evolcore 0.0.11 → 0.0.13

package/dist/cli/queue-command.js

@@ -1,5 +1,6 @@
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 export async function cmdQueue(args) {
     if (args.length === 0 || isHelpFlag(args[0]) || wantsHelp(args)) {
@@ -9,10 +10,18 @@ export async function cmdQueue(args) {
 
 查询:
   --agent <aid>           必填，目标 agent（如 mybot.agentid.pub）
+  --after <time>          只显示 adapter 接收时间晚于该值的消息（epoch ms 或 ISO）
+  --before <time>         只显示 adapter 接收时间早于该值的消息（epoch ms 或 ISO）
   --showid                显示 messageId
   --full                  显示完整消息内容（不截断）
   --format json           以 JSON 格式输出
 
+JSON 时间字段:
+  receivedAt              adapter 收到消息时间（epoch ms）
+  enqueuedAt              实际进入队列时间（epoch ms）
+  queueWaitMs             排队等待时长（ms）
+  processingStartedAt     开始处理时间（epoch ms，active）
+
 操作:
   --clear                 清空该 agent 的所有待处理消息
   --cancel <messageId>    取消指定消息
@@ -20,6 +29,7 @@ export async function cmdQueue(args) {
 
 示例:
   ec queue --agent mybot.agentid.pub
+  ec queue --agent mybot.agentid.pub --after 2026-08-19T12:00:00+08:00
   ec queue --agent mybot.agentid.pub --showid
   ec queue --agent mybot.agentid.pub --clear
   ec queue --agent mybot.agentid.pub --cancel msg_d4e5f6
@@ -45,6 +55,12 @@ export async function cmdQueue(args) {
         process.exit(1);
     }
     const formatJson = formatValue === 'json';
+    const after = parseQueueTime(getArgValue(args, '--after'), '--after');
+    const before = parseQueueTime(getArgValue(args, '--before'), '--before');
+    if (after !== undefined && before !== undefined && after >= before) {
+        console.error('❌ --after 必须早于 --before');
+        process.exit(1);
+    }
     const clear = args.includes('--clear');
     const cancelIdx = args.indexOf('--cancel');
     const cancelCandidate = cancelIdx >= 0 && cancelIdx + 1 < args.length ? args[cancelIdx + 1] : undefined;
@@ -72,12 +88,25 @@ export async function cmdQueue(args) {
             : interrupt ? 'interrupt'
                 : undefined;
     const socketPath = resolvePaths().socket;
-    const result = await ipcQuery(socketPath, {
+    const managed = process.env.EVOLCORE_SESSION_ID;
+    const result = await ipcQuery(socketPath, managed ? {
+        type: 'queue.op',
+        agent,
+        action,
+        messageId: cancelMsgId,
+        sessionKey,
+        after,
+        before,
+        sessionId: managed,
+        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+    } : {
         type: 'queue-snapshot',
         agent,
         action,
         messageId: cancelMsgId,
         sessionKey,
+        after,
+        before,
     });
     if (!result) {
         console.error('错误: 无法连接 evolcore 服务');
@@ -108,6 +137,16 @@ export async function cmdQueue(args) {
     }
     console.log(renderQueueItemsCli(items, showId, full, agent));
 }
+function parseQueueTime(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        console.error(`❌ ${flag} 必须是 epoch 毫秒或 ISO 时间: ${value}`);
+        process.exit(1);
+    }
+    return parsed;
+}
 function renderQueueItemsCli(items, showId, full, aid) {
     const lines = [`${aid} — 队列 (${items.length} 条)`, ''];
     if (items.length === 0) {
@@ -141,6 +180,12 @@ function renderQueueItemsCli(items, showId, full, aid) {
             elapsed = sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
         }
         parts.push(` ${elapsed.padEnd(elapsedColWidth)}  `);
+        const wait = item.queueWaitMs == null ? '—' : formatDuration(item.queueWaitMs);
+        parts.push(` wait:${wait.padEnd(6)}  `);
+        if (item.receivedAt != null)
+            parts.push(` recv:${formatQueueTime(item.receivedAt)} `);
+        if (item.enqueuedAt != null)
+            parts.push(` enq:${formatQueueTime(item.enqueuedAt)} `);
         // 内容列
         const content = full ? item.preview.replace(/\.\.\.$/, '') : item.preview;
         parts.push(`"${content}"`);
@@ -148,3 +193,10 @@ function renderQueueItemsCli(items, showId, full, aid) {
     }
     return lines.join('\n');
 }
+function formatDuration(ms) {
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
+}
+function formatQueueTime(timestamp) {
+    return new Date(timestamp).toISOString();
+}

