evolcore 0.0.13 → 0.0.15

package/dist/core/runtime-lock.js

@@ -0,0 +1,101 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const RUNTIME_LOCK_DIR_ENV = 'EVOLCORE_RUNTIME_LOCK_DIR';
+/**
+ * Resolve a task-provided lock location without accepting relative or escaped
+ * paths. When no managed task context is present, callers retain their legacy
+ * on-disk lock path for daemon-side compatibility and migration tooling.
+ */
+export function resolveManagedLockPath(namespace, identity, legacyPath) {
+    const configured = process.env[RUNTIME_LOCK_DIR_ENV]?.trim();
+    if (!configured || !path.isAbsolute(configured) || !namespace || !identity || !isTrustedRuntimeLockDir(configured)) {
+        return legacyPath;
+    }
+    const digest = crypto.createHash('sha256').update(identity).digest('hex').slice(0, 24);
+    return path.join(path.resolve(configured), namespace, `${digest}.lock`);
+}
+function isTrustedRuntimeLockDir(candidate) {
+    const resolved = path.resolve(candidate);
+    if (path.basename(resolved) !== 'evolcore-locks')
+        return false;
+    const tmpRoot = process.env.TMPDIR?.trim();
+    if (!tmpRoot || !path.isAbsolute(tmpRoot))
+        return false;
+    const resolvedTmpRoot = path.resolve(tmpRoot);
+    const relative = path.relative(resolvedTmpRoot, resolved);
+    const isWithinTmp = relative !== '..'
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+    // The daemon supplies each task either a generic evolcore-runtime-* child
+    // or Codex's private digest directory. Both share a sibling evolcore-locks
+    // directory so mutations from separate sessions still serialize. Do not
+    // accept arbitrary TMPDIR siblings supplied by a child process.
+    const tmpBase = path.basename(resolvedTmpRoot);
+    const tmpParent = path.dirname(resolvedTmpRoot);
+    const isGenericSessionRuntime = /^evolcore-runtime-[a-f0-9]{24}$/.test(tmpBase);
+    const isCodexSessionRuntime = /^[a-f0-9]{24}$/.test(tmpBase)
+        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(tmpParent));
+    const isManagedSessionSibling = (isGenericSessionRuntime || isCodexSessionRuntime)
+        && path.dirname(resolved) === tmpParent;
+    if (!isWithinTmp && !isManagedSessionSibling)
+        return false;
+    try {
+        const tmpStat = fs.lstatSync(resolvedTmpRoot);
+        if (!tmpStat.isDirectory() || tmpStat.isSymbolicLink())
+            return false;
+        if (typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
+            return false;
+        if ((tmpStat.mode & 0o077) !== 0)
+            return false;
+        if (isManagedSessionSibling) {
+            const parentStat = fs.lstatSync(tmpParent);
+            if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
+                return false;
+            if (typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
+                return false;
+            if ((parentStat.mode & 0o077) !== 0)
+                return false;
+        }
+        const stat = fs.lstatSync(resolved);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return false;
+        if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            return false;
+        return (stat.mode & 0o077) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function ensureManagedLockParent(lockPath) {
+    const configured = process.env[RUNTIME_LOCK_DIR_ENV]?.trim();
+    if (!configured || !isTrustedRuntimeLockDir(configured)) {
+        throw new Error('managed runtime lock directory is not trusted');
+    }
+    const root = path.resolve(configured);
+    const parent = path.resolve(path.dirname(lockPath));
+    const relative = path.relative(root, parent);
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error('managed runtime lock parent escapes its runtime directory');
+    }
+    // Create each component individually. mkdir({recursive:true}) would follow a
+    // pre-existing symlink in a namespace component before it can be checked.
+    let current = root;
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            fs.mkdirSync(current, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST')
+                throw error;
+        }
+        const stat = fs.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink()
+            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (stat.mode & 0o077) !== 0) {
+            throw new Error(`managed runtime lock path is not a private real directory: ${current}`);
+        }
+    }
+}

