evolcore 0.0.15 → 0.0.16

package/dist/core/permission/tool-policy.js

@@ -484,13 +484,19 @@ function analyzeShellProtectedOperands(command, options) {
             analysis,
             hClass: containsHClassReference(command),
             lClass: containsLClassReference(command),
+            pathHClass: false,
+            lockDiagnostic: false,
         };
     }
     const operands = queryPathOperands(analysis);
+    const lockDiagnostic = /(?:^|[\/\s'"`])(?:[^\s'"`/]*\.lock|EVOLCORE_RUNTIME_LOCK_DIR)(?=$|[\/\s'"`=])/i.test(command);
+    const pathHClass = operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'h', options, accessKind));
     return {
         analysis,
-        hClass: operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'h', options, accessKind)),
+        hClass: lockDiagnostic || pathHClass,
         lClass: operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'l', options, accessKind)),
+        pathHClass,
+        lockDiagnostic,
     };
 }
 function protectedReadToolPaths(toolName, input) {
@@ -586,6 +592,45 @@ function readonlyShellStaysInWorkspace(analysis, projectPath, managedTempDir) {
             || (!!managedTemp && isSameOrDescendant(candidate, managedTemp));
     })());
 }
+const READONLY_SOURCE_ROOTS = new Set([
+    'src', 'lib', 'app', 'apps', 'packages', 'package', 'scripts',
+    'test', 'tests', 'ecagent', 'ecweb',
+]);
+/**
+ * Optional source-diagnostic capability. It is deliberately opt-in and only
+ * admits bounded, proven-readonly queries rooted at a named source directory;
+ * project root, home, dependency, config, and session trees remain outside it.
+ */
+function readonlySourceDiagnosticAllowed(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly')
+        return false;
+    const workspace = resolveProtectedCandidate(projectPath);
+    const operands = queryPathOperands(analysis);
+    if (operands.length === 0)
+        return false;
+    return operands.every(({ operand, accessKind }) => {
+        if (accessKind === 'metadata')
+            return false;
+        const candidate = resolveProtectedCandidate(operand.value, projectPath);
+        if (!isSameOrDescendant(candidate, workspace))
+            return false;
+        const relative = path.relative(workspace, candidate);
+        const segments = relative.split(path.sep).filter(Boolean);
+        const first = segments[0];
+        if (!first || !READONLY_SOURCE_ROOTS.has(first) || segments.includes('node_modules'))
+            return false;
+        return !containsHClassReference(operand.value) && !containsLClassReference(operand.value)
+            && !containsLockPathReference(operand.value)
+            && !isHClassPath(candidate, { root: resolveRoot() })
+            && !isLClassPath(candidate, { root: resolveRoot() });
+    });
+}
+/** A lock filename used as a query pattern is safe; an operand naming the
+ * actual lock path is still protected. */
+function containsLockPathReference(value) {
+    return /(?:^|[\\/])(?:[^\\/]*\.lock|EVOLCORE_RUNTIME_LOCK_DIR)(?:$|[\\/])/i.test(value)
+        || /^(?:[^\\/]*\.lock|EVOLCORE_RUNTIME_LOCK_DIR)$/i.test(value);
+}
 /**
  * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）。普通
  * 路径上的受限查询 Bash 可自动执行；H/L-class 和未建模 Shell 仍拒绝。
@@ -631,6 +676,13 @@ export function checkReadonly(toolName, input, projectPath, context) {
             managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceDiagnosticAllowed = context?.allowReadonlySourceDiagnostics
+            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath)
+            && !protectedOperands.lClass
+            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+        if (sourceDiagnosticAllowed) {
+            return { behavior: 'allow' };
+        }
         if (protectedOperands.analysis.kind === 'proven-readonly'
             && !protectedOperands.hClass
             && !protectedOperands.lClass
@@ -929,7 +981,12 @@ export function checkHClassWrite(toolName, input, context) {
             managedTempDir: context?.managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
-        if (protectedOperands.hClass) {
+        const sourceDiagnosticAllowed = context?.permissionMode === 'readonly'
+            && context.allowReadonlySourceDiagnostics === true
+            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, context.projectPath ?? process.cwd())
+            && !protectedOperands.lClass
+            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+        if (protectedOperands.hClass && !sourceDiagnosticAllowed) {
             logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
@@ -1398,6 +1455,8 @@ export function evaluateToolPreflight(toolName, input, context) {
         workspacePath: context.workspacePath,
         root: context.root,
         managedTempDir: context.managedTempDir,
+        permissionMode: context.permissionMode,
+        allowReadonlySourceDiagnostics: context.allowReadonlySourceDiagnostics,
         allowProtectedMetadata: context.allowProtectedMetadata,
     });
     if (hClass.behavior === 'deny') {

