evolcore 0.0.11 → 0.0.13

package/dist/core/protected-paths.js

@@ -11,7 +11,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
-    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys)(?:\/|$)/,
+    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
     /^\.device_id$/,
     /^\.env$/,
     /^\.seed(?:\.|$)/,
@@ -33,11 +33,25 @@ const H_CLASS_RELATIVE_PATTERNS = [
 const H_CLASS_REFERENCE_PATTERNS = [
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
-    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys))(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid|data[\\/](?:causation-aun\.json(?:_|__)?|sessions|contact-book-audit\.jsonl|feishu-seen-[^/\\\s"']+\.jsonl|[a-z0-9_-]+-greeted-[^/\\\s"']+\.jsonl|message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|daemon[\\/](?:message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|control|migrations)|channel-state|instance[\\/]control\.token|outbox|handoff)|agents[\\/][^/\\\s"']+[\\/](?:sessions|data[\\/](?:channels|handoff|outbox\.jsonl|contact-audit\.jsonl)))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])data[\\/]triggers(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:[^/\\\s"']+\.json_|[^/\\\s"']+\.json\.migrated|defaults_\d+\.json)(?=$|[\s"';&|<>)},])/,
 ];
+// H-class directory roots are kept separately from the full path matcher so
+// an exact metadata query can distinguish a protected directory from a
+// protected file. Descendants inherit the directory classification unless an
+// existing regular file gives us a more precise answer.
+const H_CLASS_DIRECTORY_RELATIVE_PATTERNS = [
+    /^backups\/config(?:\/|$)/,
+    /^\.snapshots(?:\/|$)/,
+    /^CA(?:\/|$)/,
+    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
+    /^data\/(?:triggers|sessions|outbox|handoff|channel-state)(?:\/|$)/,
+    /^data\/daemon\/(?:control|migrations)(?:\/|$)/,
+    /^agents\/[^/]+\/sessions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/(?:channels|handoff)(?:\/|$)/,
+];
 const L_CLASS_RELATIVE_PATTERNS = [
     /^agents\/[^/]+\/triggers(?:\/|$)/,
     /^agents\/[^/]+\/roles(?:\/|$)/,
@@ -68,6 +82,22 @@ function resolveThroughExistingAncestor(value) {
         return absolute;
     }
 }
+/**
+ * H-class file names are normally leaves, but treating their descendants as
+ * protected as well is important when a malformed or externally-created
+ * directory uses a reserved file name (for example `config.json/child`).
+ * Such a path cannot expose content from the expected file, and fail-closed
+ * classification avoids turning that unusual filesystem state into a bypass.
+ */
+function matchesHClassRelative(relative) {
+    const segments = relative.split('/').filter(Boolean);
+    for (let end = segments.length; end > 0; end--) {
+        if (H_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(segments.slice(0, end).join('/')))) {
+            return true;
+        }
+    }
+    return false;
+}
 export function isSameOrDescendant(candidate, parent) {
     const normalizedCandidate = normalizeForComparison(candidate);
     const normalizedParent = normalizeForComparison(parent);
@@ -85,14 +115,89 @@ export function isHClassPath(value, options = {}) {
         : path.resolve(options.cwd ?? process.cwd(), value);
     if (isSameOrDescendant(lexicalCandidate, root)) {
         const lexicalRelative = path.relative(root, lexicalCandidate).split(path.sep).join('/');
-        if (H_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(lexicalRelative)))
+        if (matchesHClassRelative(lexicalRelative))
             return true;
     }
     const candidate = resolveProtectedCandidate(value, options.cwd);
     if (!isSameOrDescendant(candidate, root))
         return false;
     const relative = path.relative(root, candidate).split(path.sep).join('/');
-    return H_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
+    return matchesHClassRelative(relative);
+}
+function hasPathSyntax(value) {
+    return /[\0\r\n$`*?\[\]{}<>|;&]/.test(value);
+}
+function lexicalCandidate(value, cwd = process.cwd()) {
+    return path.isAbsolute(value) ? path.resolve(value) : path.resolve(cwd, value);
