evolcore 0.0.11 → 0.0.12

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 // 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
 // 这些是系统级破坏操作，任何情况下都不应该允许
@@ -1071,30 +1071,57 @@ function prepareBoundedOutputInput(input, command, kind, context) {
 export function evaluateToolPreflight(toolName, input, context) {
     if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
-        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(command)) {
+        const explicitCommandArgv = Array.isArray(input.commandArgv)
+            && input.commandArgv.every(value => typeof value === 'string')
+            ? input.commandArgv
+            : undefined;
+        const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
+        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const policyCommand = wrappedCommand ?? command;
+        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
                 behavior: 'deny',
                 input,
                 message: '🔒 EvolCore 托管会话不需要探测 `ec` 是否存在；请不要调用 `command -v`/`which`/`type`，也不要拼接其它命令。通信必须走当前 session 的 delegated sender。',
+                policyCode: 'managed_ec_discovery_forbidden',
             };
         }
-        const argv = context.sessionId ? parseLiteralShellArgv(command) : null;
-        const isOwnAgentMdPublish = !!argv
-            && argv.length === 5
-            && argv[0] === 'ec'
-            && argv[1] === 'aid'
-            && argv[2] === 'agentmd'
-            && argv[3] === 'put'
+        const argv = context.sessionId ? parseCodexToolCommandArgv(input) : null;
+        const managedAidArgv = argv?.at(-2) === '--format' && argv.at(-1) === 'json'
+            ? argv.slice(0, -2)
+            : argv;
+        const ownAid = !!managedAidArgv
             && !!context.selfAid
-            && argv[4].replace(/^@/, '') === context.selfAid.replace(/^@/, '');
-        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(command) && !isOwnAgentMdPublish) {
+            && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
+        const isSelfManagedAidRead = !!managedAidArgv
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && ownAid
+            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+                || (managedAidArgv.length === 5
+                    && managedAidArgv[2] === 'agentmd'
+                    && managedAidArgv[3] === 'get'));
+        const isSelfAgentMdPublish = !!managedAidArgv
+            && managedAidArgv.length === 5
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'agentmd'
+            && managedAidArgv[3] === 'put'
+            && ownAid;
+        const canPublishSelfAgentMd = isSelfAgentMdPublish
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EvolCore 托管会话仅允许通过 `ec aid agentmd put <当前 self AID>` 发布自身名片；禁止通过 `ec aid` 自行发现、切换或操作其他身份。',
+                message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                    ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
+                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
-        const ecCommand = classifyEvolcoreShellCommand(command);
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -1102,25 +1129,40 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
-            if (ecCommand.issue === 'unsafe-expansion') {
+            // Older app-server approval callbacks may provide only the rendered
+            // `/bin/bash -lc ...` command string.  A composite inside that carrier
+            // is not eligible for a delegation ticket, but owner bypass still
+            // handles it as an ordinary shell request.  Structured `commandArgv`
+            // callbacks remain fail-closed below because their command boundary is
+            // authoritative.
+            const legacyRenderedCarrier = !explicitCommandArgv && wrappedCommand !== undefined;
+            const allowLegacyBypassComposition = legacyRenderedCarrier
+                && context.permissionMode === 'bypass'
+                && ecCommand.issue === 'shell-composition';
+            if (!allowLegacyBypassComposition) {
+                if (ecCommand.issue === 'unsafe-expansion') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                        policyCode: 'ec_shell_unsafe_expansion',
+                    };
+                }
+                if (ecCommand.issue === 'invalid-quote') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                        policyCode: 'ec_shell_invalid_quote',
+                    };
+                }
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                    policyCode: 'ec_shell_composite_command',
                 };
             }
-            if (ecCommand.issue === 'invalid-quote') {
-                return {
-                    behavior: 'deny',
-                    input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
-                };
-            }
-            return {
-                behavior: 'deny',
-                input,
-                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
-            };
         }
         const boundedOutput = parseBoundedOutputShellCommand(command);
         const hostProcessCommand = boundedOutput
@@ -1137,7 +1179,7 @@ export function evaluateToolPreflight(toolName, input, context) {
     }
     const blacklist = checkBlacklist(toolName, input);
     if (blacklist.behavior === 'deny') {
-        return { behavior: 'deny', input, message: blacklist.message };
+        return { behavior: 'deny', input, message: blacklist.message, policyCode: 'tool_blacklist' };
     }
     const checkedInput = blacklist.updatedInput;
     const hClass = checkHClassWrite(toolName, checkedInput, {
@@ -1150,7 +1192,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         root: context.root,
     });
     if (hClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: hClass.message };
+        return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection' };
     }
     const lClass = checkLClassWrite(toolName, checkedInput, {
         sessionId: context.sessionId,
@@ -1163,7 +1205,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         root: context.root,
     });
     if (lClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: lClass.message };
+        return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection' };
     }
     const dangerous = checkDangerousCommand(toolName, checkedInput);
     if (dangerous.isDangerous
@@ -1174,6 +1216,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             behavior: 'deny',
             input: checkedInput,
             message: '🔒 Git 破坏性操作仅允许 owner/admin 调用；当前角色无权执行',
+            policyCode: 'role_git_destructive_forbidden',
         };
     }
     return { behavior: 'continue', input: checkedInput };

