evolcore 0.0.11 → 0.0.13

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.13 (2026-08-20)
+
+### AUN 消息与文件
+
+- 显式区分 AUN 私聊与群聊投递路由，强化入站去重、顺序处理、消息队列持久化和失败恢复。
+- 统一 AUN RPC 与存储客户端，扩展群文件写入与下载能力，收敛文件操作和载荷处理边界。
+- 增加群文件下载票据校验和内容哈希验证，补齐短连接 RPC、存储上传及启动期角色配置迁移能力。
+
+### 权限与关系
+
+- 收敛角色迁移、权限作用域和最小能力模式，强化 Owner、关系范围与工具执行审计边界。
+- 贯通会话投递元数据和跨会话授权校验，避免托管操作越过当前 Agent、会话或关系范围。
+- 强化受管 `$TMPDIR`、群规则读取和群文件上传的路径隔离，拒绝符号链接、越界目录及不符合权限/所有者要求的路径。
+- 完善菜单授权审计的请求与会话关联信息，扩展只读 Shell 查询、配置批量读取和委派有效期校验。
+
+### 会话与运行时
+
+- 完善消息撤回隔离、错误回传、菜单交互、重启命令和 Trigger 反馈的上下文校验。
+- 简化 Agent 运行器与启动流程，修正系统重启路径并清理托管会话凭据。
+- 为 Codex app-server 请求增加 request ID 与载荷指纹重放防护，使重复请求复用结果、冲突请求拒绝；会话重试按至多执行一次处理。
+- 统一 EC Web 守护进程的发现、接管、健康检查和退出清理，修正 Linux 进程启动时间计算，并改进 Codex 初始化/升级探测与 Web 消息路由展示。
+
+## 0.0.12 (2026-08-19)
+
+### AUN 通信
+
+- 规范结构化提及在消息收发、队列和响应链路中的传递，完善 @all、目标校验和非法载荷处理。
+- 增强入站去重、断线重投和错误回传，避免消息重复处理与错误循环。
+
+### 会话与 Agent
+
+- 串行化 Codex 会话的继续、压缩、分叉和回滚操作，完善 app-server 进程管理和安全清理。
+- 优化 proactive 会话、Handoff 和 Bootstrap 的生命周期处理，隔离并发会话上下文。
+
+### 权限与菜单
+
+- 收敛菜单执行上下文和托管命令授权，强化 EC shell 与 Codex 命令解析边界。
+- 完善菜单批量查询、关系上下文、联系人状态和工具拦截审计。
+
+### 运行兼容性
+
+- 统一跨平台子进程启动和 Windows 窗口处理，改进升级监控与内置 AUN SDK 管理。
+- 统一 Claude、Codex 的技能发现和运行时上下文注入。
+
 ## 0.0.11 (2026-08-11)
 
 ### Agent 初始化与引导

package/bin/codex-managed-hook.mjs

@@ -0,0 +1,80 @@
+import fs from 'node:fs';
+import net from 'node:net';
+
+const timeoutMs = 1500;
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
+    },
+  }));
+  // Codex 0.147 app-server runs this managed hook but does not reliably honor
+  // the JSON denial alone for thread/shellCommand. Exit 2 is the documented
+  // blocking transport; retain the JSON shape for compatible hook consumers.
+  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
+  process.exitCode = 2;
+}
+
+function queryDaemon(socketPath, payload) {
+  return new Promise(resolve => {
+    const socket = net.createConnection(socketPath);
+    let buffer = '';
+    let settled = false;
+    let timer;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    socket.once('error', () => finish(null));
+    socket.once('connect', () => socket.write(JSON.stringify(payload) + '\n'));
+    socket.on('data', chunk => {
+      buffer += String(chunk);
+      const index = buffer.indexOf('\n');
+      if (index < 0) return;
+      try { finish(JSON.parse(buffer.slice(0, index))); } catch { finish(null); }
+    });
+  });
+}
+
+async function main() {
+  const socketPath = process.argv[2];
+  let input;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch {
+    deny('Invalid Codex PreToolUse payload.');
+    return;
+  }
+  if (!socketPath
+    || input?.hook_event_name !== 'PreToolUse'
+    || typeof input?.session_id !== 'string'
+    || !input.session_id
+    || typeof input?.tool_name !== 'string'
+    || !input.tool_name) {
+    deny('Incomplete Codex PreToolUse payload.');
+    return;
+  }
+
+  const result = await queryDaemon(socketPath, {
+    type: 'codex-pre-tool-use',
+    threadId: input.session_id,
+    toolName: typeof input.tool_name === 'string' ? input.tool_name : '',
+    toolInput: input.tool_input ?? null,
+  });
+  if (!result) {
+    deny('EvolCore policy service is unavailable.');
+    return;
+  }
+  if (result.ok === true && result.applicable === true && result.decision === 'allow') return;
+  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.');
+}
+
+void main();

