evolcore 0.0.12 → 0.0.13

package/dist/utils/ecweb-supervisor.js

@@ -0,0 +1,332 @@
+import fs from 'fs';
+import path from 'path';
+import { spawn } from 'child_process';
+import { resolvePaths } from '../paths.js';
+import { WEB_PACKAGE_NAME } from '../product.js';
+import { resolveGlobalPkg } from './npm-ops.js';
+import { ecwebVersionRequirementError, resolveEcwebLaunchCommand } from './ecweb-utils.js';
+import * as platform from './cross-platform.js';
+import { getProcessStartTime } from './process-introspect.js';
+const INSTANCE_FILE_RE = /^(?:ecweb|watch-web)-\d+\.json$/;
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function isAlive(record) {
+    if (!Number.isInteger(record.pid) || record.pid <= 0)
+        return false;
+    // ECWeb versions before the supervisor used a different Linux boot-time
+    // calculation, so their `startedAt` can be off by seconds or minutes even
+    // while the PID and HTTP listener are healthy.  The instance file is already
+    // scoped to this EVOLCORE_HOME; use liveness here and let the HTTP probe be
+    // the ownership/health check.  PID/start-time validation remains in the
+    // explicit kill path below.
+    return platform.isProcessRunning(record.pid);
+}
+function readEntries() {
+    const dir = resolvePaths().instanceDir;
+    let files;
+    try {
+        files = fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const entries = [];
+    for (const file of files) {
+        if (!INSTANCE_FILE_RE.test(file))
+            continue;
+        const filePath = path.join(dir, file);
+        try {
+            const value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+            if (Number.isInteger(value.pid) && value.pid > 0) {
+                entries.push({
+                    filePath,
+                    record: {
+                        pid: value.pid,
+                        port: Number.isInteger(value.port) ? value.port : 42705,
+                        ...(typeof value.startedAt === 'number' ? { startedAt: value.startedAt } : {}),
+                    },
+                });
+            }
+        }
+        catch {
+            // A partially-written instance file is ignored until the next check.
+        }
+    }
+    return entries;
+}
+function removeEntry(entry) {
+    try {
+        fs.unlinkSync(entry.filePath);
+    }
+    catch { }
+}
+function removeEntriesForPid(pid) {
+    for (const entry of readEntries()) {
+        if (entry.record.pid === pid)
+            removeEntry(entry);
+    }
+}
+async function probe(port) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${port}/`, {
+            signal: AbortSignal.timeout(1500),
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Owns the ECWeb process for the lifetime of the daemon.
+ *
+ * The CLI may have started ECWeb moments earlier (ec start/restart/watch web).
+ * We first adopt a healthy registered instance and only spawn after a few
+ * seconds of failed discovery. This closes the race between the CLI launcher,
+ * ECWeb's own stale-instance cleanup, and daemon startup.
+ */
+export function createEcwebSupervisor(options) {
+    const failureThreshold = Math.max(1, options.failureThreshold ?? 3);
+    const checkIntervalMs = Math.max(1000, options.checkIntervalMs ?? 5000);
+    let active = null;
+    let child = null;
+    let logFd = null;
+    let timer = null;
+    let failureCount = 0;
+    let startInFlight = null;
+    let stopping = false;
+    const logFile = path.join(resolvePaths().logs, 'ecweb-daemon.log');
+    const setActiveFromEntry = (entry, owned) => {
+        active = {
+            pid: entry.record.pid,
+            port: entry.record.port,
+            // Capture the current PID start time rather than trusting the record.
+            // Older ECWeb builds could write a clock-skewed `startedAt` value.
+            startedAt: getProcessStartTime(entry.record.pid)
+                ?? (typeof entry.record.startedAt === 'number' ? entry.record.startedAt : null),
+            owned,
+        };
+    };
+    const findHealthyInstance = async () => {
+        for (const entry of readEntries()) {
+            if (!isAlive(entry.record)) {
+                removeEntry(entry);
+                continue;
+            }
+            if (await probe(entry.record.port))
+                return entry;
+        }
+        return null;
+    };
+    const waitForHealthyInstance = async (timeoutMs) => {
+        const deadline = Date.now() + timeoutMs;
+        do {
+            const found = await findHealthyInstance();
+            if (found)
+                return found;
+            if (Date.now() >= deadline)
+                break;
+            await sleep(250);
+        } while (!stopping);
+        return null;
+    };
+    const closeLogStream = () => {
+        if (logFd === null)
+            return;
+        try {
+            fs.closeSync(logFd);
+        }
+        catch { }
+        logFd = null;
+    };
+    const killActive = async () => {
+        const current = active;
+        if (!current) {
+            // During the short window between spawn() and ECWeb writing its
+            // instance record there is no `active` entry yet, but the daemon still
+            // owns the child and must not leave it behind on shutdown.
+            const pendingPid = child?.pid;
+            if (pendingPid && platform.isProcessRunning(pendingPid)) {
+                try {
+                    platform.killProcess(pendingPid, true);
+                }
+                catch { }
+                await platform.waitForProcessExit(pendingPid, 5000);
+            }
+            return;
+        }
+        const actual = getProcessStartTime(current.pid);
+        // Never kill a reused PID.  `startedAt` was captured from the live process
+        // when it was adopted/spawned, so this remains safe even for legacy records
+        // whose on-disk timestamp used a different clock.
+        const sameProcess = current.startedAt !== null && actual !== null
+            ? current.startedAt === actual
+            : false;
+        if (sameProcess && platform.isProcessRunning(current.pid)) {
+            try {
+                platform.killProcess(current.pid, true);
+            }
+            catch { }
+            await platform.waitForProcessExit(current.pid, 5000);
+        }
+        removeEntriesForPid(current.pid);
+        active = null;
