evolcore 0.0.17 → 0.0.18

package/CHANGELOG.md

@@ -3,6 +3,38 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.18 (2026-08-27)
+
+### DaemonOwner 与受管 Agent 操作
+
+- 新增 `daemon-owner` 进程角色，仅由 `daemon.json.owners` 的控制 AID 解析。
+- 进程操作、跨 Agent Trigger 与内部 Trigger 目录统一要求 DaemonOwner。
+- Agent channel 保持仅能操作自身；拒绝结果附带原因码与下一步指引。
+- 受管任务通过委派 IPC 执行授权的 `ec agent` 查询、非交互创建和生命周期操作。
+
+### 任务暂停与 Bootstrap 门禁
+
+- 新增 `/pause`、`/resume`，在下一次工具调用前暂停或恢复当前任务。
+- Codex、Claude 与 ecagent 的工具边界均接入暂停门禁；任务结束自动解除。
+- Agent 仅在 `active`、`bootstrapping` 生命周期运行，不再回退默认 Runner。
+- Bootstrap 隔离普通任务与上下文，仅允许受限的 `agent.md` 确认、发布和 ready。
+- 首次欢迎消息按实际私聊或群聊路由持久化投递。
+
+### AUN 投递与连接可靠性
+
+- 群消息恢复支持有界多页补拉，避免尾部同步后遗留大积压。
+- 适配新版 AUN 连接状态事件，隔离旧客户端事件并记录传输/入站时间。
+- 受管沙箱发送 AUN 消息改经配置存储读取超时和默认加密设置。
+
+### 审计、安全与跨平台运行
+
+- 菜单响应新增 `processing_ms` 与独立的协议业务流日志。
+- 工具与授权审计新增生命周期键、执行状态和敏感参数脱敏。
+- 统一 Codex 受管 `PreToolUse` Hook，强化 Bubblewrap 挂载与失败熔断诊断。
+- 原子写入保留正式文件并刷新热备，避免受保护状态挂载竞态。
+- `ec stop`、`ec restart` 优先经 IPC 请求守护进程优雅退出并校验 PID。
+- Windows 自启增加计划任务校验、用户级 Run 回退和非 EvolCore 配置保护。
+
 ## 0.0.17 (2026-08-25)
 
 ### Claude 与任务边界

package/bin/codex-managed-hook.mjs

@@ -1,7 +1,10 @@
 import fs from 'node:fs';
 import net from 'node:net';
 
-const timeoutMs = 1500;
+// Only bound socket establishment. Once connected, the official Codex hook
+// timeout owns the lifetime of this process; an application timeout here would
+// turn /pause into a denial/allow race.
+const connectTimeoutMs = 1500;
 
 function deny(reason) {
   process.stdout.write(JSON.stringify({
@@ -11,9 +14,8 @@ function deny(reason) {
       permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
     },
   }));
-  // Codex 0.147 app-server runs this managed hook but does not reliably honor
-  // the JSON denial alone for thread/shellCommand. Exit 2 is the documented
-  // blocking transport; retain the JSON shape for compatible hook consumers.
+  // Exit 2 is the documented blocking transport. Keep the structured JSON as
+  // well so Codex can surface the policy reason through the PreToolUse result.
   process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
   process.exitCode = 2;
 }
@@ -24,6 +26,7 @@ function queryDaemon(socketPath, payload) {
     let buffer = '';
     let settled = false;
     let timer;
+    let connected = false;
     const finish = value => {
       if (settled) return;
       settled = true;
@@ -31,10 +34,16 @@ function queryDaemon(socketPath, payload) {
       socket.destroy();
       resolve(value);
     };
-    timer = setTimeout(() => finish(null), timeoutMs);
+    timer = setTimeout(() => {
+      if (!connected) finish(null);
+    }, connectTimeoutMs);
     timer.unref?.();
     socket.once('error', () => finish(null));
-    socket.once('connect', () => socket.write(JSON.stringify(payload) + '\n'));
+    socket.once('connect', () => {
+      connected = true;
+      clearTimeout(timer);
+      socket.write(JSON.stringify(payload) + '\n');
+    });
     socket.on('data', chunk => {
       buffer += String(chunk);
       const index = buffer.indexOf('\n');
@@ -69,7 +78,7 @@ async function main() {
   const result = await queryDaemon(socketPath, {
     type: 'codex-pre-tool-use',
     threadId: input.session_id,
-    toolName: typeof input.tool_name === 'string' ? input.tool_name : '',
+    toolName: input.tool_name,
     toolInput: input.tool_input ?? null,
   });
   if (!result) {

