evolcore 0.0.17 → 0.0.19

package/dist/agents/ecagent-runner.js

@@ -459,11 +459,30 @@ function isWithin(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-function resolveToolPath(projectPath, candidate, forWrite = false) {
+export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath) {
     const root = fs.realpathSync(projectPath);
     const resolved = path.resolve(root, candidate || '.');
-    if (!isWithin(root, resolved))
+    const allowedBootstrapFile = bootstrapAgentMdPath
+        ? path.resolve(bootstrapAgentMdPath)
+        : undefined;
+    const isBootstrapAgentMd = allowedBootstrapFile === resolved;
+    if (!isWithin(root, resolved) && !isBootstrapAgentMd) {
         throw new Error(`Path is outside the project: ${candidate}`);
+    }
+    if (isBootstrapAgentMd) {
+        const parent = path.dirname(resolved);
+        const canonicalParent = fs.realpathSync(parent);
+        if (!isWithin(parent, canonicalParent) || !isWithin(canonicalParent, parent)) {
+            throw new Error(`Bootstrap agent.md parent resolves outside its declared path: ${candidate}`);
+        }
+        if (fs.existsSync(resolved)) {
+            const canonicalFile = fs.realpathSync(resolved);
+            if (!isWithin(resolved, canonicalFile) || !isWithin(canonicalFile, resolved)) {
+                throw new Error(`Bootstrap agent.md resolves outside its declared path: ${candidate}`);
+            }
+        }
+        return resolved;
+    }
     const existing = forWrite ? path.dirname(resolved) : resolved;
     let cursor = existing;
     while (!fs.existsSync(cursor) && cursor !== path.dirname(cursor))
@@ -522,7 +541,7 @@ async function walkFiles(root, signal) {
 function textResult(text, details = {}) {
     return { content: [{ type: 'text', text: truncate(text) }], details };
 }
-function createTools(env, projectPath, runtimeEnv) {
+function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath) {
     const read = {
         name: 'Read', label: 'Read', description: 'Read a UTF-8 text file from the project.',
         parameters: Type.Object({
@@ -531,7 +550,7 @@ function createTools(env, projectPath, runtimeEnv) {
             limit: Type.Optional(Type.Number({ minimum: 1 })),
         }),
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath);
             const stat = await fs.promises.stat(file);
             if (stat.size > MAX_READ_BYTES)
                 throw new Error(`File exceeds ${MAX_READ_BYTES} byte read limit`);
@@ -548,7 +567,7 @@ function createTools(env, projectPath, runtimeEnv) {
         name: 'Glob', label: 'Glob', description: 'Find project files matching a glob pattern.',
         parameters: Type.Object({ pattern: Type.String(), path: Type.Optional(Type.String()) }),
         async execute(_id, params, signal) {
-            const root = resolveToolPath(projectPath, params.path ?? '.');
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.');
             const matcher = globRegex(params.pattern.replaceAll('\\', '/'));
             const files = (await walkFiles(root, signal))
                 .map(file => path.relative(root, file).replaceAll(path.sep, '/'))
@@ -564,7 +583,7 @@ function createTools(env, projectPath, runtimeEnv) {
             case_insensitive: Type.Optional(Type.Boolean()), literal: Type.Optional(Type.Boolean()),
         }),
         async execute(_id, params, signal) {
-            const root = resolveToolPath(projectPath, params.path ?? '.');
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.');
             const files = (await fs.promises.stat(root)).isFile() ? [root] : await walkFiles(root, signal);
             const fileMatcher = params.glob ? globRegex(params.glob.replaceAll('\\', '/')) : undefined;
             const flags = params.case_insensitive ? 'i' : '';
@@ -597,7 +616,7 @@ function createTools(env, projectPath, runtimeEnv) {
         name: 'Write', label: 'Write', description: 'Create or completely overwrite a project file.',
         parameters: Type.Object({ file_path: Type.String(), content: Type.String() }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path, true);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath);
