evolcore 0.0.13 → 0.0.15

package/dist/channels/aun.js

@@ -41,6 +41,40 @@ export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
 const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
 const AUN_INBOUND_DEDUP_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const IMAGE_MIME_TYPE = /^image\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+// AUN limits the complete encrypted thought envelope to 8192 bytes. The
+// encrypted group envelope grows with the number of recipient devices, so a
+// conservative plaintext budget avoids rejecting otherwise valid thoughts.
+const AUN_THOUGHT_PLAINTEXT_MAX_BYTES = 4096;
+const AUN_THOUGHT_TRUNCATION_SUFFIX = '\n\n[thought truncated]';
+function truncateUtf8ToBytes(value, maxBytes) {
+    if (Buffer.byteLength(value, 'utf8') <= maxBytes)
+        return value;
+    if (maxBytes <= 0)
+        return '';
+    let bytes = 0;
+    let end = 0;
+    for (const char of value) {
+        const charBytes = Buffer.byteLength(char, 'utf8');
+        if (bytes + charBytes > maxBytes)
+            break;
+        bytes += charBytes;
+        end += char.length;
+    }
+    return value.slice(0, end);
+}
+function truncateUtf8WithSuffix(value, maxBytes, suffix) {
+    if (Buffer.byteLength(value, 'utf8') <= maxBytes)
+        return value;
+    if (maxBytes <= 0)
+        return '';
+    const fittedSuffix = truncateUtf8ToBytes(suffix, maxBytes);
+    const headBytes = Math.max(0, maxBytes - Buffer.byteLength(fittedSuffix, 'utf8'));
+    return `${truncateUtf8ToBytes(value, headBytes)}${fittedSuffix}`;
+}
+function isThoughtTooLargeError(error) {
+    const message = error instanceof Error ? error.message : String(error ?? '');
+    return /thought too large/i.test(message);
+}
 function requireEnvelopeDelivery(channelId, envelopeDelivery, nestedDelivery) {
     if (!isDeliveryTarget(envelopeDelivery)) {
         throw Object.assign(new Error(`AUN outbound envelope requires a top-level delivery route for channelId=${channelId}`), {
@@ -2774,6 +2808,83 @@ export class AUNChannel {
             mentions: normalizeAunMentionEntries(payload.mentions),
         };
     }
+    /**
+     * Keep thought payloads below the encrypted AUN envelope limit. Thought
+     * payloads are usually activity records, so preserving their structure and
+     * truncating large string leaves is more useful than dropping the item.
+     */
+    limitThoughtPayload(payload) {
+        let serialized;
+        try {
+            serialized = JSON.stringify(payload);
+        }
+        catch {
+            return { type: 'thought', text: '[thought unavailable: payload is not serializable]' };
+        }
+        if (typeof serialized !== 'string') {
+            return { type: 'thought', text: '[thought unavailable: payload is not serializable]' };
+        }
+        if (Buffer.byteLength(serialized, 'utf8') <= AUN_THOUGHT_PLAINTEXT_MAX_BYTES)
+            return payload;
+        const limited = JSON.parse(serialized);
+        limited.thought_truncated = true;
+        const stringLeaves = () => {
+            const leaves = [];
+            const stack = [limited];
+            while (stack.length > 0) {
+                const current = stack.pop();
+                if (!current || typeof current !== 'object')
+                    continue;
+                for (const key of Object.keys(current)) {
+                    const value = current[key];
+                    if (typeof value === 'string') {
+                        leaves.push({ parent: current, key, value, bytes: Buffer.byteLength(value, 'utf8') });
+                    }
+                    else if (value && typeof value === 'object') {
+                        stack.push(value);
+                    }
+                }
+            }
+            return leaves;
+        };
+        let limitedBytes = Buffer.byteLength(JSON.stringify(limited), 'utf8');
+        while (limitedBytes > AUN_THOUGHT_PLAINTEXT_MAX_BYTES) {
+            const leaf = stringLeaves().sort((a, b) => b.bytes - a.bytes)[0];
+            if (!leaf || leaf.bytes === 0)
+                break;
+            if (!Array.isArray(leaf.parent) && typeof leaf.key === 'string') {
+                leaf.parent[`${leaf.key}_truncated`] = true;
+            }
+            limitedBytes = Buffer.byteLength(JSON.stringify(limited), 'utf8');
+            const bytesToRemove = limitedBytes - AUN_THOUGHT_PLAINTEXT_MAX_BYTES + 32;
+            const targetBytes = Math.max(0, leaf.bytes - bytesToRemove);
+            const source = leaf.value.endsWith(AUN_THOUGHT_TRUNCATION_SUFFIX)
+                ? leaf.value.slice(0, -AUN_THOUGHT_TRUNCATION_SUFFIX.length)
+                : leaf.value;
+            leaf.parent[leaf.key] = truncateUtf8WithSuffix(source, targetBytes, AUN_THOUGHT_TRUNCATION_SUFFIX);
+            const nextBytes = Buffer.byteLength(JSON.stringify(limited), 'utf8');
+            if (nextBytes >= limitedBytes)
+                break;
+            limitedBytes = nextBytes;
+        }
+        if (limitedBytes <= AUN_THOUGHT_PLAINTEXT_MAX_BYTES) {
+            logger.info(`${this.logPrefix()} Thought payload truncated: ${Buffer.byteLength(serialized, 'utf8')} -> ${limitedBytes} bytes`);
+            return limited;
+        }
+        return this.thoughtPayloadFallback(limited);
+    }
