mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
8679b7ca75
* fix(managed-agent): e2e runner and image robustness from the #12692 R2 review Six R2 review follow-ups on #12692, re-verified against the current script (post-#13263) before patching: - waitUntil surfaces the last predicate error in its timeout message instead of swallowing it, and every iteration is bounded by the remaining deadline so a hung predicate can no longer outlive timeoutMs several-fold. - crashProcess refuses to kill a child that already died BY SIGNAL (exitCode stays null but signalCode is set), instead of throwing a raw ESRCH that hides the descriptive pre-exit diagnostic. - An interrupt delivered after the last poll now exits 1 with the signal name; success JSON can no longer appear for a run the operator explicitly stopped. - runMysql and mysqladmin pass --no-defaults first, so a developer's ~/.my.cnf client options cannot auth-fail the scratch empty-password server (both mysqld invocations already did). - The packaged-jar lookup is version-independent in both the runner (exactly-one jar assertion over target/) and the Dockerfile COPY (wildcard that fails on zero or multiple matches). - The image listens beyond loopback by default: ENV QWEN_MANAGED_AGENT_SERVER_ADDRESS=0.0.0.0 and QWEN_MANAGED_AGENT_RUNTIME_BROKER_HOST=0.0.0.0, so a documented docker run -p no longer refuses traffic; the application.yml loopback defaults stay host-appropriate. * fix(scripts-e2e): unbreak the failover lanes from the #13344 review Three findings on the R2-fix follow-up, each verified against the CI failure on hosted-harness-mysql before patching: - The packaged-jar lookup assumed exactly one qwen-managed-agent-server-*.jar in target/, but the pom attaches classified repackage executions (workspace-bundle, operator-recovery) besides the unclassified server jar, so the cardinality check could never pass and every test:e2e:managed-*-failover step died at module scope. The script now reads the project <version> from the pom — the one following the module's own <artifactId>, not the <parent> block's — and names the unclassified jar exactly. - The Dockerfile wildcard COPY fails the image build outright: multiple matches into a file destination is a Docker error, and no workflow builds this image to catch it. The build stage now selects the unclassified jar by classifier exclusion, fails unless exactly one exists, and publishes it under the fixed name the runtime stage COPYs. - waitUntil's stall timer was discarded live: a fast success idled the runner up to the largest timeout after the success JSON. The timer is unref'd. Script suite 14/14 green (new pins: pom-version jar naming, the classifier-exclusion line, stallTimer.unref()); Prettier and ESLint clean. The pom regex and the Dockerfile selection loop were both executed locally against a three-jar target before committing. * fix(scripts-e2e): harden the image guard and record the publish consequence Second review round on the jar/bind changes, each verified before patching: - The glob default arm trusted sh's non-nullglob behaviour: with zero matches the pattern itself reaches the counting arm, passes count=1 vacuously, and the build dies at cp with a glob in the message. The loop now breaks on a non-existent match candidate and the guard names the expectation loudly (expected exactly one unclassified server jar, found N). - The wide bind was necessary (-p DNATs to the bridge IP) but its consequence went unrecorded while README.md:6-8 still says the server listens on the loopback deliberately: the API has no HTTP authentication, so tenancy is whatever X-Qwen-Tenant-Id says, and docker run -p on a shared host publishes that surface. README's container section and the Dockerfile ENV comment now say this plainly; the pre-existing private-ingress gate stays with the wider lifecycle deferrals (#13302 family). - Two pins watch the bind and the guard in the script suite (both go red against the old text); the Reviewer Test Plan again matches the current head. Suite 15/15 green; Prettier applied. * fix(scripts-e2e): close the second round's eight follow-ups Each verified against the runner before patching: - The synthetic 