evolcore 0.0.16 → 0.0.17

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.17 (2026-08-25)
+
+### Claude 与任务边界
+
+- 统一识别 Claude 启动参数过长错误，记录结构化能力不可用审计并以明确终态结束任务，避免无效重试和敏感启动参数泄露。
+
+### Codex 与 AUN 消息兼容
+
+- 将运行时 BaseAgent 信息传入任务上下文，仅对 Codex AUN 私聊/群聊文本载荷解码一层 `\\n`/`\\r`/`\\t` 转义，保持其它 Runner 和原始换行不变。
+
+### 临时目录与跨平台稳定性
+
+- 改进受管临时目录创建根路径解析，在拒绝不可信 TMPDIR 时使用固定系统回退并兼容 macOS `/var` 实路径，强化跨平台私有目录校验。
+
 ## 0.0.16 (2026-08-25)
 
 ### 任务与消息可靠性

package/dist/agents/claude-runner.js

@@ -11,6 +11,7 @@ import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
+import { createClaudeStartupArgumentsTooLongError, isClaudeStartupArgumentsTooLong, } from '../utils/error-utils.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
@@ -1825,6 +1826,30 @@ export class AgentRunner {
             else {
                 logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
             }
+            if (isClaudeStartupArgumentsTooLong(err)) {
+                const detail = createClaudeStartupArgumentsTooLongError(err);
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName: 'Bash',
+                    policyCode: 'claude_startup_arguments_too_long',
+                    decisionSource: 'infrastructure',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                yield {
+                    type: 'complete',
+                    isError: true,
+                    subtype: 'infrastructure',
+                    terminalReason: 'claude_startup_arguments_too_long',
+                    errors: [detail.message],
+                    queryFinal: true,
+                };
+                return;
+            }
             if (isSandboxInitializationFailure(err, buf ?? [])) {
                 const detail = createSandboxInitializationError(err, buf ?? []);
                 await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
@@ -2538,6 +2563,8 @@ export class AgentRunner {
             catch (error) {
                 this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
                 const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isClaudeStartupArgumentsTooLong(error))
+                    throw createClaudeStartupArgumentsTooLongError(error);
                 if (isSandboxInitializationFailure(error, stderr))
                     throw createSandboxInitializationError(error, stderr);
                 throw error;
@@ -2552,6 +2579,8 @@ export class AgentRunner {
             catch (error) {
                 this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
                 const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isClaudeStartupArgumentsTooLong(error))
+                    throw createClaudeStartupArgumentsTooLongError(error);
                 if (isSandboxInitializationFailure(error, stderr))
                     throw createSandboxInitializationError(error, stderr);
                 throw error;

package/dist/aun/msg/group.js

@@ -9,7 +9,7 @@ import { daemonTaskSendIpcTimeoutMs, resolveAunMessageEncrypt } from './p2p.js';
 import { checkGroupIndex, getGroupIndex } from './group-index.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
-import { readBestTaskRuntimeContext } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext } from '../../cli/task-context.js';
 import { ipcQuery } from '../../ipc.js';
 import { resolvePaths } from '../../paths.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../../core/auth/agent-delegation.js';
@@ -151,6 +151,7 @@ export async function groupSend(args) {
     const runtimeContext = await readBestTaskRuntimeContext();
     if (args.body.mode !== 'file') {
         const payload = buildGroupPayload(args.body);
+        normalizeCodexTextPayload(payload, runtimeContext);
         applyGroupRoutingPayloadFields(payload, args, runtimeContext);
         const daemonResult = await tryDaemonGroupSend(args, payload, runtimeContext);
         if (daemonResult)
@@ -192,6 +193,7 @@ export async function groupSend(args) {
                 break;
             }
         }
+        normalizeCodexTextPayload(payload, runtimeContext);
         const payloadMentions = Object.prototype.hasOwnProperty.call(payload, 'mentions')
             ? normalizeAunMentionEntries(payload.mentions)
             : undefined;

