evolcore 0.0.13 → 0.0.15

package/dist/core/auth/authorization-audit.js

@@ -14,9 +14,40 @@ export function auditCommandAuthorization(event) {
     const auditRecord = buildAuditRecord(event);
     logAuditEvent(auditRecord);
 }
+/**
+ * Record a tool-level preflight denial (e.g. protected-path block) in the
+ * structured command-audit log. This covers interactive sessions whose
+ * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
+ */
+export function auditToolPreflightDenial(input) {
+    auditCommandAuthorization({
+        ts: Date.now(),
+        source: 'agent-tool',
+        operation: 'tool.preflight.deny',
+        scope: 'filesystem',
+        dangerous: false,
+        decision: 'deny',
+        decisionSource: 'policy',
+        toolName: input.toolName,
+        policyCode: input.policyCode,
+        reason: input.reason,
+        argsSummary: input.summary ? { summary: input.summary } : undefined,
+        sessionId: input.sessionId,
+        agentAid: input.agentAid,
+        permissionMode: input.permissionMode,
+        channel: input.channel,
+        actorId: input.actorId,
+        role: input.role ?? 'unknown',
+        selfAid: input.selfAid,
+        peerKey: input.peerKey,
+        requestId: input.requestId,
+        taskId: input.taskId,
+    });
+}
 function buildAuditRecord(event) {
     return {
         ts: event.ts,
+        correlationId: event.correlationId ?? event.requestId,
         requestId: event.requestId,
         sessionId: event.sessionId,
         agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
@@ -79,6 +110,7 @@ function logAuditEvent(record) {
         record.taskId ? `task=${record.taskId}` : null,
         record.messageId ? `message=${record.messageId}` : null,
         record.requestId ? `request=${record.requestId}` : null,
+        record.correlationId ? `correlation=${record.correlationId}` : null,
         record.sessionId ? `session=${record.sessionId}` : null,
         record.agentAid ? `agent=${record.agentAid}` : null,
         record.permissionMode ? `permissionMode=${record.permissionMode}` : null,

package/dist/core/auth/operation-catalog.js

@@ -65,7 +65,7 @@ const MSG_READ_OPERATIONS = [
     description,
     sources: ['agent-tool'],
 }));
-const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df'].map(kind => ({
+const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df', 'getfacl'].map(kind => ({
     id: `ec.fs.${kind}`,
     category: 'read',
     dangerous: false,
@@ -73,9 +73,9 @@ const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df'].ma
     description: `Read current group filesystem (${kind})`,
     sources: ['agent-tool'],
 }));
-const GROUP_FS_WRITE_OPERATIONS = ['mkdir', 'upload', 'copy', 'move', 'remove'].map(kind => ({
+const GROUP_FS_WRITE_OPERATIONS = [['mkdir', 'write-own'], ['upload', 'write-own'], ['copy', 'write-own'], ['move', 'write-own'], ['remove', 'write-own'], ['setfacl', 'write-agent']].map(([kind, category]) => ({
     id: `ec.fs.${kind}`,
-    category: 'write-own',
+    category,
     dangerous: false,
     defaultScopes: ['relation'],
     description: `Write current group filesystem (${kind})`,

package/dist/core/bootstrap-service.js

@@ -140,7 +140,13 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        const channelId = ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // The bootstrap prompt is deliberately a private message to the configured
+        // owner. An inbound owner message may have arrived from a group, in which
+        // case ctx.channelId is the group AID and must not be paired with the
+        // private delivery route below (that would call message.send(to=group)).
+        const channelId = channelType === 'aun'
+            ? recipientId
+            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;

package/dist/core/command/command-handler.js

@@ -1974,6 +1974,9 @@ export class CommandHandler {
             ...(parsed.command.recursive !== undefined ? { recursive: parsed.command.recursive } : {}),
             ...(parsed.command.parents !== undefined ? { parents: parsed.command.parents } : {}),
             ...(parsed.command.overwrite !== undefined ? { overwrite: parsed.command.overwrite } : {}),
+            ...(parsed.command.aclGrantee ? { aclGrantee: parsed.command.aclGrantee } : {}),
+            ...(parsed.command.aclPerms ? { aclPerms: parsed.command.aclPerms } : {}),
+            ...(parsed.command.aclRemove !== undefined ? { aclRemove: parsed.command.aclRemove } : {}),
         };
         const decision = authorizeOperation({
             source: 'agent-tool',