package/dist/index.js

@@ -227,18 +227,21 @@ export function resolvePersistedRestartDelivery(opts) {
         ? { valid: true, delivery: opts.delivery }
         : { valid: false };
 }
-function daemonConversationWatchdogMs(settings) {
+function daemonIdleTimeoutMs(settings) {
     const idleTimeoutSec = settings.idleMonitor?.timeout;
-    const idleMs = typeof idleTimeoutSec === 'number' && Number.isFinite(idleTimeoutSec) && idleTimeoutSec > 0
+    return typeof idleTimeoutSec === 'number' && Number.isFinite(idleTimeoutSec) && idleTimeoutSec > 0
         ? idleTimeoutSec * 1000
         : 120_000;
+}
+function daemonConversationWatchdogMs(settings) {
+    const idleMs = daemonIdleTimeoutMs(settings);
     return Math.ceil(idleMs * 5 + 60_000);
 }
 function daemonConversationTotalExecutionMs(settings) {
     const seconds = settings.idleMonitor?.maxExecutionTime;
     return typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0
         ? seconds * 1000
-        : 60 * 60 * 1000;
+        : undefined;
 }
 function originFromActorSession(session, authenticatedPeerId, authenticatedChannelKey, authenticatedChatType) {
     const peerId = authenticatedPeerId || session.metadata?.peerId;
@@ -1227,6 +1230,7 @@ async function main() {
     // 回填 messageQueue 引用
     cmdHandler.setMessageQueue(messageQueue);
     processor.setMessageQueue(messageQueue);
+    const handoffQueueTtlMs = daemonIdleTimeoutMs(globalSettings);
     const taskExecutionTtlMs = daemonConversationTotalExecutionMs(globalSettings);
     const handoffRuntime = new HandoffRuntime(sessionManager, messageQueue, async (handoff) => {
         const targetSession = await sessionManager.getSessionById(handoff.target_session_id);
@@ -1277,7 +1281,7 @@ async function main() {
                 })
                 : { ok: false, error: 'AUN channel does not support daemon private sends' };
         return { ok: result.ok, message_id: result.message_id, error: result.error };
-    }, undefined, { queueTtlMs: taskExecutionTtlMs });
+    }, undefined, { queueTtlMs: handoffQueueTtlMs });
     responseEngine.setHandoffRuntime(handoffRuntime);
     cmdHandler.setHandoffRuntime(handoffRuntime);
     // Trigger runtime: daemon-level script + feedback scheduler.

package/dist/ipc.js

@@ -1047,6 +1047,7 @@ export class IpcServer {
  * Query the running EvolCore daemon via Unix socket.
  * Returns null if the service is not running or the socket is unreachable.
  */
+/** Pass `null` as timeoutMs to wait without a client-side deadline. */
 export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
     let authenticatedCmd = cmd;
     if (!process.env.EVOLCORE_SESSION_ID
@@ -1067,10 +1068,12 @@ export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
     return new Promise((resolve) => {
         const conn = net.connect(socketPath);
         let buf = '';
-        const timer = setTimeout(() => {
-            conn.destroy();
-            resolve(null);
-        }, timeoutMs);
+        const timer = timeoutMs === null
+            ? undefined
+            : setTimeout(() => {
+                conn.destroy();
+                resolve(null);
+            }, timeoutMs);
         conn.on('connect', () => {
             conn.write(JSON.stringify(request) + '\n');
         });
@@ -1078,7 +1081,8 @@ export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
             buf += data.toString();
             const idx = buf.indexOf('\n');
             if (idx !== -1) {
-                clearTimeout(timer);
+                if (timer)
+                    clearTimeout(timer);
                 try {
                     resolve(JSON.parse(buf.slice(0, idx)));
                 }
@@ -1089,7 +1093,8 @@ export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
             }
         });
         conn.on('error', () => {
-            clearTimeout(timer);
+            if (timer)
+                clearTimeout(timer);
             resolve(null);
         });
     });