+    thoughtPayloadFallback(payload) {
+        const text = this.activityLogText(payload);
+        const fallback = {
+            type: 'thought',
+            text: truncateUtf8WithSuffix(text, 256, AUN_THOUGHT_TRUNCATION_SUFFIX),
+            thought_truncated: true,
+        };
+        if (typeof payload.chatmode === 'string')
+            fallback.chatmode = truncateUtf8ToBytes(payload.chatmode, 32);
+        logger.info(`${this.logPrefix()} Thought payload reduced to fallback (${Buffer.byteLength(JSON.stringify(fallback), 'utf8')} bytes)`);
+        return fallback;
+    }
     rememberInvalidatedInteraction(interactionId, reason) {
         this.invalidatedInteractions.set(interactionId, reason);
         const timer = setTimeout(() => this.invalidatedInteractions.delete(interactionId), 24 * 60 * 60 * 1000);
@@ -3180,8 +3291,14 @@ export class AUNChannel {
             : undefined;
         if (operationId) {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
-            if (hasMessageLogOperation(chatDir, operationId))
+            if (hasMessageLogOperation(chatDir, operationId)) {
+                const duplicate = outbox.findByDedupeKey(this.config.aid, operationId);
+                if (duplicate) {
+                    outbox.remove(this.config.aid, duplicate.id);
+                    logger.info(`${this.logPrefix()} Removed stale outbox entry for completed operation: ${operationId}`);
+                }
                 return;
+            }
         }
         // Write-ahead: persist to outbox before attempting send
         const entry = outbox.enqueue(this.config.aid, {
@@ -3785,18 +3902,17 @@ export class AUNChannel {
         const encrypt = context?.metadata?.encrypted != null
             ? !!(context.metadata.encrypted)
             : this.shouldEncrypt(targetId);
+        const payloadWithChatmode = context?.metadata?.chatmode && !finalPayload.chatmode
+            ? { ...finalPayload, chatmode: context.metadata.chatmode }
+            : finalPayload;
         const params = {
             context: { type: 'task', id: taskId },
-            payload: finalPayload,
+            payload: this.limitThoughtPayload(payloadWithChatmode),
             encrypt,
         };
-        // 补齐 chatmode（与 deliverTextEntry/applyReplyContextToPayload 对齐）
-        // 前端强依赖此字段用于消息过滤（proactive 模式的 thought 不显示在聊天流）
-        if (context?.metadata?.chatmode && !params.payload.chatmode) {
-            params.payload.chatmode = context.metadata.chatmode;
-        }
         try {
-            const items = finalPayload?.items;
+            let thoughtPayload = params.payload;
+            const items = thoughtPayload?.items;
             const itemCount = Array.isArray(items) ? items.length : 1;
             const stage = finalPayload?.stage ?? (finalPayload?.kind ? `kind=${finalPayload.kind}` : `items=${itemCount}`);
             // 提取 thought 文本：兼容旧 items[] 和新扁平 activity payload。
@@ -3818,12 +3934,28 @@ export class AUNChannel {
                 }
             }
             else {
-                thoughtText = this.activityLogText(finalPayload);
+                thoughtText = this.activityLogText(thoughtPayload);
             }
-            if (delivery.chatType === 'group') {
+            const method = delivery.chatType === 'group' ? 'group.thought.put' : 'message.thought.put';
+            if (delivery.chatType === 'group')
                 params.group_id = delivery.groupId;
-                const putRes = await this.callAndTrace('group.thought.put', params);
-                const tid = putRes?.thought_id;
+            else
+                params.to = targetId;
+            let putRes;
+            try {
+                putRes = await this.callAndTrace(method, params);
+            }
+            catch (error) {
+                if (!isThoughtTooLargeError(error))
+                    throw error;
+                thoughtPayload = this.thoughtPayloadFallback(thoughtPayload);
+                params.payload = thoughtPayload;
+                thoughtText = this.activityLogText(thoughtPayload);
+                logger.warn(`${this.logPrefix()} Retrying ${method} with minimal payload after server size rejection`);
+                putRes = await this.callAndTrace(method, params);
+            }
+            const tid = putRes?.thought_id;
+            if (delivery.chatType === 'group') {
                 logger.info(`${this.logPrefix()} thought.put ok group=${targetId} task=${taskId} stage=${stage} encrypt=${encrypt} tid=${tid ?? '?'}`);
                 this.eventBus?.publish?.({ type: 'message:thought-put', agentName: this.config.aid, channelId, taskId, text: thoughtText });
                 this.forwardOutbound(putRes);
@@ -3833,9 +3965,6 @@ export class AUNChannel {
                 }
             }
             else {
-                params.to = targetId;
-                const putRes = await this.callAndTrace('message.thought.put', params);
-                const tid = putRes?.thought_id;
                 logger.info(`${this.logPrefix()} thought.put ok p2p=${this.peerLabel(targetId)} task=${taskId} stage=${stage} encrypt=${encrypt} tid=${tid ?? '?'}`);
                 this.eventBus?.publish?.({ type: 'message:thought-put', agentName: this.config.aid, channelId, taskId, text: thoughtText });
                 this.forwardOutbound(putRes);