package/dist/aun/msg/p2p.js

@@ -4,7 +4,7 @@ import { createShortConnection } from '../rpc/index.js';
 import { getAidStore, SLOT } from '../aid/store.js';
 import { uploadFileAndBuildPayload } from './upload.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
-import { readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
 import { resolvePaths } from '../../paths.js';
 import { ipcQuery } from '../../ipc.js';
@@ -207,6 +207,7 @@ export async function msgSend(args) {
         let payload;
         if (args.body.mode !== 'file') {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
             if (Object.prototype.hasOwnProperty.call(payload, 'mentions')) {
                 payload.mentions = normalizeAunMentionEntries(payload.mentions);
             }
@@ -263,6 +264,7 @@ export async function msgSend(args) {
         // 3. 构建 payload
         if (!payload) {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
         }
         // 4. 写入 payload.chatmode
         payload.chatmode = chatmode;

package/dist/cli/task-context.js

@@ -23,6 +23,7 @@ function normalizeTaskRuntimeContext(value) {
         taskId: optionalString(value.taskId),
         sessionId: optionalString(value.sessionId),
         messageId: optionalString(value.messageId),
+        baseagent: optionalString(value.baseagent),
         channel: optionalString(value.channel),
         channelId: optionalString(value.channelId),
         chatType: optionalString(value.chatType),
@@ -38,6 +39,29 @@ function normalizeTaskRuntimeContext(value) {
         causation: normalizeCausation(value.causation),
     };
 }
+/**
+ * Codex's shell carrier can leave one JSON-style escape layer in a message
+ * argument (for example, the two characters `\\` and `n`). Decode only that
+ * layer, and only for a task that is explicitly running the Codex backend.
+ * Actual line breaks and all non-Codex CLI input remain unchanged.
+ */
+export function decodeCodexMessageText(text, runtime) {
+    if (runtime?.baseagent?.trim().toLowerCase() !== 'codex')
+        return text;
+    return text.replace(/\\([nrt])/g, (_match, escape) => {
+        if (escape === 'n')
+            return '\n';
+        if (escape === 'r')
+            return '\r';
+        return '\t';
+    });
+}
+/** Apply the Codex-only normalization to a text message payload. */
+export function normalizeCodexTextPayload(payload, runtime) {
+    if (payload.type !== 'text' || typeof payload.text !== 'string')
+        return;
+    payload.text = decodeCodexMessageText(payload.text, runtime);
+}
 function optionalAbsolutePath(value) {
     if (typeof value !== 'string' || !path.isAbsolute(value))
         return undefined;
@@ -75,6 +99,27 @@ function isPrivateDirectory(directory) {
         return false;
     }
 }
+/**
+ * Resolve the platform temp root before creating a managed directory. macOS
+ * exposes its per-user temp directory through `/var`, which is a symlink to
+ * `/private/var`; walking that lexical path would otherwise reject a freshly
+ * created directory even though its real path is private. When an inherited
+ * TMPDIR was rejected, use a fixed system fallback instead of following that
+ * untrusted path back into the fallback.
+ */
+function managedTempCreationRoot(configured) {
+    const candidate = configured
+        ? process.platform === 'win32'
+            ? path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'Temp')
+            : '/tmp'
+        : os.tmpdir();
+    try {
+        return fs.realpathSync.native(candidate);
+    }
+    catch {
+        return path.resolve(candidate);
+    }
+}
 /**
  * Ensure the daemon has a private process-wide temporary root.
  *
@@ -95,7 +140,7 @@ export function ensureProcessManagedTempDir() {
         if (isPrivateDirectory(resolved))
             return resolved;
     }
-    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-managed-tmp-'));
+    const directory = fs.mkdtempSync(path.join(managedTempCreationRoot(configured), 'evolcore-managed-tmp-'));
     try {
         fs.chmodSync(directory, 0o700);
         if (!isPrivateDirectory(directory)) {

package/dist/core/message/response-engine.js

@@ -2775,6 +2775,7 @@ export class ResponseEngine {
                     taskId,
                     sessionId: session.id,
                     messageId: message.messageId,
+                    baseagent: normalizedBaseagent.canonical,
                     channel: configChannelType,
                     channelId: message.channelId,
                     chatType: configChatType,