package/dist/paths.js

@@ -169,7 +169,24 @@ function resolveInstanceSocketPath(root) {
         const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\${WINDOWS_PIPE_PREFIX}-${hash}`;
     }
-    return path.join(root, 'data', 'instance', INSTANCE_SOCKET_FILENAME);
+    const filesystemPath = path.join(root, 'data', 'instance', INSTANCE_SOCKET_FILENAME);
+    // Linux/macOS Unix-domain sockets have a small sockaddr path limit
+    // (typically 108 bytes on Linux). Long managed TMPDIR prefixes can make a
+    // perfectly valid EVOLCORE_HOME impossible to bind. Keep the fallback a
+    // normal filesystem socket whenever possible: the endpoint is passed to
+    // child processes through environment variables, which cannot contain NUL
+    // bytes. The short path remains inside the managed temporary directory and
+    // uses the runtime root hash for isolation.
+    if (Buffer.byteLength(filesystemPath) < 100)
+        return filesystemPath;
+    const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 20);
+    const shortFilesystemPath = path.join(os.tmpdir(), `.ec-${hash.slice(0, 15)}.sock`);
+    if (Buffer.byteLength(shortFilesystemPath) < 100)
+        return shortFilesystemPath;
+    // This is only reachable when the managed temporary directory itself is
+    // unusually long. Node's in-process IPC can use the abstract namespace;
+    // callers that cross a process boundary must provide an encoded endpoint.
+    return `\0evolcore-${hash}`;
 }
 export function ensureDataDirs() {
     const p = resolvePaths();

package/dist/trigger/scheduler.js

@@ -1064,9 +1064,10 @@ export class TriggerRuntimeScheduler {
             && !!run.attemptId
             && typeof run.executionSessionId === 'string'
             && !!run.executionSessionId
-            && typeof run.executionDeadlineAt === 'number'
-            && Number.isFinite(run.executionDeadlineAt)
-            && run.executionDeadlineAt > Date.now()
+            && (run.executionDeadlineAt === undefined
+                || (typeof run.executionDeadlineAt === 'number'
+                    && Number.isFinite(run.executionDeadlineAt)
+                    && run.executionDeadlineAt > Date.now()))
             && run.definitionRevision === definitionRevision(definition);
     }
     async continueRecoveredRun(definition, runtime, session) {
@@ -1668,7 +1669,7 @@ export class TriggerRuntimeScheduler {
         return this.running.get(triggerId)?.has(runId) === true;
     }
     daemonExecutionDeadlineAt(startedAt) {
-        return this.daemonChannel.executionDeadlineAt?.(startedAt) ?? startedAt + 60 * 60 * 1_000;
+        return this.daemonChannel.executionDeadlineAt?.(startedAt);
     }
     clearTimer(triggerId) {
         const timer = this.timers.get(triggerId);

