Changes to the Java modules or the harness they drive now run a fast SDK Java subset on every push and the full suite on the first approval of the current head. An always-reporting `Managed Agent gate` check can be made required: a touched PR reports it only from a full run. Refs #14392, #14381 * fix(ci): route the Managed Agent gate's own jobs off the hosted queue The scope and gate jobs report the would-be required check; on the first run they sat in a hosted queue holding 123 runs. Trusted runs now take the ECS pool with the shared pre-checkout hygiene, forks stay hosted. * fix(ci): register managed-agent-gate.yml in the PR-stage CI budget ledger managed-agent-gate.yml triggers on pull_request and merge_group, so it is PR-stage and needs an entry in .github/workflows/.ci-budget. That ledger is a fail-closed whitelist: a missing entry makes check-ci-budget.mjs error out and short-circuits the remaining Lint & Static steps, so no linter ran. Recorded exactly as measured (3 jobs, 15 declared timeout-minutes, 1 job without a fixed timeout) so no slack is left against the ratchet. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvb6htxaa7 * fix(ci): run the full Managed Agent unit suite in the fast tier The fast tier skipped mysql-integration, the only lane that runs the module's ~4,200-test H2 suite in full, so a PR push got no unit feedback until the review-triggered full run. In the fast tier the Java 21 leg now runs the whole module suite instead of its Runtime Broker subset, after the same workspace install mysql-integration uses: part of the suite loads the built Core and CLI JavaScript. * fix(ci): harden Managed Agent gate tier selection and cancellation reporting (#14397) * fix(ci): gate the Managed Agent full tier on a maintainer approval The full tier was reachable by any approved review, including the deferred APPROVE that qwen-triage-finalize.yml posts once a PR's checks land green. That workflow now watches this gate, so its own fast tier could buy the most expensive run in the repository with no human involved. tier=full now also requires the reviewer's author_association to be OWNER, MEMBER or COLLABORATOR, and fails closed when it is absent. The concurrency group embedded the event name, so a push could never cancel the approval run it superseded: that run kept going for about 125 minutes and then reported a head that branch protection no longer reads. The group is now keyed on the pull request, with cancel-in-progress still true only for pull_request, so approvals keep queueing behind each other instead of displacing a pending full run. The design docs also described a Maven cache composite that is not in the tree, called the untouched-PR cost hosted-only when trusted runs take the ECS pool, and carried a touched-push figure from before the fast tier took on the full module suite. Non-goals now record that this gate supersedes the separate compile gate proposed in #14385, and that the Java SDK checkstyle step stays pinned to the Java 11 leg, so only the full tier runs it. * docs(ci): stop citing the Maven cache save the merge from main removed Merging main brought in #14396, which suppresses setup-java's post-job Maven cache save on self-hosted runners by making the cache input conditional on runner.environment. That was the measured cause behind two claims this branch carries, and both went stale the moment it landed. The design doc's Cost section said removing the 14 to 37 minute save was planned work with no implementation in the tree. It is now merged, so the 330 machine minute full run is a figure measured before the saving went away and should come in lower; it is stated that way, without a re-measured number this branch does not have. The daemon-e2e budget comment and its test justified the fast tier's 90 minutes entirely by that save. The value stays: the leg's own sizing puts stretched setup at about 44 minutes against a 45 ceiling, and the fast tier now runs it on every touched PR push rather than nightly only, so it meets that tail far more often. The comment now says that instead of citing a save that no longer happens. * fix(ci): diff a review event against its merge commit's first parent A pull_request_review run checks out the same test merge commit as a pull_request run (run 38997396688: "Merge 7d918f7 into 2746553"), so HEAD^1 is already the base. The payload's base sha can lag main and pull main's own Managed Agent changes into an untouched PR's diff, starting needless full runs. * fix(ci): keep comment reviews out of the gate's pull request group A concurrency group keeps one pending run, and a newcomer cancels it whatever cancel-in-progress says. With every event of a PR in one group, a comment review arriving while an approval run waits behind the fast tier cancelled that approval run, and the head's required check stayed expected until someone approved again. Reviews that are not approvals now run in a group of their own. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com>	2026-10-17 21:17:23 +08:00
Shaojin Wen	d21b861fdf	test(managed-agent): add the FG10b/FG10f workflow relay lost-reply and delivery fault gates (#14165) (#14468) ... * test(managed-agent): add the FG10b/FG10f workflow relay lost-reply and delivery fault gates (#14165) Slice 1 of FG10b/c/e/f: a new HostedWorkflowRelayFaultGatesIT on the FG9 coordinator-owned fixture, where a team lead's workflow launch walks the whole child result relay (create, bind, the child Turn's in-process agent() call, the result revision, the notification and the lead's wake Turn) on a real Spring, MySQL, embedded broker and packaged Harness. No production code changes. FG10b holds the replies to the relay's dispatch and result revisions past the relay's request timeout, so the relay re-drives each step while the first is in flight, and drops the reply to the child Turn's own journal commit: one child Session, one script run, one agent() dispatch, each child_run revision committed once, one notification and one wake round. FG10f holds the notification commit the same way (delivered at most once) and cuts the workflow child's public and WebShell streams while its subagent is in flight: each resumes with no gap and no duplicate. The store proxy now logs each commit's command id beside its operation. The Hosted fork's healthy allowance composes 3380 + 165 = 3545 s for the measured class (81.6-81.7 s), so the fork moves 3990->4155 s, the Verify step 80->85 min and the job ceiling 325->330 min. The bilingual design covers all four remaining letters; FG10c/FG10e follow as slice 2. * test(managed-agent): bind the FG10b/FG10f timeout witness to the held call (#14165) The relay's CHILD_SESSION_START attempt count is cumulative over the whole creation, so an earlier deferral (a bind that met a binding not yet visible) could satisfy `>= 1` before the held call timed out, releasing the hold early and letting the case pass on the ordinary path. The witness now reads the count as the hold begins and waits for one more attempt, the FG9f baseline-plus-one; while the call is held the relay's one scan thread is blocked in it, so nothing else of the row can spend that attempt. childRunCommands now asserts every counted commit names its command id instead of falling back to the whole log line, so a missing cmd= tag fails loudly rather than degrading the once-per-revision check. The design records both, and that slice 2 re-measures the class before composing its budget (the per-letter slack is 10 s after slice 1). --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-17 20:14:53 +08:00
Shaojin Wen	bd8684cdea	fix(ci): run three hosted control-plane jobs on the ECS pool (#14469) ... The hosted ubuntu pool is capped at 20 concurrent jobs for the org and sat at 16-20 all day on 2026-10-17 while the ECS pool idled (10 of 94 ecs-qwen slots busy). Seconds-long control-plane jobs queued behind the long hosted lanes for a median of 28 minutes. Route three of them to the ECS pool with the house repository guard and kill-switch. None checks out or runs PR code: - delay-automatic-review gates every automatic PR review. Its comment said the environment wait timer would idle an ECS slot, but the job only gets a runner after the timer elapses (run 38656917461: created 23:54:53, set up 23:59:56, done two seconds later). Also correct the stale 10-minute timer note; the environment is set to 5. - assign-issue-owner runs only the trusted base-ref script on PAT-authored label events. - auto-minimize-spam reads the blocklist from the default branch. Its sparse entry becomes the .github/scripts directory: cone mode rejects a file entry on a reused workspace (#13306), and still brings the files directly under .github/, the blocklist among them. Both checkout jobs gain the self-hosted ownership heal that assign-pr-owner carries. Pin the routing, the kill-switch, the default-branch-only checkout and the reused-workspace safety in ci-runner-routing.test.mjs.	2026-10-17 20:01:13 +08:00
易良	e5456b578a	fix(ci): stop re-running the H2 unit suite in every Hosted job step (#14423) ... * fix(ci): stop re-running the H2 unit suite in every Hosted job step The Hosted job's three Maven steps (Hosted*IT, admission gates, O4) each ran `clean verify` without skipping surefire, so the same ~4,200-test H2 suite that mysql-integration already runs on Java 21 ran up to three more times per job, ~11 minutes each. On #14391's head that pushed the Hosted verify step into its 45-minute cap with every test passing, and it still spends 11 of the O4 step's 20 minutes. Skip surefire in those profiles, as the RocketMQ gate profiles already do, and pin the split. * docs(ci): reconcile the Hosted step-comment fork history and drop surefire The Hosted verify comment still opened with "(2100 s, ... raised 1800→2100 ...)" while the fork has been 3600 s since #14334; the following sentence even said so. Rewrite the head of the comment so the current budget leads and the 2100→3600 bump is part of the history. Also drop the stale "surefire" from the third copy of the wrap justification in hosted-process-ci.test.js, matching the two workflow comments the main commit already fixed. --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-10-17 14:33:44 +08:00