package/dist/core/protected-paths.js

@@ -11,7 +11,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
-    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys)(?:\/|$)/,
+    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
     /^\.device_id$/,
     /^\.env$/,
     /^\.seed(?:\.|$)/,
@@ -33,7 +33,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
 const H_CLASS_REFERENCE_PATTERNS = [
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
-    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys))(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid|data[\\/](?:causation-aun\.json(?:_|__)?|sessions|contact-book-audit\.jsonl|feishu-seen-[^/\\\s"']+\.jsonl|[a-z0-9_-]+-greeted-[^/\\\s"']+\.jsonl|message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|daemon[\\/](?:message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|control|migrations)|channel-state|instance[\\/]control\.token|outbox|handoff)|agents[\\/][^/\\\s"']+[\\/](?:sessions|data[\\/](?:channels|handoff|outbox\.jsonl|contact-audit\.jsonl)))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])data[\\/]triggers(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:[^/\\\s"']+\.json_|[^/\\\s"']+\.json\.migrated|defaults_\d+\.json)(?=$|[\s"';&|<>)},])/,
@@ -144,10 +144,14 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('AIDs', '*', 'cert', '**'),
         path.join('AIDs', '*', 'keys'),
         path.join('AIDs', '*', 'keys', '**'),
+        path.join('AIDs', '*', 'private'),
+        path.join('AIDs', '*', 'private', '**'),
         path.join('aids', '*', 'cert'),
         path.join('aids', '*', 'cert', '**'),
         path.join('aids', '*', 'keys'),
         path.join('aids', '*', 'keys', '**'),
+        path.join('aids', '*', 'private'),
+        path.join('aids', '*', 'private', '**'),
         '.device_id',
         '.env',
         '.seed',
@@ -272,6 +276,7 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
                     continue;
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'cert'));
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'keys'));
+                addExistingTarget(targets, path.join(aidsRoot, aid.name, 'private'));
             }
         }
         catch { }

