evolclaw 3.1.5 → 3.1.7

package/dist/channels/aun.js

@@ -576,7 +576,7 @@ export class AUNChannel {
         const store = await getAidStore({
             slotId: SLOT.daemon,
             aunPath,
-            debug: this.config.aunSdkLog ?? true,
+            debug: this.config.aunSdkLog ?? false,
         });
         this.store = store;
         const client = await loadClient(store, aidName);
@@ -790,18 +790,16 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
 
 📋 **日常使用方法**：
 
-1. **绑定项目**：发送 \`/bind <项目路径>\` 绑定工作目录
-2. **查看帮助**：发送 \`/help\` 查看所有可用命令
-3. **切换项目**：发送 \`/project <项目名>\` 切换到其他项目
-4. **查看状态**：发送 \`/status\` 查看当前会话状态
-5. **会话管理**：发送 \`/session\` 查看和切换会话
+1. **查看帮助**：发送 \`/help\` 查看所有可用命令
+2. **查看状态**：发送 \`/status\` 查看当前会话状态
+3. **会话管理**：发送 \`/session\` 查看和切换会话
 
 💡 **提示**：
 - 直接发送消息即可与 Claude/Codex 对话
-- 支持多项目会话管理，每个项目独立会话
+- 支持多会话管理，每个会话独立上下文
 - 所有命令以 \`/\` 开头
 