package/dist/core/command/slash-handler.js

@@ -705,7 +705,7 @@ export async function handleSlashCommand(content, channel, channelId, sendMessag
         const args = normalizedContent.slice(5).trim();
         const permissionDecisionLabels = {
             allow: '✓ 已授权（本次），继续执行……',
-            always: '✓ 已授权（同会话同操作 30 分钟），继续执行……',
+            always: '✓ 已授权（当前会话临时授权 30 分钟），继续执行……',
             deny: '✓ 已拒绝',
         };
         // Explicit request IDs are globally unique and already bound to an exact

package/dist/core/event-catalog.js

@@ -314,6 +314,7 @@ const CATALOG = [
             { path: 'toolName', type: 'string' },
             { path: 'input', type: 'object' },
             { path: 'callId', type: 'string', optional: true },
+            { path: 'correlationId', type: 'string', optional: true },
             { path: 'agentAid', type: 'string', optional: true },
             { path: 'permissionMode', type: 'string', optional: true },
             { path: 'timestamp', type: 'number', optional: true },
@@ -330,6 +331,7 @@ const CATALOG = [
             { path: 'isError', type: 'boolean', optional: true },
             { path: 'agentName', type: 'string', optional: true },
             { path: 'callId', type: 'string', optional: true },
+            { path: 'correlationId', type: 'string', optional: true },
             { path: 'agentAid', type: 'string', optional: true },
             { path: 'permissionMode', type: 'string', optional: true },
             { path: 'timestamp', type: 'number', optional: true },

package/dist/core/message/im-renderer.js

@@ -59,7 +59,21 @@ export class IMRenderer {
     /** 推入 AgentEvent，按 chatmode 投影 */
     emit(event) {
         try {
-            logger.event({ source: 'runner', taskId: this.opts.envelope.taskId, channelId: this.opts.envelope.channelId, event });
+            const correlatedEvent = event.type === 'tool_use' || event.type === 'tool_result'
+                ? { ...event, correlationId: event.correlationId ?? event.callId }
+                : event;
+            logger.event({
+                source: 'runner',
+                taskId: this.opts.envelope.taskId,
+                sessionId: this.opts.envelope.sessionId,
+                channelId: this.opts.envelope.channelId,
+                agentAid: this.opts.agentAid,
+                agentName: this.opts.envelope.agentName,
+                ...(correlatedEvent.type === 'tool_use' || correlatedEvent.type === 'tool_result'
+                    ? { correlationId: correlatedEvent.correlationId, toolName: correlatedEvent.name }
+                    : {}),
+                event: correlatedEvent,
+            });
         }
         catch {
             // logger.event 失败不影响业务

package/dist/core/message/message-bridge.js

@@ -872,7 +872,7 @@ export class MessageBridge {
                     return;
                 }
                 // 普通消息保留原始日志；控制 payload 使用脱敏元数据日志。
-                logger.channelIn({ channel: channelName, channelId: msg.channelId, peerId: msg.peerId, peerName: msg.peerName, chatType: msg.chatType, msgId: msg.messageId, threadId: msg.threadId, content, images: msg.images?.length ?? 0, mentions: msg.mentions, replyContext: msg.replyContext });
+                logger.channelIn({ channel: channelName, channelId: msg.channelId, selfAid: msg.selfAID, peerId: msg.peerId, peerName: msg.peerName, chatType: msg.chatType, msgId: msg.messageId, correlationId: msg.messageId, threadId: msg.threadId, content, images: msg.images?.length ?? 0, mentions: msg.mentions, replyContext: msg.replyContext });
                 const accessDecision = authorizeAccess(authSubject);
                 if (!accessDecision.allow) {
                     logger.warn(`[MessageBridge] Access denied before command routing: channel=${channelName} channelId=${msg.channelId} actor=${actorId ?? '<none>'} role=${identity.role} reason=${accessDecision.reason}`);
@@ -954,7 +954,8 @@ export class MessageBridge {
                     }
                 }
                 if (msg.source !== 'handoff' && await this.handleCommand(cmdContent, channelName, msg.channelId, (text) => {
-                    logger.channelOut({ channel: channelName, channelId: msg.channelId, taskId: `cmd-${msg.messageId || Date.now()}`, payload: { kind: 'command.result', text } });
+                    const taskId = `cmd-${msg.messageId || Date.now()}`;
+                    logger.channelOut({ channel: channelName, channelId: msg.channelId, taskId, correlationId: taskId, sessionId: msg.replyContext?.sessionId, agentAid: msg.selfAID, payload: { kind: 'command.result', text } });
                     return sendReply(msg.channelId, text, msg.replyContext);
                 }, msg.peerId, msg.threadId, msg.chatType, msg.source, msg.replyContext, msg.messageId, msg.selfAID, authSubject))
                     return;
@@ -1468,9 +1469,11 @@ export class MessageBridge {
         logger.channelIn({
             channel,
             channelId: this.shortHash(msg.channelId),
+            selfAid: msg.selfAID,
             peerId: this.shortHash(msg.peerId),
             chatType: msg.chatType,
             msgId: msg.messageId,
+            correlationId: msg.messageId,
             control: {
                 id: parsed.id,
                 type: parsed.type,

