evolcore 0.0.17 → 0.0.18

package/dist/core/message/response-engine.js

@@ -13,7 +13,7 @@ import { isHostChinese } from '../../utils/locale.js';
 import { getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
 import { isExactEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
 import { summarizeToolInput } from '../../utils/tool-summary.js';
-import { getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
+import { agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
 import { renderKitSections } from '../../eck/kit-renderer.js';
 import { renderMessageBody } from '../../eck/message-renderer.js';
 import { syncGroupRulesContext } from '../../eck/group-rules-sync.js';
@@ -47,6 +47,8 @@ import { deriveSessionTitle, shouldAutoFillSessionTitle } from '../session/sessi
 import { SessionTurnCoordinator } from '../session/session-turn-coordinator.js';
 import { recordTriggerExecutionAnomaly } from '../../trigger/anomaly-store.js';
 import { classifyToolErrorCode } from '../permission/tool-error-code.js';
+import { buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { PauseController } from './pause-controller.js';
 function isShowActivitiesMode(value) {
     return value === 'all' || value === 'text' || value === 'none';
 }
@@ -592,6 +594,28 @@ export class ResponseEngine {
         registerBuiltinModes(registry);
         this.responseCoordinator = new ResponseModeCoordinator(registry);
     }
+    pauseControllers = new Map();
+    getPauseController(sessionId) {
+        let controller = this.pauseControllers.get(sessionId);
+        if (!controller) {
+            controller = new PauseController();
+            this.pauseControllers.set(sessionId, controller);
+        }
+        return controller;
+    }
+    pauseSession(sessionId) { return this.getPauseController(sessionId).requestPause(); }
+    resumeSession(sessionId) { return this.pauseControllers.get(sessionId)?.resume() ?? false; }
+    isPauseRequested(sessionId) {
+        const controller = this.pauseControllers.get(sessionId);
+        return !!controller && (controller.isPauseRequested() || controller.isPaused());
+    }
+    clearPauseSession(sessionId, expected) {
+        const controller = this.pauseControllers.get(sessionId);
+        if (expected && controller !== expected)
+            return;
+        controller?.clear();
+        this.pauseControllers.delete(sessionId);
+    }
     setInteractionRouter(router) {
         this.interactionRouter = router;
         // 等待用户交互期间暂停 idle 监控，应答/取消/超时后恢复——
@@ -609,6 +633,7 @@ export class ResponseEngine {
         this.messageQueue = queue;
     }
     async interruptSession(sessionId, reason) {
+        this.clearPauseSession(sessionId);
         // A retry delay has no active runner stream to abort. Wake it before any
         // session-store I/O so /stop and a newer message take effect immediately.
         this.cancelRetryDelays(sessionId);
@@ -1165,7 +1190,7 @@ export class ResponseEngine {
     static COMMAND_PREFIXES = [
         '/new', '/pwd', '/help', '/status', '/restart',
         '/model', '/effort', '/agent', '/slist', '/session', '/rename', '/repair', '/fork',
-        '/stop', '/clear', '/compact', '/del', '/perm', '/file', '/check',
+        '/stop', '/pause', '/resume', '/clear', '/compact', '/del', '/perm', '/file', '/check',
         '/s ', '/name ', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode',
         '/aid', '/upgrade', '/evolagent',
     ];
@@ -1293,7 +1318,10 @@ export class ResponseEngine {
         // 按 session.baseagent 选择 agent 后端（idle-kill 路径需要 interrupt）
         let agent;
         try {
-            agent = this.getAgent(channelKey, session.baseagent, session.selfAID || message.selfAID);
+            const runnerSelfAid = this.agentRegistry?.resolveByChannel(channelKey)?.aid
+                || session.selfAID
+                || message.selfAID;
+            agent = this.getAgent(channelKey, session.baseagent, runnerSelfAid);
         }
         catch (error) {
             if (error instanceof BaseagentRunnerUnavailableError) {
@@ -1526,6 +1554,10 @@ export class ResponseEngine {
         const taskAgentAid = message.selfAID || session.selfAID;
         const owningAgentForTask = this.agentRegistry?.resolveByChannel(channelKey)
             ?? (taskAgentAid ? this.agentRegistry?.get(taskAgentAid) : null);
+        const runnerSelfAid = owningAgentForTask?.aid || session.selfAID || message.selfAID;
+        const lifecycle = owningAgentForTask?.config?.lifecycle;
+        const isActive = lifecycle === 'active';
+        const isBootstrapping = lifecycle === 'bootstrapping';
         // Per-method agent name for stats bucketing (agent.name or '<unknown>')
         const agentNameForStats = owningAgentForTask?.name ?? taskAgentAid ?? '<unknown>';
         if (!channelInfo) {
@@ -1533,10 +1565,19 @@ export class ResponseEngine {
             this.publishTriggerExecutionFailure(message, `unknown_channel:${channelKey}`);
             return;
         }
+        // Agent-owned turns are runnable only in the two explicit execution
+        // states. An untransitioned `created` agent or a malformed/missing
+        // lifecycle must not fall through to a base runner's default prompt.