'predicate stalled' rejection no longer overwrites the real predicate error; undici's cause (ECONNREFUSED) is what the diagnostic surfaces instead of 'fetch failed'. - MySQL client invocations run with an isolated empty HOME: MySQL honours ~/.mylogin.cnf even with option files disabled, so a developer's mysql_config_editor credential would otherwise defeat the flag at exactly the scratch empty-password servers it was for. spawnSync probes carry their own timeouts, as a sync-blocking call prevents the race deadline from firing inside an iteration. - One 'has this child exited' spelling (childExited) replaces the four drifted phrasings that produced the original ESRCH. - The AST extractor exists once; the port-allocation test calls the shared helper instead of maintaining a second copy. - The two surfaces that pick the server jar are named similarly in test intent (pom-derived exact name in the runner, classifier exclusion with a loud guard in the Dockerfile) so their ownership no longer contradicts, and the pom regex is executed against the real pom in the suite rather than only grepped. Suite 16/16 green; ESLint clean; Prettier applied. * fix(scripts-e2e): opt the image bind in explicitly and close round three Third review round, each finding reproduced or probed before patching: - The published image no longer binds the managed-agent control plane on 0.0.0.0 by default (R1-1): the module has no HTTP authentication, so the ENV pair published a tenant API anyone routing to the port could drive. The image keeps the application.yml loopback defaults; publishing is now an explicit docker run -e opt-in documented in the README's container section, including the no--p bridge exposure. - .dockerignore excludes target/ in both spellings, so a developer's stale Maven output cannot ride the build context into the stage the jar cardinality guard inspects. - waitUntil: the stall sentinel is compared by identity and recorded only when no real predicate error was seen; an answered (falsy) iteration clears a stale earlier error; and the remaining budget is handed to the predicate so synchronous probes bound themselves. - runMysql surfaces the spawn-level reason (a timeout no longer reads as a bare 'MySQL command failed: '), and the isolated MySQL client HOME hangs off the runner's one reclaimed scratch root. - Tests: extraction lists name childExited so the early-exit branch is reachable; the pom regex is lifted from the runner source and pinned by shape instead of a copied literal (a version bump stays green); the double transpile is gone. Suite 23/23 green (7 existing + 16 added by this PR); build, typecheck and lint clean; 14 mutation probes each red their witness. * fix(scripts-e2e): floor the last MySQL probe and close round four (#13344) Fourth review round, each finding reproduced or probed before patching: - R4-1 (Critical): the container-publishing recipe named QWEN_MANAGED_AGENT_RUNTIME_BROKER_HOST=0.0.0.0 without ALLOW_NON_LOOPBACK=true, which the broker requires for a non-loopback bind — an operator enabling the broker got a crash-looping container. Dropped the broker line from the README recipe and the Dockerfile comment and pointed at the Broker deployment section; publishing the API never needs the broker's HTTP face. A pairing pin now reds any documented broker wildcard bind that omits the flag. - R1-8: waitUntil handed the final poll a remaining budget below one client round trip, so the deadline message named a wedged client when the lease was simply unexpired. runMysql floors its spawn timeout at 2s, re-admitting up to ~2s of overshoot per wedged poll against the ~10s the budget threading removed. - R3-1: the mysqlClientHome pin was a whole-file count, blind to a fifth client invocation without the override. Assert per call site over the runner's AST: every spawnSync mysql/mysqladmin/mysqld passes --no-defaults, and the mysql/mysqladmin clients use the isolated HOME (the mysqld launches deliberately keep the real one). - R3-3: the loopback-by-default guarantee is pinned at application.yml's own default, not only at the Dockerfile declining to override it. - R3-2: the waitUntil extraction list lived in six pasted