易良	880717242e	fix(ci): start the reference distribution MySQL without native AIO (#14429) ... * fix(ci): start the reference MySQL without native AIO on the pool The ECS pool shares fs.aio-nr across every job on a host. A mysql:8.4 service container reserves AIO contexts during init and dies with io_setup() EAGAIN once the budget is exhausted, before any step runs. A service container cannot take a command, so start it explicitly with native AIO disabled and own its readiness and teardown. * test(ci): pin the reference MySQL container contract Extend the routing meta-test to assert the service block stays gone, the port export reaches GITHUB_ENV, and teardown runs unconditionally; update the Maven bootstrap test for the new job-scoped container name. Make teardown best-effort so a transient docker rm cannot redden the release build; the host reaper collects the leftover. * docs(ci): correct the teardown comment to match the host reaper The host cleanup service (qwen-docker-cleanup.sh) has no state-based container prune: reap_stale filters by label/name and force-removes anything older than 86400s regardless of state. The comment claimed it only reaps exited/dead containers, which is wrong; the 24h age gate is the real reason a cancelled job would strand a running mysqld.	2026-10-17 13:03:44 +08:00
Shaojin Wen	2c700670fc	test(managed-agent): add the FG9b/FG9c session relay store-failure and crash fault gates (#14164) (#14420) ... Slice 3 of 3 of the FG9 round: two letters / five cases join HostedSessionRelayFaultGatesIT; no production code changes. FG9b refuses one journal write of the relay pass at the store with a test-only trigger on ma_session_record (the sender's outbound, the lead's receipt, the copy-back), armed until the case drops it: the store client retries a 5xx commit three times, so a one-shot arm never reaches the Session. Past the third refusal the Session latches its writes and only a cold Harness heals it; each case restarts it and pins that the healing runs through the original command: the refused outbound is answered "not sent" from the journal and never minted afresh, the re-execution after a refused receipt finds the minted position, and the refused copy-back lands once with the receipt's reply byte for byte. FG9c SIGKILLs the Harness on a commit the store accepted whose reply the store proxy holds: mid-fanout, the re-execution reports the minted position sent from the journal and mints only the next one; right after the sender's outbound landed, the takeover resumes the parked wait and the unacknowledged entry stays the one command. The scripted lead's closing round now answers with text: an empty response is retried for ~20 s, which kept the lead's Turn open across the arms, and a lead Turn open across a latch or a kill leaves the cold lead churning on workspace_unavailable. FG9b/FG9c wait for it to settle. The store proxy logs each commit's operation and status for the never-minted- twice witness. The Hosted fork's healthy allowance composes with FG8c (#14407) and FG10a (#14390): 2963 - 534 + 950 = ~3380 s for the measured six-letter class (528-557 s), so the fork moves 3600->3990 s, the Verify step 75->80 min and the job ceiling 320->325 min.	2026-10-17 12:48:06 +08:00
Shaojin Wen	e847c14496	test(managed-agent): add the FG10a workflow child_run digest-integrity fault gate (#14165) (#14390) ... * test(managed-agent): add the FG10a workflow child_run digest-integrity fault gate (#14165) Stage F round FG10 (umbrella #14054), the workflow child_run kind enabled by #13858. This slice lands FG10a — the digest-integrity gate — following the FG7/FG8 shape: a real packaged Harness, a per-case TypeScript driver, an in-JVM Spring control plane against a real MySQL, and JDBC ground truth. No production code changes. Three cases prove the launch pin under fault: a tampered envelope (bytes rewritten after the record committed, before the relay reads it) is refused by the child Turn's re-verification naming both digests, before any model spend; a same-length substitution is refused the same way; and a launch whose args carry fractional and subnormal values (0.1, 5e-324) crosses the daemon/SDK admission digest byte-identically, never wedging on invalid_hosted_prompt. The mutation check (neutralizing the re-verification) turns the refusal cases red, and the gate is green again once restored. The gate's assertions sit at the child Turn, not the record's terminal settlement: the digest refusal fires inside the Turn and runs independently of the relay's later bind/deliver walk, which a driver-held parent cannot drive to completion without a coordinator-owned attach (a Linux-only topology). FG10d (process crash) is deferred to #14387: its gate caught the recovery re-driving an unsettled workflow Turn after a Harness kill, which violates 'never re-executed on reopen' and needs adjudication outside this test-only slice. * test(managed-agent): prove FG10a's substitution is digest-attributable and args reach the child Review feedback on #14390 found the gate could not prove what it claimed: the same-length substitution rewrote the script into text the real compiler rejects with a SyntaxError, so removing the digest check would have failed on a parse error rather than executing the substitute; and the fractional-args case passed without the special values ever being observed at the execution end. The substitution now swaps in a driver-authored script that is syntactically valid, byte-length equal, and proven runnable by a new substitute-script-baseline case, so the refusal is attributable to the digest alone. The positive case reads the child Turn's final content through a new probe endpoint and compares the echoed args value-exactly — the wire rendering varies by hop (the store renders the subnormal 4.9E-324, the sandbox echoes 5e-324, keys arrive sorted) but every hop parses to the identical double. Verified: FG10a 4 cases green; with the digest check neutralised, both refusal cases turn red with the tampered/substitute script executing to COMPLETED; checkstyle, relay-headers and hosted-process-ci pins green. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-17 03:42:41 +00:00
易良	b194ac7245	fix(ci): keep the setup-java Maven cache on hosted runners (#14396) ... * fix(ci): keep the setup-java Maven cache on hosted runners An ECS host keeps ~/.m2 between jobs, so setup-java's post-job save tars the whole shared repository (14-37 minutes per job) and then loses the cache reservation to a parallel job, discarding the archive. * fix(ci): bootstrap ~/.m2/repository on fresh ECS hosts before the write-back * test(ci): widen the setup-java cache guard to every workflow (#14396) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-17 11:35:29 +08:00
Shaojin Wen	d8fcdf1e36	test(managed-agent): add the FG8c process-crash gates for monitor_run and background shells (#14163) (#14407) ... * fix(core): end the managed command launcher by its command's signal A background Shell's exit evidence is its cgroup launcher's own exit, and the launcher replaced a signal death with exit(1). A background process killed by SIGKILL was therefore recorded as `exited` with `exitCode: 1, exitSignal: null`, on the child_run record and on the Broker's `:process` row alike: a status the process never returned. The launcher now ends itself by the signal its command died of, so the waiter sees that signal. Only the signals that cannot be re-raised keep the nonzero fallback: a core-dumping one would dump the launcher too, and Node.js owns SIGUSR1 and ignores SIGPIPE. Command hooks share the launcher and already read a null exit code as a signal kill, a branch the old launcher left unreachable whenever only the command was killed. Found by the FG8c process-kill gate (#14163). * test(managed-agent): add the FG8c process-crash gates for monitor_run and background shells (#14163) FG8c kills (or stops) a real process under a live background run and pins what the platform does next against JDBC ground truth, in seven cases: the packaged Harness after the dispatch committed and after the capture started (then a cold reload on a fresh Harness), the managed worker (SIGKILL, and SIGSTOP across the broker's 30 s worker bound), the background process itself, the worker behind later prompts that reach for the Runtime again, and the worker under a live Monitor watch whose idle stop then meets the loss. Every case asserts one :start and one :process row across every boot and prompt, and exactly one Runtime binding at generation 1: a lost generation is never re-minted. Records may stay open, but never settle on evidence nobody produced; the reloaded close drains the run its process never saw (#13986); a dead worker's release is refused without stop proof; a stopped worker reads as neither stopped nor lost; and a watch whose stop nobody could prove parks as recovery_blocked / runtime_lost (#13896). The probe's state reads and the IT's record and output reads now lead with ma_resource's session_scope_key: filtered by the unindexed tenant and session columns alone, every poll scanned all the inline capture bytes the lane had written, so each later letter polled slower. The shared broker proxy also treats a client gone mid-request as no request instead of a sticky proxy failure. The hosted fork's healthy allowance moves 2640 -> 2930 s for the letter (twice its local 144 s, the FG9 convention); the 3600 s fork and the 600 s per-letter ceiling are unchanged. Seven mutation witnesses, one per case, were each observed red. The bilingual design document records the cases, two expectations of the round design that the merged recovery surface does not meet, and the follow-ups. * fix(core): keep only reachable signal names in the launcher's kept list Node.js on Linux reports signal 6 as SIGABRT, never SIGIOT, and Linux defines no SIGEMT, so neither name could ever reach the launcher's exit handler. Dropping them leaves the list as exactly the set it can match. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-17 00:33:34 +00:00