package/bin/install-codex-managed-hooks.mjs

@@ -151,7 +151,7 @@ function main() {
   const targetDirectory = argument('--managed-dir')
     || path.join(path.dirname(requirements), 'EvolCore', 'hooks');
   const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
-  if (!fs.statSync(sourceHook).isFile()) fail(`Managed hook source was not found: ${sourceHook}`);
+  if (!fs.existsSync(sourceHook) || !fs.statSync(sourceHook).isFile()) fail(`Codex PreToolUse hook source was not found: ${sourceHook}`);
 
   fs.mkdirSync(targetDirectory, { recursive: true, mode: 0o700 });
   const hookPath = path.join(targetDirectory, 'pre-tool-use.mjs');
@@ -180,7 +180,9 @@ function main() {
     'type = "command"',
     `command = ${tomlString(command)}`,
     `command_windows = ${tomlString(command)}`,
-    'timeout = 3',
+    // Intentionally omit timeout: Codex applies its documented 600-second
+    // default for synchronous PreToolUse hooks. The application pause gate
+    // itself has no timeout; Codex remains the outer infrastructure ceiling.
     'statusMessage = "Checking EvolCore session policy"',
     markerEnd,
     '',

package/dist/agents/claude-runner.js

@@ -23,9 +23,9 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
-import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -626,6 +626,40 @@ export class AgentRunner {
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
     static STDERR_BUFFER_MAX = 80;
+    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = []) {
+        const detail = createSandboxInitializationError(error, stderr);
+        const circuit = recordSandboxInitializationFailure(detail, stderr);
+        const context = this.permissionContexts.get(sessionId);
+        auditToolInfrastructureFailure({
+            toolName: 'Bash',
+            policyCode: SANDBOX_INITIALIZATION_FAILED,
+            reason: detail.message.slice(0, 512),
+            sessionId,
+            agentAid: context?.selfAid,
+            permissionMode,
+            role: context?.role,
+            callId: inputId,
+            taskId: context?.taskId,
+            occurrences: circuit.occurrences,
+        });
+        await context?.recordExecutionAnomaly?.({
+            code: 'capability_unavailable',
+            severity: 'warning',
+            phase: 'execution',
+            occurredAt: Date.now(),
+            correlationId: inputId,
+            requestId: inputId,
+            sessionId,
+            toolName: 'Bash',
+            policyCode: SANDBOX_INITIALIZATION_FAILED,
+            decisionSource: 'infrastructure',
+            agentAid: context?.selfAid,
+            permissionMode: permissionMode,
+            summary: detail.message.slice(0, 512),
+            effect: 'operation_skipped',
+        });
+        return { detail, occurrences: circuit.occurrences };
+    }
     trackSandboxSettingsFile(sessionId, filePath) {
         const files = this.sandboxSettingsFiles.get(sessionId) ?? new Set();
         files.add(filePath);
@@ -1407,7 +1441,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode) {
         let lastSessionId;
         let hasTurnActivity = false;
         let ignoredPreTurnResult = false;
@@ -1851,19 +1885,7 @@ export class AgentRunner {
                 return;
             }
             if (isSandboxInitializationFailure(err, buf ?? [])) {
-                const detail = createSandboxInitializationError(err, buf ?? []);
-                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
-                    code: 'capability_unavailable',
-                    severity: 'warning',
-                    phase: 'execution',
-                    occurredAt: Date.now(),
-                    toolName: 'Bash',
-                    policyCode: SANDBOX_INITIALIZATION_FAILED,
-                    decisionSource: 'infrastructure',
-                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
-                    summary: detail.message.slice(0, 512),
-                    effect: 'operation_skipped',
-                });
+                const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, err, buf ?? []);
                 yield {
                     type: 'complete',
                     isError: true,
@@ -1955,6 +1977,57 @@ export class AgentRunner {
         const callPermissionMode = normalizedPermission.mode;
         const runPermissionContext = this.permissionContexts.get(sessionId);
         const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
+        const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
+        if (executionSandbox.state !== 'off') {
+            const activeSandboxFailure = getActiveSandboxInitializationFailure();
+            if (activeSandboxFailure) {
+                const detail = createSandboxInitializationError(new Error(`sandbox bootstrap circuit open; firstObservedAt=${activeSandboxFailure.openedAt} ` +
+                    `occurrences=${activeSandboxFailure.occurrences}; ${activeSandboxFailure.detail}`));
+                const context = this.permissionContexts.get(sessionId);
+                auditToolInfrastructureFailure({
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    reason: detail.message.slice(0, 512),
+                    sessionId,
+                    agentAid: context?.selfAid,
+                    permissionMode: callPermissionMode,
+                    role: context?.role,
+                    callId: inputId,
+                    taskId: context?.taskId,
+                    occurrences: activeSandboxFailure.occurrences,
+                });
+                await context?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    correlationId: inputId,
