evolcore 0.0.11 → 0.0.12

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.12 (2026-08-19)
+
+### AUN 通信
+
+- 规范结构化提及在消息收发、队列和响应链路中的传递，完善 @all、目标校验和非法载荷处理。
+- 增强入站去重、断线重投和错误回传，避免消息重复处理与错误循环。
+
+### 会话与 Agent
+
+- 串行化 Codex 会话的继续、压缩、分叉和回滚操作，完善 app-server 进程管理和安全清理。
+- 优化 proactive 会话、Handoff 和 Bootstrap 的生命周期处理，隔离并发会话上下文。
+
+### 权限与菜单
+
+- 收敛菜单执行上下文和托管命令授权，强化 EC shell 与 Codex 命令解析边界。
+- 完善菜单批量查询、关系上下文、联系人状态和工具拦截审计。
+
+### 运行兼容性
+
+- 统一跨平台子进程启动和 Windows 窗口处理，改进升级监控与内置 AUN SDK 管理。
+- 统一 Claude、Codex 的技能发现和运行时上下文注入。
+
 ## 0.0.11 (2026-08-11)
 
 ### Agent 初始化与引导

package/bin/codex-managed-hook.mjs

@@ -0,0 +1,80 @@
+import fs from 'node:fs';
+import net from 'node:net';
+
+const timeoutMs = 1500;
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
+    },
+  }));
+  // Codex 0.147 app-server runs this managed hook but does not reliably honor
+  // the JSON denial alone for thread/shellCommand. Exit 2 is the documented
+  // blocking transport; retain the JSON shape for compatible hook consumers.
+  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
+  process.exitCode = 2;
+}
+
+function queryDaemon(socketPath, payload) {
+  return new Promise(resolve => {
+    const socket = net.createConnection(socketPath);
+    let buffer = '';
+    let settled = false;
+    let timer;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    socket.once('error', () => finish(null));
+    socket.once('connect', () => socket.write(JSON.stringify(payload) + '\n'));
+    socket.on('data', chunk => {
+      buffer += String(chunk);
+      const index = buffer.indexOf('\n');
+      if (index < 0) return;
+      try { finish(JSON.parse(buffer.slice(0, index))); } catch { finish(null); }
+    });
+  });
+}
+
+async function main() {
+  const socketPath = process.argv[2];
+  let input;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch {
+    deny('Invalid Codex PreToolUse payload.');
+    return;
+  }
+  if (!socketPath
+    || input?.hook_event_name !== 'PreToolUse'
+    || typeof input?.session_id !== 'string'
+    || !input.session_id
+    || typeof input?.tool_name !== 'string'
+    || !input.tool_name) {
+    deny('Incomplete Codex PreToolUse payload.');
+    return;
+  }
+
+  const result = await queryDaemon(socketPath, {
+    type: 'codex-pre-tool-use',
+    threadId: input.session_id,
+    toolName: typeof input.tool_name === 'string' ? input.tool_name : '',
+    toolInput: input.tool_input ?? null,
+  });
+  if (!result) {
+    deny('EvolCore policy service is unavailable.');
+    return;
+  }
+  if (result.ok === true && result.applicable === true && result.decision === 'allow') return;
+  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.');
+}
+
+void main();