+    };
+    const spawnEcweb = async () => {
+        const root = resolvePaths().root;
+        const localEntry = path.join(root, 'ecweb', 'dist', 'index.js');
+        const globalPkg = resolveGlobalPkg(WEB_PACKAGE_NAME);
+        let launch = resolveEcwebLaunchCommand(['--home', root, '--port', String(options.port)], {
+            installedPkg: globalPkg,
+        });
+        let cwd = root;
+        let version = globalPkg?.version;
+        if (!launch && fs.existsSync(localEntry)) {
+            launch = {
+                command: process.execPath,
+                args: [localEntry, '--home', root, '--port', String(options.port)],
+                entry: localEntry,
+                source: 'package-bin',
+            };
+            cwd = path.dirname(path.dirname(localEntry));
+            try {
+                version = JSON.parse(fs.readFileSync(path.join(root, 'ecweb', 'package.json'), 'utf8')).version;
+            }
+            catch { }
+        }
+        if (!launch) {
+            options.logger.warn(`ECWeb 启动入口不存在，请安装 ${WEB_PACKAGE_NAME}@latest`);
+            return;
+        }
+        const versionError = ecwebVersionRequirementError(version);
+        if (versionError) {
+            options.logger.error(`ECWeb 未启动: ${versionError}`);
+            return;
+        }
+        fs.mkdirSync(resolvePaths().logs, { recursive: true });
+        fs.appendFileSync(logFile, `\n# daemon supervisor start ${new Date().toISOString()}\n`);
+        // `spawn()` accepts inherited file descriptors, but not a WriteStream
+        // whose fd has not been opened yet. Open once and pass the numeric fd to
+        // both stdout and stderr; the parent closes its copy after spawning.
+        logFd = fs.openSync(logFile, 'a');
+        const childLogFd = logFd;
+        let spawned;
+        try {
+            spawned = spawn(launch.command, launch.args, {
+                cwd,
+                detached: true,
+                stdio: ['ignore', childLogFd, childLogFd],
+                windowsHide: platform.isWindows,
+                env: { ...process.env, EVOLCORE_HOME: root },
+            });
+        }
+        catch (error) {
+            closeLogStream();
+            options.logger.error(`ECWeb 子进程创建失败: ${error?.message || error}`);
+            return;
+        }
+        closeLogStream();
+        child = spawned;
+        spawned.once('error', (error) => {
+            options.logger.error(`ECWeb 子进程创建失败: ${error.message}`);
+        });
+        spawned.once('exit', (code, signal) => {
+            options.logger.warn(`ECWeb 进程退出 (PID: ${spawned.pid ?? 'unknown'}, code=${code ?? 'null'}, signal=${signal ?? 'null'})`);
+            if (child === spawned)
+                child = null;
+            if (!stopping) {
+                active = null;
+                failureCount = failureThreshold;
+            }
+            closeLogStream();
+        });
+        spawned.unref();
+        if (!spawned.pid) {
+            closeLogStream();
+            options.logger.warn('ECWeb 启动失败：未取得子进程 PID');
+            return;
+        }
+        options.logger.info(`✓ ECWeb supervisor 已启动 (PID: ${spawned.pid})，日志: ${logFile}`);
+        // ECWeb writes its own instance record after binding. Do not fabricate a
+        // record here; the watchdog will adopt the real record on its next tick.
+        // Returning immediately keeps daemon startup independent of HTTP bind
+        // latency while ServiceProxy continues to wait for the instance file.
+    };
+    const ensureRunning = async () => {
+        if (stopping || startInFlight)
+            return;
+        const healthy = await findHealthyInstance();
+        if (healthy) {
+            const changed = !active || active.pid !== healthy.record.pid || active.port !== healthy.record.port;
+            setActiveFromEntry(healthy, active?.pid === healthy.record.pid ? active.owned : false);
+            failureCount = 0;
+            if (changed)
+                options.logger.info(`✓ ECWeb supervisor 接管现有实例 (PID: ${healthy.record.pid}, 端口: ${healthy.record.port})`);
+            return;
+        }
+        failureCount += 1;
+        if (failureCount < failureThreshold)
+            return;
+        // A manual `ec watch web` may be between killing the old process and
+        // registering the replacement. Re-scan immediately before spawning.
+        const replacement = await waitForHealthyInstance(1500);
+        if (replacement) {
+            setActiveFromEntry(replacement, false);
+            failureCount = 0;
+            return;
+        }
+        startInFlight = (async () => {
+            await killActive();
+            await spawnEcweb();
+            failureCount = 0;
+        })().finally(() => { startInFlight = null; });
+        await startInFlight;
+    };
+    return {
+        async start() {
+            if (stopping)
+                return;
+            // CLI/restart-monitor writes the instance record before the daemon is
+            // ready. Give that process enough time to bind before launching another.
+            const existing = await waitForHealthyInstance(1_500);
+            if (existing) {
+                setActiveFromEntry(existing, false);
+                options.logger.info(`✓ ECWeb supervisor 接管现有实例 (PID: ${existing.record.pid}, 端口: ${existing.record.port})`);
+            }
+            else {
+                failureCount = failureThreshold;
+                await ensureRunning();
+            }
+            timer = setInterval(() => {
+                void ensureRunning().catch((error) => {
+                    options.logger.error(`ECWeb watchdog 检查失败: ${error?.message || error}`);
+                });
+            }, checkIntervalMs);
+            timer.unref?.();
+        },
+        async stop() {
+            if (stopping)
+                return;
+            stopping = true;
+            if (timer)
+                clearInterval(timer);
+            timer = null;
+            if (startInFlight) {
+                try {
+                    await startInFlight;
+                }
+                catch { }
+            }
+            await killActive();
+            if (child) {
+                try {
+                    child.removeAllListeners();
+                }
+                catch { }
+                child = null;
+            }
+            closeLogStream();
+        },
+    };
+}