jinye	2b6de671d1	feat(managed-agent): Add SSH Tool Runtime support (#14318) ... * feat(managed-agent): add SSH Tool Runtime support Add administrator-configured SSH placement, remote Workspace registration, Session-isolated workers and strict retirement over the existing HTTP protocol. Keep new admission disabled by default and preserve original-worker identity. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): clean up SSH runtime transport lifecycle Keep bootstrap work outside the endpoint lock and release unused forwards and stopped direct routes without disconnecting durable observers. Bound control work and complete queued futures during shutdown. Align SSH registration with the shared SQL clock, reuse storage identity and dependencies, and fix the environment inventory and transcript budget. Normalize inherited CSI test formatting for Java verification. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): align lifecycle and timestamp test fixtures Use canonical SQL timestamp columns and database milliseconds in fault-gate evidence, and require parent close to cancel a held child Turn as current main specifies. Preserve production behavior and capability boundaries. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): Bind environment query IDs as binary Preserve canonical Session and Turn identity types when H2 recompiles the latest environment query. Force recompilation in the existing regression without changing its admission-order or environment assertions. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-16 18:18:04 +00:00
Shaojin Wen	6e6a69c71f	test: gate the remaining chmod-based root skips on the permission-bit probe (#14403) ... Fifty cases across core, cli, browser-use, sdk-typescript, test-failure-explorer and scripts/tests force a failure with chmod and skip whenever uid is 0. ci.yml runs unit tests as root on the ECS pool, but drops CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH first, so permission bits bind there and these cases could run; the uid check skips them all on that lane anyway. Gate them on whether a mode-000 directory refuses this process, as #14162, #14271 and #14283 do for the rest: - core (22 cases in 14 files) and cli (1) use their own helper. - browser-use, sdk-typescript and test-failure-explorer import nothing from another package, so each gets a copy of the helper; browser-use, with six cases, also gets its tests, as core did in #14283. - scripts/tests (19 cases in 7 files) imports the cli helper, as other scripts tests do. Three core cases returned early as root instead of skipping, so they reported a pass without asserting anything; they now skip there. The workflow-extension case left its unreadable directory empty, so it passed whether or not the directory was refused; it now holds a workflow that would show up if it were read. package-scripts pins every copy of the helper, and the cli, core and browser-use copies of its tests, byte-identical, so a fix to one cannot leave the others behind. Left on the uid check: pathReader's case, whose permissions come from mock-fs, which lets uid 0 through whatever the mode; the session writer lease's chown case, which needs root; and the release workflow's wipe test, which does not depend on permission bits.	2026-10-16 17:34:52 +00:00
Shaojin Wen	d496c15a22	test(managed-agent): add the FG9d/FG9e session relay cancellation and SSE-gap fault gates (#14164) (#14402) ... Slice 2 of the FG9 round. FG9d cancels the sending member's Turn before the relay's first claim (once with the cancel's reply dropped after it committed and re-issued under the same key) and while the relay's handover commit is in flight; FG9e cuts the sender's and a recipient's public or WebShell stream mid-relay and resumes each from its cursor. The gate class's Spring and embedded broker now bind ephemeral ports read back after boot, and the forwarding proxy takes its upstream once Spring listens. The design document records the delivered letters, the mechanics found at landing and the slice's mutation checks.	2026-10-16 17:29:41 +00:00
Shaojin Wen	5af87595f3	test(managed-agent): add the FG8a/FG8b/FG8d monitor_run and background-shell fault gates (#14163) (#14334) ... * test(managed-agent): add the FG8a/FG8b/FG8d monitor_run and background-shell fault gates (#14163) The four fault letters on my third slice of the Stage F fault-gate track: FG8a lost replies resolve through the original identity, FG8b rejected commits within a real transaction leave zero OS effects, FG8d cancellation and the routine/drain release split settle honestly, and the letters both are expressed entirely through driver-side enhancement, with no production code changes. * test(managed-agent): attribute FG8b rejections and pin the blocked truth (#14163) Address the two FG8b review findings on PR #14334. The unconditional triggers made page-envelope-commit unprovable, and the design rows still carried latch-era wording that contradicted the issue's own cells ("a failed manifest commit blocks the run without re-executing it"). The marker text can never reach captured output: the broker flattens this SQLException into runtime_broker_internal_error, unlike FG7B's server-side commits. - Each trigger now also writes an fg8b_fire row (MyISAM, so it survives the signalled rollback); every FG8b case asserts the fire count first, so a silently-unarmed trigger goes red on attribution, not on an outcome. - manifest-commit / page-envelope-commit assert the honest blocked form: zero target-kind commits, one :process row, the drain arm ends the case, and the record settles cancelled/stop_requested, never exited. - dropFg8bTriggers now runs in the letter's finally. - Design doc (EN + zh-CN) and the driver comment updated to match. Locally green: invocation-commit and process-ledger-commit re-run with the new DDL; the two publication cases are cgroup-walled locally and settle on the hosted-harness-mysql lane. * test(managed-agent): align FG8 gate choreography with production truth (#14163) Address the review round's execution findings on PR #14334 — each one verified against the production call chain before fixing: - dispatch-reply: the broker proxy consumes the :start reply before destroying the socket, so on a cgroup host the process is live and its producer parks on the run-gate; release it after identity recovery (gated on bg-started.txt); also accept the terminal not-started form in the capability-live wait so macOS keeps proving the not_started_proven branch. - capture-commit-reply: SEGMENTS_PER_PAGE is 512, so a 24-block producer can never reach one page publish pre-gate; wait for progress, release the gate, then witness the finish-time drop. - FG8b manifest trigger: the capture publishes an initial empty manifest during prepare, ahead of spawn; the arm now targets only the settle manifest (executionStatus 'success'), leaving the prepare-manifest to commit. - FG8b publication assertions (per the reviewer's live-capture evidence): zero manifest-copy claims replaced with the honest outcome — every committed manifest's page refs resolve, zero page rows for page-envelope, settle manifest never commits for manifest-commit; the run settles naturally exited/0 with stopRequested=false — a store refusal never cancels the process, and driver stays on the natural-end branch (recovered=true). - FG8d shell cancel cases: children/operations encodes the child-agent cancel family and rejects shell records; the only stop surface a shell child_run answers is the drain release. The three cases now drive drain:true; cancel-status-unavailable adds a positive hold witness (at least one parked maintenance request) before the drain; cancel-reply-lost still drops the stopRequested commit's reply after it committed. childCancel helper removed. Locally green: invocation-commit, process-ledger-commit, dispatch-reply, cancel-before-start. Design doc (EN + zh-CN) updated to match. * docs(design): reconcile the stale Shell stop-projection claim (#14334) Review feedback on PR #14334 flagged that this H4b-era sentence in 2026-10-10-managed-task-cancel.md still claims "The Shell publisher settles `exited` even after `stopRequested`". Current production (`hosted-shell-publisher.ts` finalizeBackground) settles a stop-requested run via `settleStopRequested` as `cancelled` / `stop_requested`, never `exited` — the same projection the new FG8d fault gates pin. Fix both language versions. * test(managed-agent): size the FG8 letter fork budget to the measured lane wall clock (#14163) Lane 38848525079 (hosted-harness-mysql, workflow_dispatch at R2 head fee23d2d3c) reached the class's shared failsafe fork cleanly twice: fg8a finished at ~683 s in, fg8b at ~704 s, then Surefire received the shutdown {KILL} at exact ITS start