package/dist/channels/daemon.js

@@ -413,6 +413,7 @@ function normalizeExecutionAnomaly(value) {
     const occurredAt = typeof value.occurredAt === 'number' && Number.isFinite(value.occurredAt)
         ? value.occurredAt
         : Date.now();
+    const correlationId = nonEmptyString(value.correlationId);
     const toolName = nonEmptyString(value.toolName);
     const requestId = nonEmptyString(value.requestId);
     const policyCode = nonEmptyString(value.policyCode);
@@ -426,6 +427,7 @@ function normalizeExecutionAnomaly(value) {
         severity: 'warning',
         phase: 'execution',
         occurredAt,
+        ...(correlationId ? { correlationId } : {}),
         effect,
         ...(toolName ? { toolName } : {}),
         ...(requestId ? { requestId } : {}),

package/dist/channels/feishu.js

@@ -1467,9 +1467,14 @@ export function buildCardV2(interaction, opts) {
 export function buildResolvedV2(interaction, response) {
     const action = response.action;
     const kind = interaction.kind;
+    const temporaryGrantButton = kind.kind === 'action'
+        ? kind.buttons.find(button => button.key === 'always' || button.key === 'approve_session_30m')
+        : undefined;
+    const temporaryGrantIsFileScoped = temporaryGrantButton?.label.includes('同文件') === true;
     const labelMap = {
         'allow': '✅ 已允许',
-        'always': '⏱ 已授权同操作 30 分钟',
+        'always': temporaryGrantIsFileScoped ? '⏱ 已授权同文件 30 分钟' : '⏱ 已授权同操作 30 分钟',
+        'approve_session_30m': temporaryGrantIsFileScoped ? '⏱ 已授权同文件 30 分钟' : '⏱ 已授权本会话 30 分钟',
         'deny': '❌ 已拒绝',
         'cancel': '取消',
     };

package/dist/cli/aun-commands.js

@@ -1698,7 +1698,7 @@ Options:
             else if (r.handoff_id)
                 console.log(`✓ 已排队 handoff ${r.handoff_id}（尚未投递）`);
             else
-                console.log(`✓ 已发送 message_id=${r.message?.message_id ?? '-'} seq=${r.message?.seq ?? '-'}`);
+                console.log(`✓ 已发送 message_id=${r.message_id ?? r.message?.message_id ?? '-'} seq=${r.message?.seq ?? '-'}`);
         });
         return;
     }