+}
+function resolveWithoutFinalSymlink(value, cwd = process.cwd()) {
+    const absolute = lexicalCandidate(value, cwd);
+    const basename = path.basename(absolute);
+    const parent = resolveThroughExistingAncestor(path.dirname(absolute));
+    return basename ? path.join(parent, basename) : parent;
+}
+/** Resolve path ancestors while preserving the final symlink as a literal node. */
+export function resolveProtectedCandidateWithoutFinalSymlink(value, cwd = process.cwd()) {
+    return resolveWithoutFinalSymlink(value, cwd);
+}
+function relativeWithinRoot(value, root) {
+    if (!isSameOrDescendant(value, root))
+        return undefined;
+    return path.relative(root, value).split(path.sep).join('/');
+}
+/**
+ * Classify one literal filesystem path without interpreting shell syntax.
+ * `followFinalSymlink=false` is used by stat/lstat policy so metadata queries
+ * describe the link itself rather than exposing the protected target.
+ */
+export function classifyProtectedPath(value, options = {}) {
+    if (typeof value !== 'string' || !value.trim() || hasPathSyntax(value))
+        return 'unknown';
+    const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
+    const lexical = resolveWithoutFinalSymlink(value, options.cwd);
+    const followFinalSymlink = options.followFinalSymlink !== false;
+    const candidate = followFinalSymlink ? resolveProtectedCandidate(value, options.cwd) : lexical;
+    const relative = relativeWithinRoot(candidate, root);
+    if (relative === undefined)
+        return 'ordinary';
+    const hMatch = matchesHClassRelative(relative);
+    if (hMatch) {
+        let directory = H_CLASS_DIRECTORY_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
+        try {
+            const statTarget = followFinalSymlink ? candidate : lexical;
+            directory = fs.lstatSync(statTarget).isDirectory();
+        }
+        catch {
+            // Missing paths below a protected directory inherit that directory's
+            // class; missing exact H-class filenames remain H-class files.
+        }
+        return directory ? 'h-directory' : 'h-file';
+    }
+    const lMatch = L_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
+    if (lMatch)
+        return 'l-path';
+    return 'ordinary';
+}
+/** Apply the H/L path-class × access-action matrix to one literal path. */
+export function checkProtectedPathAccess(value, accessKind, options = {}) {
+    const pathClass = classifyProtectedPath(value, options);
+    if (pathClass === 'unknown')
+        return { pathClass, accessKind, allowed: false };
+    if (pathClass === 'h-file' || pathClass === 'h-directory') {
+        return { pathClass, accessKind, allowed: accessKind === 'metadata' };
+    }
+    if (pathClass === 'l-path') {
+        return {
+            pathClass,
+            accessKind,
+            allowed: accessKind !== 'write' && accessKind !== 'grant',
+        };
+    }
+    return {
+        pathClass,
+        accessKind,
+        allowed: accessKind !== 'write' && accessKind !== 'grant',
+    };
 }
 export function containsHClassReference(value) {
     const normalized = value.replace(/\\/g, '/');
@@ -144,10 +249,14 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('AIDs', '*', 'cert', '**'),
         path.join('AIDs', '*', 'keys'),
         path.join('AIDs', '*', 'keys', '**'),
+        path.join('AIDs', '*', 'private'),
+        path.join('AIDs', '*', 'private', '**'),
         path.join('aids', '*', 'cert'),
         path.join('aids', '*', 'cert', '**'),
         path.join('aids', '*', 'keys'),
         path.join('aids', '*', 'keys', '**'),
+        path.join('aids', '*', 'private'),
+        path.join('aids', '*', 'private', '**'),
         '.device_id',
         '.env',
         '.seed',
@@ -272,6 +381,7 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
                     continue;
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'cert'));
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'keys'));
+                addExistingTarget(targets, path.join(aidsRoot, aid.name, 'private'));
             }
         }
         catch { }