+                    requestId: inputId,
+                    sessionId,
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    decisionSource: 'infrastructure',
+                    agentAid: context?.selfAid,
+                    permissionMode: callPermissionMode,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                if (shouldLogSandboxCircuitNotice()) {
+                    logger.warn(`[ClaudeSandbox] bootstrap circuit open; skipping subprocess spawn ` +
+                        `cooldownMs=${SANDBOX_INITIALIZATION_COOLDOWN_MS} occurrences=${activeSandboxFailure.occurrences}`);
+                }
+                return (async function* () {
+                    yield {
+                        type: 'complete',
+                        isError: true,
+                        subtype: 'infrastructure',
+                        terminalReason: SANDBOX_INITIALIZATION_FAILED,
+                        errors: [detail.message],
+                        queryFinal: true,
+                    };
+                })();
+            }
+        }
         const permissionPrompt = runPermissionContext?.sendPrompt ?? this.sendPromptFn;
         const permissionContext = (signal) => {
             const context = this.permissionContexts.get(sessionId);
@@ -2013,7 +2086,14 @@ export class AgentRunner {
         // random one-shot payload from a validated output wrapper.
         const trustedSafeOutputCommands = new Set();
         // PreToolUse Hook - 黑名单检查 + input 修正（不可绕过，所有模式都走）
-        const preToolUseHook = async (input) => {
+        const preToolUseHook = async (input, _toolUseId, hookOptions) => {
+            const pauseController = this.permissionContexts.get(sessionId)?.pauseController;
+            if (pauseController) {
+                const pauseResult = await pauseController.waitAtToolBoundary(hookOptions?.signal);
+                if (pauseResult === 'cancelled') {
+                    return hookDecision('deny', '工具调用已取消');
+                }
+            }
             const toolName = input.tool_name;
             const originalInput = (input.tool_input || {});
             let toolInput = originalInput;
@@ -2358,6 +2438,10 @@ export class AgentRunner {
                     role: runPermissionContext?.role,
                 });
                 const runtimeWritePaths = trustedRuntimeWritePaths(runtimeEnv);
+                const bootstrapWritePaths = modelOverride?.bootstrapAgentMdPath
+                    ? [path.resolve(modelOverride.bootstrapAgentMdPath)]
+                    : [];
+                const allowedWritePaths = [...new Set([...runtimeWritePaths, ...bootstrapWritePaths])];
                 await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
                 const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
                 if (sandboxProjectionDurationMs > 2_000) {
@@ -2376,7 +2460,7 @@ export class AgentRunner {
                     },
                     filesystem: {
                         ...sandboxFilesystem,
-                        ...(runtimeWritePaths.length > 0 ? { allowWrite: runtimeWritePaths } : {}),
+                        ...(allowedWritePaths.length > 0 ? { allowWrite: allowedWritePaths } : {}),
                     },
                 };
             })();
@@ -2552,7 +2636,6 @@ export class AgentRunner {
         }
         let sdkStream;
         const msgStream = new MessageStream();
-        const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (images && images.length > 0) {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
             logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
@@ -2565,8 +2648,10 @@ export class AgentRunner {
                 const stderr = this.recentStderr.get(sessionId) ?? [];
                 if (isClaudeStartupArgumentsTooLong(error))
                     throw createClaudeStartupArgumentsTooLongError(error);
-                if (isSandboxInitializationFailure(error, stderr))
-                    throw createSandboxInitializationError(error, stderr);
+                if (isSandboxInitializationFailure(error, stderr)) {
+                    const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, callPermissionMode, error, stderr);
+                    throw detail;
+                }
                 throw error;
             }
         }
@@ -2581,8 +2666,10 @@ export class AgentRunner {
                 const stderr = this.recentStderr.get(sessionId) ?? [];
                 if (isClaudeStartupArgumentsTooLong(error))
                     throw createClaudeStartupArgumentsTooLongError(error);
-                if (isSandboxInitializationFailure(error, stderr))
-                    throw createSandboxInitializationError(error, stderr);
+                if (isSandboxInitializationFailure(error, stderr)) {
+                    const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, callPermissionMode, error, stderr);
+                    throw detail;
+                }
                 throw error;
             }
         }
@@ -2595,7 +2682,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode);
         const self = this;
         return (async function* () {
             try {
@@ -2611,6 +2698,7 @@ export class AgentRunner {
         })();
     }
     async interrupt(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const streamRegistered = this.activeStreams.has(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
@@ -2764,6 +2852,7 @@ export class AgentRunner {
         }
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const query = this.activeQueries.get(sessionId);
         if (query && typeof query.close === 'function')
             query.close();