package/dist/index.js

@@ -87,6 +87,7 @@ import { applyTriggerPatch } from './trigger/patch.js';
 import { validateModelSelectionForRole } from './core/model/model-permission.js';
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride, } from './core/role/runtime-policy.js';
 import { atomicWriteJson } from './core/session/session-fs-store.js';
+import { ensureProcessManagedTempDir } from './cli/task-context.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from './core/message/message-log.js';
 import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 import { MAIN_PACKAGE_NAME } from './product.js';
@@ -456,6 +457,20 @@ export async function sendSystemPayload(adapter, envelope, payload) {
 }
 async function runBindBootstrapDaemon(daemonCfg) {
     logger.warn('[bind-bootstrap] starting control AID + IPC only');
+    // Bootstrap exits before the normal trigger scheduler is constructed. Keep
+    // the daemon-owned upgrade check present during a fresh installation too;
+    // the regular startup path will reseed this definition idempotently.
+    const bootstrapControlAid = daemonCfg.aid || '__daemon__';
+    try {
+        seedUpgradeCheckTrigger(new TriggerDefinitionManager(bootstrapControlAid), {
+            aid: bootstrapControlAid,
+            originPeerId: bootstrapControlAid,
+            baseagent: 'codex',
+        });
+    }
+    catch (error) {
+        logger.warn(`[bind-bootstrap] failed to seed daemon upgrade trigger: ${error instanceof Error ? error.message : String(error)}`);
+    }
     const bindService = new BindService({
         receiverAid: daemonCfg.aid,
         getAvailableBaseagents: detectAvailableBaseagentsForBind,
@@ -649,6 +664,9 @@ function readFastaunVersion() {
     }
 }
 async function main() {
+    // Service managers do not necessarily export TMPDIR. Establish the private
+    // managed root before any runner or task runtime is initialized.
+    ensureProcessManagedTempDir();
     // 启动信息：目录类型 + 版本号 + 代码最新时间戳
     {
         const pkgRoot = getPackageRoot();
@@ -1726,11 +1744,20 @@ async function main() {
         // 0. 包装 adapter.send，记录所有出站到 channel-out.log
         const originalSend = inst.adapter.send.bind(inst.adapter);
         inst.adapter.send = async (envelope, payload) => {
-            logger.channelOut({ channel: inst.adapter.channelName, channelId: envelope.channelId, taskId: envelope.taskId, payload: summarizeOutboundPayload(payload) });
+            const owningAgent = agentRegistry.resolveByChannel(inst.adapter.channelKey)
+                ?? agentRegistry.resolveByChannel(inst.adapter.channelName);
+            logger.channelOut({
+                channel: inst.adapter.channelName,
+                channelId: envelope.channelId,
+                taskId: envelope.taskId,
+                correlationId: envelope.operationId ?? envelope.taskId,
+                sessionId: envelope.sessionId,
+                agentAid: owningAgent?.aid,
+                agentName: envelope.agentName,
+                payload: summarizeOutboundPayload(payload),
+            });
             const result = await originalSend(envelope, payload);
             if (shouldCountSentPayload(payload)) {
-                const owningAgent = agentRegistry.resolveByChannel(inst.adapter.channelKey)
-                    ?? agentRegistry.resolveByChannel(inst.adapter.channelName);
                 if ((inst.channelType || inst.adapter.channelName) !== 'aun') {
                     try {
                         const logPayload = outboundPayloadToLogText(payload);