package/dist/core/message/response-engine.js

@@ -3,7 +3,7 @@ import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
 import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForContextWindow, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken } from '../../agents/runner-types.js';
-import { buildTaskRuntimeEnv } from '../../cli/task-context.js';
+import { buildTaskRuntimeEnv, ensureRuntimeLockDir, ensureSessionRuntimeDir } from '../../cli/task-context.js';
 import { IMRenderer } from './im-renderer.js';
 import { createSendFileMarkerPattern } from './file-markers.js';
 import { createTextInferenceProvider } from '../inference/text-inference.js';
@@ -953,7 +953,7 @@ export class ResponseEngine {
             }
             agent.registerStream(streamKey, retryStream);
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
-            undefined, turnLease, opts.permissionMode);
+            undefined, turnLease, opts.permissionMode, opts.proactiveSelfAid);
         }
         // Dropping the whole session hides the root cause and can replay side
         // effects in unattended trigger tasks. Surface an actionable failure
@@ -1992,6 +1992,7 @@ export class ResponseEngine {
             const renderer = new IMRenderer({
                 adapter,
                 envelope,
+                agentAid: session.selfAID,
                 flushDelay: (options?.flushDelay ?? this.agentRegistry?.resolveByChannel(channelKey)?.config?.flush_delay ?? 3) * 1000,
                 suppressActivityItems: isProactive ? false : middleOutputMode !== 'all',
                 suppressIntermediateText: isProactive ? false : middleOutputMode === 'none',
@@ -2170,6 +2171,7 @@ export class ResponseEngine {
                 ? (anomaly) => {
                     recordTriggerExecutionAnomaly(triggerRunId, {
                         ...anomaly,
+                        correlationId: anomaly.correlationId ?? anomaly.requestId,
                         agentAid: anomaly.agentAid ?? session.selfAID ?? message.selfAID,
                         sessionId: anomaly.sessionId ?? session.id,
                         permissionMode: anomaly.permissionMode ?? effectivePermissionMode,
@@ -2758,6 +2760,12 @@ export class ResponseEngine {
                             this.handoffRuntime.completeTargetContext(selfAid, handoffId);
                     }
                 }
+                // The runner may already own a stronger per-session directory (Codex
+                // registers one before constructing its thread). Other runners use a
+                // private child of the process-provided TMPDIR. Both paths are passed
+                // explicitly so sandboxed helper commands never fall back to a shared
+                // agent or project directory for transient state.
+                const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
@@ -2771,6 +2779,8 @@ export class ResponseEngine {
                     peerType: message.peerType || session.metadata?.peerType || undefined,
                     peerRole,
                     threadId: session.threadId || undefined,
+                    sessionRuntimeDir,
+                    runtimeLockDir: ensureRuntimeLockDir(sessionRuntimeDir),
                     handoffIds: v2HandoffIds.length > 0 && v2HandoffDirection === 'target' ? v2HandoffIds : undefined,
                     causation: taskCausation,
                 };
@@ -2841,7 +2851,7 @@ export class ResponseEngine {
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, session.selfAID || message.selfAID);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
@@ -2999,6 +3009,7 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
+                        proactiveSelfAid: session.selfAID || message.selfAID,
                         permissionMode: effectivePermissionMode,
                         turnLease,
                     });
@@ -3041,6 +3052,7 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
+                    proactiveSelfAid: session.selfAID || message.selfAID,
                     permissionMode: effectivePermissionMode,
                     turnLease,
                 });
@@ -4022,7 +4034,7 @@ export class ResponseEngine {
      */
     async processEventStream(stream, session, agent, renderer, resetTimer, shouldSuppress, proactive, 
     /** [迁移点4/5] 响应模式插件 + 状态，用于调 onToolUse/onComplete 钩子 */
-    modeHooks, causation, turnLease, permissionMode) {
+    modeHooks, causation, turnLease, permissionMode, proactiveSelfAid) {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
@@ -4038,6 +4050,7 @@ export class ResponseEngine {
         let toolUseCount = 0;
         const openToolUseIds = new Set();
         const anonymousToolUseIds = new Map();
+        const anonymousOpenIdByCorrelation = new Map();
         const finalizeResult = () => ({
             ...completeResult,
             hasReceivedText,
@@ -4053,7 +4066,28 @@ export class ResponseEngine {
         let lastReplyText = '';
         // callId → description 映射，用于 tool_result 回显描述
         const toolDescByCallId = new Map();
+        const toolInputByCallId = new Map();
+        const toolInputByCorrelationId = new Map();