package/dist/cli/response.js

@@ -15,6 +15,9 @@ import { readField, writeField, determineFieldScope, normalizePeer, ModelScopeEr
 import { readFieldWithSource, resolveAgentConfig, ConfigTarget } from '../config/config-manager.js';
 import { ResponseModeRegistry } from '../response-system/registry.js';
 import { registerBuiltinModes } from '../response-system/modes/index.js';
+import { ipcQuery } from '../ipc.js';
+import { resolvePaths } from '../paths.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 const RESPONSE_MODE_FIELD = 'responseMode';
 const RESPONSE_MODE_PARAMS_FIELD = 'responseModeParams';
 /**
@@ -54,6 +57,71 @@ function fail(formatJson, code, message) {
     }
     process.exit(1);
 }
+async function managedConfig(fieldArgs, formatJson) {
+    const sessionId = process.env.EVOLCORE_SESSION_ID;
+    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    if (!sessionId)
+        fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID is not set');
+    if (!delegationToken)
+        fail(formatJson, 'DELEGATION_REQUIRED', `${AGENT_DELEGATION_TOKEN_ENV} is not set`);
+    const response = await ipcQuery(resolvePaths().socket, {
+        type: 'config.op',
+        argv: ['config', ...fieldArgs],
+        sessionId,
+        delegationToken,
+    }, 10_000);
+    if (!response)
+        fail(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    if (!response.ok || !response.result?.ok) {
+        fail(formatJson, response.code || 'CONFIG_AUTH_FAILED', response.error || 'response config operation failed');
+    }
+    return response.result;
+}
+async function runManagedResponse(args, formatJson) {
+    if (getArgValue(args, '--self') || getArgValue(args, '--peer')) {
+        fail(formatJson, 'NOT_ALLOWED', 'Managed response commands always use the authenticated current relation');
+    }
+    const sub = args[0];
+    if (sub === 'set') {
+        const id = args[1];
+        if (!id)
+            fail(formatJson, 'MISSING_ID', 'set requires a mode id');
+        if (!buildRegistry().has(id))
+            fail(formatJson, 'UNKNOWN_MODE', `Unknown mode: ${id}`);
+        await managedConfig(['set', RESPONSE_MODE_FIELD, id], formatJson);
+        return emit(formatJson, { ok: true, scope: 'relation', mode: id }, () => `✓ 已设置响应模式为 ${id}（作用域: relation）`);
+    }
+    if (sub === 'reset') {
+        await managedConfig(['unset', RESPONSE_MODE_FIELD], formatJson);
+        return emit(formatJson, { ok: true, scope: 'relation' }, () => '✓ 已清除当前关系的响应模式设置');
+    }
+    if (sub === 'current') {
+        const modeResult = await managedConfig(['get', RESPONSE_MODE_FIELD], formatJson);
+        const paramsResult = await managedConfig(['get', RESPONSE_MODE_PARAMS_FIELD], formatJson);
+        const configuredMode = typeof modeResult.value === 'string' ? modeResult.value : undefined;
+        const mode = configuredMode ?? buildRegistry().getPreferredId();
+        return emit(formatJson, {
+            ok: true,
+            scope: 'relation',
+            responseMode: mode ?? null,
+            source: configuredMode ? 'config' : 'preferred',
+            sourceTarget: modeResult.source?.target ?? null,
+            responseModeParams: paramsResult.value ?? null,
+        }, () => `当前响应模式: ${mode ?? '(无)'}`);
+    }
+    if (sub === 'config') {
+        if (args[1] === 'set') {
+            fail(formatJson, 'NOT_ALLOWED', 'responseModeParams cannot be modified as an opaque object from a managed task');
+        }
+        const result = await managedConfig(['get', RESPONSE_MODE_PARAMS_FIELD], formatJson);
+        const params = result.value ?? {};
+        const modeId = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+        if (modeId)
+            return emit(formatJson, { ok: true, mode: modeId, config: params[modeId] ?? {} }, () => `${modeId} 配置: ${JSON.stringify(params[modeId] ?? {}, null, 2)}`);
+        return emit(formatJson, { ok: true, responseModeParams: params }, () => `所有模式配置: ${JSON.stringify(params, null, 2)}`);
+    }
+    fail(formatJson, 'NOT_ALLOWED', `response ${sub} is not available in a managed task`);
+}
 /** 解析 --self / --peer 为作用域选择器 */
 function parseSelector(args, formatJson) {
     const self = getArgValue(args, '--self');
@@ -331,6 +399,9 @@ export async function cmdResponse(args) {
         console.log(HELP);
         return;
     }
+    if (process.env.EVOLCORE_SESSION_ID && sub !== 'list' && sub !== 'info') {
+        return runManagedResponse(args, formatJson);
+    }
     switch (sub) {
         case 'list': return cmdList(args, formatJson);
         case 'current': return cmdCurrent(args, formatJson);