package/dist/response-system/engines/v1/proactive-flow.js

@@ -10,6 +10,84 @@
  */
 const STATE_KEY = 'proactive';
 const TOOL_REPORT_INTERVAL = 10;
+const SEND_RECEIPT_RE = /["']?(?:message[_ -]?id|handoff[_ -]?id)["']?\s*[:=]\s*["']?([A-Za-z0-9][A-Za-z0-9._:-]*)/gi;
+const HANDOFF_TEXT_RECEIPT_RE = /\bhandoff\s+(h-[A-Za-z0-9._-]+)/i;
+function hasSuccessfulSendReceipt(result, isError) {
+    if (isError === true)
+        return false;
+    const hasReceiptValue = (value) => {
+        if (typeof value !== 'string')
+            return false;
+        const normalized = value.trim().toLowerCase();
+        return normalized.length > 0 && normalized !== '-' && normalized !== 'undefined' && normalized !== 'null';
+    };
+    const hasExplicitFailure = (value, seen) => {
+        if (!value || typeof value !== 'object')
+            return false;
+        if (seen.has(value))
+            return false;
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.some(item => hasExplicitFailure(item, seen));
+        const data = value;
+        if (Object.prototype.hasOwnProperty.call(data, 'ok') && data.ok !== true)
+            return true;
+        if (typeof data.error === 'string' && data.error.trim())
+            return true;
+        if (typeof data.status === 'string' && /^(failed|error|rejected|denied)$/i.test(data.status.trim()))
+            return true;
+        return Object.values(data).some(item => hasExplicitFailure(item, seen));
+    };
+    if (hasExplicitFailure(result, new Set()))
+        return false;
+    const inspect = (value, seen) => {
+        if (!value || typeof value !== 'object')
+            return false;
+        if (seen.has(value))
+            return false;
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.some(item => inspect(item, seen));
+        for (const [key, item] of Object.entries(value)) {
+            if ((key === 'message_id' || key === 'handoff_id' || key === 'messageId' || key === 'handoffId')
+                && hasReceiptValue(item))
+                return true;
+            if (inspect(item, seen))
+                return true;
+        }
+        return false;
+    };
+    if (inspect(result, new Set()))
+        return true;
+    let text = '';
+    if (typeof result === 'string')
+        text = result;
+    else {
+        try {
+            text = JSON.stringify(result) ?? '';
+        }
+        catch {
+            return false;
+        }
+    }
+    if (/(?:^|\n)\s*(?:script failed|❌)|returned no (?:message|group message)/i.test(text))
+        return false;
+    if (/(?:^|[\s,{])["']?ok["']?\s*[:=]\s*(?:false|0|no)\b/i.test(text))
+        return false;
+    if (/(?:^|[\s,{])["']?status["']?\s*[:=]\s*["']?(?:failed|error|rejected|denied)\b/i.test(text))
+        return false;
+    if (/\b(?:failed|failure|error|rejected|denied)\b/i.test(text))
+        return false;
+    SEND_RECEIPT_RE.lastIndex = 0;
+    for (const match of text.matchAll(SEND_RECEIPT_RE)) {
+        if (hasReceiptValue(match[1]))
+            return true;
+    }
+    const handoffText = text.match(HANDOFF_TEXT_RECEIPT_RE)?.[1];
+    if (hasReceiptValue(handoffText))
+        return true;
+    return false;
+}
 function isHumanFacingMessage(message) {
     if (message.source === 'trigger')
         return false;
@@ -106,15 +184,9 @@ export const proactiveFlow = {
         const state = ctx.state.get(STATE_KEY);
         if (!state)
             return;
-        // PreToolUse 可能被工具子进程直接调用，因此审批阶段不能推进门禁状态。
-        // 只有 runner 发布真实工具事件后，精确匹配的发送命令才提交状态。
+        // PreToolUse 和 tool_use 都发生在命令执行前，不能推进发送门禁。
+        // 只有成功的 tool_result 携带明确回执时才提交状态。
         const isAllowedTool = ctx.isSendCommand(ctx.toolName, ctx.toolInput);
-        if (isAllowedTool) {
-            if (state.firstSendRequired && !state.firstToolDone)
-                state.firstToolDone = true;
-            if (state.toolReportPending)
-                state.toolReportPending = false;
-        }
         if (!state.toolUseReminder)
             return;
         // 队列未读变化提醒
@@ -139,6 +211,18 @@ export const proactiveFlow = {
             ctx.injectToModel(`⚠️ 工具调用已达到 ${state.toolCount} 次，请立即用 ${cmdHint} 向${target}汇报当前情况和下一步意图。`);
         }
     },
+    // ─── onToolResult：成功发送回执后解除门禁 ───
+    onToolResult(ctx) {
+        const state = ctx.state.get(STATE_KEY);
+        if (!state || !ctx.isSendCommand(ctx.toolName, ctx.toolInput))
+            return;
+        if (!hasSuccessfulSendReceipt(ctx.result, ctx.isError || !!ctx.error))
+            return;
+        if (state.firstSendRequired && !state.firstToolDone)
+            state.firstToolDone = true;
+        if (state.toolReportPending)
+            state.toolReportPending = false;
+    },
     // ─── onComplete：标志位检查 ───
     async onComplete(ctx) {
         if (/\[PROACTIVE:REPLY_CONFIRMED_(SENT|NONE)\]/.test(ctx.lastReplyText)) {