plus 1800 s — the fork budget, not an assertion, is what cut fg8d's choreography off. Fixes per wrap-up: - packages/managed-agent-server/pom.xml: forkedProcessTimeoutInSeconds 1800 → 3600 s, two sites; comment updated to describe the current five-letter / 21-case class (no longer the seven-case shape the original 1800 s headroom covered). - scripts/tests/hosted-process-ci.test.js: hostedForkHealthySeconds 1100 → 2400 with the lane-measured sourcing comment (five letters / twenty-one cases at run 38848525079, fork doubled for 2× headroom). - .github/workflows/sdk-java.yml: hosted-harness-mysql job timeout-minutes 290 → 320, so the Verify step wraps its own fork (3600 s + wrap margin) instead of capping the suite under it. Verified: pins all pass (hosted-process-ci.test.js 28/28), vitest relation ceiling + healthySeconds ≤ fork holds (600 + 2400 = 3000 ≤ 3600). No assertion-level changes; the budget answer stays in this PR as review promised (P2 fork budget moves land in the same PR). * test(managed-agent): align the FG8 gate letters with the lane-measured production truth (#14163) At head a1ac638c08 the lane (run 38868090681) finally reached the letters under the raised fork budget and four of the PR's own cases failed deterministically with choreography truth instead of lane noise: - FG8a capture-commit-reply: the page-publish arm watched a wire the production code never uses. Staged resource envelopes (pages, manifests) are only staged locally by HttpManagedSessionResourceStore.publish and reach the store fused inside journal commits' `resources` array; only content segments have their own /tool-results:publish POST. The drop arm now drops the first journal commit carrying a `managed-tool-result-page` resource (lose-after-commit), matching the issue's "capture-page commit" cell. droppedPagePublishes keeps its name. - FG8b manifest-commit: the issue cell is "a failed manifest commit blocks the run without re-executing it", and the lane proves it — the fused settle commit rolls back whole on the refused envelope, three commitChildRunRecord 500s then silence, and a drain release that changes nothing. The driver now witnesses the refused settle commit plus a stability window and reports recovered=false; the IT splits the publication cases: manifest-commit must stay blocked (running, no stop proof, stopRequested false, zero settle manifests) while page-envelope-commit keeps its degraded natural settle (refusal poisons the capture alone). - FG8d cancel-status-unavailable: a quiet Harness issues no status reads of its own on the lane (sixty seconds of armed silence), so the positive hold witness was structurally impossible. The driver now issues one captive status read through the same armed proxy and awaits it after restore, keeping the no-fabricated-terminal assertions unchanged. - FG8f in-flight-cap: the resume probe read 16 and 18 committed segments against a 16-block stall — probe-window smear on a fast lane, not the resume-at-empty regression the assertion guards (fee23d2d3c touched none of the fg8f paths). The drain now advances one held commit per 150 ms, making the resume measurement deterministic. Design docs updated bilingually for the arm's real wire, the FG8b per-kind split, and the captive witness; the hold-point open question is recorded as settled by lane run 38868090681. Local verification (macOS, cgroup-free forms): fg8a/dispatch-reply, fg8b/invocation-commit, fg8b/process-ledger-commit, fg8d/cancel-before-start all BUILD SUCCESS on MariaDB 10.11 with mvn verify; prettier unchanged, mvn test-compile and checkstyle green, integration-tests tsc green. The remaining ten cases run on the cgroup lane dispatched at this head. * test(managed-agent): implement validateConfiguration in the guard-convoy IT fixture (#14163) #14370 renamed the ToolPublicationObjectStore contract to validateConfiguration(), and the anonymous impl in ManagedSessionGuardConvoyIT was left carrying the removed requireUnversioned() — a text-clean merge that broke test-compile on the merged branch the same way it would on main. The lane's `mvn verify` compiles the IT classes, so the branch must carry the one-line fixture rename to pass. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-17 00:11:24 +08:00
易良	3bddf6e0bb	feat(ci): route the release lane's hosted stragglers onto ECS runners (#14336) ... * feat(ci): route the release lane's hosted stragglers onto ECS runners The 2026-10-15 v0.25.2 releases validated in minutes and then queued up to 64 minutes on the GitHub-hosted pool behind PR automation (FIFO, no priority). publish stayed hosted on purpose — it carries release credentials — and the shared self-hosted pool is dual-labelled onto PR CI instances, so it could not simply move back either. quality joins the pool its five checks already use, effective on merge. publish and collect move behind a new opt-in variable ECS_RELEASE_HOST_RUNNER_ENABLED onto a new release-only label ecs-qwen-release-host: unset, everything dispatches exactly as before; set, publish only reaches machines that never run PR code. publish gains the disk-floor gate, collect clears stale prebuilds fail-closed, and the meta-tests pin the new routing and credential isolation. * ci(managed-agent): fold reference version resolution into the build job The separate prepare job ran for seconds but waited 25-30 minutes for a GitHub-hosted runner before build could queue again, so each PR dry run spent close to an hour in two serial queues. The root package.json path is dropped because the packager only reads version and engines.node from it, while most unrelated PRs touch it. * test(ci): pin collect's release-host routing and stale-prebuild wipe Address the review suggestions on the collect job: nothing parsed audio-capture-prebuilds.yml, so its opt-in routing expression and the fail-closed wipe were the one behaviour in this change no test pinned. Also note in the YAML that run steps resolve against the job's working-directory while action inputs stay workspace-relative — the indirection the rm -rf and find steps depend on. * ci(managed-agent): run trusted reference dry runs on the ECS pool Trusted pull-request dry runs of the reference distribution now use the persistent pool instead of waiting on the saturated hosted queue. The job gains the pool's pre-checkout hygiene, a random MySQL host port on tmpfs, a random server port, and a job-local Maven repository so the fixed qwencode-sdk and server coordinates built from PR code never reach the host-shared ~/.m2. Dispatch builds feed the published release and stay on hosted VMs. Published release notes are anchored at the previous reference release instead of whichever tag family the API picks.	2026-10-16 23:13:26 +08:00
易良	4d835faee5	fix(ci): document the shared-group supersede policy and keep main uncancellable (#14286) ... * fix(ci): let main pushes supersede under the shared concurrency group A concurrency group holds at most one running plus one pending run, and a newer pending run replaces the older one even while cancel-in-progress reads false. Back-to-back merges to main therefore already dropped each other's run, only silently and one merge behind. Make the intent explicit: only the newest tree matters and it covers every merged change — the same stance e2e.yml already takes (#5859). Release branches stay uncancelled. * fix(ci): keep main uncancellable and document the pending-replacement policy Review on #14286 showed the flip cancels the in-flight main run: merges land every ~18min against this ~30min lane, no merge queue is enabled, so this run is the only fast witness of a merged tree, and its always()-gated coverage upload would publish partial reports under the complete artifact name. e2e.yml already measured that cancelling main starved the suite (67 of 100 push runs cancelled, 25 reported, #5859). Restore the main exclusion and instead make the existing behavior explicit: a newer pending run replaces the older one even with cancel-in-progress false, so back-to-back merges already coalesce onto the newest tree, and the in-flight run always finishes and reports — by design, not accident.	2026-10-16 22:53:31 +08:00
易良	a84dbff23e	feat(providers): add QwenCloud as the first /auth entry (#14073) ... * feat(providers): add 千问AI平台 / QwenCloud as the first /auth entry Adds QwenCloud as a new top-level provider group ahead of Alibaba ModelStudio, following the product ruling in #14025: the two entries coexist rather than one replacing the other, so saved ModelStudio credentials, endpoints and model selections keep resolving to their existing presets and no migration is needed. Two new presets share the ModelStudio wizard shape (Access Method -> Platform -> API Key -> models): - qwencloud-standard (pay-as-you-go, `sk-` / `sk-ws-` keys) - qwencloud-token-plan (Credit subscription, `sk-sp-` keys) Each offers China (千问AI平台) and International (QwenCloud) as an explicit platform choice, so the UI language never decides the endpoint. Coding Plan is not offered here — it is a ModelStudio product. Endpoints were taken from the platform's own documentation and probed before landing (all four return the DashScope `invalid_api_key` error envelope): - https://maas.qianwenaiapi.com/compatible-mode/v1 - https://token-plan.maas.qianwenaiapi.com/compatible-mode/v1 - https://maas.qwencloudapi.com/compatible-mode/v1 - https://token-plan.maas.qwencloudapi.com/compatible-mode/v1 The new hosts are added to the DashScope provider detection and the web-search endpoint allowlist so the built-in `web_search` backend keeps working; both new env keys are added to the no-AK CI gate's cleared-env list. Group wiring is mirrored across the ink