             await fs.promises.mkdir(path.dirname(file), { recursive: true });
             await fs.promises.writeFile(file, params.content, { encoding: 'utf8', signal });
             return textResult(`Wrote ${Buffer.byteLength(params.content)} bytes to ${path.relative(projectPath, file)}`, { file });
@@ -610,7 +629,7 @@ function createTools(env, projectPath, runtimeEnv) {
             replace_all: Type.Optional(Type.Boolean()),
         }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveToolPath(projectPath, params.file_path);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath);
             const value = await fs.promises.readFile(file, { encoding: 'utf8', signal });
             if (!params.old_string)
                 throw new Error('old_string must not be empty');
@@ -809,7 +828,7 @@ export class EcagentRunner {
                 models,
                 model,
                 thinkingLevel: normalizeThinkingLevel(effort),
-                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv),
+                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath),
                 systemPrompt: [DEFAULT_SYSTEM_PROMPT, request.systemPromptAppend].filter(Boolean).join('\n\n'),
                 streamOptions: {
                     timeoutMs: this.config.timeoutMs,
@@ -823,7 +842,15 @@ export class EcagentRunner {
                 runtime.harness = undefined;
                 throw new Error('ecagent run interrupted');
             }
-            harness.on('tool_call', event => this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input));
+            harness.on('tool_call', async (event, signal) => {
+                const pauseController = this.permissionContexts.get(request.sessionId)?.pauseController;
+                if (pauseController) {
+                    const pauseResult = await pauseController.waitAtToolBoundary(signal);
+                    if (pauseResult === 'cancelled')
+                        return { block: true, reason: '工具调用已取消' };
+                }
+                return this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input);
+            });
             const unsubscribe = harness.subscribe(event => this.mapHarnessEvent(queue, event, stats, model, effort));
             queue.push({ type: 'state_changed', state: 'running' });
             queue.push({ type: 'status', subtype: 'started', message: `ecagent is using ${modelId}` });
@@ -1043,6 +1070,7 @@ export class EcagentRunner {
         return decision.matched && decision.decision === 'deny' ? { block: true, reason: '危险操作未获人工批准' } : {};
     }
     async interrupt(sessionKey) {
+        this.permissionContexts.get(sessionKey)?.pauseController?.cancel();
         this.permissionGateway?.cancelAll(sessionKey, 'interrupted');
         const harness = this.runtimes.get(sessionKey)?.harness;
         if (harness) {
@@ -1058,6 +1086,7 @@ export class EcagentRunner {
             void harness.steer(text).catch(error => logger.warn('[EcagentRunner] Failed to steer active run:', error));
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         await this.interrupt(sessionId).catch(() => { });
         this.runtimes.delete(sessionId);
         this.activeStreams.delete(sessionId);

package/dist/agents/gemini-runner.js

@@ -129,44 +129,99 @@ const GEMINI_L_CLASS_PATTERNS = [
 const GEMINI_L_CLASS_WRITE_TOOLS = [
     'write_file', 'replace', 'delete_file', 'move_file', 'rename_file',
 ];
+const GEMINI_BOOTSTRAP_FILE_TOOLS = ['write_file', 'replace'];
+const GEMINI_BOOTSTRAP_LIFECYCLE_TOOLS = ['update_topic', 'complete_task'];
 const GEMINI_EC_COMMAND_PATTERNS = [
-    String.raw `"command":"[ ]*ec[ ]*"`,
+    String.raw `\x00"command":"[ ]*ec[ ]*"\x00`,
     // This is only a shell-process boundary. It deliberately does not inspect
     // subcommands or arguments. Shell composition remains excluded because the
     // Gemini policy exception applies to the whole run_shell_command call.
-    String.raw `"command":"[ ]*ec[ ]+(?:[^"\\;&|$()<>\x60\r\n]|\\")*"`,
+    // stableStringify JSON-escapes control characters. Reject those escapes
+    // explicitly, while retaining valid `\\`/`\"` escapes used by paths and
+    // quoted arguments.