package/dist/utils/error-utils.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { logger } from './logger.js';
+import { isSandboxInitializationFailure } from '../core/permission/sandbox-runtime.js';
 export var ErrorType;
 (function (ErrorType) {
     ErrorType["SDK_TIMEOUT"] = "sdk_timeout";
@@ -11,6 +12,7 @@ export var ErrorType;
     ErrorType["STREAM_ERROR"] = "stream_error";
     ErrorType["CONTEXT_TOO_LONG"] = "context_too_long";
     ErrorType["MODEL_UNAVAILABLE"] = "model_unavailable";
+    ErrorType["SANDBOX_INITIALIZATION_FAILED"] = "sandbox_initialization_failed";
     ErrorType["UNKNOWN"] = "unknown";
 })(ErrorType || (ErrorType = {}));
 /**
@@ -269,6 +271,9 @@ export function classifyError(error) {
         || /api error: 404\b/.test(msg)) {
         return ErrorType.MODEL_UNAVAILABLE;
     }
+    if (isSandboxInitializationFailure(error)) {
+        return ErrorType.SANDBOX_INITIALIZATION_FAILED;
+    }
     if (msg.includes('401') || msg.includes('authentication_error') || msg.includes('unauthorized')) {
         return ErrorType.AUTH_ERROR;
     }
@@ -328,6 +333,8 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
                 return `${prefix}工具执行失败，请检查操作或重试`;
             case 'permission_denied':
                 return `${prefix}权限被拒绝，操作已取消`;
+            case 'sandbox_initialization_failed':
+                return `${warnPrefix}只读执行沙箱启动失败（sandbox_initialization_failed），当前任务未执行；请检查 user namespace/seccomp 配置后重试`;
             case 'aborted_streaming':
             case 'aborted_tools':
                 return `${prefix}任务已中断`;
@@ -345,6 +352,9 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     if (msg.includes('CONTEXT_COMPACT_FAILED') || isContextTooLongText(msg)) {
         return `${warnPrefix}上下文过长，自动压缩失败，请手动输入 /compact 重试`;
     }
+    if (isSandboxInitializationFailure(error)) {
+        return `${warnPrefix}只读执行沙箱启动失败（sandbox_initialization_failed），当前任务未执行；请检查 user namespace/seccomp 配置后重试`;
+    }
     if (msg.includes('401') || msg.includes('authentication_error') || msg.toLowerCase().includes('unauthorized')) {
         return `${errPrefix}API Key 无效，请检查密钥配置。使用 /status 查看当前配置`;
     }