+        if (owningAgentForTask && !isActive && !isBootstrapping) {
+            const blockedLifecycle = lifecycle ?? 'missing';
+            logger.error(`[ResponseEngine] Agent lifecycle is not runnable: agent=${owningAgentForTask.aid} lifecycle=${blockedLifecycle}`);
+            this.publishTriggerExecutionFailure(message, `agent_lifecycle_not_runnable:${blockedLifecycle}`);
+            return;
+        }
         // 二次拦截：如果命令消息绕过 MessageBridge 的 handleCommand 泄漏到这里，
         // 静默丢弃而不是发送给 Agent（命令已在 MessageBridge 层处理过）
         const rawContent = message.content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
-        if (rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
+        if (!isBootstrapping && rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
             logger.warn(`[ResponseEngine] Command leaked past MessageBridge, dropped: "${rawContent.substring(0, 40)}"`);
             this.publishTriggerExecutionFailure(message, 'trigger_command_not_supported');
             return;
@@ -1546,7 +1587,7 @@ export class ResponseEngine {
         const identityRole = session.identity?.role || 'none';
         let agent;
         try {
-            agent = this.getAgent(channelKey, session.baseagent, session.selfAID || message.selfAID);
+            agent = this.getAgent(channelKey, session.baseagent, runnerSelfAid);
         }
         catch (error) {
             if (error instanceof BaseagentRunnerUnavailableError) {
@@ -1569,6 +1610,7 @@ export class ResponseEngine {
         }
         // 为本次任务处理生成唯一 task_id（客户端生成，格式 task-{10hex}）
         const taskId = `task-${crypto.randomUUID().replace(/-/g, '').slice(0, 10)}`;
+        const taskPauseController = this.getPauseController(session.id);
         let turnLease;
         const inputCausation = normalizeCausation(message.causation) ?? createRootCausation();
         const taskCausation = deriveCausation(inputCausation);
@@ -1604,7 +1646,12 @@ export class ResponseEngine {
         const currentChannelType = options?.channelType || message.channel;
         const adapterAny = channelInfo.adapter;
         const adapterSelfAid = typeof adapterAny._selfAid === 'function' ? adapterAny._selfAid() : undefined;
-        const selfAid = adapterSelfAid || message.selfAID || session.selfAID || undefined;
+        // During bootstrap the lifecycle owner is the authoritative identity. Do
+        // not let a stale/crafted message or session selfAID redirect agent.md
+        // access or the two lifecycle commands to another local AID.
