evolcore 0.0.16 → 0.0.18

package/dist/agents/gemini-runner.js

@@ -129,44 +129,99 @@ const GEMINI_L_CLASS_PATTERNS = [
 const GEMINI_L_CLASS_WRITE_TOOLS = [
     'write_file', 'replace', 'delete_file', 'move_file', 'rename_file',
 ];
+const GEMINI_BOOTSTRAP_FILE_TOOLS = ['write_file', 'replace'];
+const GEMINI_BOOTSTRAP_LIFECYCLE_TOOLS = ['update_topic', 'complete_task'];
 const GEMINI_EC_COMMAND_PATTERNS = [
-    String.raw `"command":"[ ]*ec[ ]*"`,
+    String.raw `\x00"command":"[ ]*ec[ ]*"\x00`,
     // This is only a shell-process boundary. It deliberately does not inspect
     // subcommands or arguments. Shell composition remains excluded because the
     // Gemini policy exception applies to the whole run_shell_command call.
-    String.raw `"command":"[ ]*ec[ ]+(?:[^"\\;&|$()<>\x60\r\n]|\\")*"`,
+    // stableStringify JSON-escapes control characters. Reject those escapes
+    // explicitly, while retaining valid `\\`/`\"` escapes used by paths and
+    // quoted arguments.
+    String.raw `\x00"command":"[ ]*ec[ ]+(?:[^"\x00;&|$()<>\x60\r\n\\]|\\(?:\\|"))*"\x00`,
 ];
-export function resolveGeminiPermissionProfile(value) {
+export function resolveGeminiPermissionProfile(value, bootstrap = false) {
     const normalized = normalizePermissionMode(value);
-    if (normalized.mode === 'auto')
-        return { mode: 'auto', approvalMode: 'auto_edit' };
-    if (normalized.mode === 'request' || normalized.mode === 'bypass') {
-        return { mode: 'readonly', approvalMode: 'plan', degradedFrom: normalized.mode };
-    }
-    return { mode: 'readonly', approvalMode: 'plan' };
+    const profile = normalized.mode === 'auto'
+        ? { mode: 'auto', approvalMode: 'auto_edit' }
+        : normalized.mode === 'request' || normalized.mode === 'bypass'
+            ? { mode: 'readonly', approvalMode: 'plan', degradedFrom: normalized.mode }
+            : { mode: 'readonly', approvalMode: 'plan' };
+    // Bootstrap has its own deny-by-default Admin policy. auto_edit is required
+    // so Gemini exposes write_file/replace, while that policy still limits them
+    // to the single declared agent.md path.
+    return bootstrap ? { ...profile, approvalMode: 'auto_edit' } : profile;
+}
+function escapeGeminiArgsRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function normalizeGeminiBootstrapAgentMdPath(candidate) {
+    const filePath = path.resolve(candidate);
+    const aidDir = path.dirname(filePath);
+    const aid = path.basename(aidDir);
+    const aidsDirName = path.basename(path.dirname(aidDir));
+    if (path.basename(filePath).toLowerCase() !== 'agent.md'
+        || aidsDirName.toLowerCase() !== 'aids'
+        || !/^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?){2,}$/.test(aid)) {
+        throw new Error(`Invalid Gemini bootstrap agent.md path: ${candidate}`);
+    }
+    return { filePath, aid };
+}
+function geminiJsonFieldEqualsPattern(fields, value) {
+    const encodedValue = JSON.stringify(value);
+    return `\\x00"(?:${fields.join('|')})":${escapeGeminiArgsRegex(encodedValue)}\\x00`;
+}
+function geminiExactShellCommandPattern(command) {
+    // Gemini stableStringify wraps the top-level NUL-delimited field in `{}`.
+    // Matching the whole object also rejects extra shell options such as
+    // is_background or additional_permissions during bootstrap.
+    return `^\\{\\x00"command":"[ ]*${escapeGeminiArgsRegex(command)}[ ]*"\\x00\\}$`;
 }
 function appendGeminiPolicyRule(lines, toolName, decision, priority, argsPattern) {
     lines.push('[[rule]]');
     lines.push(`toolName = ${Array.isArray(toolName) ? JSON.stringify(toolName) : JSON.stringify(toolName)}`);
     if (argsPattern)
-        lines.push(`argsPattern = '${argsPattern}'`);
+        lines.push(`argsPattern = ${JSON.stringify(argsPattern)}`);
     lines.push(`decision = "${decision}"`);
     lines.push(`priority = ${priority}`, '');
 }
-export function buildGeminiAdminPolicy(profile) {
+export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath) {
     const lines = [];
+    if (bootstrapAgentMdPath) {
+        const bootstrap = normalizeGeminiBootstrapAgentMdPath(bootstrapAgentMdPath);
+        // Preserve the global protected-path boundary even if a malformed internal
+        // caller ever supplies a protected file as the bootstrap target.
+        for (const pattern of GEMINI_H_CLASS_PATTERNS) {
+            appendGeminiPolicyRule(lines, '*', 'deny', 998, pattern);
+        }
+        for (const pattern of GEMINI_L_CLASS_PATTERNS) {
+            appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 997, pattern);
+        }
+        const readPathPattern = geminiJsonFieldEqualsPattern(['file_path'], bootstrap.filePath);
+        const writePathPattern = geminiJsonFieldEqualsPattern(['file_path'], bootstrap.filePath);
+        appendGeminiPolicyRule(lines, 'read_file', 'allow', 990, readPathPattern);
+        appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_FILE_TOOLS, 'allow', 990, writePathPattern);
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec aid agentmd put ${bootstrap.aid}`));