package/kits/docs/evolcore/trigger.md

@@ -132,11 +132,24 @@ Trigger V3 第二阶段使用 `execution.type` 区分执行位置：
 ```bash
 --target-channel <channelKey>
 --target-channel-id <channelId>
+--target-chat-type <private|group>
 --target-session main
 --target-session thread --target-thread-id <threadId>
 ```
 
-AUN 渠道由 agent AID 隐式创建，不需要写入 agent 配置的 `channels[]`。CLI 和 Trigger V3.1 definition 均可将 `aun` 用作 `channelKey` 简写；保存前会按 `agentAid` 展开为 `aun#<agentAid>#main`。其他渠道仍需指定完整的实例 channel key。
+AUN 渠道由 agent AID 隐式创建，不需要写入 agent 配置的 `channels[]`。CLI 和 Trigger V3.1 definition 均可将 `aun` 用作 `channelKey` 简写；保存前会按 `agentAid` 展开为 `aun#<agentAid>#main`。AUN 目标必须明确设置 `chatType`；`channelId` 在私聊时是对端 ID，在群聊时就是群 ID，不再额外保存 `groupId`。读取缺少 `chatType` 的旧 AUN Trigger definition 时，迁移逻辑会仅在该次迁移中按 `private` 补齐并回写；新建和编辑仍要求显式指定。其他渠道仍需指定完整的实例 channel key。
+
+```json
+{
+  "strategy": "target",
+  "target": {
+    "channelKey": "aun",
+    "channelId": "peer.agentid.pub",
+    "chatType": "private",
+    "session": "main"
+  }
+}
+```
 
 Trigger V3.1 feedback 是单策略：
 
@@ -307,6 +320,7 @@ ec trigger create --exec script --file ./trigger-dir --enable
     "target": {
       "channelKey": "<channelKey>",
       "channelId": "<channelId>",
+      "chatType": "private",
       "session": "main"
     }
   },
@@ -388,6 +402,7 @@ ec trigger create --exec script --file ./trigger-dir --enable
     "target": {
       "channelKey": "<channelKey>",
       "channelId": "<channelId>",
+      "chatType": "private",
       "session": "main"
     },
     "onReply": {
@@ -466,6 +481,7 @@ flag 模式不能配置过滤条件。需要根据事件 payload 过滤时，写
     "target": {
       "channelKey": "<channelKey>",
       "channelId": "<channelId>",
+      "chatType": "private",
       "session": "main"
     }
   },

package/kits/migrations/migrate-contact-book-v2.mjs

@@ -49,8 +49,7 @@ function isExplicitGroupId(value) {
   return (id.startsWith('group.') && id.includes('/'))
     || /^\d+\.[a-z0-9.-]+$/i.test(id)
     || /^grp_[a-z0-9_-]+$/i.test(id)
-    || /^g-[a-z0-9_-]+(?:[.@][a-z0-9.-]+)?$/i.test(id)
-    || /(?:^|\.)groupid\.pub$/i.test(id);
+    || /^g-[a-z0-9_-]+(?:[.@][a-z0-9.-]+)?$/i.test(id);
 }
 