-现在，请先使用 \`/bind\` 命令绑定您的项目目录，然后就可以开始工作了！`;
+现在就可以开始工作了！`;
             // First contact with Owner races against Owner's async cert fetch from
             // gateway PKI; a 3s pause lets the cert propagate. persist_required asks
             // the gateway to durably store the message so Owner can recover it via
@@ -818,6 +816,8 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
                 persist_required: true,
             });
             logger.info(`${this.logPrefix()} Welcome message sent to owner: ${owner}`);
+            // Send binding credential for Evol App to persist locally
+            await this.sendBindingCredential(owner, agentDisplayName, agentConfig.active_baseagent || 'claude').catch(e => logger.warn(`${this.logPrefix()} Binding credential failed: ${e}`));
             // Mark agent as initialized in config.json (replaces old agent.md frontmatter flag)
             try {
                 const fresh = loadAgent(aidName);
@@ -835,7 +835,57 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             logger.warn(`${this.logPrefix()} Failed to send welcome message: ${e}`);
         }
     }
+    async sendBindingCredential(owner, name, baseagent) {
+        if (!this.client)
+            return;
+        await this.callAndTrace('message.send', {
+            to: owner,
+            payload: { type: 'binding', aid: this.config.aid, name, owner, baseagent },
+            encrypt: true,
+            persist_required: true,
+        });
+        logger.info(`${this.logPrefix()} Binding credential sent to owner: ${owner}`);
+    }
     // ── Event handlers ──────────────────────────────────────────
+    /**
+     * 判断附件是否为图片，返回 MIME 类型（非图片返回空）。
+     * 多重检测：附件元数据字段 → 文件名后缀 → 文件 magic bytes。
+     */
+    detectImageMime(att, filePath) {
+        const extToMime = {
+            '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+            '.gif': 'image/gif', '.webp': 'image/webp',
+        };
+        // 1. 附件元数据字段（content_type / mime_type / mimeType）
+        const metaCt = (att?.content_type || att?.mime_type || att?.mimeType || '');
+        if (typeof metaCt === 'string' && metaCt.startsWith('image/'))
+            return metaCt;
+        // 2. 文件名后缀
+        const name = (att?.filename || att?.object_key || filePath || '').toLowerCase();
+        for (const [ext, mime] of Object.entries(extToMime)) {
+            if (name.endsWith(ext))
+                return mime;
+        }
+        // 3. magic bytes
+        try {
+            const { openSync, readSync, closeSync } = require('node:fs');
+            const fd = openSync(filePath, 'r');
+            const head = Buffer.alloc(12);
+            readSync(fd, head, 0, 12, 0);
+            closeSync(fd);
+            if (head[0] === 0x89 && head[1] === 0x50 && head[2] === 0x4e && head[3] === 0x47)
+                return 'image/png';
+            if (head[0] === 0xff && head[1] === 0xd8 && head[2] === 0xff)
+                return 'image/jpeg';
+            if (head[0] === 0x47 && head[1] === 0x49 && head[2] === 0x46)
+                return 'image/gif';
+            if (head[0] === 0x52 && head[1] === 0x49 && head[2] === 0x46 && head[3] === 0x46 &&
+                head[8] === 0x57 && head[9] === 0x45 && head[10] === 0x42 && head[11] === 0x50)
+                return 'image/webp';
+        }
+        catch { /* not readable, skip */ }
+        return '';
+    }
     async downloadAttachment(att, channelId) {
         const ownerAid = att.owner_aid || this._aid || '';
         const objectKey = att.object_key;
@@ -844,7 +894,9 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             return null;
         }
         const filename = att.filename || objectKey.split('/').pop() || 'unknown';
-        let downloadUrl;
+        // 安全：始终通过受信任的 ticket 路径获取下载 URL。
+        // 不信任 att.url（来自对端消息 payload，可被构造为内网/元数据地址，SSRF）。
+        let downloadUrl = '';
         try {
             const ticket = await this.callAndTrace('storage.create_download_ticket', {
                 owner_aid: ownerAid,
@@ -924,12 +976,21 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         // Process attachments (顶层 + 嵌套在 merge.items / quote.quote 中的)
         const rawAttachments = this.collectAllAttachments(payload);
         let finalText = text;
+        const inboundImages = [];
         if (rawAttachments.length > 0 && this.client) {
             const fileParts = [];
             for (const att of rawAttachments) {
                 const filePath = await this.downloadAttachment(att, fromAid);
                 if (filePath) {
                     const name = sanitizeFileName(att.filename || att.object_key?.split('/').pop() || 'file');
+                    const mime = this.detectImageMime(att, filePath);
+                    if (mime) {
+                        try {
+                            const { readFileSync } = await import('node:fs');
+                            inboundImages.push({ data: readFileSync(filePath).toString('base64'), mimeType: mime });
+                        }
+                        catch { /* fallback to file path */ }
+                    }