package/dist/cli/fs-command.js

@@ -34,8 +34,8 @@ Commands:
   mkdir [-p] <AID>:<path>         创建目录
   ln -s <target> <AID>:<path>     创建软链（personal storage）
   chmod [mode] <AID>:<path>       切换公开/私有（personal storage）
-  setfacl <AID>:<path> -m|-x ...   设置/移除 ACL（personal storage）
-  getfacl <AID>:<path>            查看 ACL（personal storage）
+  setfacl <AID>:<path> -m|-x ...   设置/移除 ACL（群路径使用 role:member|role:admin）
+  getfacl <AID>:<path>            查看 ACL
   token issue|revoke|ls <path>    管理访问 token（personal storage）
   find <AID>:<path> [filters]     查找节点
   df <AID>:                       查看容量/配额
@@ -273,6 +273,12 @@ async function runManagedFs(args, formatJson) {
         case 'remove':
             console.log(`✓ 已删除: ${result.path}`);
             return;
+        case 'getfacl':
+            console.log(JSON.stringify(result.result ?? {}, null, 2));
+            return;
+        case 'setfacl':
+            console.log(`✓ 已${result.removed ? '移除' : '设置'}群 ACL: ${result.path}`);
+            return;
     }
 }
 function parseCommonOptions(args) {
@@ -838,10 +844,16 @@ async function fsSetfacl(args, opts) {
     }
     await withClient(opts, async ({ client, store }) => {
         const route = await resolveRoute(target.aid, store);
-        if (route.backend === 'group') {
-            throw new FsCliError('UNSUPPORTED', 'group fs 当前 SDK facade 没有 setfacl 接口', '请在 personal storage 中使用 setfacl。');
-        }
         if (modify) {
+            if (route.backend === 'group') {
+                const [role, rolePerms] = parseGroupAclSpec(modify, true);
+                if (expiresAt !== undefined || maxUses !== undefined) {
+                    throw new FsCliError('INVALID_ARGUMENT', '群空间 ACL 不支持 --expires 或 --max-uses');
+                }
+                const result = await client.group.fs.setAcl(remoteRef(target), { granteeAid: role, perms: rolePerms });
+                outputSuccess(opts, { command: 'setfacl', backend: route.backend, route, path: remoteRef(target), result }, () => console.log(`✓ 已设置群 ACL: ${remoteRef(target)}`));
+                return;
+            }
             const [grantee, perms] = parseAclSpec(modify, true);
             const result = await client.storage.setAcl(target.path, {
                 owner: target.aid,
@@ -853,6 +865,12 @@ async function fsSetfacl(args, opts) {
             outputSuccess(opts, { command: 'setfacl', backend: route.backend, route, path: remoteRef(target), result }, () => console.log(`✓ 已设置 ACL: ${remoteRef(target)}`));
             return;
         }
+        if (route.backend === 'group') {
+            const [role] = parseGroupAclSpec(remove || '', false);
+            const result = await client.group.fs.removeAcl(remoteRef(target), { granteeAid: role });
+            outputSuccess(opts, { command: 'setfacl', backend: route.backend, route, path: remoteRef(target), result }, () => console.log(`✓ 已移除群 ACL: ${remoteRef(target)}`));
+            return;
+        }
         const [grantee] = parseAclSpec(remove || '', false);
         const result = await client.storage.removeAcl(target.path, {
             owner: target.aid,
@@ -865,10 +883,9 @@ async function fsGetfacl(args, opts) {
     const target = parseRemoteRequired(firstPositional(args), { command: 'getfacl' });
     await withClient(opts, async ({ client, store }) => {
         const route = await resolveRoute(target.aid, store);
-        if (route.backend === 'group') {
-            throw new FsCliError('UNSUPPORTED', 'group fs 当前 SDK facade 没有 getfacl/listAcl 接口', '请在 personal storage 中使用 getfacl。');
-        }
-        const result = await client.storage.listAcl(target.path, { owner: target.aid });
+        const result = route.backend === 'group'
+            ? await client.group.fs.getAcl(remoteRef(target))
+            : await client.storage.listAcl(target.path, { owner: target.aid });
         outputSuccess(opts, { command: 'getfacl', backend: route.backend, route, path: remoteRef(target), result }, () => console.log(JSON.stringify(result, null, 2)));
     });
 }
@@ -1305,6 +1322,26 @@ function parseAclSpec(value, requirePerms) {
     }
     return [parts[1]];
 }
+function parseGroupAclSpec(value, requirePerms) {
+    const parts = value.split(':');
+    if (parts[0] !== 'role' || !parts[1] || (parts.length !== (requirePerms ? 3 : 2))) {
+        throw new FsCliError('INVALID_ARGUMENT', '群空间 ACL 条目格式应为 role:member:<perms>、role:admin:<perms> 或 role:<role>');
+    }
+    const role = `role:${parts[1]}`;
+    if (!['role:member', 'role:admin'].includes(role)) {
+        throw new FsCliError('INVALID_ARGUMENT', '群空间 ACL 仅支持 role:member 或 role:admin');
+    }
+    if (!requirePerms)
+        return [role];
+    const perms = parts[2];
+    if (!perms || !/^(?:r|rw|rwx)$/.test(perms)) {
+        throw new FsCliError('INVALID_ARGUMENT', '群空间 ACL 权限必须是 r、rw 或 rwx');
+    }
+    if (role === 'role:member' && perms !== 'rw') {
+        throw new FsCliError('INVALID_ARGUMENT', 'role:member 只能授予 rw 群空间 ACL');
+    }
+    return [role, perms];
+}
 function assertLocalFile(localPath) {
     let st;
     try {