package/dist/cli/restart-monitor.js

@@ -6,8 +6,7 @@ import { resolvePaths, getPackageRoot, daemonControlDir } from '../paths.js';
 import { loadDaemonConfig } from '../config-store.js';
 import * as platform from '../utils/cross-platform.js';
 import { EventBus } from '../core/event-bus.js';
-import { tryUpgrade, tryUpgradeAunSdk, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
-import { resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG } from '../aun/aid/client.js';
+import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
 import { isValidAid } from '../aun/aid/index.js';
 import { msgSend } from '../aun/msg/index.js';
 import { scanInstances, cleanupInstances, writeRestartMonitor, removeRestartMonitor, isRestartMonitorWinner, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
@@ -15,7 +14,6 @@ import { WEB_PACKAGE_NAME } from '../product.js';
 import { shouldSuppressRealRestart } from '../utils/restart-safety.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
-import { serviceProxyNeedsEcweb, startEcwebIfEnabled } from './daemon-commands.js';
 const execFileAsync = promisify(execFile);
 // 清理 Claude Code 环境变量，防止 SDK 认为是嵌套会话
 function cleanEnv() {
@@ -181,21 +179,7 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ evolcore 升级失败，使用当前版本继续\n${upgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // AUN SDK 版本检查与升级
-    const aunUpgrade = await tryUpgradeAunSdk(resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG);
-    switch (aunUpgrade.status) {
-        case 'upgraded':
-            log(`✅ AUN SDK upgraded: ${aunUpgrade.from} → ${aunUpgrade.to}`);
-            await notifyDaemonOwners(p, `📦 AUN SDK 已升级 ${aunUpgrade.from} → ${aunUpgrade.to}`, log);
-            break;
-        case 'no-update':
-            break;
-        case 'failed':
-            log(`⚠ AUN SDK upgrade failed (${aunUpgrade.from} → ${aunUpgrade.to}): ${aunUpgrade.error}`);
-            await notifyDaemonOwners(p, `⚠️ AUN SDK 升级失败，使用当前版本继续\n${aunUpgrade.error ?? ''}`.trim(), log);
-            break;
-    }
-    // EC Web 版本检查与升级（已安装才检查）
+    // EC Web 是独立全局包，已安装时单独检查升级。
     const ecwebUpgrade = await tryUpgradeGlobalPkg(() => resolveGlobalPkg(WEB_PACKAGE_NAME), WEB_PACKAGE_NAME);
     switch (ecwebUpgrade.status) {
         case 'upgraded':
@@ -209,22 +193,12 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ ${WEB_PACKAGE_NAME} 升级失败，使用当前版本继续\n${ecwebUpgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // source=ecweb 的 Service Proxy 只在 daemon 启动后的短窗口内发现实例。
-    // restart-monitor 直接 spawn daemon，必须在此先启动独立的 ec-web，不能绕过
-    // cmdStart 的 ECWeb 生命周期逻辑。
-    const ecwebStartedBeforeDaemon = serviceProxyNeedsEcweb(loadDaemonConfig())
-        ? await startEcwebIfEnabled(p)
-        : false;
-    if (ecwebStartedBeforeDaemon)
-        log('ECWeb started before daemon');
+    // ECWeb is owned by the daemon. Starting it here used to race with the
+    // daemon's own launcher and ECWeb's stale-instance cleanup, which could
+    // leave ServiceProxy pointed at a dead PID.
     // 启动并检测 ready signal
     let started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
     if (started) {
-        // 没有 Service Proxy 时可以等 daemon ready 后再启动；有代理时已在上方启动，
-        // 避免重新拉起造成实例记录和反向隧道短暂失配。
-        if (!ecwebStartedBeforeDaemon && await startEcwebIfEnabled(p)) {
-            log('ECWeb started after daemon');
-        }
         log('✓ Service restarted successfully');
         archiveSelfHealLog(p, log);
         // 发起会话内的“重启成功”通知由新进程自行发送，此处只负责失败/自愈告警。
@@ -392,7 +366,7 @@ async function spawnAndWaitReady(p, log, timeout) {
     const out = fs.openSync(stdoutLog, 'a');
     const err = fs.openSync(stdoutLog, 'a');
     const appMain = path.join(getPackageRoot(), 'dist', 'index.js');
-    const child = spawn('node', ['--no-warnings=ExperimentalWarning', appMain], {
+    const child = spawn(process.execPath, ['--no-warnings=ExperimentalWarning', appMain], {
         detached: true,
         stdio: ['ignore', out, err],
         windowsHide: true,
@@ -489,6 +463,7 @@ async function invokeClaude(claudePath, p, attempt, maxAttempts, timeout, log) {
             timeout,
             // Windows npm CLIs are .cmd shims; execFile needs a shell to run them.
             shell: platform.isWindows,
+            windowsHide: platform.isWindows,
             env: { ...process.env, CLAUDE_CODE_ENTRYPOINT: 'cli' },
             maxBuffer: 10 * 1024 * 1024,
         });