package/dist/utils/cross-platform.js

@@ -4,6 +4,7 @@ import { execFileSync, execFile, spawn, spawnSync } from 'child_process';
 import { promisify } from 'util';
 import fs from 'fs';
 import { getProcessStartTime, parseCimDate } from './process-introspect.js';
+import { decodeWindowsOutput } from './windows-output.js';
 const execFileAsync = promisify(execFile);
 export const isWindows = process.platform === 'win32';
 /**
@@ -287,30 +288,6 @@ function parseDateString(value) {
     const parsed = Date.parse(value);
     return Number.isNaN(parsed) ? null : parsed;
 }
-/** Decode PowerShell output consistently across Windows 5.1 and pwsh. */
-function decodeWindowsOutput(value) {
-    if (!value)
-        return '';
-    const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value);
-    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe) {
-        return bytes.subarray(2).toString('utf16le');
-    }
-    if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
-        const swapped = Buffer.allocUnsafe(bytes.length - 2);
-        for (let i = 2; i + 1 < bytes.length; i += 2) {
-            swapped[i - 2] = bytes[i + 1];
-            swapped[i - 1] = bytes[i];
-        }
-        return swapped.toString('utf16le');
-    }
-    const utf8 = bytes.toString('utf8').replace(/^\uFEFF/, '');
-    if (utf8.includes('\u0000')) {
-        const utf16 = bytes.toString('utf16le').replace(/^\uFEFF/, '');
-        if (utf16.includes('{') || utf16.includes('[') || utf16.includes('CommandLine'))
-            return utf16;
-    }
-    return utf8;
-}
 /**
  * Cross-platform command existence check.
  */

package/dist/utils/instance-registry.js

@@ -11,10 +11,11 @@
 import fs from 'fs';
 import path from 'path';
 import { spawnSync } from 'child_process';
-import { resolvePaths } from '../paths.js';
+import { getPackageRoot, resolvePaths } from '../paths.js';
 import { isProcessRunning, killProcess, isWindows, findProcesses } from './cross-platform.js';
 import { getProcessStartTime, startTimeMatches } from './process-introspect.js';
 import { isConfirmedLeakedTestDaemon, runtimeHomeFromEnv } from './restart-safety.js';
+import { decodeWindowsOutput } from './windows-output.js';
 // ── Helpers ──
 function instanceDir() {
     return resolvePaths().instanceDir;
@@ -334,8 +335,37 @@ export function removeAll(pid) {
 function killPid(pid) {
     killProcess(pid, true);
 }
+function normalizeProcessPath(value) {
+    return value.replace(/[\\/]+/g, '/').toLowerCase();
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 /**
- * 扫所有 node 进程中跑 dist/index.js 的 PID，减去当前 HOME 已登记的 main PID。
+ * Return whether a process command line contains an exact EvolCore package
+ * main entry point. The current package path is accepted verbatim, while
+ * other installations are accepted only when their package directory is
+ * explicitly named `evolcore`.
+ *
+ * Matching the package entry instead of any `dist/index.js` path prevents
+ * unrelated Node services (for example BrowserMCP) from being classified as