package/dist/response-system/modes/single-session/index.js

@@ -79,6 +79,9 @@ export class SingleSessionMode {
     onToolUse(ctx) {
         return this.flow().onToolUse?.(ctx);
     }
+    onToolResult(ctx) {
+        return this.flow().onToolResult?.(ctx);
+    }
     onComplete(ctx) {
         return this.flow().onComplete?.(ctx);
     }

package/dist/trigger/history.js

@@ -1,16 +1,29 @@
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
+import { isManagedSessionRuntimeDir, SESSION_RUNTIME_DIR_ENV } from '../cli/task-context.js';
 import { definitionRevision } from './validation.js';
 export class TriggerHistoryStore {
     rootDir;
     agentAid;
     file;
+    fallbackFile;
     constructor(rootDir, agentAid) {
         this.rootDir = rootDir;
         this.agentAid = agentAid;
-        fs.mkdirSync(rootDir, { recursive: true });
+        try {
+            fs.mkdirSync(rootDir, { recursive: true });
+        }
+        catch (error) {
+            if (!['EACCES', 'EPERM', 'EROFS'].includes(error?.code))
+                throw error;
+        }
         this.file = path.join(rootDir, 'history.jsonl');
+        const runtimeDir = process.env[SESSION_RUNTIME_DIR_ENV];
+        if (isManagedSessionRuntimeDir(runtimeDir)) {
+            const digest = crypto.createHash('sha256').update(this.agentAid).digest('hex').slice(0, 24);
+            this.fallbackFile = path.join(path.resolve(runtimeDir), 'trigger-history', digest, 'history.jsonl');
+        }
     }
     recordDefinition(type, definition, opts = {}) {
         const event = {
@@ -191,15 +204,37 @@ export class TriggerHistoryStore {
         return imported;
     }
     append(event) {
-        fs.appendFileSync(this.file, `${JSON.stringify(event)}\n`, { encoding: 'utf8', mode: 0o600 });
-    }
-    readLines() {
+        const line = `${JSON.stringify(event)}\n`;
         try {
-            return fs.readFileSync(this.file, 'utf8').split('\n').filter(Boolean);
+            fs.appendFileSync(this.file, line, { encoding: 'utf8', mode: 0o600 });
+            return;
         }
-        catch {
-            return [];
+        catch (error) {
+            if (!this.fallbackFile || !['EACCES', 'EPERM', 'EROFS'].includes(error?.code))
+                throw error;
+        }
+        try {
+            fs.mkdirSync(path.dirname(this.fallbackFile), { recursive: true, mode: 0o700 });
+            fs.appendFileSync(this.fallbackFile, line, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch (error) {
+            // A readonly task may legitimately have no writable runtime. Preserve
+            // the command result while making the loss visible to the daemon log.
+            if (!['EACCES', 'EPERM', 'EROFS'].includes(error?.code))
+                throw error;
+        }
+    }
+    readLines() {
+        const lines = [];
+        for (const file of [this.file, this.fallbackFile].filter((value) => !!value)) {
+            try {
+                lines.push(...fs.readFileSync(file, 'utf8').split('\n').filter(Boolean));
+            }
+            catch {
+                // Missing or inaccessible history is treated as an empty source.
+            }
         }
+        return lines;
     }
     mergeRunStats(legacy, current) {
         if (!legacy)