                     fileParts.push(`[文件: ${name} → ${filePath}]`);
                 }
             }
@@ -938,9 +999,11 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
                 if (text)
                     parts.push(text);
                 parts.push(...fileParts);
-                parts.push('请使用 Read 工具读取文件内容。');
+                if (inboundImages.length === 0)
+                    parts.push('请使用 Read 工具读取文件内容。');
                 finalText = parts.join('\n\n');
             }
+            logger.info(`${this.logPrefix()} [img-debug] private attachments=${rawAttachments.length} images=${inboundImages.length}`);
         }
         // 私聊 channelId = 对端 AID（不再读 payload.chat_id 含 device 三段式）
         // device_id 仅 SDK 内部多实例去重用，evolclaw session 层面跨端共享会话
@@ -993,7 +1056,11 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             mentions,
             peerName: displayName || undefined,
             peerType: peerIdentity.type,
+            sameDevice: msg.same_device === true || undefined,
+            sameNetwork: msg.same_network === true || undefined,
+            sameEgressIp: msg.same_egress_ip === true || undefined,
             replyContext,
+            images: inboundImages.length > 0 ? inboundImages : undefined,
         });
     }
     async handleIncomingGroupMessage(data) {
@@ -1144,12 +1211,21 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             : mentionedSelf && this._aid ? [this._aid] : [];
         // Process attachments
         let finalText = strippedText;
+        const inboundImages = [];
         if (hasAttachments && this.client) {
             const fileParts = [];
             for (const att of rawAttachments) {
                 const filePath = await this.downloadAttachment(att, groupId);
                 if (filePath) {
                     const name = sanitizeFileName(att.filename || att.object_key?.split('/').pop() || 'file');
+                    const mime = this.detectImageMime(att, filePath);
+                    if (mime) {
+                        try {
+                            const { readFileSync } = await import('node:fs');
+                            inboundImages.push({ data: readFileSync(filePath).toString('base64'), mimeType: mime });
+                        }
+                        catch { /* fallback to file path */ }
+                    }
                     fileParts.push(`[文件: ${name} → ${filePath}]`);
                 }
             }
@@ -1158,7 +1234,8 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
                 if (strippedText)
                     parts.push(strippedText);
                 parts.push(...fileParts);
-                parts.push('请使用 Read 工具读取文件内容。');
+                if (inboundImages.length === 0)
+                    parts.push('请使用 Read 工具读取文件内容。');
                 finalText = parts.join('\n\n');
             }
         }
@@ -1191,6 +1268,9 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             userId: senderAid,
             peerName: displayName || undefined,
             peerType: peerIdentity.type,
+            sameDevice: msg.same_device === true || undefined,
+            sameNetwork: msg.same_network === true || undefined,
+            sameEgressIp: msg.same_egress_ip === true || undefined,
             text: finalText,
             chatType: 'group',
             messageId,
@@ -1198,6 +1278,7 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             threadId,
             mentions,
             replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmode),
+            images: inboundImages.length > 0 ? inboundImages : undefined,
         });
     }
     dispatchMessage(event) {
@@ -1260,13 +1341,55 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             peerId: event.userId || event.channelId || '',
             peerName: event.peerName,
             peerType: event.peerType,
+            sameDevice: event.sameDevice,
+            sameNetwork: event.sameNetwork,
+            sameEgressIp: event.sameEgressIp,
             messageId: event.messageId,
             threadId: event.threadId,
             mentions: mentionObjects,
             replyContext,
+            images: event.images,
         }).catch(err => {
             logger.error(`${this.logPrefix()} Message handler error:`, err);
         });
+        // Observer forward: inbound
+        this.forwardToOwners('inbound', {
+            from: event.userId || event.channelId || '',
+            to: this.config.aid,
+            seq: event.seq,
+            payload: { type: 'text', text: event.text },
+        });
+    }
+    /**
+     * 观察者模式转发：将消息副本以 observer.forward 格式发给所有 owners。
+     * 仅在 AgentConfig.observable === true 时执行；owners 为空或无法加载配置时静默跳过。
+     */
+    forwardToOwners(direction, original) {
+        if (!this.connected || !this.client)
+            return;
+        const agentConfig = loadAgent(this.config.aid);
+        if (!agentConfig?.observable)
+            return;
+        const owners = agentConfig.owners ?? [];
+        if (owners.length === 0)
+            return;
+        const forwardPayload = {
+            type: 'observer.forward',