+ * EvolCore orphans.
+ */
+export function isEvolCoreMainCommand(cmdline, packageRoot = getPackageRoot()) {
+    const mainEntry = normalizeProcessPath(path.join(packageRoot, 'dist', 'index.js'));
+    const command = normalizeProcessPath(cmdline);
+    const entryPattern = escapeRegExp(mainEntry);
+    if (new RegExp(`(?:^|[\\s"'=])${entryPattern}(?=$|[\\s"'])`).test(command))
+        return true;
+    // Cross-install detection (notably on Windows/macOS where process
+    // environments may be unavailable): only an exact `evolcore/dist/index.js`
+    // package suffix qualifies. This deliberately excludes BrowserMCP and
+    // every other package that happens to use the same entry filename.
+    return /(?:^|[\s"'=])(?:[^"'=]*\/)?evolcore\/dist\/index\.js(?=$|[\s"'])/.test(command);
+}
+/**
+ * 扫所有 node 进程中运行当前 EvolCore 包 dist/index.js 的 PID，减去当前 HOME
+ * 已登记的 main PID。
  *
  * 用途：检测跨 HOME 残留的 evolcore 主进程（例如测试套件 spawn 后未清理、
  * 旧版本 pidfile 模式遗留等），由 cmdStart/cmdRestart 在启动前提示用户。
@@ -358,7 +388,7 @@ export function findOrphanProcesses() {
         if (m.alive)
             known.add(m.record.pid);
     }
-    // 2. 系统中所有跑 dist/index.js 的 node 进程
+    // 2. 先按入口文件名找候选，再用完整包路径做严格校验。
     // Use a stable filename anchor for the Windows CIM query. The full path
     // regex contains escaped separators and is applied after command lines have
     // been fetched; embedding it in the CIM pre-filter can silently miss a
@@ -371,11 +401,8 @@ export function findOrphanProcesses() {
         if (!isProcessRunning(pid))
             continue;
         const cmdline = readCmdline(pid);
-        // 二次验证：确实是 evolcore 的 dist/index.js
-        if (!/dist[\\/]index\.js/.test(cmdline))
-            continue;
-        // 三次验证：排除内嵌 ecweb 与独立 npm 包 ec-web。
-        if (/[\\/](?:ecweb|ec-web)[\\/]dist[\\/]index\.js/.test(cmdline))
+        // 二次验证：入口必须是当前 EvolCore 包的 dist/index.js。
+        if (!isEvolCoreMainCommand(cmdline))
             continue;
         const processEnv = readProcessEnvironment(pid);
         orphans.push({
@@ -440,25 +467,6 @@ function readCmdline(pid) {
         }
     }
 }
-function decodeWindowsOutput(value) {
-    if (!value)
-        return '';
-    const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value);
-    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe)
-        return bytes.subarray(2).toString('utf16le');
-    if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
-        const swapped = Buffer.allocUnsafe(bytes.length - 2);
-        for (let i = 2; i + 1 < bytes.length; i += 2) {
-            swapped[i - 2] = bytes[i + 1];
-            swapped[i - 1] = bytes[i];
-        }
-        return swapped.toString('utf16le');
-    }
-    const utf8 = bytes.toString('utf8').replace(/^\uFEFF/, '');
-    if (utf8.includes('\u0000'))
-        return bytes.toString('utf16le').replace(/^\uFEFF/, '');
-    return utf8;
-}
 function readProcessEnvironment(pid) {
     // Linux: /proc/<pid>/environ
     if (!isWindows && process.platform !== 'darwin') {