+        const anonymousToolInputsByName = new Map();
         const ctlQueueReadCallIds = new Set();
+        const removePendingToolInput = (pending) => {
+            for (const [callId, value] of toolInputByCallId) {
+                if (value === pending)
+                    toolInputByCallId.delete(callId);
+            }
+            for (const [correlationId, value] of toolInputByCorrelationId) {
+                if (value === pending)
+                    toolInputByCorrelationId.delete(correlationId);
+            }
+            const anonymous = anonymousToolInputsByName.get(pending.name);
+            if (anonymous) {
+                const remaining = anonymous.filter(value => value !== pending);
+                if (remaining.length > 0)
+                    anonymousToolInputsByName.set(pending.name, remaining);
+                else
+                    anonymousToolInputsByName.delete(pending.name);
+            }
+        };
         try {
             for await (let event of stream) {
                 if (turnLease && !this.turnCoordinator.isCurrent(turnLease)) {
@@ -4085,16 +4119,44 @@ export class ResponseEngine {
                     else {
                         const syntheticId = `__anonymous_tool_${toolUseCount}`;
                         openToolUseIds.add(syntheticId);
+                        if (event.correlationId)
+                            anonymousOpenIdByCorrelation.set(event.correlationId, syntheticId);
                         const pending = anonymousToolUseIds.get(event.name) ?? [];
                         pending.push(syntheticId);
                         anonymousToolUseIds.set(event.name, pending);
                     }
                 }
                 else if (event.type === 'tool_result') {
-                    if (event.callId) {
+                    // A result carrying both identifiers may be stale or replayed. Do not
+                    // close the active call until both identifiers resolve to the same
+                    // pending tool invocation; otherwise a mismatched result can make the
+                    // protocol look complete even though the real call is still open.
+                    const hasBothResultIdentifiers = !!event.callId && !!event.correlationId;
+                    const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                    const byCorrelationId = event.correlationId
+                        ? toolInputByCorrelationId.get(event.correlationId)
+                        : undefined;
+                    const identifiersMatch = !hasBothResultIdentifiers
+                        || (!!byCallId && !!byCorrelationId && byCallId === byCorrelationId);
+                    if (event.callId && identifiersMatch) {
                         openToolUseIds.delete(event.callId);
                     }
-                    else {
+                    else if (!event.callId && event.correlationId && byCorrelationId) {
+                        const syntheticId = anonymousOpenIdByCorrelation.get(event.correlationId);
+                        if (syntheticId) {
+                            openToolUseIds.delete(syntheticId);
+                            anonymousOpenIdByCorrelation.delete(event.correlationId);
+                        }
+                        else {
+                            for (const [callId, pending] of toolInputByCallId) {
+                                if (pending === byCorrelationId) {
+                                    openToolUseIds.delete(callId);
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    else if (!event.callId) {
                         const names = event.name ? [event.name] : [...anonymousToolUseIds.keys()];
                         for (const name of names) {
                             const pending = anonymousToolUseIds.get(name);
@@ -4350,16 +4412,32 @@ export class ResponseEngine {
                             toolName: event.name,
                             input: event.input,
                             ...(event.callId ? { callId: event.callId } : {}),
+                            ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
                             ...(session.selfAID ? { agentAid: session.selfAID } : {}),
                             ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
+                        const desc = summarizeToolInput(event.name, event.input || {});
+                        const pendingInput = { name: event.name, input: event.input || {} };
+                        if (event.callId)
+                            toolInputByCallId.set(event.callId, pendingInput);
+                        if (event.correlationId)
+                            toolInputByCorrelationId.set(event.correlationId, pendingInput);
+                        else if (event.callId) {
+                            // Renderer/event-log normalization uses callId as the fallback
+                            // correlation. Keep the same alias here so a result carrying both
+                            // fields with that fallback still matches the original call.
+                            toolInputByCorrelationId.set(event.callId, pendingInput);