package/dist/core/session/session-manager.js

@@ -11,7 +11,7 @@ import fs from 'fs';
 import os from 'os';
 function newSessionStableMetadata(chatType, ...sources) {
     const keys = chatType === 'group'
-        ? ['channelKey', 'groupId', 'groupName', 'dispatchMode']
+        ? ['channelKey', 'groupId', 'groupName', 'mentionMode']
         : ['channelKey', 'peerId', 'peerName', 'peerType'];
     const metadata = {};
     for (const source of sources) {
@@ -1135,6 +1135,10 @@ export class SessionManager {
         if (!baseagent) {
             throw new Error(`[SessionManager] createNewSession: baseagent is empty for channel=${channel} channelId=${channelId}`);
         }
+        const metadata = newSessionStableMetadata(inheritedChatType, activeMetadata, identityMetadata);
+        if (identityMetadata?.sessionBoundaryOperationId) {
+            metadata.sessionBoundaryOperationId = identityMetadata.sessionBoundaryOperationId;
+        }
         const session = {
             id: generateSessionId(),
             channel,
@@ -1146,7 +1150,7 @@ export class SessionManager {
             baseagent,
             sessionKey: formatSessionKey(channelType, channelId, DEFAULT_THREAD_ID),
             chatType: inheritedChatType,
-            metadata: newSessionStableMetadata(inheritedChatType, activeMetadata, identityMetadata),
+            metadata,
             name: name || '默认会话',
             createdAt: Date.now(),
             updatedAt: Date.now(),
@@ -1163,6 +1167,21 @@ export class SessionManager {
         });
         return session;
     }
+    /**
+     * Create and activate one fresh main session for a durable system operation.
+     * Replaying the same operation returns the already-created session.
+     */
+    async ensureNewMainSessionForOperation(opts) {
+        const active = this.getActiveSessionSync(opts.channel, opts.channelId);
+        if (active?.metadata?.sessionBoundaryOperationId === opts.operationId) {
+            return { session: active, created: false };
+        }
+        const session = await this.createNewSession(opts.channel, opts.channelId, opts.projectPath, undefined, opts.baseagent, {
+            ...(opts.identityMetadata ?? {}),
+            sessionBoundaryOperationId: opts.operationId,
+        });
+        return { session, created: true };
+    }
     async createForkedSession(sourceSession, forkedAgentSessionId, name) {
         const channelType = sourceSession.channelType || sourceSession.channel;
         const threadId = sourceSession.threadId || '';