package/dist/utils/logger.js

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import { resolvePaths } from '../paths.js';
 import { LogWriter } from './log-writer.js';
+import { classifyToolErrorCode } from '../core/permission/tool-error-code.js';
 let currentLevel = process.env.LOG_LEVEL || 'INFO';
 const LEVELS = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
 const config = {
@@ -46,30 +47,60 @@ export function normalizeStructuredLog(data) {
     if (!data || typeof data !== 'object' || Array.isArray(data))
         return data;
     const nested = data.event && typeof data.event === 'object' ? data.event : undefined;
+    const eventType = data.type ?? nested?.type;
     const correlationId = data.correlationId
+        ?? data.correlation_id
         ?? data.callId
+        ?? data.call_id
+        ?? data.toolUseId
+        ?? data.tool_use_id
         ?? data.requestId
+        ?? data.request_id
         ?? data.operationId
         ?? data.msgId
         ?? nested?.correlationId
-        ?? nested?.callId;
-    const sessionId = data.sessionId ?? nested?.sessionId;
-    const agentAid = data.agentAid ?? data.selfAid ?? nested?.agentAid;
-    const toolName = data.toolName ?? data.tool ?? nested?.toolName ?? nested?.name;
-    const isToolResult = data.type === 'tool:result' || nested?.type === 'tool_result';
+        ?? nested?.correlation_id
+        ?? nested?.callId
+        ?? nested?.call_id
+        ?? nested?.toolUseId
+        ?? nested?.tool_use_id;
+    const sessionId = data.sessionId ?? data.session_id ?? nested?.sessionId ?? nested?.session_id;
+    const agentAid = data.agentAid ?? data.agent_aid ?? data.selfAid ?? nested?.agentAid ?? nested?.agent_aid;
+    const permissionMode = data.permissionMode ?? data.permission_mode ?? nested?.permissionMode ?? nested?.permission_mode;
+    const toolName = data.toolName ?? data.tool ?? data.name ?? nested?.toolName ?? nested?.name;
+    const isToolResult = eventType === 'tool:result' || eventType === 'tool_result';
+    const isToolUse = eventType === 'tool:use' || eventType === 'tool_use';
+    const isError = data.isError ?? data.is_error ?? (data.ok === false ? true : undefined)
+        ?? nested?.isError ?? nested?.is_error ?? (nested?.ok === false ? true : undefined);
+    const error = data.error ?? data.errorMessage ?? nested?.error ?? nested?.errorMessage;
+    const result = data.result ?? data.content ?? nested?.result ?? nested?.content;
     const decision = data.decision
         ?? data.status
-        ?? (isToolResult && (data.isError === true || nested?.isError === true) ? 'error' : undefined)
-        ?? (isToolResult && (data.isError === false || nested?.isError === false) ? 'allow' : undefined)
-        ?? (nested?.type === 'tool_use' ? 'started' : undefined)
+        ?? (isToolResult && isError === true ? 'error' : undefined)
+        ?? (isToolResult && isError === false ? 'allow' : undefined)
+        ?? (isToolUse ? 'started' : undefined)
         ?? nested?.decision;
+    const explicitErrorCode = data.errorCode
+        ?? data.error_code
+        ?? nested?.errorCode
+        ?? nested?.error_code;
+    const errorCode = isToolResult && isError === true
+        ? classifyToolErrorCode({ errorCode: explicitErrorCode, error, result })
+        : explicitErrorCode;
+    const lifecycleRecord = isToolUse || isToolResult;
+    const missingContextFields = lifecycleRecord
+        ? ['sessionId', 'agentAid', 'permissionMode'].filter(field => ({ sessionId, agentAid, permissionMode }[field] == null))
+        : [];
     return {
         ...data,
         ...(correlationId ? { correlationId } : {}),
-        ...(sessionId ? { sessionId } : {}),
-        ...(agentAid ? { agentAid } : {}),
+        ...(sessionId ? { sessionId } : lifecycleRecord ? { sessionId: 'unknown' } : {}),
+        ...(agentAid ? { agentAid } : lifecycleRecord ? { agentAid: 'unknown' } : {}),
+        ...(permissionMode ? { permissionMode } : lifecycleRecord ? { permissionMode: 'unknown' } : {}),
         ...(toolName ? { toolName } : {}),
         ...(decision ? { decision } : {}),
+        ...(errorCode ? { errorCode } : {}),
+        ...(missingContextFields.length > 0 ? { contextMissing: missingContextFields } : {}),
     };
 }
 export function localTimestamp() {