+        const selfAid = isBootstrapping
+            ? owningAgentForTask?.aid
+            : adapterSelfAid || message.selfAID || session.selfAID || undefined;
         const registrySelfName = selfAid ? this.agentRegistry?.resolveDisplayName?.(selfAid) : undefined;
         const adapterSelfName = typeof adapterAny._selfName === 'function' ? adapterAny._selfName() : undefined;
         const selfName = registrySelfName ?? adapterSelfName;
@@ -1684,9 +1731,10 @@ export class ResponseEngine {
             chatType,
             peerType,
         });
+        const responseModeAgentDir = selfAid ? resolveAgentDir(selfAid) : undefined;
         // mentionMode：顶层通用参数（先读出备用，投递/入队策略后续接入）
         const mentionMode = effectiveAgentConfig?.mentionMode ?? 'disabled';
-        const resolvedMode = triggerChatModeOverride || systemOrServicePeer
+        const resolvedMode = triggerChatModeOverride || systemOrServicePeer || !responseModeAgentDir
             ? null // trigger 强制覆盖或 system/service 强制 interactive 时，不走插件解析
             : this.responseCoordinator.resolveMode(effectiveAgentConfig?.responseMode, // 标量：关系级>agent级>注册表首选
             chatModeFallback, effectiveAgentConfig?.responseModeParams, // 按模式分桶的参数字典
@@ -1706,7 +1754,7 @@ export class ResponseEngine {
                     send: async () => { }, // 引擎自行发送，插件 handleOutbound 只做决策
                 },
                 logger,
-                agentDir: resolvePaths().agentsDir,
+                agentDir: responseModeAgentDir,
             });
         if (resolvedMode) {
             logger.info('[ResponseSystem] selected mode=' + resolvedMode.mode.id + ' source=' + resolvedMode.source + ' chatType=' + chatType + ' peerKey=' + (peerKey ?? 'none') + ' chatMode=' + chatModeFallback);
@@ -2208,6 +2256,7 @@ export class ResponseEngine {
                 approvalRouting,
                 approvalInteractionPolicy: authorizationIdentity ? 'deny' : 'interactive',
                 recordExecutionAnomaly,
+                pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
                 armApprovedDelegationCommand: this.agentDelegationRegistry
                     ? (carrierToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
@@ -2363,8 +2412,8 @@ export class ResponseEngine {
                 // Personal state is exposed to the manifest as vars. The manifest owns
                 // loading persona.md and working.md into the system prompt.
                 const owningAgent = owningAgentForTask;
-                const persona = owningAgent?.getPersona?.() || undefined;
-                const working = owningAgent?.getWorkingMemory?.() || undefined;
+                const persona = isActive ? (owningAgent?.getPersona?.() || undefined) : undefined;
+                const working = isActive ? (owningAgent?.getWorkingMemory?.() || undefined) : undefined;
                 // 计算 peerKey：群聊固定按 groupId/channelId，私聊按发送者 peerId。
                 // 这样单条和积压合并批次不会因队列状态不同而切换关系级配置。
                 const normalizedBaseagent = normalizeBaseagent(agent.name);
@@ -2521,6 +2570,12 @@ export class ResponseEngine {
                 if (shouldPassPermissionMode) {
                     modelOverride = { ...(modelOverride || {}), permissionMode: effectivePermissionMode };
                 }
+                if (isBootstrapping && selfAid) {
+                    modelOverride = {
+                        ...(modelOverride || {}),
+                        bootstrapAgentMdPath: agentMdPath(selfAid),
+                    };
+                }
                 if (normalizedBaseagent.canonical === 'claude') {
                     modelOverride = {
                         ...(modelOverride || {}),
@@ -2567,6 +2622,9 @@ export class ResponseEngine {
                         VENUES_DIR: selfAid ? path.join(resolveRoot(), 'agents', selfAid, 'venues') : undefined,
                         selfAid: selfAid || undefined,
                         selfName: selfName || undefined,
+                        agentMdPath: selfAid ? agentMdPath(selfAid) : undefined,
+                        lifecycle,
+                        isBootstrapping,
                         hasPersona: !!persona,
                         hasWorkingMemory: !!working,
                         peerId: peerIdRaw || undefined,
@@ -2637,7 +2695,12 @@ export class ResponseEngine {
                 // 按会话原型（sessionType）选 manifest 文件：config.sessionManifests 映射，缺省回退主 manifest。
                 const sessionType = session.sessionType ?? 'main';
                 const sessionManifests = this.agentRegistry?.resolveByChannel(channelKey)?.config?.sessionManifests;
-                const manifestFile = sessionManifests?.[sessionType] ?? 'eck_manifest.json';
+                // Bootstrap always uses the lifecycle-gated main manifest. A custom
+                // session manifest (for example the auxiliary manifest with `always`
+                // sections) must not reintroduce normal rules or command context.