package/dist/core/session/session-manager.js

@@ -2,8 +2,7 @@ import { ensureDir } from '../../utils/atomic-write.js';
 import { logger } from '../../utils/logger.js';
 import { encodePath } from '../../utils/cross-platform.js';
 import { chatDirPath, generateSessionId, formatTimestamp, atomicWriteJson, atomicWriteText, appendJsonl, readJsonFile, readLastJsonlLine, readAllJsonlLines, scanChatDirs, scanMetaFiles, ensureChatDir, readThreadIndex, writeThreadIndex, } from './session-fs-store.js';
-import { sessionToFile, fileToSession } from './session-mapper.js';
-import { formatSessionKey, DEFAULT_THREAD_ID } from './session-key.js';
+import { sessionToFile, fileToSession, formatSessionKey, DEFAULT_THREAD_ID } from './session-mapper.js';
 import { tryParseChannelKey } from '../channel-loader.js';
 import { isSystemControlChannel } from '../system-channels.js';
 import path from 'path';
@@ -11,7 +10,7 @@ import fs from 'fs';
 import os from 'os';
 function newSessionStableMetadata(chatType, ...sources) {
     const keys = chatType === 'group'
-        ? ['channelKey', 'groupId', 'groupName', 'dispatchMode']
+        ? ['channelKey', 'groupId', 'groupName', 'mentionMode']
         : ['channelKey', 'peerId', 'peerName', 'peerType'];
     const metadata = {};
     for (const source of sources) {
@@ -597,6 +596,14 @@ export class SessionManager {
                     mutated = true;
                 }
             }
+            if (chatType === 'group' && metadata?.groupId) {
+                if (!session.metadata)
+                    session.metadata = {};
+                if (session.metadata.groupId !== metadata.groupId) {
+                    session.metadata.groupId = metadata.groupId;
+                    mutated = true;
+                }
+            }
             if (metadata?.peerType && session.metadata?.peerType !== metadata.peerType) {
                 if (!session.metadata)
                     session.metadata = {};
@@ -636,6 +643,9 @@ export class SessionManager {
             if (metadata?.peerType) {
                 session.metadata.peerType = metadata.peerType;
             }
+            if (chatType === 'group' && metadata?.groupId) {
+                session.metadata.groupId = metadata.groupId;
+            }
             this.persistSession(session, 'sync');
             return session;
         }
@@ -702,11 +712,20 @@ export class SessionManager {
             const existing = this.readMetaLatest(metaPath);
             if (existing) {
                 const validSessionId = this.validateSessionFile(existing);
+                let mutated = false;
                 if (metadata) {
                     const creatorPeerId = existing.metadata?.peerId;
                     existing.metadata = { ...(existing.metadata || {}), ...metadata };
                     if (creatorPeerId && existing.metadata)
                         existing.metadata.peerId = creatorPeerId;
+                    mutated = true;
+                }
+                if (chatType && existing.chatType !== chatType) {
+                    logger.info(`[SessionManager] Updating thread chatType for session ${existing.id}: ${existing.chatType} -> ${chatType}`);
+                    existing.chatType = chatType;
+                    mutated = true;
+                }
+                if (mutated) {
                     this.persistSession(existing, 'none');
                 }
                 return { ...existing, agentSessionId: validSessionId };
@@ -1135,6 +1154,10 @@ export class SessionManager {
         if (!baseagent) {
             throw new Error(`[SessionManager] createNewSession: baseagent is empty for channel=${channel} channelId=${channelId}`);
         }
+        const metadata = newSessionStableMetadata(inheritedChatType, activeMetadata, identityMetadata);
+        if (identityMetadata?.sessionBoundaryOperationId) {
+            metadata.sessionBoundaryOperationId = identityMetadata.sessionBoundaryOperationId;
+        }
         const session = {
             id: generateSessionId(),
             channel,
@@ -1146,7 +1169,7 @@ export class SessionManager {
             baseagent,
             sessionKey: formatSessionKey(channelType, channelId, DEFAULT_THREAD_ID),
             chatType: inheritedChatType,
-            metadata: newSessionStableMetadata(inheritedChatType, activeMetadata, identityMetadata),
+            metadata,
             name: name || '默认会话',
             createdAt: Date.now(),
             updatedAt: Date.now(),
@@ -1163,6 +1186,21 @@ export class SessionManager {
         });
         return session;
     }
+    /**
+     * Create and activate one fresh main session for a durable system operation.
+     * Replaying the same operation returns the already-created session.
+     */
+    async ensureNewMainSessionForOperation(opts) {
+        const active = this.getActiveSessionSync(opts.channel, opts.channelId);
+        if (active?.metadata?.sessionBoundaryOperationId === opts.operationId) {
+            return { session: active, created: false };
+        }
+        const session = await this.createNewSession(opts.channel, opts.channelId, opts.projectPath, undefined, opts.baseagent, {
+            ...(opts.identityMetadata ?? {}),
+            sessionBoundaryOperationId: opts.operationId,
+        });
+        return { session, created: true };
+    }
     async createForkedSession(sourceSession, forkedAgentSessionId, name) {
         const channelType = sourceSession.channelType || sourceSession.channel;
         const threadId = sourceSession.threadId || '';