and OpenTUI dialogs, the VS Code provider picker, and the serve catalog consumed by Web Shell. Closes #14025 Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(cli): add QwenCloud auth strings to en and zh-TW locales The new auth entries introduced in the previous commit were only added to zh.js. Since en.js is the source of translation keys and both zh and zh-TW enforce strict key parity, the i18n check failed with "Extra key in zh.js" for all eight strings. Add the same keys to en.js as identity mappings and to zh-TW.js with Traditional Chinese values, so all three locale files have an identical key set. * test(cli): follow the QwenCloud row in the OpenTUI auth menu tests The new first /auth entry shifts the main menu by one row, but the tests addressed the sub-menus by position, so most flows landed a row early and the region-height assertions still named the old first row. * feat(providers): localize the QwenCloud /auth entry label per locale The top-level /auth entry was the only mixed CJK/Latin label in the menu ("千问AI平台 / QwenCloud"), and because en/zh mapped that key to itself it was effectively hardcoded mixed in every locale. Route it through i18n instead: en and other locales show "QwenCloud", zh shows "千问AI平台", zh-TW shows "千問AI平台". Locale-neutral surfaces (serve catalog, VS Code provider picker) carry the single Latin brand; the Chinese brand stays visible in the explicit platform step ("China — 千问AI平台") and the docs. The step-title flowTitle now goes through t() so the localized brand also appears in "… · Step 1/3 · …". Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(providers): register QwenCloud hosts in telemetry and reasoning classifiers The QwenCloud MaaS hosts and env keys were registered in the two host gates this PR edits, but two further independent classifiers of the same hosts did not learn about them, and both misclassify the entry this PR makes the first-position default: - telemetry/gen-ai-provider.ts had no providerFromHostname match for maas.qianwenaiapi.com / maas.qwencloudapi.com and no PROVIDER_BY_ENV_KEY entry for QWENCLOUD_API_KEY / QWENCLOUD_TOKEN_PLAN_API_KEY, so resolveGenAiProviderName fell through to its `default: return 'openai'` arm. Every span and log record for a QwenCloud install was attributed to OpenAI, while the identical ModelStudio path resolved to 'dashscope'. - core/reasoning-overrides.ts keeps its own inline hostname regex without the new hosts, so a user-authored partial reasoning override on a qwen* model behind a QwenCloud baseUrl selected 'qwen-chat-template' -> toggleOnly -> invalidReasoning, which captureLatestReasoning catches and warns. The override was silently discarded; the same declaration on dashscope.aliyuncs.com resolves to 'dashscope-effort'. Also widen the SDK-side mirror DaemonAuthProviderCatalog.groups[].id to include 'qwencloud', which packages/cli/src/serve/types.ts and auth-provider-helpers.ts already emit as the first group, and derive web-shell's AuthGroupId from that union instead of re-declaring it, so the SDK type is the single source of truth. A second literal union in web-shell is why nothing reddened in-repo while the daemon emitted a group id its own published wire type declared impossible. The new suffixes go inside the existing anchored (^|\.)...$ group, so a forged maas.qianwenaiapi.com.evil.com cannot match while the legitimate token-plan. subscription subdomains still do. Both env keys map to the existing 'dashscope' provider value rather than a new one. The hosts stay literals in gen-ai-provider.ts rather than importing QWENCLOUD_MAAS_HOSTS: that module is a zero-import telemetry leaf, and dashscope.ts already imports core/reasoning-overrides at runtime, so importing back would cycle. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv8fwg2z5f * test(providers): pin QwenCloud host classification and registry membership Cover behaviour this PR added that no test observed: - dashscope.test.ts: the QwenCloud MaaS pay-as-you-go and token-plan hosts are DashScope origins, plus dot-boundary lookalike negatives. - web-search.test.ts: the same four hosts pass the web-search gate. - qwencloud-standard/token-plan.test.ts: both presets are registered in ALL_PROVIDERS and QWENCLOUD_PROVIDERS, and the qwencloud access-method group excludes Coding Plan (replaces a constant-true id/label check). Each new assertion is mutation-verified: dropping isQwenCloudOrigin from the dashscope return, weakening its host match, dropping the QWENCLOUD_MAAS_HOSTS spread, removing the two registry entries, or flipping codingPlanProvider uiGroup each turns exactly the intended test red. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv8mbxgn5t * test(providers,cli): pin QwenCloud preset separation and the auth catalog group Coverage for lines this PR itself added (review round 1: R1-21, R1-26, R1-15): - qwencloudStandardProvider.ownsModel is cross-checked against its QwenCloud Token Plan sibling and against a foreign envKey on its own endpoint. The two presets share uiGroup, catalog and protocol bucket, so that envKey gate is the only discriminator; dropping it kept the suite green while applyModelProvidersPatch would claim a Token Plan install. - buildAuthProviderCatalog gets its first test: the QwenCloud group is first and carries both access methods. A misspelled group filter stayed green. - The zero-row main-menu paint test now names row 0, which this PR re-pointed from Alibaba ModelStudio to QwenCloud while only rows 1 and 2 stayed pinned. Each assertion was confirmed load-bearing by one mutation that the pre-existing tests did not catch. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv8oh38g5y * docs(users): sweep the /auth menu enumeration in overview and quickstart This PR re-numbered the /auth menu to four options in auth.md and model-providers.md, but overview.md and quickstart.md still described three entries with Alibaba ModelStudio as the recommended one (review round 1: R1-4). The doc set contradicted itself, and a quickstart reader holding a QwenCloud key was routed to the ModelStudio entry, whose endpoints reject it. Both pages now list QwenCloud first and reserve the "recommended setup" claim for it, matching auth.md. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv8oh38g5y * fix(providers): validate daemon credentials and close QwenCloud follow-ups (#14302) * fix(serve): validate API key format before persisting in daemon install path The CLI, ACP and VS Code surfaces each call provider.validateApiKey before persisting credentials. The daemon route (POST /workspace/auth/provider) did not, because validateApiKey is a function on ProviderConfig and cannot be serialized to the wire — so no client of this route can apply the check either. Without this guard a key the provider's own entry rejects (e.g. a Token Plan sk-sp- key aimed at the Standard API Key entry) gets persisted silently, and the user only discovers the mismatch at the first authenticated call. Fix: call validateApiKey in the route after protocol validation and before invoking installAuthProvider. Return 400 with code 'invalid_api_key' on failure, matching the other three surfaces. Closes #14257 (item S3 / R2-13). * fix(providers): address #14257 deferred Suggestions (D1/D2, T1/T3-T9, I1, P5, S6/S7) Batch fix for actionable items from #14257: Docs: - D1: Add settings.json example to QwenCloud headless setup section - D2: Add QwenCloud rows to web-search.md auto-activation table Tests: - T1: Pin flowTitle locale resolution in both dialog suites - T3/T4: Assert QwenCloud sub-menu contents (Token Plan + Standard, no Coding Plan) - T5: Add missing token-plan.maas.qwencloudapi.com endpoint to dashscope.test.ts - T6: Add QwenCloud host tests to reasoning-overrides.test.ts - T7: Assert providerState in qwencloud-standard preset test - T8: Test ownsModel baseUrl conjunct independently of envKey - T9: Test providerMatchesCredentials URL gate independently of envKey - S7: Assert QwenCloud group in VS Code AuthMessageHandler picker i18n: - I1: Add validateApiKey messages to all 9 locale files Product: - P5: Fix qwen3.7-plus modalities to include video (matches alibaba-token-plan) Code: - S6: Update docstring enumerations in dashscope.ts and web-search.ts Remaining items need human decisions: P1-P4 (wording/labels), S1-S5 (API surface), T2 (ink suite gating is a pre-existing harness pattern). * fix(auth): translate provider titles at render time Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(providers): handle optional preset models Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(providers): pin Token Plan providerState and ownsModel baseUrl leg Addresses four review Suggestions on this PR: - R1-10 (#14257 T7): the providerState stamp was asserted for the Standard preset only. Token Plan has two baseUrl options and a baseUrl-dependent modelNamePrefix, so stamp both routes. - R1-11 (#14257 T8): the deciding baseUrl negative for ownsModel was added to the Standard suite only. The Token Plan negatives added here differ in envKey, so the baseUrl conjunct was never the deciding factor. - R1-1: the web-search host note contradicted the two QwenCloud rows this PR adds to the table on the same page. Name the Model Studio and QwenCloud MaaS families the code actually accepts. - R1-4: the daemon route comment claimed parity with the CLI/ACP/VS Code copies. Those resolve the endpoint first and validate the resolved URL; this route validates the client-supplied baseUrl. Comment only. Both new Token Plan rows were mutation-checked one mutant at a time: dropping baseUrl from resolveProviderState, stamping the provider default endpoint instead of the requested one, and relaxing ownsModel to envKey-only each turn exactly the intended row red. An additional cross-route "versions must differ" row stayed green under all of them (model configs already embed baseUrl), so it was dropped rather than shipped inert. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmv9zmmcj86 * test: make the QwenCloud witnesses discriminating; trim daemon key once R1-9: the two Token Plan cases and the four lookalike cases never reached the dashscope host regex - both blocks short-circuited in validateReasoningDeclaration/validateReasoningCapabilities before route.baseUrl was parsed, and the block comment misstated the Token Plan endpoints as unregistered. Fold the Token Plan hosts into the QwenCloud host table with a declaration that omits `thinking`/`profile`, so all four registered endpoints now pin the anchored suffixes. R1-5/R1-6: the Ink VIEW_TITLES fix had no CI-executed guard (every keystroke case is skipped under CI=true) and its T1 case asserted only the already-lazy flowTitle path. Add one ungated, keystroke-free render assertion and assert the sub-menu heading between the two keystrokes. R1-3: validate and forward the same trimmed key rather than validating the trimmed value while forwarding the raw one. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmva623ox8i * fix(auth): guard zh locale test cleanup, note hand-written provider caveat R1-7: wrap the QwenCloud zh flow-title test body in try/finally so unmount() and the locale reset still run when an assertion rejects, matching the shape of the opentui twin added in the same change. R1-2: note in the settings.json alternative that a hand-written provider entry carries no capabilities stamp, so /effort offers the generic tiers rather than the QwenCloud curated set. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Patrol-Run: qwen-pr-closeout/jmvaacf8g8p * fix(providers): address #14073 round-3 deferred Suggestions - docs/design/auth/motivation.md: QwenCloud-first /auth enumeration (S1) - docs/users/quickstart.md: name QwenCloud credentials in Before you begin (S3) - docs/users/configuration/auth.md: scope the Token Plan prefix rule to ModelStudio vs QwenCloud so Option 1 and Option 4 no longer read as contradictory (S4) - qwencloud-standard.test.ts: correct the ownsModel comment — envKey and baseUrl conjuncts each exclude the sibling independently (S5) - auth-provider-helpers.test.ts + alibaba-standard.test.ts: pin every catalog group's providerIds and the alibaba uiGroup (S6) - web-search.test.ts: forged-suffix boundary cases for the QwenCloud host gate (S7) S2 (6-latin-locale backfill) and S8 (web-shell group dict) verified as no-ops: the sibling ModelStudio strings rely on the identical raw-key fallback in the same locales/dictionary. * fix(auth): localize provider API key errors * fix(providers): seed Token Plan only with models its endpoint serves A live GET /models on the China Token Plan route (real subscription key, 2026-10-16) serves neither kimi-k3 nor deepseek-v4-pro-0813 — the endpoint offers kimi-k2.x and deepseek-v4-pro instead, matching the platform doc's personal-edition table. The shared QWENCLOUD_MODELS seed list therefore pre-filled two ids the wizard would install as dead entries whenever discovery succeeded, and offered them in the offline fallback. Filter the shared catalog down to the five confirmed-served models for the Token Plan preset instead of duplicating stamps; the Standard (pay-as-you-go) catalog keeps the full list, which no live data has falsified. Pinned by a new preset test asserting the exact seed ids. --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(auth): preserve explicit models during provider discovery --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-16 21:34:43 +08:00
Shaojin Wen	52a7094d8c	test: skip the chmod-based core, wecom and scripts tests where permission bits do not bind (#14283) ... * test: skip the chmod-based core, wecom and scripts tests where permission bits do not bind Ten tests outside packages/cli fail when run as root, because root with its DAC capabilities bypasses the mode bits their fixtures rely on: four in core (skill-curator, git-worktrees x2, session-writer-lease), one in channels/wecom, and five in scripts/tests (the pr-review health probe x2, two autofix gate cases, and the desktop smoke's undeletable workspace). They pass as a regular user and on a root lane that drops those capabilities, as ci.yml does for unit tests. Guard them on whether a mode-000 directory refuses this process, as #14162 does for cli: - core gets its own copy of the probe and its tests, as revised in #14271 (it reads the real node:fs, so a test file's vi.mock cannot change its answer), as core already keeps its own latency-budget. - wecom cannot import across packages (import/no-relative-packages), so its one case carries a small inline probe, which also names an inconclusive probe on stderr. - scripts/tests imports the cli helper, as other scripts tests import cli sources. One autofix case checked five tampering shapes and only the unreadable one needs the bits, so that shape moves to a case of its own, which skips where they do not bind; the other four keep running as root. The two git-worktrees cases also checked a link loop, a linked `.git` and an oversized `.git`, which need no permission bits; those move to cases of their own, still skipped on Windows for its symlink privilege, so they keep running as root. The autofix self-check that pins its mapfile gates now pins each case's exact guard, the probe included where it belongs. * test: pin the root lane's capability drop and surface an inconclusive probe Address review on the permission-bit gates: - package-scripts pins ci.yml's root branch by its code lines: the setpriv assignment sits uncommented inside the uid-0 branch, nothing else names test_runner (no unset, read or reset), and both the workspaces and the scripts command run under it, with no unwrapped copy. Without that a root lane keeps CAP_DAC_OVERRIDE and every gate skips while CI stays green. - Under GitHub Actions an inconclusive probe opens its stderr line with :⚠️:, in the cli and core helpers and the wecom inline probe, so the skips show in the check UI. The answer is unchanged. The helper's tests stub GITHUB_ACTIONS, pin the plain line outside Actions and the annotated one under it, each as one whole line. - The mocked-fs test first checks that its node:fs mock is installed, for the named and the default export; without that it passes whether or not the probe ignores the mock. - The autofix status-0 pin accepts !hasBashMapfile ahead of another guard, however Prettier wraps it, as the mapfile pin already does. cli and core keep identical copies of the helper and its tests. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-16 19:38:32 +08:00
Shaojin Wen	72d0541625	test(managed-agent): add the FG9a/FG9f session_message and session_command relay fault gates (#14164) (#14333) ... * test(managed-agent): add the FG9a/FG9f session_message and session_command relay fault gates (#14164) Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(managed-agent): account the FG9 letters in the Hosted fork budget (#14164) * test(managed-agent): witness proxy holds before FG9f releases and prove each mint delivered (#14164) * test(managed-agent): prove each FG9 mint consumed through the receiver session journal (#14164) --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-16 19:24:57 +08:00
ytahdn	a8eb74fdf5	fix(web-shell): polish files and trim preview resources (#14143) ... * fix(web-shell): polish files and trim preview resources * test(cli): observe pending child Hook promises * fix(web-shell): address Files browser review findings * fix(vscode): sync Pierre modification notices * chore: ignore the repo-local .pnpm-store fallback directory pnpm falls back to a project-local store at .pnpm-store/ when the global store directory is not writable (e.g. sandboxed CI runners). It is a regenerable cache that node_modules hard-links into; its thousands of untracked files otherwise dirty the working tree and fail deterministic workspace-clean verification. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(web-shell): address Pierre preview and file display review findings - getPreviewLanguage folds case on the extension only, so README.MD and config.YML highlight while whole-name detector keys (Gemfile, BUILD) keep their case-sensitive behavior - formatFileName strips the full Default_Ignorable_Code_Point class so zero-advance Hangul fillers and variation selectors cannot desync the tree search projection from the rendered name - pin the previously unwitnessed pierre-build guards: redirected Shiki subpaths count toward the 4 MiB budget, getModuleInfo may return null for redirected ids, emitted assets are skipped, and entry-module resolveId calls carry no importer - pin the theme name->module mapping with exact token colors and give the formatFileName display sites discriminating coverage with repeated-space names --------- Co-authored-by: 钉萁 <dingqi.jww@alibaba-inc.com> Co-authored-by: qwen-code[bot] <qwen-code[bot]@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-10-16 16:45:56 +08:00