package/dist/cli/task-context.js

@@ -1,5 +1,14 @@
 import { normalizeCausation } from '../core/causation/context.js';
+import { RUNTIME_LOCK_DIR_ENV } from '../core/runtime-lock.js';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
+export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
+export { RUNTIME_LOCK_DIR_ENV };
+const generatedProcessManagedTempDirs = new Set();
+let processTempCleanupRegistered = false;
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
@@ -23,10 +32,171 @@ function normalizeTaskRuntimeContext(value) {
         peerType: optionalString(value.peerType),
         peerRole: optionalString(value.peerRole),
         threadId: optionalString(value.threadId),
+        sessionRuntimeDir: optionalAbsolutePath(value.sessionRuntimeDir),
+        runtimeLockDir: optionalAbsolutePath(value.runtimeLockDir),
         handoffIds: handoffIds?.length ? handoffIds : undefined,
         causation: normalizeCausation(value.causation),
     };
 }
+function optionalAbsolutePath(value) {
+    if (typeof value !== 'string' || !path.isAbsolute(value))
+        return undefined;
+    return path.resolve(value);
+}
+function isPrivateDirectory(directory) {
+    try {
+        const resolved = path.resolve(directory);
+        const stat = fs.lstatSync(resolved);
+        // Windows does not expose Unix ownership and permission bits through
+        // Stats.mode. The ACL is enforced by the platform, so applying the
+        // POSIX 0700 check here rejects otherwise valid Windows directories.
+        const isWindows = process.platform === 'win32';
+        if (!stat.isDirectory()
+            || stat.isSymbolicLink()
+            || (!isWindows && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (!isWindows && (stat.mode & 0o077) !== 0))
+            return false;
+        // A private leaf below a symlinked ancestor can still escape the managed
+        // namespace. Walk the existing ancestor chain and reject such paths while
+        // allowing the normal public system temp parent (for generated roots).
+        let current = resolved;
+        while (true) {
+            const ancestor = fs.lstatSync(current);
+            if (ancestor.isSymbolicLink())
+                return false;
+            const parent = path.dirname(current);
+            if (parent === current)
+                break;
+            current = parent;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure the daemon has a private process-wide temporary root.
+ *
+ * Service managers commonly omit TMPDIR. In that case create a private
+ * directory below the platform temp root and publish it for all managed
+ * runners. An explicitly supplied value is accepted only when it is already
+ * a private directory owned by this process. A shared system directory such
+ * as `/tmp`, a symlink, or a group/world-readable path is replaced with a
+ * fresh private root instead of becoming a capability for managed children.
+ */
+export function ensureProcessManagedTempDir() {
+    const configured = process.env.TMPDIR?.trim();
+    if (configured) {
+        if (!path.isAbsolute(configured)) {
+            throw new Error('managed TMPDIR is unset or not absolute');
+        }
+        const resolved = path.resolve(configured);
+        if (isPrivateDirectory(resolved))
+            return resolved;
+    }
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-managed-tmp-'));
+    try {
+        fs.chmodSync(directory, 0o700);
+        if (!isPrivateDirectory(directory)) {
+            throw new Error(`managed temp path is not a private directory: ${directory}`);
+        }
+        process.env.TMPDIR = directory;
+        generatedProcessManagedTempDirs.add(directory);
+        if (!processTempCleanupRegistered) {
+            processTempCleanupRegistered = true;
+            process.once('exit', () => {
+                for (const candidate of generatedProcessManagedTempDirs) {
+                    if (!path.basename(candidate).startsWith('evolcore-managed-tmp-'))
+                        continue;
+                    try {
+                        if (isPrivateDirectory(candidate))
+                            fs.rmSync(candidate, { recursive: true, force: true });
+                    }
+                    catch {