package/dist/core/session/session-mapper.js

@@ -1,5 +1,24 @@
 import { formatTimestamp } from './session-fs-store.js';
-import { formatSessionKey, DEFAULT_THREAD_ID } from './session-key.js';
+/** Default topic component used by the stable session routing key. */
+export const DEFAULT_THREAD_ID = 'main';
+export function formatSessionKey(channelType, channelId, threadId) {
+    const tid = threadId || DEFAULT_THREAD_ID;
+    return `${channelType}#${encodeURIComponent(channelId)}#${encodeURIComponent(tid)}`;
+}
+export function parseSessionKey(key) {
+    const first = key.indexOf('#');
+    if (first <= 0)
+        throw new Error(`Invalid session key: ${key}`);
+    const rest = key.slice(first + 1);
+    const second = rest.indexOf('#');
+    if (second <= 0)
+        throw new Error(`Invalid session key (missing threadId): ${key}`);
+    return {
+        channelType: key.slice(0, first),
+        channelId: decodeURIComponent(rest.slice(0, second)),
+        threadId: decodeURIComponent(rest.slice(second + 1)),
+    };
+}
 export function sessionToFile(session) {
     const metadata = {};
     if (session.metadata) {

package/dist/eck/detect.js

@@ -1,6 +1,23 @@
 import fs from 'fs';
 import path from 'path';
-import { BASEAGENT_CAPS } from './baseagent-caps.js';
+export const BASEAGENT_CAPS = {
+    'claude-code': {
+        autoLoadsRules: true,
+        supportsSystemPrompt: true,
+    },
+    'claude': {
+        autoLoadsRules: true,
+        supportsSystemPrompt: true,
+    },
+    'codex': {
+        autoLoadsRules: false,
+        supportsSystemPrompt: true,
+    },
+    'gemini': {
+        autoLoadsRules: false,
+        supportsSystemPrompt: true,
+    },
+};
 const MAX_DEPTH = 5;
 export function resolveEckInjection(agentConfig, projectPath, kitsRulesPath) {
     const caps = BASEAGENT_CAPS[agentConfig.baseAgent]