+    String.raw `\x00"command":"[ ]*ec[ ]+(?:[^"\x00;&|$()<>\x60\r\n\\]|\\(?:\\|"))*"\x00`,
 ];
-export function resolveGeminiPermissionProfile(value) {
+export function resolveGeminiPermissionProfile(value, bootstrap = false) {
     const normalized = normalizePermissionMode(value);
-    if (normalized.mode === 'auto')
-        return { mode: 'auto', approvalMode: 'auto_edit' };
-    if (normalized.mode === 'request' || normalized.mode === 'bypass') {
-        return { mode: 'readonly', approvalMode: 'plan', degradedFrom: normalized.mode };
-    }
-    return { mode: 'readonly', approvalMode: 'plan' };
+    const profile = normalized.mode === 'auto'
+        ? { mode: 'auto', approvalMode: 'auto_edit' }
+        : normalized.mode === 'request' || normalized.mode === 'bypass'
+            ? { mode: 'readonly', approvalMode: 'plan', degradedFrom: normalized.mode }
+            : { mode: 'readonly', approvalMode: 'plan' };
+    // Bootstrap has its own deny-by-default Admin policy. auto_edit is required
+    // so Gemini exposes write_file/replace, while that policy still limits them
+    // to the single declared agent.md path.
+    return bootstrap ? { ...profile, approvalMode: 'auto_edit' } : profile;
+}
+function escapeGeminiArgsRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function normalizeGeminiBootstrapAgentMdPath(candidate) {
+    const filePath = path.resolve(candidate);
+    const aidDir = path.dirname(filePath);
+    const aid = path.basename(aidDir);
+    const aidsDirName = path.basename(path.dirname(aidDir));
+    if (path.basename(filePath).toLowerCase() !== 'agent.md'
+        || aidsDirName.toLowerCase() !== 'aids'
+        || !/^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?){2,}$/.test(aid)) {
+        throw new Error(`Invalid Gemini bootstrap agent.md path: ${candidate}`);
+    }
+    return { filePath, aid };
+}
+function geminiJsonFieldEqualsPattern(fields, value) {
+    const encodedValue = JSON.stringify(value);
+    return `\\x00"(?:${fields.join('|')})":${escapeGeminiArgsRegex(encodedValue)}\\x00`;
+}
+function geminiExactShellCommandPattern(command) {
+    // Gemini stableStringify wraps the top-level NUL-delimited field in `{}`.
+    // Matching the whole object also rejects extra shell options such as
+    // is_background or additional_permissions during bootstrap.
+    return `^\\{\\x00"command":"[ ]*${escapeGeminiArgsRegex(command)}[ ]*"\\x00\\}$`;
 }
 function appendGeminiPolicyRule(lines, toolName, decision, priority, argsPattern) {
     lines.push('[[rule]]');
     lines.push(`toolName = ${Array.isArray(toolName) ? JSON.stringify(toolName) : JSON.stringify(toolName)}`);
     if (argsPattern)
-        lines.push(`argsPattern = '${argsPattern}'`);
+        lines.push(`argsPattern = ${JSON.stringify(argsPattern)}`);
     lines.push(`decision = "${decision}"`);
     lines.push(`priority = ${priority}`, '');
 }
-export function buildGeminiAdminPolicy(profile) {
+export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath) {
     const lines = [];
+    if (bootstrapAgentMdPath) {
+        const bootstrap = normalizeGeminiBootstrapAgentMdPath(bootstrapAgentMdPath);
+        // Preserve the global protected-path boundary even if a malformed internal
+        // caller ever supplies a protected file as the bootstrap target.
