Skip to content

Commit bc72a69

Browse files
Liki4claude
Liki4
and
claude
committed
feat: publish native Qoder 1.1.74 support and CN authentication
Align native authentication and request identity with Qoder CLI 1.1.74, add regional login and catalog-v7 compatibility, and retain versioned synthetic protocol verification. Prepare user-facing documentation, contribution and security guidance, and account-free CI for public development. Co-Authored-By: Claude Code <noreply@anthropic.com>
1 parent b8b595f commit bc72a69

52 files changed

Lines changed: 7853 additions & 1001 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
branches: [master]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
test:
19+
name: Offline Go and protocol tests
20+
runs-on: ubuntu-latest
21+
timeout-minutes: 20
22+
env:
23+
GOTOOLCHAIN: local
24+
GOWORK: "off"
25+
GOFLAGS: -mod=readonly
26+
QODER2API_E2E: "0"
27+
QODER2API_E2E_REFRESH: "0"
28+
steps:
29+
- name: Check out source
30+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31+
with:
32+
persist-credentials: false
33+
34+
- name: Set up Go
35+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
36+
with:
37+
go-version: "1.25.x"
38+
cache: false
39+
40+
- name: Unit tests
41+
run: go test -count=1 ./...
42+
43+
- name: Race tests
44+
run: go test -race -count=1 ./...
45+
46+
- name: Static analysis
47+
run: go vet ./...
48+
49+
- name: Offline E2E and observer tests
50+
run: go test -tags=e2e -count=1 ./...
51+
52+
- name: Standalone oracle unit tests
53+
working-directory: tools/wasm_oracle
54+
run: go test -count=1 ./...
55+
56+
- name: Protocol harness self-test
57+
run: python3 -B tools/wasm_harness.py --self-test

‎.gitignore‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# Build outputs and downloaded executables
2+
/bin/
23
/qodercli2api
34
/qodercli2api-*
45
/qodercli-*
@@ -10,6 +11,8 @@
1011
/.qoder/
1112
/.qodercli2api/
1213
/.claude/
14+
/login.md
15+
/next-session.md
1316
/dumps/
1417
*.sqlite
1518
*.sqlite-shm
@@ -18,10 +21,12 @@
1821
# Reverse-engineering workspace is local-only
1922
/re/
2023

21-
# Only the two reviewed public documents are tracked
24+
# Only reviewed public protocol and analysis documents are tracked
2225
/docs/*
2326
!/docs/oauth.md
2427
!/docs/inference-protocol.md
28+
!/docs/qodercli-1.1.74-analysis.md
29+
!/docs/development.md
2530