package/dist/agents/codex-app-server-client.js

@@ -475,6 +475,8 @@ export class CodexAppServerClient {
             fs.chmodSync(directory, 0o700);
             const hookPath = path.join(directory, 'pre-tool-use.mjs');
             const sourcePath = path.join(getPackageRoot(), 'bin', 'codex-managed-hook.mjs');
+            if (!fs.existsSync(sourcePath))
+                throw new Error('Codex PreToolUse hook source is unavailable');
             fs.copyFileSync(sourcePath, hookPath, fs.constants.COPYFILE_EXCL);
             fs.chmodSync(hookPath, 0o500);
             const command = `${this.shellQuote(process.execPath)} ${this.shellQuote(hookPath)} ${this.shellQuote(resolvePaths().instanceSocket)}`;
@@ -494,7 +496,10 @@ export class CodexAppServerClient {
                 '[[hooks.PreToolUse.hooks]]',
                 'type = "command"',
                 `command = ${JSON.stringify(command)}`,
-                'timeout = 3',
+                // Intentionally omit timeout: Codex applies its documented 600-second
+                // default for synchronous PreToolUse hooks. The application pause
+                // gate itself has no timeout; Codex remains the outer infrastructure
+                // ceiling.
                 'statusMessage = "Checking EvolCore session policy"',
                 '',
             ].join('\n'), { mode: 0o400, flag: 'wx' });