+                        }
+                        if (!event.callId && !event.correlationId) {
+                            const pending = anonymousToolInputsByName.get(event.name) ?? [];
+                            pending.push(pendingInput);
+                            anonymousToolInputsByName.set(event.name, pending);
+                        }
                         if (!shouldSuppress()) {
-                            const desc = summarizeToolInput(event.name, event.input || {});
-                            if (event.callId) {
+                            if (event.callId)
                                 toolDescByCallId.set(event.callId, desc);
-                            }
                             renderer.addToolCall(event.name, event.input, event.callId, desc, event.turn, event.outputTokens);
                         }
                         if (event.callId && isCtlQueueReadCommand(event.name, event.input || {})) {
@@ -4375,7 +4453,7 @@ export class ResponseEngine {
                                 toolInput: event.input || {},
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
-                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', session.selfAID),
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
                                 logger,
                             });
                         }
@@ -4402,11 +4480,61 @@ export class ResponseEngine {
                             isError: event.isError,
                             agentName: agentNameForStats,
                             ...(event.callId ? { callId: event.callId } : {}),
+                            ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
                             ...(session.selfAID ? { agentAid: session.selfAID } : {}),
                             ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
+                        // A proactive send gate advances only after the matching command
+                        // completed successfully and returned an explicit send receipt.
+                        let original;
+                        const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                        const byCorrelationId = event.correlationId
+                            ? toolInputByCorrelationId.get(event.correlationId)
+                            : undefined;
+                        // Both identifiers must describe the same call. This avoids
+                        // accepting a stale/replayed correlation as the result of a new
+                        // call, or vice versa.
+                        const hasBothResultIdentifiers = !!event.callId && !!event.correlationId;
+                        if (hasBothResultIdentifiers
+                            && (!byCallId || !byCorrelationId || byCallId !== byCorrelationId)) {
+                            logger.warn(`[ResponseEngine] Ignoring mismatched tool result identifiers: session=${session.id}`);
+                        }
+                        else if (!hasBothResultIdentifiers) {
+                            original = byCallId ?? byCorrelationId;
+                        }
+                        else {
+                            original = byCallId;
+                        }
+                        if (!original && !event.callId && !event.correlationId) {
+                            const pending = anonymousToolInputsByName.get(event.name);
+                            // Without either identifier, FIFO is unsafe when same-named calls
+                            // overlap or complete out of order. Leave the gate unchanged until
+                            // a unique pending call can be matched.
+                            if (pending?.length === 1) {
+                                original = pending[0];
+                                anonymousToolInputsByName.delete(event.name);
+                            }
+                        }
+                        if (original)
+                            removePendingToolInput(original);
+                        if (original && modeHooks?.mode?.onToolResult) {
+                            const proactiveState = modeHooks.state.get('proactive');
+                            await modeHooks.mode.onToolResult({
+                                session,
+                                state: modeHooks.state,
+                                toolName: original.name,
+                                toolInput: original.input,
+                                result: event.result,
+                                isError: event.isError,
+                                error: event.error,
+                                injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
+                                getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
+                                logger,
+                            });
+                        }
                         // 从 tool_use 阶段缓存的描述中回溯
                         const cachedDesc = event.callId ? toolDescByCallId.get(event.callId) : undefined;
                         if (event.isError && !shouldSuppress()) {