+                        // Best-effort cleanup; the directory is private and uniquely named.
+                    }
+                }
+            });
+        }
+        return directory;
+    }
+    catch (error) {
+        try {
+            fs.rmSync(directory, { recursive: true, force: true });
+        }
+        catch { }
+        throw error;
+    }
+}
+function isRunnerOwnedSessionRuntimeDir(directory) {
+    const resolved = path.resolve(directory);
+    const base = path.basename(resolved);
+    const parent = path.dirname(resolved);
+    // Codex allocates a private, direct child named with a 24-character digest
+    // below its private evolcore-codex-* parent. The runner has already checked
+    // canonical containment before returning this path to the response engine.
+    const isCodexRuntime = /^[a-f0-9]{24}$/.test(base)
+        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(parent));
+    return isCodexRuntime && isPrivateDirectory(parent) && isPrivateDirectory(resolved);
+}
+/** Whether a task-provided runtime directory stays inside the process-managed
+ * TMPDIR and is safe to use for transient writes. */
+export function isManagedSessionRuntimeDir(directory) {
+    const tmpDir = process.env.TMPDIR?.trim();
+    if (!directory || !path.isAbsolute(directory) || !tmpDir || !path.isAbsolute(tmpDir))
+        return false;
+    const root = path.resolve(tmpDir);
+    const resolved = path.resolve(directory);
+    const relative = path.relative(root, resolved);
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+        return false;
+    return isPrivateDirectory(root) && isPrivateDirectory(resolved);
+}
+/**
+ * Create a private runtime directory below the process-provided TMPDIR.
+ * There is deliberately no os.tmpdir() fallback: managed sessions must not
+ * silently escape the session-owned temporary workspace.
+ */
+export function ensureSessionRuntimeDir(sessionId) {
+    const base = process.env.TMPDIR?.trim();
+    if (!base || !path.isAbsolute(base) || !sessionId)
+        return undefined;
+    const root = path.resolve(base);
+    const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
+    const directory = path.join(root, `evolcore-runtime-${digest}`);
+    try {
+        fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+        if (!isPrivateDirectory(root))
+            return undefined;
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        fs.mkdirSync(path.join(directory, 'locks'), { recursive: true, mode: 0o700 });
+        return isManagedSessionRuntimeDir(directory) ? directory : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Shared by tasks in one daemon runtime, while remaining outside each
+ * session's history/files area. The caller must still pass this path through
+ * the task environment before a sandboxed child can use it. */
+export function ensureRuntimeLockDir(sessionRuntimeDir) {
+    if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
+        return undefined;
+    if (!isManagedSessionRuntimeDir(sessionRuntimeDir) && !isRunnerOwnedSessionRuntimeDir(sessionRuntimeDir))
+        return undefined;
+    const parent = path.dirname(path.resolve(sessionRuntimeDir));
+    if (!isPrivateDirectory(parent))
+        return undefined;
+    const directory = path.join(parent, 'evolcore-locks');
+    try {
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        return isPrivateDirectory(directory) ? directory : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function runtimeRefMessageIdForMsgSend(args) {
     const runtime = args.runtime;
     if (!runtime)
@@ -76,5 +246,11 @@ export function buildTaskRuntimeEnv(ctx) {
     return {
         EVOLCORE_SESSION_ID: ctx.sessionId ?? '',
         [TASK_RUNTIME_CONTEXT_ENV]: JSON.stringify(clean),
+        // Every managed child receives the session directory as TMPDIR. This keeps
+        // ordinary temporary files and runtime-only fallbacks out of shared agent
+        // or process directories, including for non-Codex runners.
+        ...(clean.sessionRuntimeDir ? { TMPDIR: clean.sessionRuntimeDir } : {}),
+        ...(clean.sessionRuntimeDir ? { [SESSION_RUNTIME_DIR_ENV]: clean.sessionRuntimeDir } : {}),
+        ...(clean.runtimeLockDir ? { [RUNTIME_LOCK_DIR_ENV]: clean.runtimeLockDir } : {}),
     };
 }