package/dist/eck/group-rules-sync.js

@@ -1,8 +1,8 @@
 import fs from 'fs';
 import path from 'path';
-import { createHash } from 'crypto';
 import { TextDecoder } from 'util';
 import { getAidStore, isValidAid, loadClient, SLOT } from '../aun/aid/index.js';
+import { downloadGroupFsBytes, GroupFsDownloadError } from '../aun/group-fs-download.js';
 import { checkGroupIndex as checkGroupIndexRpc, getGroupIndex as getGroupIndexRpc } from '../aun/msg/group-index.js';
 import { agentRelationsDir } from '../paths.js';
 import { formatPeerKey } from '../core/relation/peer-identity.js';
@@ -220,7 +220,9 @@ function lazyGroupClient(selfAid) {
         client: async () => {
             if (client)
                 return client;
-            store = await getAidStore({ slotId: SLOT.daemon });
+            // This short-lived RPC client must never share the daemon's gateway
+            // cursor. A short connection can perform a background pull on connect.
+            store = await getAidStore({ slotId: SLOT.groupRules });
             client = await loadClient(store, selfAid);
             await client.connect({ connection_kind: 'short', short_ttl_ms: 30000, auto_reconnect: false });
             return client;
@@ -242,39 +244,15 @@ function lazyGroupClient(selfAid) {
     };
 }
 async function downloadGroupFileBytes(client, remoteRef) {
-    const ticket = await client.call('group.fs.create_download_ticket', { path: remoteRef });
-    if (!isRecord(ticket)) {
-        throw statusError('unreadable', 'group.fs.create_download_ticket returned invalid response');
-    }
-    const downloadUrl = stringField(ticket, ['download_url', 'url']);
-    if (!downloadUrl) {
-        throw statusError('unreadable', 'group.fs.create_download_ticket did not return download_url');
-    }
-    const bytes = await client.group.fs.lowlevel.httpGet(downloadUrl, bearerHeaders(client));
-    const expectedSha = stringField(ticket, ['sha256']);
-    if (expectedSha && sha256Hex(bytes).toLowerCase() !== expectedSha.toLowerCase()) {
-        throw statusError('unreadable', 'download hash verification failed');
+    try {
+        return (await downloadGroupFsBytes(client, remoteRef)).bytes;
     }
-    return bytes;
-}
-function sha256Hex(bytes) {
-    return createHash('sha256').update(bytes).digest('hex');
-}
-function bearerHeaders(client) {
-    const token = accessTokenFromClient(client);
-    return token ? { Authorization: `Bearer ${token}` } : undefined;
-}
-function accessTokenFromClient(client) {
-    const anyClient = client;
-    if (typeof anyClient.getAccessToken === 'function') {
-        const token = stringValue(anyClient.getAccessToken());
-        if (token)
-            return token;
+    catch (error) {
+        if (error instanceof GroupFsDownloadError) {
+            throw statusError('unreadable', error.message);
+        }
+        throw error;
     }
-    return stringValue(anyClient.accessToken)
-        || stringValue(anyClient.access_token)
-        || stringValue(anyClient._identity?.access_token)
-        || stringValue(anyClient._sessionParams?.access_token);
 }
 function assertUtf8(bytes) {
     new TextDecoder('utf-8', { fatal: true }).decode(bytes);
@@ -302,6 +280,10 @@ function classifyError(e) {
     if (e instanceof StatusError)
         return e.status;
     const msg = errorMessage(e).toLowerCase();
+    // A peer cache miss is a signer/identity lookup failure, not a missing
+    // rules file.
+    if (msg.includes('peer not found in cache'))
+        return 'unreadable';
     if (msg.includes('forbidden') || msg.includes('unauthorized') || msg.includes('permission'))
         return 'forbidden';
     if (msg.includes('not found') || msg.includes('does not exist'))
@@ -314,17 +296,6 @@ function errorMessage(e) {
 function isRecord(x) {
     return typeof x === 'object' && x !== null && !Array.isArray(x);
 }
-function stringValue(x) {
-    return typeof x === 'string' ? x : '';
-}
-function stringField(obj, keys) {
-    for (const k of keys) {
-        const v = obj[k];
-        if (typeof v === 'string')
-            return v;
-    }
-    return undefined;
-}
 function numberField(obj, keys) {
     for (const k of keys) {
         const v = obj[k];