2631
# Python/local tool state
2732
__pycache__/

‎CONTRIBUTING.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# 贡献指南
2+
3+
欢迎提交文档修正、合成测试、兼容性修复和小范围功能改进。使用方式见 [README](README.md)，架构与协议验证见 [开发指南](docs/development.md)。
4+
安全问题请使用 [私密漏洞报告渠道](SECURITY.md)，不要先开公开 issue。
5+
6+
## 本地准备
7+
8+
- 安装 **Go 1.25+**。根模块仅使用标准库，无需官方 CLI、账号或 WASM。
9+
- 根目录的空 `go.sum` 必须保留；不要为清理文件而删除它。
10+
- `tools/wasm_oracle` 是独立 Go 模块，依赖和测试与根模块分开；首次检查需要下载标准 Go 模块依赖，不需要 Qoder 账号或外置 WASM。
11+
- 需要构建时使用 `go build -o ./bin/qodercli2api .`（先创建 `bin/`），不要覆盖根目录的现有可执行文件。
12+
13+
默认检查从仓库根目录运行，允许按本机 Go 配置下载模块依赖，但不访问 Qoder 账号：
14+
15+
```bash
16+
export GOTOOLCHAIN=local GOWORK=off
17+
18+
go -C tools/wasm_oracle mod download
19+
go test ./...
20+
go test -race ./...
21+
go vet ./...
22+
QODER2API_E2E=0 QODER2API_E2E_REFRESH=0 go test -tags=e2e ./...
23+
go -C tools/wasm_oracle test ./...
24+
python3 -B tools/wasm_harness.py --self-test
25+
```
26+
27+
`mod download` 会按 Go 配置访问模块代理/校验服务，它不是 Qoder 账号调用，也不下载认证 WASM。
28+
如需**严格离线检查**，先在允许联网的环境中执行上述下载命令、准备好依赖缓存，再设置 `GOPROXY=off` 运行测试；缺缓存时离线模式会失败，不应通过开启真实 E2E 来解决。
29+
30+
race 检查需要受支持的平台/工具链。外置 oracle 的 opt-in 环境变量应保持未设置；Python 自检不需要第三方包。
31+
真实 E2E 不是贡献前提；它需要账号持有人单独明确授权，并可能计费和改写凭据，详见 [授权 E2E](docs/development.md#authorized-e2e)。
32+
33+
## Issue 与 PR
34+
35+
1. 描述可观察的问题、预期行为、相关协议版本和最小复现；只使用合成输入或已人工脱敏的信息。
36+
2. 一个 PR 聚焦一个问题，避免混入无关重构、生成产物或大规模格式变化；行为变化附回归测试，用户配置变化同步更新文档。
37+
3. 提交前格式化修改的 Go 文件，并运行与改动有关的检查。PR 中说明执行了哪些命令、结果及未运行的项目，不将跳过的测试写成通过。
38+
4. 保留历史冻结向量的字节、版本和 manifest 身份；升级协议时新增独立版本目录和来源证据，不能改写旧向量来“修复”测试。
39+
40+
## 数据与授权边界
41+
42+
- 测试和 fixture 仅使用**合成数据**；不要提交真实账号、token、PAT、API key、环境文件、私有模型缓存、请求/响应或抓包。
43+
- 不提交 Qoder CLI、认证 WASM、完整 JS bundle、原生 addon 或其他专有二进制/提取物。
44+
- 可选 oracle 只能读取操作者有权持有和执行的外部 pinned 模块；遵循 [工具说明](tools/README.md) 与 [NOTICE](NOTICE)，不要把它嵌入生产构建。
45+
- 避免在 issue 中粘贴完整日志；错误、路径、工具参数和模型输出也可能泄露私有信息。
46+
47+
贡献将按仓库的 [AGPL-3.0 许可证](LICENSE) 发布。提交前请确认你有权贡献相关代码和材料。

‎NOTICE‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,31 @@ This project is an independent interoperability project and is not affiliated
55
with, endorsed by, or sponsored by Qoder or Alibaba. Qoder, Alibaba, and
66
related names and marks belong to their respective owners.
77

8-
This repository is licensed under the GNU Affero General Public License
8+
This project is licensed under the GNU Affero General Public License
99
version 3.0 as provided in LICENSE.
1010

11-
The production implementation is pure Go. This repository and its production
12-
binary do not distribute or embed Qoder CLI's qoder_auth WebAssembly module and
13-
do not depend on wazero.
11+
The production implementation is pure Go. The current source tree and
12+
production builds contain and distribute no Qoder CLI qoder_auth WebAssembly
13+
module. The root Go module and production builds do not depend on wazero.
14+
The optional standalone analysis tool under tools/wasm_oracle is a separate
15+
Go module with its own dependencies, including wazero.
16+
17+
This statement about the current source tree and production builds does not
18+
apply to every historical revision: commit 09452a6 contained a vendor WASM
19+
asset, which was removed in commit baa9052. The Git history retains those
20+
revisions; removal from the current tree does not remove historical copies
21+
or grant redistribution rights to that asset.
1422

1523
The optional analysis tools under tools/ can validate and execute an
16-
authorized, operator-supplied Qoder CLI 1.1.34 WebAssembly module as an external
17-
interoperability oracle. That external module is not part of this repository
18-
or this project's AGPL-3.0 license. Operators are responsible for confirming
19-
their right to possess and execute it and must not redistribute it without the
24+
authorized, operator-supplied, version-pinned Qoder CLI 1.1.34 or 1.1.74
25+
WebAssembly module as an external interoperability oracle. That external
26+
module is not included in the current source tree or covered by this
27+
project's AGPL-3.0 license. Operators are responsible for confirming their
28+
right to possess and execute it and must not redistribute it without the
2029
applicable permissions.
2130

22-
This repository does not distribute Qoder CLI, user credentials, captured
23-
traffic, model catalogs, or local account data. Users must use their own
24-
authorized subscription and comply with applicable service terms and law.
31+
The current source tree does not distribute official Qoder CLI binaries,
32+
real user credentials, captured live traffic, private model catalogs, or
33+
local account data. Test fixtures contain synthetic data only. Users must
34+
use their own authorized account and subscription and comply with applicable
35+
service terms and law.

0 commit comments

Comments
 (0)