Shaojin Wen	41d369ab54	test(managed-agent): keep the member command IT inside the Hosted fork budget, and release a relay hold that never took (#14061) ... * test(managed-agent): size the member command ITs' timeouts above their waits, and drop a relay hold that never took Both cases' @Timeout sat below the sum of the bounded waits they wrap (the restart case: 180 s against ~465 s), so a stall on a loaded runner could end as a bare JUnit timeout before the stalled phase's own atMost reported it. Raise each bound above that sum plus the Spring start. holdMessageRelay asserted the hold before handing back its release latch, so a hold that never took stayed queued with nobody left to release it: once it ran it parked the relay's only thread, and the context close then waited out its 30 s shutdown phase on it. Release it on that path (an interrupted wait included), so the queued task returns as soon as it runs. The restart case's note on the relay-attach race now states only what was observed: the takeover's load is refused with 409 hosted_session_already_attached and deferred a full backoff step. * test(managed-agent): keep the member command IT inside the Hosted fork budget, and pin its relay hold's release The Hosted*IT classes share one failsafe fork. Raising this class's ceilings to 360 + 540 s put it 350 s outside the fork-budget model in scripts/tests/hosted-process-ci.test.js, and nothing in CI checked this class against it. The ceilings go back to 240 + 180 s. A case cut by its @Timeout still reports the wait it was in: every wait goes through waiting(), whose failFast fails on the interrupt, and JUnit attaches that failure, with the line of the wait, to its TimeoutException. The budget test's summed-ceiling row, so far run only for HostedTeamLeadMySqlIT, now runs for this class too. The relay hold moves into SchedulerHold so that SchedulerHoldTest can pin the release of a hold that never took: with the release removed, the probe task queued behind it never runs. * test(managed-agent): pin the interrupted relay hold, and keep its files checkstyle-clean SchedulerHoldTest pinned the took and timeout paths of the hold's release guard, not the interrupted one: dropping the try/finally (the timeout branch unchanged) kept both cases green. A third case interrupts the caller while its hold is still queued, the way a case's @Timeout does, and checks that the scheduler's only thread is left free. That mutant now fails it, and only it. The board case's budget comment said every wait goes through waiting(). The Awaitility waits do; the raw waits left (Process.waitFor, the relay hold's latch, HttpClient.send) throw on the same interrupt, which the comment now says. Main's qwen-code-checks.xml (#14186) covers test sources, so the two new files take its import order and braces; checkstyle:check on the module is clean. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-16 12:47:15 +08:00
易良	c3012a523f	fix(ci): restore a meaningful Windows merge gate (#14298) ... * fix(ci): restore a meaningful Windows merge gate Keep the known workspace baseline visible while making Windows installer/script coverage and hosted process checks authoritative again. * fix(ci): gate Windows on installer security coverage Keep the broader failing baselines visible while making the verified Windows installer and Hosted process contracts authoritative.	2026-10-16 10:35:46 +08:00
jinye	28415ddff3	refactor(managed-agent): Consolidate server and broker sources (#14277) ... * refactor(managed-agent): Consolidate server and broker sources Move the combined Java application beside sdk-java and remove the standalone Runtime Broker artifact. Update build, development, packaging and CI references while preserving Java package identities, runtime protocols and schema resources. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * docs(managed-agent): Preserve historical evidence and verification guidance Restore commit-pinned H3 probe inputs and align the Java verification environment contract with the consolidated server layout. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): Run hosted Broker tests under Bash Keep Maven property arguments intact on Windows and stop before Broker tests when the SDK install fails. Exercise both successful and failed SDK installation in the workflow regression tests. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): Quote the hosted Broker shell value Follow the repository yamllint single-quote rule without changing the parsed workflow configuration. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-16 00:28:58 +00:00
jinye	3259339bd5	fix(managed-agent): Standardize SQL timestamps and query mappings (#14185) ... * fix(managed-agent): Standardize SQL timestamps and query mappings Use explicit Managed SQL projections and typed receipt/scalar mappings, update modification times atomically, and store business timestamps as unsigned epoch milliseconds with gmt creation/modification names. Preserve API contracts, immutable journal bytes, physical identity and fencing conditions. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(managed-agent): keep completed GC ledgers out of the claim range scan available_at became BIGINT UNSIGNED, so completed CAPTURE_GC and SESSION_RESOURCE_GC ledgers moved from -1 to 0. Zero falls inside the claim query's "available_at >= 0 AND available_at <= now" range over ix_ma_operation_gc_due, and state is not part of that index, so every claim walked the whole never-deleted completed history before discarding it: 67 -> 10067 handler reads at 10k completed rows, growing with deployment age. Mark completed ledgers never-due instead, above every claim bound. The sentinel stays below 2^53 so it still round-trips through JavaScript exactly. Both collectors already treat a future available_at as unclaimable, so this aligns the index scan with existing semantics. Also repair the retirement fault injection in WorkspaceSessionRetentionMySqlIT: the UPDATE now advances gmt_modified first, so the stale prefix stopped matching and silently left the deletion-rollback guarantee untested. * fix(managed-agent): address review feedback from PR #14185 - Rename databaseEpochMillis to epochMillis and make static (R1-6) - Add UUID suffix to H2 in-memory DB name in projection test (R1-8) - Restore broad claim_until matcher in Issue-13181 query-budget test (R1-12) * fix(managed-agent): stop flushParts re-stamping the derived item time flushTurnProjection writes ma_message.gmt_modified from the derived event timeline, then calls flushParts for the same item ids. The gmt_modified clause this branch added to the flushParts UPDATE overwrote that derived value with the flush wall clock, so the public updated_at reported materialization time instead of content-change time: re-materializing a January session in October stamped every item October. The clause was absent at the merge base, so ma_message.gmt_modified goes back to being set exclusively from the derived timeline. Both flushParts callers already stamp it there -- flushTurnProjection immediately before the call, and materializeNextBatch through the insert-or-update helper that binds event.createdAt() to gmt_create and gmt_modified. Pinned by asserting the derived time survives a resource-backed part write; re-adding SQL_NOW to that UPDATE makes the assertion fail with the wall clock, which is how this went unnoticed before. * ci: sync PR budget gate prerequisites from main Import main commit 813840b1ea without unrelated main changes. The current PR workflow already invokes the new budget entrypoint; include its checker, ledger and tests so the head checkout can run that gate instead of failing MODULE_NOT_FOUND. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-10-16 00:46:13 +08:00
Shaojin Wen	37f8e851c7	test(managed-agent): add the FG8e/FG8f monitor_run and background-shell fault gates (#14120) ... * test(managed-agent): add the FG8e/FG8f monitor_run and background-shell fault gates Stage F fault gates for the capabilities #13889 enabled without a fault round, per #13856's G6 written obligation and #14054's triage: SSE stream continuity across client abort/resume (FG8e, over the public and WebShell streams) and background output delivery consistency under publisher loss (FG8f: the publisher killed mid-capture, the 16 MiB pause/resume watermarks under held store commits, a dropped manifest-commit reply re-driven by the original identity). Real packaged Harness, real MySQL, JDBC ground truth; no production code changes. Slice 1 of the FG8 round per the design doc: FG8a lands after #14021, FG8b/c/d after #13986/#13918. The hosted-harness-mysql lane gains the delegated cgroup v2 root these gates need, and its fork/Verify/job budgets move 1200s→1800s / 35→40min / 160→165min with hosted-process-ci.test.js updated to match. * test(managed-agent): address FG8 review round 1 and the schema consolidation - Port the gate class and probe to the consolidated 32-table schema (#14069): ma_* table names, and the SESSION-stream filter on the ledger/count queries — a child task's state_changed audit rows share the sequence space but the surfaces never serve them. - Enable the verified-workspace storage guard the way the repaired Hosted fixtures do (#14131): the Linux-gated property, guard.register per storage, and the mount-root mtime pin. - P1: start the Verify step inside the delegated cgroup through a privileged cgroup.procs write (delegation containment rejects the migration for a process outside the subtree), and smoke-test a real child joining a unit in the delegation step. - P2: resume only after JDBC proves a committed event beyond the cursor (advance the capability while disconnected), so a history-dropping endpoint cannot pass vacuously; the catch-up window outlives two 60 s poll cycles. - R1-1: register the new driver in the relay-headers enumeration pin. - R1-2/3/4: doc budget numbers to the merged lane values, the per-ceiling profile comment, and the create/export, privileged-move and smoke pins. - R1-5..R1-9 deferred to #14147: one sweep extracting the shared helpers across all hosted gate classes. * test(managed-agent): remove the FG8e monitor