+            direction,
+            agent_aid: this.config.aid,
+            original: {
+                from: original.from,
+                to: original.to,
+                ...(original.seq != null ? { seq: original.seq } : {}),
+                timestamp: Date.now(),
+                payload: original.payload,
+            },
+        };
+        for (const ownerAid of owners) {
+            const encrypt = this.shouldEncrypt(ownerAid);
+            this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt })
+                .catch(e => logger.debug(`${this.logPrefix()} observer.forward to ${ownerAid} failed: ${e}`));
+        }
     }
     handleEcho(event) {
         const ts = () => {
@@ -1743,6 +1866,12 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
                     appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: channelId, msgId: mid, kind: 'text', len: finalText.length, groupId: channelId });
                     this.aidStatsCollector?.recordOutbound(this.config.aid, channelId, Buffer.byteLength(finalText, 'utf-8'), finalText, false, encrypt, context?.metadata?.chatmode);
                     this.appendOutboundJsonl(channelId, finalText, mid, encrypt, context, true, 'text', source);
+                    // Observer forward: outbound (group)
+                    this.forwardToOwners('outbound', {
+                        from: this.config.aid,
+                        to: channelId,
+                        payload: { type: 'text', text: finalText },
+                    });
                 }
             }
             else {
@@ -1756,6 +1885,12 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
                     appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: targetAid, msgId: result.message_id, kind: 'text', len: finalText.length });
                     this.aidStatsCollector?.recordOutbound(this.config.aid, targetAid, Buffer.byteLength(finalText, 'utf-8'), finalText, false, encrypt, context?.metadata?.chatmode);
                     this.appendOutboundJsonl(targetAid, finalText, result.message_id, encrypt, context, false, 'text', source);
+                    // Observer forward: outbound (private)
+                    this.forwardToOwners('outbound', {
+                        from: this.config.aid,
+                        to: targetAid,
+                        payload: { type: 'text', text: finalText },
+                    });
                 }
             }
             return true;
@@ -2444,7 +2579,7 @@ export class AUNChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name, // channelName 实际上就是 channelKey
-                capabilities: { file: true, image: true, interaction: true, markdown: true, thought: true, status: true },
+                capabilities: { file: true, image: true, interaction: true, markdown: true, thought: true, status: true, thread: true },
                 send: async (envelope, payload) => {
                     const ctx = envelope.replyContext;
                     const channelId = envelope.channelId;
@@ -2497,22 +2632,22 @@ export class AUNChannelPlugin {
                             channel.sendProcessingStatus(channelId, 'progress', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.started':
-                            channel.sendProcessingStatus(channelId, 'start', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'start', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.queued':
-                            channel.sendProcessingStatus(channelId, 'queued', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'queued', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.completed':
-                            channel.sendProcessingStatus(channelId, 'done', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'done', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.interrupted':
-                            channel.sendProcessingStatus(channelId, 'interrupted', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'interrupted', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.error':
-                            channel.sendProcessingStatus(channelId, 'error', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'error', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'status.timeout':
-                            channel.sendProcessingStatus(channelId, 'timeout', envelope.taskId, envelope.taskId, ctx);
+                            channel.sendProcessingStatus(channelId, 'timeout', envelope.taskId, envelope.taskId, ctx, payload.metadata);
                             return;
                         case 'interaction': {
                             const req = payload.interaction;
@@ -2637,6 +2772,7 @@ export class AUNChannelPlugin {
                             threadId: opts.threadId,
                             replyContext: opts.replyContext,
                             source: opts.source,
+                            images: opts.images,
                         });
                     }), (channelId, text, replyContext) => channel.sendMessage(channelId, text, replyContext), adapter, channelType);
                 },