package/dist/agents/claude-runner.js

@@ -14,7 +14,7 @@ import { logger } from '../utils/logger.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { summarizeToolInput } from '../utils/tool-summary.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { encodePath } from '../utils/cross-platform.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
@@ -1852,6 +1852,27 @@ export class AgentRunner {
                 ...(updatedInput ? { updatedInput } : {}),
             },
         });
+        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode) => {
+            const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
+            if (!code)
+                return;
+            try {
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
+                    policyCode: code,
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] failed to record preflight denial: session=${sessionId} tool=${toolName} code=${code} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         // A rewritten helper command is trusted only after this hook produced its
         // random one-shot payload from a validated output wrapper.
         const trustedSafeOutputCommands = new Set();
@@ -1896,6 +1917,7 @@ export class AgentRunner {
             // proactive 模式行为策略（首次工具调用必须是 ec msg send）
             const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
             if (policyResult?.block) {
+                await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, policyResult.policyCode ?? 'session_policy_hook');
                 return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);
             }
             const permCtx = this.permissionContexts.get(sessionId);
@@ -1916,8 +1938,10 @@ export class AgentRunner {
             toolInput = preflight.input;
             if (toolInput !== originalInput)
                 updatedInput = toolInput;
-            if (preflight.behavior === 'deny')
+            if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, toolInput, preflight, input.tool_use_id ?? input.toolUseID);
                 return hookDecision('deny', preflight.message, updatedInput);
+            }
             if (preflight.behavior === 'allow') {
                 const commandAfterPreflight = typeof toolInput.command === 'string' ? toolInput.command : undefined;
                 if (commandAfterPreflight && commandAfterPreflight !== commandBeforePreflight) {
@@ -1942,6 +1966,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'readonly_mode');
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -1951,6 +1976,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_unknown_tool');
                     return hookDecision('deny', `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`, updatedInput);
                 }
                 // request/bypass only receive external tools admitted by the session's
@@ -1960,6 +1986,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, toolInput);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_dangerous_command');
                     return hookDecision('deny', `危险操作已由 auto 模式拒绝：${danger.reason}`, updatedInput);
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
@@ -2030,6 +2057,7 @@ export class AgentRunner {
             });
             input = preflight.input;
             if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, input, preflight, options.toolUseID);
                 return { behavior: 'deny', message: preflight.message, decisionClassification: 'user_reject' };
             }
             if (preflight.behavior === 'allow') {
@@ -2041,6 +2069,7 @@ export class AgentRunner {
             }
             const permissionExpansion = inspectClaudePermissionExpansion(input, options, projectPath);
             if (permissionExpansion.protectedReason) {
+                await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'protected_permission_expansion');
                 return {
                     behavior: 'deny',
                     message: permissionExpansion.protectedReason,
@@ -2049,6 +2078,7 @@ export class AgentRunner {
             }
             if (permissionExpansion.requiresApproval) {
                 if (callPermissionMode === 'readonly' || callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, callPermissionMode === 'readonly' ? 'readonly_permission_expansion' : 'auto_permission_expansion');
                     return {
                         behavior: 'deny',
                         message: `${callPermissionMode} 模式拒绝 Claude SDK 文件系统或未知权限扩权请求`,
@@ -2092,6 +2122,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'readonly_mode');
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
@@ -2101,6 +2132,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_unknown_tool');
                     return {
                         behavior: 'deny',
                         message: `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`,
@@ -2112,6 +2144,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, input);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_dangerous_command');
                     return { behavior: 'deny', message: `auto 模式拒绝危险操作：${danger.reason}`, decisionClassification: 'user_reject' };
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {

package/dist/agents/codex-app-server-client.js

@@ -5,6 +5,11 @@ import { buildHClassGuardCommand } from '../core/permission/sandbox-runtime.js';
 import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
 import { createHash } from 'crypto';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { getPackageRoot, resolvePaths } from '../paths.js';
+import { registerCodexAppServerProcess, unregisterCodexAppServerProcess, } from '../utils/codex-app-server-registry.js';
 const BUILT_IN_CODEX_PROVIDER_IDS = new Set(['openai']);
 function tomlProviderKey(value) {
     if (!value || /[\0\r\n]/.test(value)) {
@@ -41,6 +46,8 @@ export class CodexAppServerClient {
     initialized = false;
     initializing = null;
     stderrBuffer = [];
+    managedHookRuntimeDir = null;
+    processRegistrationPath = null;
     constructor(options) {
         this.options = options;
     }
@@ -298,25 +305,33 @@ export class CodexAppServerClient {
             pending.reject(new Error('Codex app-server closed'));
         }
         this.pending.clear();
-        if (!proc)
+        if (!proc) {
+            this.cleanupManagedHookRuntime();
             return;
+        }
         // 优雅关闭：先关闭 stdin，然后发送 SIGTERM，等待进程退出
         proc.stdin.end();
         proc.kill('SIGTERM');
         // 等待进程退出，最多等待 5 秒
         await new Promise((resolve) => {
+            let exited = false;
             const timeout = setTimeout(() => {
-                if (!proc.killed) {
-                    logger.warn('[CodexAppServer] Process did not exit after SIGTERM, sending SIGKILL');
+                if (exited)
+                    return;
+                logger.warn('[CodexAppServer] Process did not exit after SIGTERM, sending SIGKILL');
+                try {
                     proc.kill('SIGKILL');
                 }
+                catch { }
                 resolve();
             }, 5000);
             proc.once('exit', () => {
+                exited = true;
                 clearTimeout(timeout);
                 resolve();
             });
         });
+        this.cleanupManagedHookRuntime();
     }
     async ensureStarted() {
         if (this.initialized)
@@ -352,22 +367,56 @@ export class CodexAppServerClient {
         const launchCommand = resolveCodexLaunchCommand(args);
         if (!launchCommand)
             throw new Error('Codex CLI not found');
-        const guardedCommand = buildHClassGuardCommand(launchCommand.command, launchCommand.args);
-        if (process.platform === 'linux' && !guardedCommand) {
-            throw new Error('Codex 缺少 EvolCore H 类路径隔离运行时，已拒绝启动 app-server');
+        try {
+            let command = launchCommand.command;
+            let commandArgs = launchCommand.args;
+            if (process.platform === 'linux') {
+                const managedRequirements = this.ensureManagedHookRuntime();
+                const guardedCommand = buildHClassGuardCommand(command, commandArgs, undefined, {
+                    managedCodexRequirements: managedRequirements,
+                });
+                if (!guardedCommand) {
+                    throw new Error('Codex 缺少 EvolCore managed-hook 隔离运行时，已拒绝启动 app-server');
+                }
+                command = guardedCommand.command;
+                commandArgs = guardedCommand.args;
+            }
+            this.proc = spawn(command, commandArgs, {
+                cwd: this.options.cwd,
+                env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                windowsHide: process.platform === 'win32',
+            });
+            try {
+                this.processRegistrationPath = registerCodexAppServerProcess(this.proc.pid);
+            }
+            catch (error) {
+                logger.warn(`[CodexAppServer] failed to register owned process pid=${this.proc.pid ?? '<unknown>'}: ${error}`);
+            }
         }
-        this.proc = spawn(guardedCommand?.command ?? launchCommand.command, guardedCommand?.args ?? launchCommand.args, {
-            cwd: this.options.cwd,
-            env,
-            stdio: ['pipe', 'pipe', 'pipe'],
+        catch (error) {
+            this.cleanupManagedHookRuntime();
+            throw error;
+        }
+        const proc = this.proc;
+        const processRegistrationPath = this.processRegistrationPath;
+        proc.once('error', error => {
+            unregisterCodexAppServerProcess(processRegistrationPath);
+            if (this.processRegistrationPath === processRegistrationPath) {
+                this.processRegistrationPath = null;
+            }
+            this.failAll(error);
         });
-        this.proc.once('error', error => this.failAll(error));
-        this.proc.once('exit', (code, signal) => {
+        proc.once('exit', (code, signal) => {
+            unregisterCodexAppServerProcess(processRegistrationPath);
+            if (this.processRegistrationPath === processRegistrationPath) {
+                this.processRegistrationPath = null;
+            }
             this.failAll(new Error(`Codex app-server exited: code=${code ?? 'null'} signal=${signal ?? 'null'}`));
         });
-        const rl = readline.createInterface({ input: this.proc.stdout, crlfDelay: Infinity });
+        const rl = readline.createInterface({ input: proc.stdout, crlfDelay: Infinity });
         rl.on('line', line => this.handleLine(line));
-        this.proc.stderr.on('data', chunk => {
+        proc.stderr.on('data', chunk => {
             const text = String(chunk).trim();
             if (!text)
                 return;
@@ -377,6 +426,62 @@ export class CodexAppServerClient {
             logger.debug(`[CodexAppServer] ${text}`);
         });
     }
+    ensureManagedHookRuntime() {
+        if (this.managedHookRuntimeDir) {
+            return path.join(this.managedHookRuntimeDir, 'requirements.toml');
+        }
+        const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-codex-hooks-'));
+        try {
+            fs.chmodSync(directory, 0o700);
+            const hookPath = path.join(directory, 'pre-tool-use.mjs');
+            const sourcePath = path.join(getPackageRoot(), 'bin', 'codex-managed-hook.mjs');
+            fs.copyFileSync(sourcePath, hookPath, fs.constants.COPYFILE_EXCL);
+            fs.chmodSync(hookPath, 0o500);
+            const command = `${this.shellQuote(process.execPath)} ${this.shellQuote(hookPath)} ${this.shellQuote(resolvePaths().instanceSocket)}`;
+            const requirementsPath = path.join(directory, 'requirements.toml');
+            fs.writeFileSync(requirementsPath, [
+                'allow_managed_hooks_only = true',
+                '',
+                '[features]',
+                'hooks = true',
+                '',
+                '[hooks]',
+                `managed_dir = ${JSON.stringify(directory)}`,
+                '',
+                '[[hooks.PreToolUse]]',
+                'matcher = "*"',
+                '',
+                '[[hooks.PreToolUse.hooks]]',
+                'type = "command"',
+                `command = ${JSON.stringify(command)}`,
+                'timeout = 3',
+                'statusMessage = "Checking EvolCore session policy"',
+                '',
+            ].join('\n'), { mode: 0o400, flag: 'wx' });
+            this.managedHookRuntimeDir = directory;
+            return requirementsPath;
+        }
+        catch (error) {
+            try {
+                fs.rmSync(directory, { recursive: true, force: true });
+            }
+            catch { }
+            throw error;
+        }
+    }
+    shellQuote(value) {
+        return `'${value.replace(/'/g, `'"'"'`)}'`;
+    }
+    cleanupManagedHookRuntime() {
+        const directory = this.managedHookRuntimeDir;
+        this.managedHookRuntimeDir = null;
+        if (!directory || !path.basename(directory).startsWith('evolcore-codex-hooks-'))
+            return;
+        try {
+            fs.rmSync(directory, { recursive: true, force: true });
+        }
+        catch { }
+    }
     buildProcessEnvironment() {
         const env = sanitizeShellExecutionEnvironment({
             ...process.env,
@@ -571,5 +676,6 @@ export class CodexAppServerClient {
             pending.reject(error);
         }
         this.pending.clear();
+        this.cleanupManagedHookRuntime();
     }
 }