package/dist/cli/trigger-command.js

@@ -31,6 +31,10 @@ export async function cmdTrigger(args) {
         }
         return;
     }
+    if (process.env.EVOLCORE_SESSION_ID
+        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path'))) {
+        throw new Error('Managed tasks cannot read trigger definitions, prompts, or scripts from local files; use inline prompt content');
+    }
     try {
         switch (sub) {
             case 'list':
@@ -109,6 +113,7 @@ Create 参数模式支持:
   --permission <readonly|auto|request|bypass>（省略则继承当前身份配置）
   --tz <时区> (仅 cron)
   --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
+  --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)
   --target-session <main|thread> [--target-thread-id <threadId>]
   --trigger-thread <by-run|by-trigger>  (兼容旧值 per-run)
   --name <名称>
@@ -259,6 +264,11 @@ async function createTrigger(args, json) {
     if (!parsed.targetChannel || !parsed.targetChannelId) {
         throw new Error('CLI flag 模式需要显式指定 --target-channel <channelKey> --target-channel-id <id>');
     }
+    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel.startsWith('aun#');
+    if (targetIsAun && !parsed.targetChatType) {
+        throw new Error('AUN 目标必须显式指定 --target-chat-type private 或 group');
+    }
+    const targetChatType = parsed.targetChatType;
     const now = Date.now();
     if (parsed.targetSession === 'thread' && !parsed.targetThreadId) {
         throw new Error('--target-session thread 需要 --target-thread-id');
@@ -296,6 +306,7 @@ async function createTrigger(args, json) {
                 channelKey: parsed.targetChannel,
                 channelId: parsed.targetChannelId,
                 session: parsed.targetSession,
+                ...(targetChatType ? { chatType: targetChatType } : {}),
                 ...(parsed.targetSession === 'thread' ? { threadId: parsed.targetThreadId } : {}),
             },
         },