+        for (const pattern of GEMINI_H_CLASS_PATTERNS) {
+            appendGeminiPolicyRule(lines, '*', 'deny', 998, pattern);
+        }
+        for (const pattern of GEMINI_L_CLASS_PATTERNS) {
+            appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 997, pattern);
+        }
+        const readPathPattern = geminiJsonFieldEqualsPattern(['file_path'], bootstrap.filePath);
+        const writePathPattern = geminiJsonFieldEqualsPattern(['file_path'], bootstrap.filePath);
+        appendGeminiPolicyRule(lines, 'read_file', 'allow', 990, readPathPattern);
+        appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_FILE_TOOLS, 'allow', 990, writePathPattern);
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec aid agentmd put ${bootstrap.aid}`));
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec agent ready ${bootstrap.aid}`));
+        // These are Gemini's non-I/O task bookkeeping tools. They do not expose
+        // project files, shell, network, MCP, or user-interaction capabilities.
+        appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_LIFECYCLE_TOOLS, 'allow', 950);
+        appendGeminiPolicyRule(lines, '*', 'deny', 900);
+        return lines.join('\n');
+    }
     // EC/daemon owns all command semantics and authorization. The Runner only
     // admits a single EC process through the otherwise mode-specific shell
     // policy. Keep this above path denies so `--file` is not reinterpreted here.
     for (const pattern of GEMINI_EC_COMMAND_PATTERNS) {
-        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 1000, pattern);
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 999, pattern);
     }
     // H-class protection is mode-independent and applies to built-in and MCP tools.
     for (const pattern of GEMINI_H_CLASS_PATTERNS) {
-        appendGeminiPolicyRule(lines, '*', 'deny', 999, pattern);
+        appendGeminiPolicyRule(lines, '*', 'deny', 998, pattern);
     }
     for (const pattern of GEMINI_L_CLASS_PATTERNS) {
-        appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 998, pattern);
+        appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 997, pattern);
     }
     if (profile.mode === 'readonly') {
         appendGeminiPolicyRule(lines, GEMINI_READONLY_TOOLS, 'allow', 950);
@@ -277,7 +332,10 @@ export class GeminiRunner {
         let geminiSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
         // per-call 权限模式/模型：优先 override，缺省回落实例级（多会话并发互不污染）
         const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
-        const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode);
+        const bootstrapAgentMdPath = modelOverride?.bootstrapAgentMdPath
+            ? normalizeGeminiBootstrapAgentMdPath(modelOverride.bootstrapAgentMdPath).filePath
+            : undefined;
+        const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode, !!bootstrapAgentMdPath);
         const callModel = modelOverride?.model || this.model;
         const runtimeDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR;
         const managedTmpDir = runtimeDir ?? process.env.TMPDIR;
@@ -288,7 +346,12 @@ export class GeminiRunner {
         fs.mkdirSync(geminiHome, { recursive: true, mode: 0o700 });
         const sandboxProbe = buildBubblewrapCommand(this.resolved.cliPath, [], {
             projectPath,
-            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
+            writablePaths: [
+                geminiHome,
+                ...(runtimeDir ? [runtimeDir] : []),
+                ...(runtimeLockDir ? [runtimeLockDir] : []),
+                ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+            ],
         });
         if (!sandboxProbe && workspaceContainsHClassPaths(projectPath)) {
             throw new Error('Gemini 缺少可用的路径级隔离运行时，且项目覆盖 EvolCore 受保护根；已拒绝启动本轮任务');
@@ -309,7 +372,7 @@ export class GeminiRunner {
                 throw new Error('Gemini 系统级 admin policy 会忽略 EvolCore 的临时安全策略，已拒绝启动本轮任务');
             }
             const policyPath = path.join(managedTmpDir, `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