package/bin/ec-safe-output.js

@@ -82,12 +82,27 @@ function resolveExecutionPaths(payload) {
   return { workspace, cwd };
 }
 
+function resolveManagedTempRoot() {
+  const raw = typeof process.env.TMPDIR === 'string' ? process.env.TMPDIR.trim() : '';
+  if (!raw || !path.isAbsolute(raw)) fail('managed TMPDIR is unavailable');
+  try {
+    const root = fs.realpathSync(raw);
+    if (!fs.statSync(root).isDirectory()) fail('managed TMPDIR is not a directory');
+    return root;
+  } catch {
+    fail('managed TMPDIR is unavailable');
+  }
+}
+
 function openOutputFile(payload, paths) {
   if (payload.outputPath === undefined) return undefined;
-  if (typeof payload.outputPath !== 'string' || !payload.outputPath || path.isAbsolute(payload.outputPath)) {
-    fail('output path must be relative');
-  }
-  const target = path.resolve(paths.cwd, payload.outputPath);
+  if (typeof payload.outputPath !== 'string' || !payload.outputPath) fail('output path is invalid');
+
+  const isManagedTempOutput = path.isAbsolute(payload.outputPath);
+  const outputRoot = isManagedTempOutput ? resolveManagedTempRoot() : paths.workspace;
+  const target = isManagedTempOutput
+    ? path.resolve(payload.outputPath)
+    : path.resolve(paths.cwd, payload.outputPath);
   const parent = path.dirname(target);
   let realParent;
   try {
@@ -97,9 +112,13 @@ function openOutputFile(payload, paths) {
     fail('output parent does not exist');
   }
   const canonicalTarget = path.join(realParent, path.basename(target));
-  if (!sameOrDescendant(canonicalTarget, paths.workspace)) fail('output path escapes workspace');
-  const relative = path.relative(paths.workspace, canonicalTarget);
-  if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  if (!sameOrDescendant(canonicalTarget, outputRoot)) {
+    fail(isManagedTempOutput ? 'output path escapes managed TMPDIR' : 'output path escapes workspace');
+  }
+  if (!isManagedTempOutput) {
+    const relative = path.relative(paths.workspace, canonicalTarget);
+    if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  }
 