 function readJson(file) {

package/kits/schemas/role-config.schema.1.json

@@ -132,6 +132,7 @@
         "properties": {
           "allow": { "type": "boolean", "description": "是否允许该角色执行匹配的 operation。" },
           "dangerous": { "type": "boolean", "default": false, "description": "是否将该授权规则标记为危险操作规则；危险操作还会应用额外安全约束。" },
+          "permissionMode": { "type": "string", "enum": ["readonly", "auto", "request", "bypass"], "description": "临时 operation 级权限模式；后续迁移到作用域模式规则。" },
           "scopes": {
             "type": "array",
             "items": { "type": "string", "enum": ["relation", "role", "agent", "process", "filesystem", "control", "raw-cli"], "description": "该命令权限适用的一个配置或执行作用域。", "x-enumDescriptions": { "relation": "当前 Agent 与对端的关系配置域", "role": "独立角色注册表或角色策略配置域", "agent": "单个 Agent 的配置与生命周期域", "process": "EvolCore 进程级配置与运行域", "filesystem": "受控文件系统操作域", "control": "控制面命令和管理通道域", "raw-cli": "未经结构化 operation 封装的原始 CLI 执行域" } },

package/kits/templates/roles/admin.json

@@ -63,6 +63,11 @@
       "scopes": ["agent"],
       "constraints": { "targetCurrentAgentOnly": true, "requireAgentAdmin": true }
     },
+    "ec.fs.mkdir": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.upload": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.move": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.remove": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "*": { "allow": true },
     "agent.reload": {
       "allow": true,

package/kits/templates/roles/member.json

@@ -24,7 +24,7 @@
     "storage.*": { "allow": false },
     "aid.*": { "allow": false },
     "gateway.*": { "allow": false },
-    "group.list": { "allow": false },
+    "group.list": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "agent.baseagent.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "agent.baseagent.list": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "agent.*": { "allow": false },
@@ -66,6 +66,11 @@
     "ec.fs.cat": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.find": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.df": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.mkdir": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.upload": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.move": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.remove": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.handoff.status": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.handoff.list": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.handoff.trace": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
@@ -73,6 +78,7 @@
     "ec.queue.*": { "allow": false },
     "ec.group.send": { "allow": true, "constraints": { "groupOnly": true, "currentRelationOnly": true } },
     "ec.group.file": { "allow": true, "constraints": { "groupOnly": true, "currentRelationOnly": true } },
+    "ec.group.list": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "ec.group.info": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.group.pull": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.group.members": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },

package/kits/templates/roles/visitor.json

@@ -36,6 +36,7 @@
     "group.mentionmode.update": { "allow": false },
     "group.rulespolicy.current": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "group.rulespolicy.update": { "allow": false },
+    "group.list": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "trigger.list": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "trigger.show": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "trigger.history": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
@@ -69,6 +70,7 @@
     "storage.*": { "allow": false },
     "ec.group.send": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true } },
     "ec.group.file": { "allow": false },
+    "ec.group.list": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "ec.group.info": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.group.pull": { "allow": false },
     "ec.group.members": { "allow": false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",

package/dist/aun/msg/payload-type.js

@@ -1,27 +0,0 @@
-import path from 'path';
-const EXT_TYPE_MAP = {
-    // image
-    '.png': 'image', '.jpg': 'image', '.jpeg': 'image',
-    '.gif': 'image', '.webp': 'image', '.svg': 'image',
-    '.bmp': 'image', '.heic': 'image', '.heif': 'image',
-    // video
-    '.mp4': 'video', '.mov': 'video', '.webm': 'video',
-    '.avi': 'video', '.mkv': 'video', '.m4v': 'video',
-    // voice
-    '.opus': 'voice', '.mp3': 'voice', '.aac': 'voice',
-    '.m4a': 'voice', '.wav': 'voice', '.flac': 'voice', '.ogg': 'voice',
-};
-/**
- * 按扩展名推断 payload.type。
- * 未识别的扩展名归类为 'file'。
- */
-export function inferPayloadType(filename) {
-    const ext = path.extname(filename).toLowerCase();
-    return EXT_TYPE_MAP[ext] ?? 'file';
-}
-/**
- * 校验显式传入的 --as 值。
- */
-export function isValidPayloadType(value) {
-    return value === 'image' || value === 'video' || value === 'voice' || value === 'file';
-}