package/dist/agents/codex-runner.js

@@ -795,7 +795,7 @@ export class CodexRunner {
         }
         return Object.fromEntries([...paths].map(candidate => [candidate, 'write']));
     }
-    buildPermissionProfileConfig(sessionId, mode, projectPath) {
+    buildPermissionProfileConfig(sessionId, mode, projectPath, bootstrapAgentMdPath) {
         const profileName = this.permissionProfileName(sessionId);
         const managedTempDir = this.ensureSessionTempDir(sessionId);
         const network = {
@@ -812,6 +812,9 @@ export class CodexRunner {
                             denyLClassRead: mode === 'readonly',
                         }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
+                        ...(bootstrapAgentMdPath ? {
+                            [path.resolve(bootstrapAgentMdPath)]: mode === 'readonly' ? 'read' : 'write',
+                        } : {}),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
                             [path.join(managedTempDir, '**')]: 'write',
@@ -824,12 +827,12 @@ export class CodexRunner {
             },
         };
     }
-    buildExecutionSandboxOptions(sessionId, mode, projectPath) {
+    buildExecutionSandboxOptions(sessionId, mode, projectPath, bootstrapAgentMdPath) {
         const decision = resolvePhaseOneExecutionSandbox(mode, this.permissionContexts.get(sessionId)?.role);
         return {
             decision,
             permissionProfileConfig: decision.state === 'active'
-                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath)
+                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath, bootstrapAgentMdPath)
                 : undefined,
             sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
         };
@@ -837,7 +840,11 @@ export class CodexRunner {
     buildLifecycleLockdownConfig() {
         return {
             features: {
-                hooks: false,
+                // The app-server is launched with allow_managed_hooks_only=true, so
+                // enabling the feature exposes only EvolCore's requirements-managed
+                // PreToolUse hook. Disabling it here suppresses that managed hook too
+                // and bypasses the pause/proactive policy boundary entirely.
+                hooks: true,
             },
         };
     }
@@ -867,7 +874,7 @@ export class CodexRunner {
             throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
         }
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput) {
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal) {
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
@@ -878,6 +885,12 @@ export class CodexRunner {
         if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
             return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
         }
+        if (context.pauseController) {
+            const pauseResult = await context.pauseController.waitAtToolBoundary(signal);
+            if (pauseResult === 'cancelled') {
+                return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
+            }
+        }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
@@ -1044,7 +1057,7 @@ export class CodexRunner {
         const callMode = normalizedPermission.mode;
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
-        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath);
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
         const appServer = this.getAppServerClient();
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
@@ -1203,6 +1216,7 @@ export class CodexRunner {
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
+        this.permissionContexts.get(sessionKey)?.pauseController?.cancel();
         const controller = this.activeAbortControllers.get(sessionKey);
         const activeTurn = this.activeTurns.get(sessionKey);
         const hadActiveState = !!controller || !!activeTurn || this.activeStreams.has(sessionKey);
@@ -1265,6 +1279,7 @@ export class CodexRunner {
         this.onSessionIdUpdate?.(sessionId, agentSessionId);
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const threadId = this.activeSessions.get(sessionId);
         this.activeSessions.delete(sessionId);
         this.activeStreams.delete(sessionId);