package/dist/utils/windows-autostart.js

@@ -2,19 +2,35 @@ import fs from 'fs';
 import path from 'path';
 import { spawnSync } from 'child_process';
 import { getPackageRoot } from '../paths.js';
+import { decodeWindowsOutput } from './windows-output.js';
 export const WINDOWS_AUTOSTART_TASK_NAME = 'EvolCore';
 function isWindows() {
     return process.platform === 'win32';
 }
 function runSchtasks(args) {
     return spawnSync('schtasks.exe', args, {
-        encoding: 'utf8',
+        encoding: 'buffer',
         windowsHide: true,
         timeout: 15_000,
     });
 }
 function commandError(result, fallback) {
-    return String(result.error?.message || result.stderr || result.stdout || fallback).trim();
+    const output = decodeWindowsOutput(result.stderr) || decodeWindowsOutput(result.stdout);
+    const status = result.status == null ? '' : `（退出码 ${result.status}）`;
+    const signal = result.signal ? `（信号 ${result.signal}）` : '';
+    return `${result.error?.message || output || fallback}${status}${signal}`.trim();
+}
+function isTaskNotFoundMessage(message) {
+    return /cannot find the file specified|系统找不到指定的文件|找不到指定的文件|指定的任务不存在|任务不存在/i.test(message);
+}
+function probeWindowsTask() {
+    const result = runSchtasks(['/Query', '/TN', WINDOWS_AUTOSTART_TASK_NAME]);
+    if (result.status === 0)
+        return { state: 'installed' };
+    const message = decodeWindowsOutput(result.stderr) || decodeWindowsOutput(result.stdout);
+    if (isTaskNotFoundMessage(message))
+        return { state: 'not-found' };
+    return { state: 'error', error: commandError(result, '查询 Windows 登录自启任务失败') };
 }
 function powershellLiteral(value) {
     return `'${value.replace(/'/g, "''")}'`;
@@ -28,8 +44,7 @@ function wrapperPath(runtimeRoot) {
 export function windowsAutostartInstalled() {
     if (!isWindows())
         return false;
-    const result = runSchtasks(['/Query', '/TN', WINDOWS_AUTOSTART_TASK_NAME]);
-    return result.status === 0;
+    return probeWindowsTask().state === 'installed';
 }
 function createWrapper(runtimeRoot) {
     const scriptPath = wrapperPath(runtimeRoot);
@@ -73,10 +88,18 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
     const scriptPath = wrapperPath(absoluteRoot);
     if (!enabled) {
         const result = runSchtasks(['/Delete', '/TN', WINDOWS_AUTOSTART_TASK_NAME, '/F']);
-        if (result.status !== 0 && windowsAutostartInstalled()) {
+        if (result.status !== 0) {
+            const probe = probeWindowsTask();
+            if (probe.state === 'not-found') {
+                try {
+                    fs.rmSync(scriptPath, { force: true });
+                }
+                catch { }
+                return { ok: true, enabled: false };
+            }
             return {
                 ok: false,
-                enabled: true,
+                enabled: probe.state === 'installed',
                 error: commandError(result, '删除 Windows 开机自启任务失败'),
             };
         }
@@ -91,7 +114,11 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
     try {
         if (fs.existsSync(scriptPath))
             previousWrapper = fs.readFileSync(scriptPath, 'utf8');
-        previouslyInstalled = windowsAutostartInstalled();
+        const previousTask = probeWindowsTask();
+        if (previousTask.state === 'error') {
+            return { ok: false, enabled: false, error: previousTask.error };
+        }
+        previouslyInstalled = previousTask.state === 'installed';
         const taskScript = createWrapper(absoluteRoot);
         const systemRoot = process.env.SystemRoot || 'C:\\Windows';
         const powershell = path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
@@ -108,14 +135,28 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
         const result = runSchtasks(args);
         if (result.status !== 0) {
             const restoreError = restoreWrapper(scriptPath, previousWrapper);
-            const stillInstalled = windowsAutostartInstalled();
+            const probe = probeWindowsTask();
             const rollbackSuffix = restoreError ? `; 恢复原启动脚本失败: ${restoreError}` : '';
             return {
                 ok: false,
-                enabled: stillInstalled,
+                enabled: probe.state === 'installed',
                 error: `${commandError(result, '创建 Windows 开机自启任务失败')}${rollbackSuffix}`,
             };
         }
+        const probe = probeWindowsTask();
+        if (probe.state !== 'installed') {
+            const cleanup = runSchtasks(['/Delete', '/TN', WINDOWS_AUTOSTART_TASK_NAME, '/F']);
+            const afterCleanup = cleanup.status === 0 ? probeWindowsTask() : probe;
+            const restoreError = restoreWrapper(scriptPath, previousWrapper);
+            const details = probe.state === 'error' ? probe.error : '创建后无法查询到任务';
+            const cleanupError = cleanup.status === 0 ? '' : `; 清理任务失败: ${commandError(cleanup, '未知错误')}`;
+            const rollbackSuffix = restoreError ? `; 恢复原启动脚本失败: ${restoreError}` : '';
+            return {
+                ok: false,
+                enabled: afterCleanup.state === 'installed',
+                error: `${details}${cleanupError}${rollbackSuffix}`,
+            };
+        }
         return { ok: true, enabled: true };
     }
     catch (error) {