package/dist/aun/rpc/caller.js

@@ -1,42 +0,0 @@
-import { createShortConnection } from './connection.js';
-export async function rpcCall(aid, method, params, opts) {
-    const conn = await createShortConnection(aid, opts);
-    try {
-        const result = await conn.call(method, params);
-        return { ok: true, result };
-    }
-    catch (e) {
-        if (e.code !== undefined && e.message !== undefined) {
-            return { ok: false, error: { code: e.code, message: e.message, data: e.data } };
-        }
-        return { ok: false, error: { code: -1, message: String(e.message || e) } };
-    }
-    finally {
-        await conn.close();
-    }
-}
-export async function rpcBatch(aid, calls, opts) {
-    const conn = await createShortConnection(aid, opts);
-    const results = [];
-    try {
-        for (const { method, params } of calls) {
-            try {
-                const result = await conn.call(method, params);
-                results.push({ ok: true, result });
-            }
-            catch (e) {
-                if (e.code !== undefined && e.message !== undefined) {
-                    results.push({ ok: false, error: { code: e.code, message: e.message, data: e.data } });
-                }
-                else {
-                    results.push({ ok: false, error: { code: -1, message: String(e.message || e) } });
-                }
-                break; // stop on first failure
-            }
-        }
-    }
-    finally {
-        await conn.close();
-    }
-    return results;
-}

package/dist/aun/rpc/connection.js

@@ -1,25 +0,0 @@
-import { getAidStore, loadClient, SLOT } from '../aid/store.js';
-export async function createShortConnection(aid, opts) {
-    const store = await getAidStore({ slotId: opts?.slotId ?? SLOT.cli, aunPath: opts?.aunPath });
-    try {
-        const client = await loadClient(store, aid);
-        await client.connect({ connection_kind: 'short', short_ttl_ms: 30000, auto_reconnect: false });
-        return {
-            async call(method, params) {
-                return client.call(method, params);
-            },
-            async close() {
-                try {
-                    await client.close();
-                }
-                finally {
-                    store.close();
-                }
-            },
-        };
-    }
-    catch (e) {
-        store.close();
-        throw e;
-    }
-}

package/dist/aun/storage/manage.js

@@ -1,10 +0,0 @@
-import { rpcCall } from '../rpc/caller.js';
-export async function storageLs(aid, prefix, opts) {
-    return rpcCall(aid, 'storage.list_objects', { prefix: prefix || '' }, { aunPath: opts?.aunPath });
-}
-export async function storageRm(aid, remotePath, opts) {
-    return rpcCall(aid, 'storage.delete_object', { object_key: remotePath }, { aunPath: opts?.aunPath });
-}
-export async function storageQuota(aid, opts) {
-    return rpcCall(aid, 'storage.get_quota', {}, { aunPath: opts?.aunPath });
-}

package/dist/config/access-policy-domain.js

@@ -1,18 +0,0 @@
-import { isValidAid } from '../aun/aid/validation.js';
-export function validAgentOwnerIds(agent) {
-    return [...new Set((agent?.owners ?? [])
-            .map(value => String(value || '').trim())
-            .filter(isValidAid))];
-}
-export function validateAccessPolicyDomain(selfAid, agent) {
-    const access = agent.access;
-    if (!access)
-        return undefined;
-    if (access.policyMode !== 'open' && validAgentOwnerIds(agent).length === 0) {
-        return {
-            code: 'restricted_mode_without_owner',
-            message: `Agent ${selfAid} cannot use ${access.policyMode} without an Owner`,
-        };
-    }
-    return undefined;
-}

package/dist/config/config-batch-get.js

@@ -1,11 +0,0 @@
-import { normalizeCliArgv } from '../cli/cli-argv.js';
-export function splitConfigBatchGetArgv(inputArgv) {
-    const argv = normalizeCliArgv(inputArgv);
-    if (argv[0] !== 'config' || argv[1] !== 'get')
-        return null;
-    const fields = [];
-    let i = 2;
-    for (; i < argv.length && !argv[i].startsWith('-'); i++)
-        fields.push(argv[i]);
-    return { fields, rest: argv.slice(i) };
-}