package/dist/eck/manifest-engine.js

@@ -55,6 +55,10 @@ function loadAndMergeManifest(filename) {
         for (const s of base.sections)
             merged.set(s.id, { ...s });
         for (const s of override.sections) {
+            if (s.id === 'relation-group-profile' && merged.has('peer-profile')) {
+                logger.warn('[ManifestEngine] Ignoring deprecated patch section "relation-group-profile"; use "peer-profile" instead');
+                continue;
+            }
             const existing = merged.get(s.id);
             merged.set(s.id, existing ? { ...existing, ...s } : s);
         }
@@ -320,15 +324,35 @@ function resolvePath(rawPath, vars) {
     const r = resolvePathWithDiag(rawPath, vars);
     return r.status === 'ok' ? r.resolved : null;
 }
+function isWithinDirectory(filePath, directory) {
+    const relative = path.relative(path.resolve(directory), path.resolve(filePath));
+    return relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`));
+}
+/**
+ * 随包发布的 kits 内容只在 reload/重启后刷新；personal/relations 及用户自定义
+ * manifest 路径属于运行时数据，必须用 mtime 检查，否则同一 daemon 内会长期陈旧。
+ */
+function sectionCacheOptions(resolvedPath, vars) {
+    if (isWithinDirectory(resolvedPath, kitsDir())) {
+        return { policy: 'on-reload', group: 'kits' };
+    }
+    const personalDir = typeof vars.PERSONAL_DIR === 'string' ? vars.PERSONAL_DIR : null;
+    const selfAid = typeof vars.selfAid === 'string' ? vars.selfAid : null;
+    if (personalDir && selfAid && isWithinDirectory(resolvedPath, personalDir)) {
+        return { policy: 'mtime', group: `agent-files:${selfAid}` };
+    }
+    return { policy: 'mtime', group: 'eck-runtime' };
+}
 /** 加载 loop 的 child 子模板文件内容（路径解析 + fileCache）。找不到返回 null。 */
 export function loadChildTemplate(childFile, vars) {
     const resolved = resolvePath(childFile, vars);
     if (!resolved)
         return null;
-    return fileCache.getText(resolved, { policy: 'on-reload', group: 'kits' });
+    return fileCache.getText(resolved, sectionCacheOptions(resolved, vars));
 }
 /**
- * 返回 [filePath, rawContent][]；按 sessionId 缓存已读文件内容。
+ * 返回 [filePath, rawContent][]。kits 文件跨 session 缓存到 reload；运行时文件
+ * （personal/relations/用户自定义路径）每次按 mtime 检查。
  * 若传入 overflowOut 且目录段触发单目录限额（maxFiles/maxBytes），
  * 会把溢出信息写入 overflowOut.value（不传则不启用限额收集，行为同旧版但仍应用默认上限）。
  */
@@ -343,7 +367,7 @@ export function loadSectionFiles(section, vars, sessionCache, overflowOut) {
             return [];
         const maxFiles = section.maxFiles ?? DIR_MAX_FILES;
         const maxBytes = section.maxBytes ?? DIR_MAX_BYTES;
-        const { files, overflow } = readDirectoryFiles(resolved, section.pattern, maxFiles, maxBytes);
+        const { files, overflow } = readDirectoryFiles(resolved, section.pattern, maxFiles, maxBytes, vars);
         if (overflow && overflowOut)
             overflowOut.value = overflow;
         return files.map(([name, content]) => [path.join(resolved, name), content]);
@@ -351,31 +375,33 @@ export function loadSectionFiles(section, vars, sessionCache, overflowOut) {
     return [];
 }
 function loadFileSection(filePath, vars, sessionCache) {
-    void sessionCache; // 内容跨 session 共享，改走全局 fileCache（on-reload）
+    void sessionCache; // 内容跨 session 共享，统一走全局 fileCache
     const resolved = resolvePath(filePath, vars);
     if (!resolved)
         return null;
-    // 内容跨 session 共享：用全局 fileCache（on-reload，reload/重启时失效），
-    // 不再按 session 重复缓存同一文件内容。
-    const content = fileCache.getText(resolved, { policy: 'on-reload', group: 'kits' });
+    const content = fileCache.getText(resolved, sectionCacheOptions(resolved, vars));
     return content === null ? null : [resolved, content];
 }
 /**
  * 读取目录下匹配文件，受单目录限额（maxFiles/maxBytes）约束。
  * 返回已加载文件 + 溢出信息（超限时）。按 fileCache 缓存目录列表与文件内容。
  */
-function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes) {
+function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes, vars) {
     const glob = pattern || '*.md';
-    // 目录列表 + 各文件内容均走 fileCache（on-reload）。目录列表以 "<dir>|<glob>"
-    // 为键缓存文件名数组；各文件内容走 fileCache.getText 共享。
-    const names = fileCache.get(`${dirPath} ${glob}`, () => {
+    const cacheOptions = sectionCacheOptions(dirPath, vars);
+    const readNames = () => {
         try {
             return fs.readdirSync(dirPath).filter(f => matchGlob(f, glob)).sort();
         }
         catch {
             return [];
         }
-    }, { policy: 'on-reload', group: 'kits' });
+    };
+    // synthetic cache key 无法用文件 mtime 门控。kits 目录结构只在 reload 后刷新；
+    // 运行时目录直接重扫，确保新增/删除文件在同一 session 内可见。
+    const names = cacheOptions.policy === 'on-reload'
+        ? fileCache.get(`${dirPath} ${glob}`, readNames, cacheOptions)
+        : readNames();
     const out = [];
     let usedBytes = 0;
     let overflow;
@@ -387,7 +413,7 @@ function readDirectoryFiles(dirPath, pattern, maxFiles, maxBytes) {
             break;
         }
         const fp = path.join(dirPath, f);
-        const content = fileCache.getText(fp, { policy: 'on-reload', group: 'kits' });
+        const content = fileCache.getText(fp, sectionCacheOptions(fp, vars));
         if (content === null)
             continue;
         // 字节限额（至少加载一个文件，避免单个超大文件导致空目录）