package/dist/config/access-policy.js

@@ -1,6 +1,5 @@
 import crypto from 'crypto';
-import { ConfigError, ConfigTarget, mutateConfig, read, validateConfig, } from './config-manager.js';
-import { validAgentOwnerIds, validateAccessPolicyDomain, } from './access-policy-domain.js';
+import { ConfigError, ConfigTarget, mutateConfig, read, validateConfig, validAgentOwnerIds, validateAccessPolicyDomain, } from './config-manager.js';
 export class AccessPolicyError extends Error {
     code;
     data;

package/dist/config/builtin-roles.js

@@ -35,11 +35,20 @@ export function getManagementCommandPermissions(role) {
         'role.revoke': { allow: true, scopes: ['agent'] },
         'role.policy.read': { allow: true, scopes: ['agent'] },
         'role.relation.read': { allow: true, scopes: ['agent'] },
+        'agent.baseagent.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'observable.current': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
+        'observable.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'config.get': { allow: true, scopes: ['agent', 'relation'] },
         'config.set': { allow: true, scopes: ['agent', 'relation'] },
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },
         'role.policy.write': { allow: true, dangerous: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
+        'ec.aid.show': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.aid.agentmd.put': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.fs.mkdir': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.upload': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.copy': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.move': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.remove': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         '*': { allow: true },
         // Reload is valid from an Agent's own channel and the daemon control plane.
         // The control-channel gate still requires a daemon owner for cross-Agent reloads.

package/dist/config/config-manager.js

@@ -28,7 +28,27 @@ import { clearRoleStoreCache, isRoleName } from './role-store.js';
 import { writeRoleDefinition, writeRoleRegistry } from './role-service.js';
 import { mutateContactBookTransactionSync } from './contact-book-store.js';
 import { DAEMON_SCHEMA_NAME } from '../product.js';
-import { validateAccessPolicyDomain } from './access-policy-domain.js';
+export function shouldFailFastForMissingOwners(env = process.env) {
+    const value = (env.EVOLCORE_REQUIRE_OWNERS || '').trim().toLowerCase();
+    return value === '1' || value === 'true' || value === 'yes';
+}
+export function validAgentOwnerIds(agent) {
+    return [...new Set((agent?.owners ?? [])
+            .map(value => String(value || '').trim())
+            .filter(isValidAid))];
+}
+export function validateAccessPolicyDomain(selfAid, agent) {
+    const access = agent.access;
+    if (!access)
+        return undefined;
+    if (access.policyMode !== 'open' && validAgentOwnerIds(agent).length === 0) {
+        return {
+            code: 'restricted_mode_without_owner',
+            message: `Agent ${selfAid} cannot use ${access.policyMode} without an Owner`,
+        };
+    }
+    return undefined;
+}
 export var ConfigTarget;
 (function (ConfigTarget) {
     ConfigTarget["Process"] = "process";

package/dist/config/contact-book-store.js

@@ -184,17 +184,25 @@ function mutateContactBookPreparedSyncInternal(selfAid, prepare) {
                 value: prepared.value,
             };
         }
-        prepared.beforeCommit?.({
+        const preparedChanges = prepared.beforeCommit?.({
             contact: next,
             previousContactRevision: previousRevision,
             contactRevision: nextRevision,
         });
         const before = readTextOrNull(file);
         const after = `${JSON.stringify(next, null, 2)}\n`;
-        const changes = [{ file, before, after }];
+        const additionalChanges = preparedChanges === undefined
+            ? []
+            : Array.isArray(preparedChanges) ? preparedChanges : [preparedChanges];
+        const changes = [
+            { file, before, after },
+            ...additionalChanges,
+        ];
+        validateTransactionChanges(selfAid, changes);
         writeJournal(selfAid, { schemaVersion: 1, state: 'prepared', selfAid, changes });
         try {
-            applyTransactionChange(changes[0]);
+            for (const change of changes)
+                applyTransactionChange(change);
             writeJournal(selfAid, { schemaVersion: 1, state: 'committed', selfAid, changes });
             removeJournal(selfAid);
         }