package/dist/eck/manifest-engine.js

@@ -55,6 +55,10 @@ function loadAndMergeManifest(filename) {
         for (const s of base.sections)
             merged.set(s.id, { ...s });
         for (const s of override.sections) {
+            if (s.id === 'relation-group-profile' && merged.has('peer-profile')) {
+                logger.warn('[ManifestEngine] Ignoring deprecated patch section "relation-group-profile"; use "peer-profile" instead');
+                continue;
+            }
             const existing = merged.get(s.id);
             merged.set(s.id, existing ? { ...existing, ...s } : s);
         }
@@ -320,15 +324,35 @@ function resolvePath(rawPath, vars) {
     const r = resolvePathWithDiag(rawPath, vars);
     return r.status === 'ok' ? r.resolved : null;
 }
+function isWithinDirectory(filePath, directory) {
+    const relative = path.relative(path.resolve(directory), path.resolve(filePath));
+    return relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`));
+}
+/**
+ * 随包发布的 kits 内容只在 reload/重启后刷新；personal/relations 及用户自定义
+ * manifest 路径属于运行时数据，必须用 mtime 检查，否则同一 daemon 内会长期陈旧。
+ */
+function sectionCacheOptions(resolvedPath, vars) {
+    if (isWithinDirectory(resolvedPath, kitsDir())) {
+        return { policy: 'on-reload', group: 'kits' };
+    }
+    const personalDir = typeof vars.PERSONAL_DIR === 'string' ? vars.PERSONAL_DIR : null;
+    const selfAid = typeof vars.selfAid === 'string' ? vars.selfAid : null;
+    if (personalDir && selfAid && isWithinDirectory(resolvedPath, personalDir)) {
+        return { policy: 'mtime', group: `agent-files:${selfAid}` };
+    }
+    return { policy: 'mtime', group: 'eck-runtime' };
+}
 /** 加载 loop 的 child 子模板文件内容（路径解析 + fileCache）。找不到返回 null。 */
 export function loadChildTemplate(childFile, vars) {
     const resolved = resolvePath(childFile, vars);
     if (!resolved)
         return null;
-    return fileCache.getText(resolved, { policy: 'on-reload', group: 'kits' });
+    return fileCache.getText(resolved, sectionCacheOptions(resolved, vars));
 }
 /**
- * 返回 [filePath, rawContent][]；按 sessionId 缓存已读文件内容。
+ * 返回 [filePath, rawContent][]。kits 文件跨 session 缓存到 reload；运行时文件
+ * （personal/relations/用户自定义路径）每次按 mtime 检查。
  * 若传入 overflowOut 且目录段触发单目录限额（maxFiles/maxBytes），
  * 会把溢出信息写入 overflowOut.value（不传则不启用限额收集，行为同旧版但仍应用默认上限）。
  */
@@ -343,7 +367,7 @@ export function loadSectionFiles(section, vars, sessionCache, overflowOut) {
             return [];
         const maxFiles = section.maxFiles ?? DIR_MAX_FILES;
         const maxBytes = section.maxBytes ?? DIR_MAX_BYTES;
-        const { files, overflow } = readDirectoryFiles(resolved, section.pattern, maxFiles, maxBytes);
+        const { files, overflow } = readDirectoryFiles(resolved, section.pattern, maxFiles, maxBytes, vars);
         if (overflow && overflowOut)
             overflowOut.value = overflow;
         return files.map(([name, content]) => [path.join(resolved, name), content]);
@@ -351,31 +375,33 @@ export function loadSectionFiles(section, vars, sessionCache, overflowOut) {
     return [];
 }
 function loadFileSection(filePath, vars, sessionCache) {
-    void sessionCache; // 内容跨 session 共享，改走全局 fileCache（on-reload）
+    void sessionCache; // 内容跨 session 共享，统一走全局 fileCache
     const resolved = resolvePath(filePath, vars);
     if (!resolved)
         return null;
-    // 内容跨 session 共享：用全局 fileCache（on-reload，reload/重启时失效），
-    // 不再按 session 重复缓存同一文件内容。
-    const content = fileCache.getText(resolved, { policy: 'on-reload', group: 'kits' });
+    const content = fileCache.getText(resolved, sectionCacheOptions(resolved, vars));
     return content === null ? null : [resolved, content];
 }
 /**
  * 读取目录下匹配文件，受单目录限额（maxFiles/maxBytes）约束。
  * 返回已加载文件 + 溢出信息（超限时）。按 fileCache 缓存目录列表与文件内容。
  */
-function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes) {
+function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes, vars) {
     const glob = pattern || '*.md';
-    // 目录列表 + 各文件内容均走 fileCache（on-reload）。目录列表以 "<dir>|<glob>"
-    // 为键缓存文件名数组；各文件内容走 fileCache.getText 共享。
-    const names = fileCache.get(`${dirPath} ${glob}`, () => {
+    const cacheOptions = sectionCacheOptions(dirPath, vars);
+    const readNames = () => {
         try {
             return fs.readdirSync(dirPath).filter(f => matchGlob(f, glob)).sort();
         }
         catch {
             return [];
         }
-    }, { policy: 'on-reload', group: 'kits' });
+    };
+    // synthetic cache key 无法用文件 mtime 门控。kits 目录结构只在 reload 后刷新；
+    // 运行时目录直接重扫，确保新增/删除文件在同一 session 内可见。
+    const names = cacheOptions.policy === 'on-reload'
+        ? fileCache.get(`${dirPath} ${glob}`, readNames, cacheOptions)
+        : readNames();
     const out = [];
     let usedBytes = 0;
     let overflow;
@@ -387,7 +413,7 @@ function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes) {
             break;
         }
         const fp = path.join(dirPath, f);
-        const content = fileCache.getText(fp, { policy: 'on-reload', group: 'kits' });
+        const content = fileCache.getText(fp, sectionCacheOptions(fp, vars));
         if (content === null)
             continue;
         // 字节限额（至少加载一个文件，避免单个超大文件导致空目录）