package/dist/utils/windows-output.js

@@ -0,0 +1,36 @@
+import { TextDecoder } from 'util';
+/** Decode output from Windows native commands regardless of the active code page. */
+export function decodeWindowsOutput(value) {
+    if (!value)
+        return '';
+    const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value);
+    if (bytes.length === 0)
+        return '';
+    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe) {
+        return bytes.subarray(2).toString('utf16le').replace(/^\uFEFF/, '');
+    }
+    if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
+        const swapped = Buffer.allocUnsafe(bytes.length - 2);
+        for (let i = 2; i + 1 < bytes.length; i += 2) {
+            swapped[i - 2] = bytes[i + 1];
+            swapped[i - 1] = bytes[i];
+        }
+        return swapped.toString('utf16le').replace(/^\uFEFF/, '');
+    }
+    // Windows PowerShell 5.1 can emit UTF-16 without a BOM when stdout is
+    // redirected. NUL bytes are not expected in command text, so use them as
+    // the signal for this representation before trying code-page decoding.
+    const utf8Loose = bytes.toString('utf8');
+    if (utf8Loose.includes('\u0000')) {
+        const utf16 = bytes.toString('utf16le').replace(/^\uFEFF/, '');
+        if (!utf16.includes('\u0000'))
+            return utf16;
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes).replace(/^\uFEFF/, '');
+    }
+    catch {
+        // schtasks.exe uses the active Windows/OEM code page for redirected output.
+        return new TextDecoder('gb18030').decode(bytes).replace(/^\uFEFF/, '');
+    }
+}

package/kits/docs/evolcore/config.md

@@ -176,6 +176,7 @@ ec config unset groupRules.mode \
   `role` 由角色分配服务维护；`permissionMode` 仅在角色策略中维护
 - **兼容字段**：`enable_rich_content` 仍可读取旧值，但已废弃且不再产生运行时效果
 - **群规则策略**：`groupRules.mode` 仅 Agent owner 或 daemon owner 可 set/unset；其他角色可读取当前 relation 的有效值
+- **源码诊断白名单**：`readonlySourceDiagnostics` 默认关闭；开启后只读会话仅可在项目源码目录执行受限、可证明只读查询，配置/证书/快照/session/锁文件仍禁止访问
 - **仅人可写**：channels / owners / admins / 凭证 / aid / enabled / projects / aun / models.allowed
 - Agent 托管环境写仅人字段被拒
 

package/kits/schemas/agent-config.schema.10.json

@@ -195,6 +195,12 @@
       "x-merge": "dict",
       "description": "Agent 能力开关及能力参数"
     },
+    "readonlySourceDiagnostics": {
+      "type": "boolean",
+      "x-merge": "scalar",
+      "default": false,
+      "description": "允许只读会话在显式源码目录内执行受限、可证明只读的诊断查询"
+    },
     "observable": {
       "type": "boolean",
       "default": false,

package/kits/schemas/daemon.schema.1.json

@@ -67,7 +67,7 @@
         "enabled": { "type": "boolean", "default": true, "description": "是否启用空闲监控" },
         "timeout": { "type": "number", "default": 120, "description": "空闲超时秒数" },
         "retryAttemptTimeout": { "type": "number", "description": "API 重试尝试连续无事件时的超时秒数；未设置时继承 timeout" },
-        "maxExecutionTime": { "type": "number", "default": 3600, "description": "单个任务总执行时限（秒），等待审批期间仍继续计时" }
+        "maxExecutionTime": { "type": "number", "description": "单个任务总执行时限（秒）；未配置、非数字或小于等于 0 表示不限制" }
       }
     },
     "ecweb": {

package/kits/schemas/daemon.schema.2.json

@@ -77,7 +77,7 @@
         "enabled": { "type": "boolean", "default": true, "description": "是否启用空闲监控" },
         "timeout": { "type": "number", "default": 120, "description": "空闲超时秒数" },
         "retryAttemptTimeout": { "type": "number", "description": "API 重试尝试连续无事件时的超时秒数；未设置时继承 timeout" },
-        "maxExecutionTime": { "type": "number", "default": 3600, "description": "单个任务总执行时限（秒），等待审批期间仍继续计时" }
+        "maxExecutionTime": { "type": "number", "description": "单个任务总执行时限（秒）；未配置、非数字或小于等于 0 表示不限制" }
       }
     },
     "ecweb": {