host
1402dc67fd
P1 security batch: quota execution checks, cost accounting, goal/coordinator semantics, PR channel, orphan signature, control-plane and console hardening
...
- Docker quota watchdog + fail-closed quota checks, system tasks need real owner
- max_cost_usd actually accumulated, cancel records cost, estimated rows excluded from unpriced cap, cache_write declared non-billed
- goal-resume keeps original verify on breakpoint resume, goal retry falls back to resume, goal_max_rounds capped at 100 at create and execution
- coordinator children inherit parent model/effort, orphans marked interrupted with audit
- PR jobs on docker workers return explicit needs_local_worker instead of silent empty
- worker code signature covers 6 files and is checked before claim, fail-closed
- sub2api lazy provisioning with rotation, backup whitelist + 0600, push SSRF block, repos/workers desensitized, key/project audits and limits, console buttons/quota/status wording, coordinator/automation quota reserve
2026-10-27 16:27:50 +00:00
openqj and host
c86b450851
feat: goal 模式新语义——prompt 即目标，无验收命令，不限轮次，模型宣告完成 ( #67 )
...
console 打勾 goal 模式时不再有专用 goal 文本、验收命令、轮次
三个输入（已移除，换成说明行），只发 goal_mode=1；server 侧
goal_mode=1 时 goal 存 prompt、验收命令空、轮次存 0，带验收
命令或与计划模式同用时 400，旧的带验收命令任务照原样可用。
host.py goal 循环：verify 为空时不跑验测，轮次提示里写明
标记约定；模型在完整跑完的回合末尾单独一行输出“目标已
达成”即达标（超时回合的部分文本含标记也不算）；--max-rounds
0 为不限轮次，goal-resume 续跑按 0 处理（不用 or 兜底成 3）。
刹车只有取消与预算耗尽（后者记 interrupted、可续跑）。
迁移与 worker：tasks 加 goal_mode 列（server 迁移、worker 列
补齐、PG schema 三处同步）；worker 按 goal_mode 或
verify_command 判定 goal 路径，重试与后续消息排空对新语义
同样只跑一次/不排空；Local/Docker goal_task 的 --verify 可选、
--max-rounds 0 原样传。
Co-authored-by: host <host@test.local >
2026-10-27 03:54:48 +08:00
host
63823fc2e3
逐任务真实成本：上游用量事件 + 价目表计价
...
此前每任务只记一条 estimated（字符数/4，金额为空），注释称
host 协议不暴露真实 token 数。本轮实测推翻了该前提：
- account/usage/read 在中继上是死的（要求 ChatGPT 账号登录），
不是来源，已在 cost.py docstring 写明死胡同
- app-server 每上游补全发 thread/tokenUsage/updated，last 是该次
补全的用量；中继 5 调用回合实测 last 之和等于最后 total
（input/output/cached/reasoning 四路都对得上）
实现：host.py run_turn 从事件窗口按 threadId+turnId 汇总用量，
重试/goal 各轮累加，dispatch/run JSON 与 goal 用量行透传；
sandbox 三路解析（dispatch JSON 解析改用完整 stdout，顺带修
了长 text 下 failed 被误判 completed 的潜 bug）；worker 每任务
记一条 actual（重试/fallback 用量累加进同一条），无用量时回落
estimated；cost.py 价目表（默认 OpenAI 挂牌价，env 可覆盖，
无价模型 usd 记 None、报表进 unpriced_actual_tokens 而非 0 美元），
cost_records 加 cached_input_tokens 列（SQLite/PG 两支迁移）；
报表与按天行新增 cached_input_tokens/unpriced_actual_tokens。
测试：host 32、cloud 483 全过。
2026-10-26 18:41:27 +08:00
host
5ee9d291dd
云端 goal/merge/review 三事件：goal 循环 + PR 事件通知
...
此前 goal-unmet/merge-failed/review-requested 只有允许列表，
云端没有生产者（概念只在本地 host.py）。本轮给三者接真生产者：
- goal：POST /tasks 接受 goal/verify_command/goal_max_rounds
（迁移补列，SQLite 与 Postgres 两支）；带 verify_command 的
任务走 host.py goal 循环（Local/Docker 执行器 goal_task，
turn→验测→喂回重试，缺省 3 轮）；达标 completed，未达标
failed 且只发 goal-unmet、不重复发 failed；goal 模式下 worker
级重试/fallback 关闭，同任务 /retry 会撞 host 任务名已存在
（已在文档写明，须新建任务）；CloudExecutor 无 goal 概念，
如实失败不降级
- review-requested：POST /tasks/{id}/pr 建 PR 成功时发
（payload 含 pr_url/pr_number）
- merge-failed：PR 落盘（push/建 PR）失败 502 时发（payload
含 step/error），任务保持 merged、可重调 /pr；跳过时不发
测试：host 29、cloud 469 全过。
2026-10-26 18:11:12 +08:00
host
07a8eaaa73
Docker sandbox real test + cloud merge status endpoint
...
- DockerExecutor: extra mounts (host.py work/state, repo, codex-home
at same paths), worker --docker-extra-mounts, container user
configurable; Dockerfile copies codex-resources beside the codex
binary and puts bwrap on PATH (previous /usr/local/lib layout
made codex report bubblewrap unavailable inside the container).
- Real Docker task on external host: triple added in ~18s, merged
inside a container, main repo now add+mul2+triple, --rm cleanup.
Honest boundary: this host/kernel forbids unprivileged user
namespaces, so bwrap fails on host and in containers; production
mode here is Docker isolation + inner danger-full-access, not
double sandboxing.
- Cloud merge status: POST /tasks/{id}/merge syncs status only
(merge itself stays with host.py merge); completed -> merged,
maintainer+ (approve_merge), other states and repeat calls 409,
audit merge_task. Tests: cloud 223, host 27, all passing.
2026-10-26 02:46:10 +08:00
host
b74d99e959
cloud: production control plane (API, auth/RBAC, queue, sandbox, memory/KB, fallback/cost, webhooks)
2026-10-26 01:23:21 +08:00
host