package/dist/config/builtin-roles.js

@@ -49,6 +49,8 @@ export function getManagementCommandPermissions(role) {
         'ec.fs.copy': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         'ec.fs.move': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         'ec.fs.remove': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.getfacl': { allow: true, scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.setfacl': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         '*': { allow: true },
         // Reload is valid from an Agent's own channel and the daemon control plane.
         // The control-channel gate still requires a daemon owner for cross-Agent reloads.

package/dist/config/config-manager.js

@@ -12,6 +12,7 @@
  */
 import fs from 'fs';
 import path from 'path';
+import { ensureManagedLockParent, resolveManagedLockPath } from '../core/runtime-lock.js';
 import crypto from 'crypto';
 import { resolvePaths, agentConfig as agentConfigPath, agentContactConfig, agentRelationConfig, agentDir, agentRelationsDir, agentRolesIndex, agentRoleConfig, } from '../paths.js';
 import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
@@ -793,12 +794,15 @@ function sortConfigValue(value) {
         .map(([key, nested]) => [key, sortConfigValue(nested)]));
 }
 function acquireConfigMutationLock(file) {
-    const lockDir = `${file}.mutation.lock`;
+    const lockDir = resolveManagedLockPath('config', file, `${file}.mutation.lock`);
     const ownerFile = path.join(lockDir, 'owner.json');
     const token = crypto.randomBytes(16).toString('hex');
     const candidate = `${lockDir}.candidate-${process.pid}-${token}`;
     const candidateOwner = path.join(candidate, 'owner.json');
-    fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (lockDir === `${file}.mutation.lock`)
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+    else
+        ensureManagedLockParent(lockDir);
     fs.mkdirSync(candidate);
     fs.writeFileSync(candidateOwner, `${JSON.stringify({ pid: process.pid, token })}\n`, { mode: 0o600 });
     let acquired = false;

package/dist/config/contact-book-store.js

@@ -6,6 +6,7 @@ import { isExplicitGroupId } from '../aun/group-identity.js';
 import { agentConfig, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
+import { ensureManagedLockParent, resolveManagedLockPath } from '../core/runtime-lock.js';
 import { ConfigTarget, notifyConfigWrite, validateConfig } from './config-manager.js';
 import { parseContactAlias } from './contact-alias.js';
 import { clearRoleStoreCache } from './role-store.js';
@@ -426,12 +427,16 @@ function readContactBookFromDisk(selfAid) {
     }
 }
 function acquireAgentLock(selfAid) {
-    const lockDir = path.join(agentDir(selfAid), LOCK_NAME);
+    const legacyLockDir = path.join(agentDir(selfAid), LOCK_NAME);
+    const lockDir = resolveManagedLockPath('contact', selfAid, legacyLockDir);
     const ownerFile = path.join(lockDir, 'owner.json');
     const lockToken = crypto.randomBytes(16).toString('hex');
     const candidateDir = `${lockDir}.candidate-${process.pid}-${lockToken}`;
     const candidateOwnerFile = path.join(candidateDir, 'owner.json');
-    fs.mkdirSync(path.dirname(lockDir), { recursive: true });
+    if (lockDir === legacyLockDir)
+        fs.mkdirSync(path.dirname(lockDir), { recursive: true });
+    else
+        ensureManagedLockParent(lockDir);
     fs.mkdirSync(candidateDir);
     fs.writeFileSync(candidateOwnerFile, `${JSON.stringify({
         pid: process.pid,

package/dist/core/auth/auth-gateway.js

@@ -165,6 +165,7 @@ function auditDecision(params, decision) {
     auditCommandAuthorization({
         ts: Date.now(),
         ...params.auditMetadata,
+        correlationId: params.auditMetadata?.correlationId ?? params.auditMetadata?.requestId ?? params.subject.requestId,
         requestId: params.auditMetadata?.requestId ?? params.subject.requestId,
         sessionId: params.auditMetadata?.sessionId ?? params.subject.sessionId,
         agentAid: params.auditMetadata?.agentAid ?? params.subject.selfAid,