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec agent ready ${bootstrap.aid}`));
+        // These are Gemini's non-I/O task bookkeeping tools. They do not expose
+        // project files, shell, network, MCP, or user-interaction capabilities.
+        appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_LIFECYCLE_TOOLS, 'allow', 950);
+        appendGeminiPolicyRule(lines, '*', 'deny', 900);
+        return lines.join('\n');
+    }
     // EC/daemon owns all command semantics and authorization. The Runner only
     // admits a single EC process through the otherwise mode-specific shell
     // policy. Keep this above path denies so `--file` is not reinterpreted here.
     for (const pattern of GEMINI_EC_COMMAND_PATTERNS) {
-        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 1000, pattern);
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 999, pattern);
     }
     // H-class protection is mode-independent and applies to built-in and MCP tools.
     for (const pattern of GEMINI_H_CLASS_PATTERNS) {
-        appendGeminiPolicyRule(lines, '*', 'deny', 999, pattern);
+        appendGeminiPolicyRule(lines, '*', 'deny', 998, pattern);
     }
     for (const pattern of GEMINI_L_CLASS_PATTERNS) {
-        appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 998, pattern);
+        appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 997, pattern);
     }
     if (profile.mode === 'readonly') {
         appendGeminiPolicyRule(lines, GEMINI_READONLY_TOOLS, 'allow', 950);
@@ -277,7 +332,10 @@ export class GeminiRunner {
         let geminiSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
         // per-call 权限模式/模型：优先 override，缺省回落实例级（多会话并发互不污染）
         const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
-        const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode);
+        const bootstrapAgentMdPath = modelOverride?.bootstrapAgentMdPath
+            ? normalizeGeminiBootstrapAgentMdPath(modelOverride.bootstrapAgentMdPath).filePath
+            : undefined;
+        const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode, !!bootstrapAgentMdPath);
         const callModel = modelOverride?.model || this.model;
         const runtimeDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR;
         const managedTmpDir = runtimeDir ?? process.env.TMPDIR;
@@ -288,7 +346,12 @@ export class GeminiRunner {
         fs.mkdirSync(geminiHome, { recursive: true, mode: 0o700 });
         const sandboxProbe = buildBubblewrapCommand(this.resolved.cliPath, [], {
             projectPath,
-            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
+            writablePaths: [
+                geminiHome,
+                ...(runtimeDir ? [runtimeDir] : []),
+                ...(runtimeLockDir ? [runtimeLockDir] : []),
+                ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+            ],
         });
         if (!sandboxProbe && workspaceContainsHClassPaths(projectPath)) {
             throw new Error('Gemini 缺少可用的路径级隔离运行时，且项目覆盖 EvolCore 受保护根；已拒绝启动本轮任务');
@@ -309,7 +372,7 @@ export class GeminiRunner {
                 throw new Error('Gemini 系统级 admin policy 会忽略 EvolCore 的临时安全策略，已拒绝启动本轮任务');
             }
             const policyPath = path.join(managedTmpDir, `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
-            fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile), { mode: 0o600, flag: 'wx' });
+            fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile, bootstrapAgentMdPath), { mode: 0o600, flag: 'wx' });
             tempFiles.push(policyPath);
             args.push(...buildGeminiPermissionArgs(permissionProfile, policyPath, !!sandboxProbe));
         }
@@ -331,9 +394,12 @@ export class GeminiRunner {
         args.push('--output-format', 'stream-json');
         args.push('-m', callModel);
         // Permission mode
-        if (permissionProfile.degradedFrom) {
+        if (permissionProfile.degradedFrom && !bootstrapAgentMdPath) {
             logger.warn(`[GeminiRunner] permission mode ${permissionProfile.degradedFrom} is unavailable in headless mode; degraded to readonly`);
         }
+        else if (bootstrapAgentMdPath) {
+            logger.info('[GeminiRunner] using bootstrap-only tool policy for the declared agent.md');
+        }
         // Resume session
         if (geminiSessionId) {
             args.push('-r', geminiSessionId);
@@ -342,7 +408,12 @@ export class GeminiRunner {
         const env = this.buildAgentEnv(sessionId, runtimeEnv);
         const sandboxedCommand = buildBubblewrapCommand(this.resolved.cliPath, args, {
             projectPath,
-            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
+            writablePaths: [
+                geminiHome,
+                ...(runtimeDir ? [runtimeDir] : []),
+                ...(runtimeLockDir ? [runtimeLockDir] : []),
+                ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+            ],
             readonlyPaths: tempFiles,
         });
         const child = spawn(sandboxedCommand?.command ?? this.resolved.cliPath, sandboxedCommand?.args ?? args, {