package/dist/agents/ecagent-runner.js

@@ -459,11 +459,30 @@ function isWithin(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-function resolveToolPath(projectPath, candidate, forWrite = false) {
+export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath) {
     const root = fs.realpathSync(projectPath);
     const resolved = path.resolve(root, candidate || '.');
-    if (!isWithin(root, resolved))
+    const allowedBootstrapFile = bootstrapAgentMdPath
+        ? path.resolve(bootstrapAgentMdPath)
+        : undefined;
+    const isBootstrapAgentMd = allowedBootstrapFile === resolved;
+    if (!isWithin(root, resolved) && !isBootstrapAgentMd) {
         throw new Error(`Path is outside the project: ${candidate}`);
+    }
+    if (isBootstrapAgentMd) {
+        const parent = path.dirname(resolved);
+        const canonicalParent = fs.realpathSync(parent);
+        if (!isWithin(parent, canonicalParent) || !isWithin(canonicalParent, parent)) {
+            throw new Error(`Bootstrap agent.md parent resolves outside its declared path: ${candidate}`);
+        }
+        if (fs.existsSync(resolved)) {
+            const canonicalFile = fs.realpathSync(resolved);
+            if (!isWithin(resolved, canonicalFile) || !isWithin(canonicalFile, resolved)) {
+                throw new Error(`Bootstrap agent.md resolves outside its declared path: ${candidate}`);
+            }
+        }
+        return resolved;
+    }
     const existing = forWrite ? path.dirname(resolved) : resolved;
     let cursor = existing;
     while (!fs.existsSync(cursor) && cursor !== path.dirname(cursor))
@@ -522,7 +541,7 @@ async function walkFiles(root, signal) {
 function textResult(text, details = {}) {
     return { content: [{ type: 'text', text: truncate(text) }], details };
 }
-function createTools(env, projectPath, runtimeEnv) {
+function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath) {
     const read = {
         name: 'Read', label: 'Read', description: 'Read a UTF-8 text file from the project.',
         parameters: Type.Object({
@@ -531,7 +550,7 @@ function createTools(env, projectPath, runtimeEnv) {
             limit: Type.Optional(Type.Number({ minimum: 1 })),
         }),
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath);
             const stat = await fs.promises.stat(file);
             if (stat.size > MAX_READ_BYTES)
                 throw new Error(`File exceeds ${MAX_READ_BYTES} byte read limit`);
@@ -548,7 +567,7 @@ function createTools(env, projectPath, runtimeEnv) {
         name: 'Glob', label: 'Glob', description: 'Find project files matching a glob pattern.',
         parameters: Type.Object({ pattern: Type.String(), path: Type.Optional(Type.String()) }),
         async execute(_id, params, signal) {
-            const root = resolveToolPath(projectPath, params.path ?? '.');
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.');
             const matcher = globRegex(params.pattern.replaceAll('\\', '/'));
             const files = (await walkFiles(root, signal))
                 .map(file => path.relative(root, file).replaceAll(path.sep, '/'))
@@ -564,7 +583,7 @@ function createTools(env, projectPath, runtimeEnv) {
             case_insensitive: Type.Optional(Type.Boolean()), literal: Type.Optional(Type.Boolean()),
         }),
         async execute(_id, params, signal) {
-            const root = resolveToolPath(projectPath, params.path ?? '.');
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.');
             const files = (await fs.promises.stat(root)).isFile() ? [root] : await walkFiles(root, signal);
             const fileMatcher = params.glob ? globRegex(params.glob.replaceAll('\\', '/')) : undefined;
             const flags = params.case_insensitive ? 'i' : '';
@@ -597,7 +616,7 @@ function createTools(env, projectPath, runtimeEnv) {
         name: 'Write', label: 'Write', description: 'Create or completely overwrite a project file.',
         parameters: Type.Object({ file_path: Type.String(), content: Type.String() }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path, true);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath);
             await fs.promises.mkdir(path.dirname(file), { recursive: true });
             await fs.promises.writeFile(file, params.content, { encoding: 'utf8', signal });
             return textResult(`Wrote ${Buffer.byteLength(params.content)} bytes to ${path.relative(projectPath, file)}`, { file });
@@ -610,7 +629,7 @@ function createTools(env, projectPath, runtimeEnv) {
             replace_all: Type.Optional(Type.Boolean()),
         }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath);
             const value = await fs.promises.readFile(file, { encoding: 'utf8', signal });
             if (!params.old_string)
                 throw new Error('old_string must not be empty');
@@ -809,7 +828,7 @@ export class EcagentRunner {
                 models,
                 model,
                 thinkingLevel: normalizeThinkingLevel(effort),
-                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv),
+                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath),
                 systemPrompt: [DEFAULT_SYSTEM_PROMPT, request.systemPromptAppend].filter(Boolean).join('\n\n'),
                 streamOptions: {
                     timeoutMs: this.config.timeoutMs,
@@ -823,7 +842,15 @@ export class EcagentRunner {
                 runtime.harness = undefined;
                 throw new Error('ecagent run interrupted');
             }
-            harness.on('tool_call', event => this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input));
+            harness.on('tool_call', async (event, signal) => {
+                const pauseController = this.permissionContexts.get(request.sessionId)?.pauseController;
+                if (pauseController) {
+                    const pauseResult = await pauseController.waitAtToolBoundary(signal);
+                    if (pauseResult === 'cancelled')
+                        return { block: true, reason: '工具调用已取消' };
+                }
+                return this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input);
+            });
             const unsubscribe = harness.subscribe(event => this.mapHarnessEvent(queue, event, stats, model, effort));
             queue.push({ type: 'state_changed', state: 'running' });
             queue.push({ type: 'status', subtype: 'started', message: `ecagent is using ${modelId}` });
@@ -1043,6 +1070,7 @@ export class EcagentRunner {
         return decision.matched && decision.decision === 'deny' ? { block: true, reason: '危险操作未获人工批准' } : {};
     }
     async interrupt(sessionKey) {
+        this.permissionContexts.get(sessionKey)?.pauseController?.cancel();
         this.permissionGateway?.cancelAll(sessionKey, 'interrupted');
         const harness = this.runtimes.get(sessionKey)?.harness;
         if (harness) {
@@ -1058,6 +1086,7 @@ export class EcagentRunner {
             void harness.steer(text).catch(error => logger.warn('[EcagentRunner] Failed to steer active run:', error));
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         await this.interrupt(sessionId).catch(() => { });
         this.runtimes.delete(sessionId);
         this.activeStreams.delete(sessionId);