producer's natural exit A producer that exits on its own closes the scope, and the scope-close cancel write races the watch's quota settle — the record then settles stop_requested instead of max_events with the quota verifiably reached (observed twice on the lane after the merge). The producer now idles past its last mark so the quota stop's kill is the only way out, making the settle deterministic; the fixture note records the race in both languages. * test(managed-agent): address the FG8 round-2 review findings - receipt-drop: report the dropped commit's op and assert it is the settle cascade's manifest commit (commitChildRunRecord), so a positional misdrop goes red instead of passing on the count alone; postDropSettled is now read off the commit log, not a literal. - tearDown: gateServer.stop runs in a finally so a throwing Spring close no longer leaks the gate server's dispatcher thread. - workflow: point the delegation smoke's sleep at /dev/null so a failing line can't leave it holding the step's stdout open. * ci: bump the sdk-java.yml size baseline for the FG8 cgroup wiring The FG8 monitor/run gates' cgroup v2 delegation step (the privileged move plus a real child joining a unit) and the Verify step's env/prefix add 2067 bytes over main. The recorded 70375 was also 2392 bytes stale against main's actual 72767; the new 74834 records both, keeping the lane inside the 4096-byte allowance. --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-15 22:35:21 +08:00
易良	5d40c8153c	fix(ci): gate Desktop and Java SDK releases on checks of the release commit (#14259) ... * fix(ci): gate desktop releases on checks of the release commit Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): gate Java SDK releases on the complete Java suite Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): update sdk-java MAVEN_ARGS count after checkstyle step addition Commit 404845a (#14242) added a 'Run Managed Agent Server Checkstyle' step to the test job in sdk-java.yml, bringing the MAVEN_ARGS count from 6 to 7, but did not update the corresponding test expectation. * fix(ci): run desktop shell checks in parallel with the build The relocated desktop_shell job serialized up to 45 minutes ahead of the 120-minute build on every release and daily dry run, re-running cargo test and test-release.js that build already runs ungated on all five matrix entries against the same pinned revision. Keep the job, but gate only publish and sync-oss on it; build needs prepare alone, so the shell lane runs in parallel and nothing publishes unchecked. Also: sdk-java.yml's cancel-in-progress expression named a trigger #14205 removed, so it was permanently false — make that literal. The desktop qwen_code_ref input descriptions now say the ref must contain the desktop crate, since a pre-desktop ref hard-fails the gate instead of passing vacuously. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): restore the runs-on dropped from the desktop build job Commit 6989b9c replaced the build job's `runs-on: '${{ matrix.os }}'` with the comment explaining the parallel shell lane, so the key never came back. actionlint fails the Lint & Static gate on it, and GitHub rejects the file outright — the push-event Desktop Release run ends "failed because of a workflow file issue" with zero jobs, which would break every desktop release and dry run, not just CI. Restore the line. The build job's 34 steps and its five-entry `os` matrix are unchanged, so this returns the job to the shape main has. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>	2026-10-15 19:42:08 +08:00
Shaojin Wen	95468e293f	test(managed-agent): gate G3 Step 3 recovery, model-round takeover and control-plane fencing (#14181) ... * test(managed-agent): gate G3 Step 3 recovery, model-round takeover and control-plane fencing Run the five Step 3 packaged gates (approval Allow, Deny, Cancel and expiry, and the continuation closeout) as hosted-harness-mysql steps through a new --g3-verify flag; G3_VERIFY_MODE keeps working. Add a model-round arm: the first model round of a Session with no Workspace survives two Harness-only replacements, each reissuing the same saved request and retracting the dead owner's prefix, with no tool execution and a clean next-Turn history. Add a frozen control-plane arm for the binding half of #12952 Q2: the original Spring and Harness are SIGSTOPped mid-round, a second pair on the same MySQL finishes the Turn, and after SIGCONT the woken Spring's stale claim, witnessed in the MySQL general log, must leave the Session binding, the Turn row, the public events and the journal unchanged. The woken coordinator never reaches a bind call, so a store test pins the bind guards directly: a former owner whose claim lapsed cannot rebind, renew or admit, and a terminal Turn cannot be bound. Fix the server README paragraph that still said a model-round park wedges the Session, document every G3 arm and the first-release recovery scope, and record decision D11 in both languages of the G3 design. Refs #12952 * test(managed-agent): answer the first review of the G3 residual gates The README no longer says a parked model round or approval in a Session with Hooks or MCP ends with a typed decline: a Hooks Session never takes over and an MCP approval plain-attaches. It now says Step 3 neither reissues nor resumes those states and no gate covers how they end. The model-round arm requires the writer generation, journal revision and committed sequence to advance across every takeover, and its terminal wait watches both the live control plane and the Harness finishing the round; waitUntil and waitForTerminal accept several children for this. The frozen control-plane arm gains a writer-side witness: the woken Harness must meet the store's stale-writer refusal after the wake and not before, counted on its output since the wake rather than the rolling log tail. It also refuses to wake a Harness whose home is gone, reports the retained home, and splits a poll budget across the snapshot's synchronous probes while one-shot snapshots keep 10 s each. The store test pins the owner check of recordRecoveryAdmission for a former owner, and both admission refusals now check their message. New pins cover the writer side of the Step 3 evidence path, the awaited waits, the pre-wake baseline and the checks above. The design doc's stale CI budget item now points at D11, which states the step sum. Refs #12952 * test(managed-agent): answer the second review of the G3 residual gates waitUntil's deadline message now takes its log tails from the normalised child list, so a deadline on the model-round terminal wait reports both tails instead of throwing a TypeError on the array. An early exit names the child that died, which tells the control plane apart from the Harness generation finishing the round. The waitUntil tests cover a dead first child, a dead last child and a deadline with both children alive, and the signal-death comment sits on its own test again. The frozen control-plane arm watches the replacement Spring and Harness through the quiet window and every wait after the wake, and checks them once more before the fenced verdict: a dead owner would otherwise hold every snapshot still. The README and both design docs no longer say the new gates run in CI. They are steps of the Hosted MySQL job, which runs daily or on demand and reaches them only after its verification step passes; that step was failing on main when the gates were added. The D11 snapshot list now says the journal probe is a per-generation, per-operation count and highest revision. Refs #12952 * test(managed-agent): let the frozen arm see an owner exit during its probes The fenced snapshot's probes are synchronous, so a replacement that exits while they run is not recorded until the event loop turns. The arm now yields once before checking the owners, and the pin covers the check's body, not only its position. The docs say the new steps run only when every earlier step of the job passes, not only the Verify step, and state in the past tense that no CI run had executed them when they were added. The README's no-change statement is bounded by what the D11 snapshot can see. Refs #12952 --------- Co-authored-by: 易良 <1204183885@qq.com>	2026-10-15 19:29:48 +08:00
易良	b99787e474	docs: remind to update workflow meta-tests when changing CI workflows (#14239) ... * docs: remind to update workflow meta-tests when changing CI workflows #14205 moved Java and Desktop checks off pull_request/push triggers but forgot three scripts/tests/*.test.js files that pin those workflows' trigger shapes. The resulting red main CI run was fixed by #14227. Add a step to the general workflow so the next workflow change updates all parsing meta-tests, not just the obvious ones. * docs: preserve workflow validation guidance after renumbering Correct the self-audit reference so fixes rerun build, typecheck, and tests, and keep the workflow lookup command on one line for Prettier. * test(ci): update Java Maven step count for server Checkstyle Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-15 06:27:55 +00:00
易良	c1b012539b	fix(ci): repair daily failure reporting and contract guards (#14238) ... Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>	2026-10-15 05:07:50 +00:00
易良	a750166bec	feat(managed-agent): publish an experimental reference distribution (#14176) ... * feat(managed-agent): publish reference distribution Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): support GNU tar in reference packager * fix(managed-agent): satisfy checksum regex lint * fix(ci): close reference release gates Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>	2026-10-15 05:04:29 +00:00