package/dist/aun/aid/store.js

@@ -1,6 +1,12 @@
 import fs from 'fs';
 import path from 'path';
 import { AUN_KEYSTORE_ENCRYPTION_SEED } from './encryption-seed-policy.js';
+// fastaun uses maxPages=1 for the background tail -> forward handoff. That is
+// useful as a latency guard, but it can leave a group backlog when no later
+// push arrives to trigger the next page. Bound the daemon recovery pull to ten
+// pages so a large backlog is drained without monopolizing the sync loop.
+const FULL_GROUP_PULL_MAX_PAGES = 10;
+const GROUP_PULL_PAGINATION_PATCH = Symbol('evolcore.groupPullPaginationPatch');
 /**
  * Slot 命名约定（基于 fastaun 0.4.3 隔离键语义）。
  *
@@ -68,6 +74,36 @@ export async function loadClient(store, aid) {
     const { AUNClient } = await import('@agentunion/fastaun');
     return new AUNClient(loadAid(store, aid));
 }
+/**
+ * Enable bounded multi-page group pulls for the long-lived daemon client.
+ *
+ * The SDK's background realtime recovery path intentionally passes
+ * `maxPages=1`; for a daemon this can strand a backlog after a tail sync.
+ * This adapter only expands that sentinel value and leaves all other pull
+ * options unchanged. It is isolated to the client that explicitly opts in.
+ */
+export function enableFullGroupPullPagination(client) {
+    const target = client;
+    if (target[GROUP_PULL_PAGINATION_PATCH])
+        return false;
+    const pull = target._pullGroupV2;
+    if (typeof pull !== 'function')
+        return false;
+    const wrappedPull = function (groupId, afterSeq, limit, opts) {
+        const expandedOpts = opts?.maxPages === 1
+            ? { ...opts, maxPages: FULL_GROUP_PULL_MAX_PAGES }
+            : opts;
+        return pull.call(this, groupId, afterSeq, limit, expandedOpts);
+    };
+    Object.defineProperty(target, GROUP_PULL_PAGINATION_PATCH, {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false,
+    });
+    target._pullGroupV2 = wrappedPull;
+    return true;
+}
 /** 加载本地 AID 值对象（用于离线签名/验签，无需连接）。load 失败抛 AidLoadError。 */
 export function loadAid(store, aid) {
     const r = store.load(aid);