+                const manifestFile = isBootstrapping
+                    ? 'eck_manifest.json'
+                    : sessionManifests?.[sessionType] ?? 'eck_manifest.json';
                 const kitContext = renderKitSections(kitCtx, manifestFile);
                 effectiveSystemPrompt = [options?.systemPromptAppend, kitContext].filter(Boolean).join('\n') || undefined;
                 // ── Stats: context_breakdown 旁路采集（各段估算 token 数，字符数/4 近似） ──
@@ -3834,6 +3897,7 @@ export class ResponseEngine {
             if (this.activeRenderers.get(session.id)?.taskId === taskId) {
                 this.activeRenderers.delete(session.id);
             }
+            this.clearPauseSession(session.id, taskPauseController);
         }
         // [迁移探针] 任务收尾：记录工具提醒最终状态并落盘（防线 1）
         if (snapshot.isEnabled()) {
@@ -4420,8 +4484,15 @@ export class ResponseEngine {
                         // 重置最后回复追踪
                         lastReplyText = '';
                         hasProjectedCurrentReplyText = false;
+                        const lifecycleEventKey = buildToolLifecycleEventKey({
+                            sessionId: session.id,
+                            callId: event.callId,
+                            correlationId: event.correlationId,
+                        });
                         this.eventBus.publish({
                             type: 'tool:use',
+                            eventKey: lifecycleEventKey,
+                            eventPhase: 'use',
                             sessionId: session.id,
                             toolName: event.name,
                             input: event.input,
@@ -4429,6 +4500,10 @@ export class ResponseEngine {
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
                             agentAid: session.selfAID ?? 'unknown',
                             permissionMode: permissionMode ?? 'unknown',
+                            decision: 'pending',
+                            decisionSource: 'runner',
+                            executed: false,
+                            executionState: 'requested',
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4487,8 +4562,15 @@ export class ResponseEngine {
                                 logger.warn('[ResponseEngine] auto clear queue after ec ctl queue failed:', error);
                             }
                         }
+                        const lifecycleEventKey = buildToolLifecycleEventKey({
+                            sessionId: session.id,
+                            callId: event.callId,
+                            correlationId: event.correlationId,
+                        });
                         this.eventBus.publish({
                             type: 'tool:result',
+                            eventKey: lifecycleEventKey,
+                            eventPhase: 'result',
                             sessionId: session.id,
                             toolName: event.name,
                             isError: event.isError,
@@ -4498,6 +4580,10 @@ export class ResponseEngine {
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
                             agentAid: session.selfAID ?? 'unknown',
                             permissionMode: permissionMode ?? 'unknown',
+                            decision: event.isError ? 'error' : 'allow',
+                            decisionSource: 'runner',
+                            executed: true,
+                            executionState: event.isError ? 'failed' : 'completed',
                             timestamp: Date.now(),
                             causation,
                         });

package/dist/core/permission/sandbox-runtime.js

@@ -4,7 +4,42 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+let sandboxInitializationCircuit;
+let sandboxCircuitNoticeAt = 0;
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
+export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
+/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
+    const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
+    sandboxInitializationCircuit = sandboxInitializationCircuit
+        ? {
+            ...sandboxInitializationCircuit,
+            lastObservedAt: now,
+            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            detail,
+        }
+        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
+    return { ...sandboxInitializationCircuit };
+}
+/** Return an active failure circuit, or allow one probe after the cooldown. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
+    if (!sandboxInitializationCircuit)
+        return undefined;
+    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+        sandboxInitializationCircuit = undefined;
+        sandboxCircuitNoticeAt = 0;
+        return undefined;
+    }
+    return { ...sandboxInitializationCircuit };
+}
+/** Rate-limit human-readable warnings; structured audit still records every blocked task. */
+export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
+    if (sandboxCircuitNoticeAt && now - sandboxCircuitNoticeAt < intervalMs)
+        return false;
+    sandboxCircuitNoticeAt = now;
+    return true;
+}
 /** Recognize sandbox bootstrap failures independently of localized stderr. */
 export function isSandboxInitializationFailure(error, stderr = []) {
     const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
@@ -14,9 +49,18 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
         || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
-        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
+    if (error instanceof Error
+        && (error.code === SANDBOX_INITIALIZATION_FAILED
+            || error.message.includes(`${SANDBOX_INITIALIZATION_FAILED}:`))) {
+        error.code = SANDBOX_INITIALIZATION_FAILED;
+        if (stderr.length > 0)
+            error.stderr = [...stderr].slice(-20);
+        return error;
+    }
     const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
     const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
     wrapped.name = 'SandboxInitializationError';
@@ -211,6 +255,16 @@ function appendRuntimeBackedEtcFiles(args) {
         args.push('--ro-bind', candidate, resolved);
     }
 }
+function appendContainerEtcFileBinds(args) {
+    for (const candidate of ['/etc/resolv.conf', '/etc/hosts', '/etc/hostname']) {
+        if (!fs.existsSync(candidate))
+            continue;
+        // A directory bind does not recursively preserve OCI/container-runtime
+        // file mounts. Rebind only the three standard runtime-injected files after
+        // /etc becomes readonly; no other /etc mount is carried into the guard.