package/dist/utils/error-utils.js

@@ -358,6 +358,13 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     if (msg.includes('401') || msg.includes('authentication_error') || msg.toLowerCase().includes('unauthorized')) {
         return `${errPrefix}API Key 无效，请检查密钥配置。使用 /status 查看当前配置`;
     }
+    // Managed PreToolUse availability is a deterministic local configuration
+    // failure. Preserve the actionable setup guidance instead of telling the
+    // user to retry a condition that cannot change by itself.
+    if (msg.includes('Codex Windows proactive requires an installed and loaded EvolCore managed PreToolUse hook')
+        || msg.includes('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook')) {
+        return `${errPrefix}${msg}`;
+    }
     if (hasRetryableHttpStatus(msg)) {
         return `${warnPrefix}API 服务暂时不可用，请稍后重试`;
     }

package/dist/utils/logger.js

@@ -39,6 +39,39 @@ function getWriters() {
 function shouldLog(level) {
     return (LEVELS[level] ?? 1) >= (LEVELS[currentLevel] ?? 1);
 }
+/** Keep structured log streams joinable even when a producer only knows one
+ * of the lifecycle identifiers. Existing fields remain source-of-truth; this
+ * only supplies aliases used by daily interception analysis. */
+export function normalizeStructuredLog(data) {
+    if (!data || typeof data !== 'object' || Array.isArray(data))
+        return data;
+    const nested = data.event && typeof data.event === 'object' ? data.event : undefined;
+    const correlationId = data.correlationId
+        ?? data.callId
+        ?? data.requestId
+        ?? data.operationId
+        ?? data.msgId
+        ?? nested?.correlationId
+        ?? nested?.callId;
+    const sessionId = data.sessionId ?? nested?.sessionId;
+    const agentAid = data.agentAid ?? data.selfAid ?? nested?.agentAid;
+    const toolName = data.toolName ?? data.tool ?? nested?.toolName ?? nested?.name;
+    const isToolResult = data.type === 'tool:result' || nested?.type === 'tool_result';
+    const decision = data.decision
+        ?? data.status
+        ?? (isToolResult && (data.isError === true || nested?.isError === true) ? 'error' : undefined)
+        ?? (isToolResult && (data.isError === false || nested?.isError === false) ? 'allow' : undefined)
+        ?? (nested?.type === 'tool_use' ? 'started' : undefined)
+        ?? nested?.decision;
+    return {
+        ...data,
+        ...(correlationId ? { correlationId } : {}),
+        ...(sessionId ? { sessionId } : {}),
+        ...(agentAid ? { agentAid } : {}),
+        ...(toolName ? { toolName } : {}),
+        ...(decision ? { decision } : {}),
+    };
+}
 export function localTimestamp() {
     const d = new Date();
     const pad = (n) => String(n).padStart(2, '0');
@@ -72,18 +105,18 @@ export const logger = {
         const writer = getWriters().message;
         if (!writer)
             return;
-        writer.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+        writer.write(JSON.stringify({ ts: localTimestamp(), ...normalizeStructuredLog(data) }));
     },
     event: (data) => {
         const writer = getWriters().event;
         if (!writer)
             return;
-        writer.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+        writer.write(JSON.stringify({ ts: localTimestamp(), ...normalizeStructuredLog(data) }));
     },
     channelIn: (data) => {
-        getWriters().channelIn.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+        getWriters().channelIn.write(JSON.stringify({ ts: localTimestamp(), ...normalizeStructuredLog(data) }));
     },
     channelOut: (data) => {
-        getWriters().channelOut.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+        getWriters().channelOut.write(JSON.stringify({ ts: localTimestamp(), ...normalizeStructuredLog(data) }));
     }
 };

package/kits/templates/roles/admin.json

@@ -68,6 +68,8 @@
     "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.move": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.remove": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.getfacl": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.setfacl": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "*": { "allow": true },
     "agent.reload": {
       "allow": true,

package/kits/templates/roles/member.json

@@ -66,6 +66,7 @@
     "ec.fs.cat": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.find": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.df": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.getfacl": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.mkdir": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.upload": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",