package/dist/aun/msg/group.js

@@ -9,7 +9,7 @@ import { daemonTaskSendIpcTimeoutMs, resolveAunMessageEncrypt } from './p2p.js';
 import { checkGroupIndex, getGroupIndex } from './group-index.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
-import { readBestTaskRuntimeContext } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext } from '../../cli/task-context.js';
 import { ipcQuery } from '../../ipc.js';
 import { resolvePaths } from '../../paths.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../../core/auth/agent-delegation.js';
@@ -151,6 +151,7 @@ export async function groupSend(args) {
     const runtimeContext = await readBestTaskRuntimeContext();
     if (args.body.mode !== 'file') {
         const payload = buildGroupPayload(args.body);
+        normalizeCodexTextPayload(payload, runtimeContext);
         applyGroupRoutingPayloadFields(payload, args, runtimeContext);
         const daemonResult = await tryDaemonGroupSend(args, payload, runtimeContext);
         if (daemonResult)
@@ -192,6 +193,7 @@ export async function groupSend(args) {
                 break;
             }
         }
+        normalizeCodexTextPayload(payload, runtimeContext);
         const payloadMentions = Object.prototype.hasOwnProperty.call(payload, 'mentions')
             ? normalizeAunMentionEntries(payload.mentions)
             : undefined;

package/dist/aun/msg/p2p.js

@@ -4,7 +4,7 @@ import { createShortConnection } from '../rpc/index.js';
 import { getAidStore, SLOT } from '../aid/store.js';
 import { uploadFileAndBuildPayload } from './upload.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
-import { readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
 import { resolvePaths } from '../../paths.js';
 import { ipcQuery } from '../../ipc.js';
@@ -14,22 +14,34 @@ import { normalizeAunMentionEntries } from './mention-schema.js';
 const DAEMON_SEND_TIMEOUT_GRACE_MS = 10_000;
 const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 const MAX_TIMER_MS = 2_147_483_647;
+/**
+ * Read process settings through the config facade. A delegated CLI can run
+ * inside a sandbox where daemon.json is intentionally unreadable; sending a
+ * message must still use the protocol defaults instead of surfacing EACCES.
+ */
+function readDaemonConfigForSend() {
+    try {
+        return loadDaemonConfig();
+    }
+    catch {
+        return {};
+    }
+}
 export function daemonTaskSendIpcTimeoutMs(file = false) {
     let idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS;
-    try {
-        const config = JSON.parse(fs.readFileSync(resolvePaths().daemonConfig, 'utf8'));
-        const seconds = config.idleMonitor?.timeout;
-        if (typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0) {
-            idleTimeoutMs = seconds * 1000;
-        }
+    // Use the ConfigStore read path so managed tasks never open daemon.json
+    // directly. The daemon-owned config reader handles missing, invalid, and
+    // protected files without leaking a filesystem access error into IMRenderer.
+    const seconds = readDaemonConfigForSend().idleMonitor?.timeout;
+    if (typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0) {
+        idleTimeoutMs = seconds * 1000;
     }
-    catch { }
     return Math.min(MAX_TIMER_MS, Math.max(file ? 120_000 : 5_000, idleTimeoutMs + DAEMON_SEND_TIMEOUT_GRACE_MS));
 }
 export function resolveAunMessageEncrypt(explicit) {
     if (typeof explicit === 'boolean')
         return explicit;
-    return loadDaemonConfig().aun?.defaultEncrypt ?? true;
+    return readDaemonConfigForSend().aun?.defaultEncrypt ?? true;
 }
 function buildSimplePayload(body) {
     switch (body.mode) {
@@ -207,6 +219,7 @@ export async function msgSend(args) {
         let payload;
         if (args.body.mode !== 'file') {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
             if (Object.prototype.hasOwnProperty.call(payload, 'mentions')) {
                 payload.mentions = normalizeAunMentionEntries(payload.mentions);
             }
@@ -263,6 +276,7 @@ export async function msgSend(args) {
         // 3. 构建 payload
         if (!payload) {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
         }
         // 4. 写入 payload.chatmode
         payload.chatmode = chatmode;