+        args.push('--ro-bind', candidate, candidate);
+    }
+}
 function appendHClassMasks(args, root, maskContainerSockets) {
     for (const target of getExistingHClassMaskTargets(root)) {
         if (target.kind === 'directory')
@@ -251,20 +305,30 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
             throw new Error(`Codex managed requirements is not a file: ${requirements}`);
         }
         const managedDirectory = path.dirname(requirements);
+        const systemConfigDirectory = '/etc/codex';
+        let systemConfigStat;
+        try {
+            systemConfigStat = fs.lstatSync(systemConfigDirectory);
+        }
+        catch {
+            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                + 'must be created as a real directory during installation');
+        }
+        if (!systemConfigStat.isDirectory() || systemConfigStat.isSymbolicLink()) {
+            throw new Error(`Codex managed requirements mountpoint is unsafe: ${systemConfigDirectory} `
+                + 'must be a real directory');
+        }
         // Keep the copied hook immutable even when a session uses bypass mode.
         args.push('--ro-bind', managedDirectory, managedDirectory);
-        // A host may not have /etc/codex yet. Overlay /etc inside this namespace so
-        // Bubblewrap can create the mountpoint without modifying the host, while
-        // retaining the complete host /etc as the read-only lower layer.
-        args.push('--overlay-src', '/etc');
-        args.push('--tmp-overlay', '/etc');
-        args.push('--dir', '/etc/codex');
-        // Replace the complete Codex system-config directory inside this app-server
-        // namespace so host system hooks cannot join EvolCore's managed hook set.
-        args.push('--tmpfs', '/etc/codex');
-        args.push('--ro-bind', requirements, '/etc/codex/requirements.toml');
-        args.push('--remount-ro', '/etc/codex');
-        args.push('--remount-ro', '/etc');
+        // The guard starts from a writable root so owner-bypass workspaces keep
+        // their normal semantics. Make the system configuration tree readonly
+        // before replacing only Codex's directory, so a root daemon cannot write
+        // unrelated files under /etc from inside this namespace.
+        args.push('--ro-bind', '/etc', '/etc');
+        appendContainerEtcFileBinds(args);
+        // Replace only Codex's system-config directory. Requiring the mountpoint to
+        // exist prevents Bubblewrap from creating it on the writable host root.
+        args.push('--ro-bind', managedDirectory, systemConfigDirectory);
     }
     args.push('--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
@@ -304,4 +368,6 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
 }
 export function _resetSandboxRuntimeCache() {
     cachedBubblewrapPath = undefined;
+    sandboxInitializationCircuit = undefined;
+    sandboxCircuitNoticeAt = 0;
 }

package/dist/core/permission/tool-policy.js

@@ -1148,7 +1148,7 @@ export function checkLClassWrite(toolName, input, context) {
                 behavior: 'deny',
                 message: context?.permissionMode === 'readonly'
                     ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
-                    : '🔒 L-class 路径仅允许受限、可证明只读的命令；未知 Shell 语法失败关闭。修改必须通过受控的 EvolCore 命令',
+                    : '🔒 L-class 路径允许读取，但当前 Bash 复合命令无法证明为只读，已拒绝执行。请改用受控的 EvolCore 读取命令或白名单只读命令',
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);