   const noFollow = fs.constants.O_NOFOLLOW ?? 0;
   try {

package/dist/agents/claude-runner.js

@@ -14,16 +14,15 @@ import { logger } from '../utils/logger.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { summarizeToolInput } from '../utils/tool-summary.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { encodePath } from '../utils/cross-platform.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -1759,6 +1758,30 @@ export class AgentRunner {
             else {
                 logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
             }
+            if (isSandboxInitializationFailure(err, buf ?? [])) {
+                const detail = createSandboxInitializationError(err, buf ?? []);
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    decisionSource: 'infrastructure',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                yield {
+                    type: 'complete',
+                    isError: true,
+                    subtype: 'infrastructure',
+                    terminalReason: SANDBOX_INITIALIZATION_FAILED,
+                    errors: [detail.message],
+                    queryFinal: true,
+                };
+                return;
+            }
             throw err;
         }
         finally {
@@ -1852,6 +1875,30 @@ export class AgentRunner {
                 ...(updatedInput ? { updatedInput } : {}),
             },
         });
+        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode) => {
+            const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
+            if (!code)
+                return;
+            try {
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
+                    policyCode: code,
+                    decisionSource: 'policy',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    permissionMode: callPermissionMode,
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] failed to record preflight denial: session=${sessionId} tool=${toolName} code=${code} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         // A rewritten helper command is trusted only after this hook produced its
         // random one-shot payload from a validated output wrapper.
         const trustedSafeOutputCommands = new Set();
@@ -1896,6 +1943,7 @@ export class AgentRunner {
             // proactive 模式行为策略（首次工具调用必须是 ec msg send）
             const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
             if (policyResult?.block) {
+                await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, policyResult.policyCode ?? 'session_policy_hook');
                 return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);
             }
             const permCtx = this.permissionContexts.get(sessionId);
@@ -1910,14 +1958,17 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
             toolInput = preflight.input;
             if (toolInput !== originalInput)
                 updatedInput = toolInput;
-            if (preflight.behavior === 'deny')
+            if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, toolInput, preflight, input.tool_use_id ?? input.toolUseID);
                 return hookDecision('deny', preflight.message, updatedInput);
+            }
             if (preflight.behavior === 'allow') {
                 const commandAfterPreflight = typeof toolInput.command === 'string' ? toolInput.command : undefined;
                 if (commandAfterPreflight && commandAfterPreflight !== commandBeforePreflight) {
@@ -1939,9 +1990,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -1951,6 +2004,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_unknown_tool');
                     return hookDecision('deny', `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`, updatedInput);
                 }
                 // request/bypass only receive external tools admitted by the session's
@@ -1960,6 +2014,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, toolInput);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_dangerous_command');
                     return hookDecision('deny', `危险操作已由 auto 模式拒绝：${danger.reason}`, updatedInput);
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
@@ -2025,11 +2080,13 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
             input = preflight.input;
             if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, input, preflight, options.toolUseID);
                 return { behavior: 'deny', message: preflight.message, decisionClassification: 'user_reject' };
             }
             if (preflight.behavior === 'allow') {
@@ -2041,6 +2098,7 @@ export class AgentRunner {
             }
             const permissionExpansion = inspectClaudePermissionExpansion(input, options, projectPath);
             if (permissionExpansion.protectedReason) {
+                await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'protected_permission_expansion');
                 return {
                     behavior: 'deny',
                     message: permissionExpansion.protectedReason,
@@ -2049,6 +2107,7 @@ export class AgentRunner {
             }
             if (permissionExpansion.requiresApproval) {
                 if (callPermissionMode === 'readonly' || callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, callPermissionMode === 'readonly' ? 'readonly_permission_expansion' : 'auto_permission_expansion');
                     return {
                         behavior: 'deny',
                         message: `${callPermissionMode} 模式拒绝 Claude SDK 文件系统或未知权限扩权请求`,
@@ -2089,9 +2148,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
@@ -2101,6 +2162,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_unknown_tool');
                     return {
                         behavior: 'deny',
                         message: `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`,
@@ -2112,6 +2174,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, input);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_dangerous_command');
                     return { behavior: 'deny', message: `auto 模式拒绝危险操作：${danger.reason}`, decisionClassification: 'user_reject' };
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
@@ -2340,12 +2403,28 @@ export class AgentRunner {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
             logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
             msgStream.push(prompt, images, inputId);
-            sdkStream = createQuery(msgStream);
+            try {
+                sdkStream = createQuery(msgStream);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         else {
             logger.debug('[AgentRunner] Creating query with text only, agentSessionId:', initialClaudeSessionId);
             msgStream.push(prompt, undefined, inputId);
-            sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            try {
+                sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         this.activeMessageStreams.set(sessionId, msgStream);
         this.activeQueries.set(sessionId, sdkStream);