package/dist/channels/dingtalk.js

@@ -448,7 +448,7 @@ export class DingtalkChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name,
-                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false },
+                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false, thread: false },
                 send: async (envelope, payload) => {
                     const ctx = envelope.replyContext;
                     const channelId = envelope.channelId;

package/dist/channels/feishu.js

@@ -283,7 +283,8 @@ export class FeishuChannel {
                         else if (msg.message_type === 'merge_forward') {
                             const { text: mergedText, images: mergedImages } = await this.extractMergeForwardContent(msg.message_id, msg.chat_id);
                             if (mergedText) {
-                                const finalContent = quotedText + mergedText;
+                                // 直接发送合并转发时，parent_id 指向自己，引用解析会把相同内容填入 quotedText 导致重复，丢弃
+                                const finalContent = mergedText;
                                 const allImages = [...quotedImages, ...mergedImages];
                                 await this.messageHandler({ channelId: msg.chat_id, content: finalContent, images: allImages.length > 0 ? allImages : undefined, peerId, peerName, messageId: msg.message_id, threadId, rootId, chatType });
                             }
@@ -513,10 +514,15 @@ export class FeishuChannel {
                 if (options.replyInThread) {
                     replyData.reply_in_thread = true;
                 }
-                await this.client.im.message.reply({
+                const replyRes = await this.client.im.message.reply({
                     path: { message_id: options.replyToMessageId },
                     data: replyData
                 });
+                if (options.replyInThread && options.onThreadCreated) {
+                    const newThreadId = replyRes?.data?.thread_id;
+                    if (newThreadId)
+                        options.onThreadCreated(newThreadId);
+                }
             }
             else {
                 await this.client.im.message.create({
@@ -710,13 +716,18 @@ export class FeishuChannel {
             // seenThreads 无时间戳，仅限容量（话题持久存在，不按时间清理）
             if (this.seenThreads.size > 1000)
                 this.seenThreads.clear();
-            // 重写文件，去掉过期条目
-            if (this.config.seenMsgFile && this.seenMessages.size > 0) {
+            // 重写文件，去掉过期条目（仅在有记录被清理时才写）
+            if (cleaned > 0 && this.config.seenMsgFile) {
                 try {
-                    const lines = [...this.seenMessages.entries()]
-                        .map(([id, ts]) => JSON.stringify({ id, ts }))
-                        .join('\n') + '\n';
-                    fs.writeFileSync(this.config.seenMsgFile, lines);
+                    if (this.seenMessages.size === 0) {
+                        fs.unlinkSync(this.config.seenMsgFile);
+                    }
+                    else {
+                        const lines = [...this.seenMessages.entries()]
+                            .map(([id, ts]) => JSON.stringify({ id, ts }))
+                            .join('\n') + '\n';
+                        fs.writeFileSync(this.config.seenMsgFile, lines);
+                    }
                 }
                 catch { }
             }
@@ -1196,6 +1207,15 @@ export function buildResolvedV2(interaction, response) {
         });
         bodyElements.push({ tag: 'markdown', content: lines.join('\n') });
     }
+    // CommandCard: 显示原有按钮列表（保留上下文）
+    if (kind.kind === 'command-card' && kind.buttons?.length) {
+        const lines = kind.buttons.map(btn => {
+            const prefix = btn.command === action ? '✓' : '•';
+            const cleanLabel = btn.label.replace(/^✓\s*/, '');
+            return `${prefix} ${cleanLabel}`;
+        });
+        bodyElements.push({ tag: 'markdown', content: lines.join('\n') });
+    }
     return {
         toast: { type: 'success', content: statusText },
         card: {
@@ -1403,7 +1423,7 @@ export class FeishuChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name,
-                capabilities: { file: true, image: true, interaction: true, markdown: true, thought: false, status: true },
+                capabilities: { file: true, image: true, interaction: true, markdown: true, thought: false, status: true, thread: true },
                 send: async (envelope, payload) => {
                     const ctx = envelope.replyContext;
                     const channelId = envelope.channelId;
@@ -1417,6 +1437,8 @@ export class FeishuChannelPlugin {
                             const sendCtx = { ...(ctx ?? {}) };
                             if (payload.kind === 'result.text' && payload.isFinal)
                                 sendCtx.title = '✅ 最终回复:';
+                            if (ctx?.metadata?.onThreadCreated)
+                                sendCtx.onThreadCreated = ctx.metadata.onThreadCreated;
                             await channel.sendMessage(channelId, payload.text, sendCtx);
                             return;
                         }

package/dist/channels/qqbot.js

@@ -335,7 +335,7 @@ export class QQBotChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name,
-                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false },
+                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false, thread: false },
                 send: async (envelope, payload) => {
                     const ctx = envelope.replyContext;
                     const channelId = envelope.channelId;

package/dist/channels/wechat.js

@@ -731,7 +731,7 @@ export class WechatChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name,
-                capabilities: { file: false, image: false, interaction: false, markdown: false, thought: false, status: true },
+                capabilities: { file: false, image: false, interaction: false, markdown: false, thought: false, status: true, thread: false },
                 send: async (envelope, payload) => {
                     const channelId = envelope.channelId;
                     switch (payload.kind) {

package/dist/channels/wecom.js

@@ -491,7 +491,7 @@ export class WecomChannelPlugin {
             const adapter = {
                 channelName: inst.name,
                 channelKey: inst.name,
-                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false },
+                capabilities: { file: true, image: true, interaction: false, markdown: true, thought: false, status: false, thread: false },
                 send: async (envelope, payload) => {
                     const ctx = envelope.replyContext;
                     const channelId = envelope.channelId;