package/dist/utils/error-utils.js

@@ -3,6 +3,32 @@ import path from 'path';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { logger } from './logger.js';
 import { isSandboxInitializationFailure } from '../core/permission/sandbox-runtime.js';
+export const CLAUDE_STARTUP_ARGUMENTS_TOO_LONG = 'claude_startup_arguments_too_long';
+/** Identify a Claude process-start failure without treating ordinary tool errors as startup failures. */
+export function isClaudeStartupArgumentsTooLong(error) {
+    const code = error && typeof error === 'object' && 'code' in error
+        ? String(error.code ?? '')
+        : '';
+    const message = error && typeof error === 'object' && 'message' in error
+        ? String(error.message ?? '')
+        : String(error ?? '');
+    const text = `${code}\n${message}`.toLowerCase();
+    return text.includes(CLAUDE_STARTUP_ARGUMENTS_TOO_LONG)
+        || text.includes('enametoolong')
+        || text.includes('e2big')
+        || text.includes('argument list too long')
+        || text.includes('command line too long');
+}
+export function createClaudeStartupArgumentsTooLongError(error) {
+    const wrapped = new Error(`${CLAUDE_STARTUP_ARGUMENTS_TOO_LONG}: Claude 启动参数过长，任务未执行`);
+    wrapped.name = 'ClaudeStartupArgumentsTooLongError';
+    wrapped.code = CLAUDE_STARTUP_ARGUMENTS_TOO_LONG;
+    // Keep the original error available to diagnostics without echoing argv,
+    // settings contents, or absolute paths to users.
+    if (error !== undefined)
+        wrapped.cause = error;
+    return wrapped;
+}
 export var ErrorType;
 (function (ErrorType) {
     ErrorType["SDK_TIMEOUT"] = "sdk_timeout";
@@ -13,6 +39,7 @@ export var ErrorType;
     ErrorType["CONTEXT_TOO_LONG"] = "context_too_long";
     ErrorType["MODEL_UNAVAILABLE"] = "model_unavailable";
     ErrorType["SANDBOX_INITIALIZATION_FAILED"] = "sandbox_initialization_failed";
+    ErrorType["CLAUDE_STARTUP_ARGUMENTS_TOO_LONG"] = "claude_startup_arguments_too_long";
     ErrorType["UNKNOWN"] = "unknown";
 })(ErrorType || (ErrorType = {}));
 /**
@@ -251,6 +278,11 @@ function hasRetryableHttpStatus(text) {
 }
 export function classifyError(error) {
     const msg = (error?.message || '').toLowerCase();
+    // Startup-size failures are deterministic local failures and must win over
+    // dictionary rules that would otherwise turn them into generic retries.
+    if (isClaudeStartupArgumentsTooLong(error)) {
+        return ErrorType.CLAUDE_STARTUP_ARGUMENTS_TOO_LONG;
+    }
     // 字典优先 — 命中则直接返回
     const rule = matchErrorRule(msg);
     if (rule) {
@@ -314,6 +346,10 @@ export function isRetryableError(error) {
     return false;
 }
 export function getErrorMessage(error, terminalReason, includeEmoji = true) {
+    if (isClaudeStartupArgumentsTooLong(error)) {
+        const prefix = includeEmoji ? '⚠️ ' : '';
+        return `${prefix}当前 Claude 启动参数过长，任务未执行`;
+    }
     // terminalReason 提供更精确的错误提示（SDK 0.2.100+）
     if (terminalReason) {
         const prefix = includeEmoji ? '❌ ' : '';
@@ -335,6 +371,8 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
                 return `${prefix}权限被拒绝，操作已取消`;
             case 'sandbox_initialization_failed':
                 return `${warnPrefix}只读执行沙箱启动失败（sandbox_initialization_failed），当前任务未执行；请检查 user namespace/seccomp 配置后重试`;
+            case 'claude_startup_arguments_too_long':
+                return `${warnPrefix}当前 Claude 启动参数过长，任务未执行`;
             case 'aborted_streaming':
             case 'aborted_tools':
                 return `${prefix}任务已中断`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",