copies; one WAIT_UNTIL_DEPS inventory with one loadWaitUntil() loader now serves all six, and the loader takes injected new Function parameters (used by the crashProcess and runMysql cases). - R4-2: the jar-selection guard is exercised as shell — the RUN stage's own text run under a probed sh against zero/one/three/two-unclassified fixture target/ populations, asserting exit status and message. Suite 24/24 green (7 existing + 17 added by this PR); build, typecheck and lint clean; seven mutation probes red their witnesses, with the guarded broker variant staying green as the control. * fix(scripts-e2e): gate the jar guard on cp and sharpen the MySQL scan (#13344) Fifth review round, each finding probed before patching: - R4-2 (Critical): the executable jar-guard case gated on sh alone, but its fixture ends in cp — on a Git-Bash-only Windows PATH sh.exe resolves without the coreutils, so the merge-queue lane would red at the status assertions, and where sh is absent the in-body return recorded a pass for a guard that never ran. The case now probes the capability it consumes (sh -c 'command -v cp') and skipIf-gates, so a host without either reports skipped, matching the repo's own hasSha256sum probe spelling. - R3-1: the per-call-site scan matched spawnSync only, missing the long-lived start(mysqld, ...) launch (3 of the 4 MySQL process launches); a collapsed population still passed the lower-bound assertion; and toContain pinned the flag's presence, not its position, though MySQL honors --no-defaults only as the first option. The scan now covers spawnSync/spawn/start, asserts the exact four-call inventory, and pins --no-defaults as each call's first array element. - R1-8: the floor pin exercised only the clamp side; the default-timeout call now also pins that a budget above the floor reaches spawnSync unchanged (10_000), so a Math.max-to-constant regression reds the case. R1-12 stays open for a maintainer: it asks for a PR-body edit (the stale Image bind bullet and the 15/15 count), which this loop cannot perform — it has no GitHub write credentials. Suite 24/24 green; build, typecheck, lint and prettier clean; six mutation probes red their witnesses (clamp-to-constant; --no-defaults dropped from the start() launch; a fifth unprotected client; the flag moved off index 0; cardinality guard disabled; a cp-less PATH reports the jar-guard case skipped). * fix(scripts-e2e): document a bootable publish recipe and close round five (#13344) Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): boot the documented container recipe and pin the round-two gaps (#13344) Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): pass the recipe's datasource password valueless and pin the round-three gaps (#13344) Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): name both valueless credentials in the publish recipe's export instruction (#13344) * fix(scripts-e2e): cover the third pom classifier in the image jar guard (#13344) The base-conflict merge from main added the workspace-migration repackage classifier to the pom while the Dockerfile's exclusion list stayed at two arms, so the cardinality guard counted two unclassified jars and the documented image build failed at the RUN stage with no CI lane building the image to catch it. Add the missing arm, extend the shell-fixture populations with the real four-artifact target/ layout, and derive the exclusion set from the pom's own <classifier> elements in the suite so a fourth classifier reddens the Test job instead of an operator's docker build. The three prose copies of the artifact count are retired rather than renumbered, so they cannot drift again. Also close the two remaining round-one test-hardening findings: the port-allocation test now loads through the shared load() helper instead of a second local new Function spelling, and the image ENV pins anchor on the instruction (case-insensitive, leading whitespace tolerated) rather than the conventional uppercase column-0 spelling. Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): defer the freeze wake record and name stalls in waitUntil errors (#13344) - The --freeze arm printed its fencedFormerWriter record eagerly inside the try, so a SIGINT right after it left a success-shaped document on stdout for a run that exits 1, and the record flipped to before the main result. Defer it like resultJson and print it after the main result, restoring the base ordering. - When the deadline's own poll stalled, waitUntil reported a stale earlier error as the final state. The message now reads "predicate stalled; last error before the stall: ..." so both facts survive. - README: the documented MySQL grants did not boot the server (Flyway's performance_schema.user_variables_by_thread probe is denied with ERROR 1142 and startup stops at 'foreign_key_checks'); add the SELECT grant to the one-liner and mention it in the container section. * fix(scripts-e2e): floor the waitUntil stall bound so a final in-flight poll can answer (#13344) Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): print the README's full grant set in the dev recipe hint (#13344) Co-authored-by: Qwen-Coder <[email protected]> * fix(scripts-e2e): re-key the in-flight poll test off the clock for re-entry margin (#13344) Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: qwen-code[bot] <qwen-code[bot]@users.noreply.github.com>
66 lines
2.9 KiB
Docker
66 lines
2.9 KiB
Docker
FROM maven:3.9.11-eclipse-temurin-21 AS build
|
|
|
|
WORKDIR /workspace
|
|
COPY packages/sdk-java/qwencode packages/sdk-java/qwencode
|
|
COPY packages/sdk-java/runtime-broker packages/sdk-java/runtime-broker
|
|
COPY packages/sdk-java/managed-agent-server packages/sdk-java/managed-agent-server
|
|
COPY packages/core/src/managed-runtime/contracts/managed-tool-result-v1.schema.json packages/core/src/managed-runtime/contracts/
|
|
|
|
RUN mvn --batch-mode --no-transfer-progress \
|
|
-f packages/sdk-java/qwencode/pom.xml \
|
|
-DskipTests -Dgpg.skip=true install \
|
|
&& mvn --batch-mode --no-transfer-progress \
|
|
-f packages/sdk-java/runtime-broker/pom.xml \
|
|
-DskipTests install \
|
|
&& mvn --batch-mode --no-transfer-progress \
|
|
-f packages/sdk-java/managed-agent-server/pom.xml \
|
|
-DskipTests package \
|
|
# The pom attaches classified repackage executions alongside the
|
|
# unclassified server jar, so a wildcard matches several artifacts and
|
|
# a pinned version drifts. Select
|
|
# the unclassified jar by exclusion and publish it under a fixed name;
|
|
# fail the build (rather than ship a bad image) unless exactly one
|
|
# exists. sh has no nullglob, so a zero-match glob yields the pattern
|
|
# itself — break on it so the count check below still fails, and name
|
|
# the expectation loudly instead of dying at cp.
|
|
&& cd packages/sdk-java/managed-agent-server/target \
|
|
&& main="" && count=0 \
|
|
&& for f in qwen-managed-agent-server-*.jar; do \
|
|
[ -e "$f" ] || break; \
|
|
case "$f" in \
|
|
*-workspace-bundle.jar|*-operator-recovery.jar|*-workspace-migration.jar) ;; \
|
|
*) main="$f"; count=$((count+1)) ;; \
|
|
esac; \
|
|
done \
|
|
&& { [ "$count" -eq 1 ] || { \
|
|
echo >&2 "expected exactly one unclassified server jar," \
|
|
"found $count"; exit 1; \
|
|
}; } \
|
|
&& cp "$main" /tmp/qwen-managed-agent-server.jar
|
|
|
|
FROM eclipse-temurin:21-jre
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /tmp/qwen-managed-agent-server.jar \
|
|
/app/qwen-managed-agent-server.jar
|
|
|
|
# The image keeps the application.yml loopback defaults: under the shipped
|
|
# `auto` auth mode the server refuses a non-loopback bind, so a plain
|
|
# `docker run -p 8080:8080` must not — and cannot — publish it. Publishing
|
|
# is an explicit operator opt-in that names an authentication posture (see
|
|
# the README's container section):
|
|
# docker run -p 8080:8080 \
|
|
# -e QWEN_MANAGED_AGENT_SERVER_ADDRESS=0.0.0.0 \
|
|
# -e QWEN_MANAGED_AGENT_AUTH_MODE=signed \
|
|
# -e QWEN_MANAGED_AGENT_AUTH_SIGNING_KEY \
|
|
# -e SPRING_DATASOURCE_URL='jdbc:mysql://<db-host>:3306/qwen_managed_agent' \
|
|
# -e SPRING_DATASOURCE_USERNAME='qwen' \
|
|
# -e SPRING_DATASOURCE_PASSWORD \
|
|
# <image>
|
|
# or the deliberately unauthenticated
|
|
# QWEN_MANAGED_AGENT_AUTH_ALLOW_INSECURE_BIND=true override.
|
|
|
|
EXPOSE 8080 4182
|
|
USER 10001
|
|
ENTRYPOINT ["java", "-jar", "/app/qwen-managed-agent-server.jar"]
|