package/dist/cli/agent.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import os from 'os';
 import readline from 'readline';
 import { resolvePaths, agentMdPath as getAgentMdPathFromPaths, aunPath as defaultAunPath } from '../paths.js';
 import { loadDefaults, loadAllAgents, loadAgent, saveAgent, ensureAgentDirSkeleton } from '../config-store.js';
@@ -11,11 +10,6 @@ import { commandExists } from '../utils/cross-platform.js';
 import { isCodexSdkAvailable } from '../agents/codex-runner.js';
 // ==================== Helpers ====================
 const BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini'];
-const BASEAGENT_ENV_KEY = {
-    claude: 'ANTHROPIC_API_KEY',
-    codex: 'OPENAI_API_KEY',
-    gemini: 'GEMINI_API_KEY',
-};
 function isBaseagentAvailable(baseagent) {
     if (baseagent === 'codex')
         return isCodexSdkAvailable();
@@ -30,8 +24,7 @@ function pickDefaultBaseagent(available) {
     return available.includes('claude') ? 'claude' : available[0];
 }
 function buildBaseagentsBlock(chosen) {
-    const env = BASEAGENT_ENV_KEY[chosen];
-    return { [chosen]: env ? { apiKey: `$ENV:${env}` } : {} };
+    return { [chosen]: {} };
 }
 const DEFAULT_CHATMODE = { private: 'interactive', group: 'proactive', nothuman: 'proactive' };
 const DEFAULT_DISPATCH = 'mention';
@@ -296,11 +289,11 @@ export async function agentCreateInteractive(opts = {}) {
             const defaults = loadDefaults();
             const rootPath = defaults?.projects?.rootPath
                 || (defaults?.projects?.defaultPath && path.dirname(defaults.projects.defaultPath))
-                || path.join(os.homedir(), 'evolclaw-projects');
+                || resolvePaths().root + '/projects';
             suggestedProjectPath = deriveAgentProjectPath(rootPath, aid);
         }
         catch {
-            suggestedProjectPath = deriveAgentProjectPath(path.join(os.homedir(), 'evolclaw-projects'), aid);
+            suggestedProjectPath = deriveAgentProjectPath(resolvePaths().root + '/projects', aid);
         }
         const projectInput = (await ask(`Project path [${suggestedProjectPath}]: `)).trim();
         const projectPath = projectInput || suggestedProjectPath;
@@ -633,7 +626,7 @@ export async function agentSyncAids() {
     const defaults = loadDefaults();
     const rootPath = defaults?.projects?.rootPath
         || (defaults?.projects?.defaultPath && path.dirname(defaults.projects.defaultPath))
-        || path.join(os.homedir(), 'evolclaw-projects');
+        || resolvePaths().root + '/projects';
     const created = [];
     for (const aid of localAids) {
         if (existingAids.has(aid))
@@ -761,6 +754,12 @@ export async function agentSet(aid, key, rawValue) {
         return { ok: false, error: `Failed to read config: ${e?.message || e}` };
     }
     const value = parseJsonValue(rawValue);
+    // active_baseagent 白名单校验：只允许已知 baseagent，挡住把模型名（如 deepseek）误设为后端
+    if (key === 'active_baseagent') {
+        if (typeof value !== 'string' || !BASEAGENT_CANDIDATES.includes(value)) {
+            return { ok: false, error: `无效 active_baseagent: ${JSON.stringify(value)}（可选: ${BASEAGENT_CANDIDATES.join(' / ')}）` };
+        }
+    }
     setNestedValue(config, key, value);
     try {
         saveAgent(config);

package/dist/cli/bench.js

@@ -8,7 +8,7 @@ import { aidList, aidCreate } from '../aun/aid/identity.js';
 import { msgSend, msgPull } from '../aun/msg/index.js';
 import { getPackageRoot, aunPath as defaultAunPath } from '../paths.js';
 import { getAidStore, loadClient, SLOT } from '../aun/aid/store.js';
-import { isHelpFlag } from './help.js';
+import { isHelpFlag, getArgValue } from './help.js';
 const execFileAsync = promisify(execFile);
 // ==================== ANSI ====================
 const GREEN = '\x1b[32m';
@@ -132,10 +132,6 @@ function percentile(sorted, p) {
     const idx = Math.ceil((p / 100) * sorted.length) - 1;
     return sorted[Math.max(0, idx)];
 }
-function getArgValue(args, flag) {
-    const idx = args.indexOf(flag);
-    return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : undefined;
-}
 // ==================== Promise Pool ====================
 function withTimeout(promise, ms, label) {
     return new Promise((resolve, reject) => {

package/dist/cli/help.js

@@ -21,3 +21,11 @@ export function wantsHelp(args) {
             return true;
     return false;
 }
+/**
+ * 取出 `--flag <value>` 形式的参数值。
+ * flag 不存在或其后无值时返回 undefined。
+ */
+export function getArgValue(args, flag) {
+    const idx = args.indexOf(flag);
+    return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : undefined;
+}