-            fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile), { mode: 0o600, flag: 'wx' });
+            fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile, bootstrapAgentMdPath), { mode: 0o600, flag: 'wx' });
             tempFiles.push(policyPath);
             args.push(...buildGeminiPermissionArgs(permissionProfile, policyPath, !!sandboxProbe));
         }
@@ -331,9 +394,12 @@ export class GeminiRunner {
         args.push('--output-format', 'stream-json');
         args.push('-m', callModel);
         // Permission mode
-        if (permissionProfile.degradedFrom) {
+        if (permissionProfile.degradedFrom && !bootstrapAgentMdPath) {
             logger.warn(`[GeminiRunner] permission mode ${permissionProfile.degradedFrom} is unavailable in headless mode; degraded to readonly`);
         }
+        else if (bootstrapAgentMdPath) {
+            logger.info('[GeminiRunner] using bootstrap-only tool policy for the declared agent.md');
+        }
         // Resume session
         if (geminiSessionId) {
             args.push('-r', geminiSessionId);
@@ -342,7 +408,12 @@ export class GeminiRunner {
         const env = this.buildAgentEnv(sessionId, runtimeEnv);
         const sandboxedCommand = buildBubblewrapCommand(this.resolved.cliPath, args, {
             projectPath,
-            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
+            writablePaths: [
+                geminiHome,
+                ...(runtimeDir ? [runtimeDir] : []),
+                ...(runtimeLockDir ? [runtimeLockDir] : []),
+                ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+            ],
             readonlyPaths: tempFiles,
         });
         const child = spawn(sandboxedCommand?.command ?? this.resolved.cliPath, sandboxedCommand?.args ?? args, {

package/dist/aun/aid/store.js

@@ -1,6 +1,12 @@
 import fs from 'fs';
 import path from 'path';
 import { AUN_KEYSTORE_ENCRYPTION_SEED } from './encryption-seed-policy.js';
+// fastaun uses maxPages=1 for the background tail -> forward handoff. That is
+// useful as a latency guard, but it can leave a group backlog when no later
+// push arrives to trigger the next page. Bound the daemon recovery pull to ten
+// pages so a large backlog is drained without monopolizing the sync loop.
+const FULL_GROUP_PULL_MAX_PAGES = 10;
+const GROUP_PULL_PAGINATION_PATCH = Symbol('evolcore.groupPullPaginationPatch');
 /**
  * Slot 命名约定（基于 fastaun 0.4.3 隔离键语义）。
  *
@@ -68,6 +74,36 @@ export async function loadClient(store, aid) {
     const { AUNClient } = await import('@agentunion/fastaun');
     return new AUNClient(loadAid(store, aid));
 }
+/**
+ * Enable bounded multi-page group pulls for the long-lived daemon client.
+ *
+ * The SDK's background realtime recovery path intentionally passes
+ * `maxPages=1`; for a daemon this can strand a backlog after a tail sync.
+ * This adapter only expands that sentinel value and leaves all other pull
+ * options unchanged. It is isolated to the client that explicitly opts in.
+ */
+export function enableFullGroupPullPagination(client) {
+    const target = client;
+    if (target[GROUP_PULL_PAGINATION_PATCH])
+        return false;
+    const pull = target._pullGroupV2;
+    if (typeof pull !== 'function')
+        return false;
+    const wrappedPull = function (groupId, afterSeq, limit, opts) {
+        const expandedOpts = opts?.maxPages === 1
+            ? { ...opts, maxPages: FULL_GROUP_PULL_MAX_PAGES }
+            : opts;
+        return pull.call(this, groupId, afterSeq, limit, expandedOpts);
+    };
+    Object.defineProperty(target, GROUP_PULL_PAGINATION_PATCH, {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false,
+    });
+    target._pullGroupV2 = wrappedPull;
+    return true;
+}
 /** 加载本地 AID 值对象（用于离线签名/验签，无需连接）。load 失败抛 AidLoadError。 */
 export function loadAid(store, aid) {
     const r = store.load(aid);

package/dist/aun/msg/p2p.js

@@ -14,22 +14,34 @@ import { normalizeAunMentionEntries } from './mention-schema.js';
 const DAEMON_SEND_TIMEOUT_GRACE_MS = 10_000;
 const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 const MAX_TIMER_MS = 2_147_483_647;
+/**
+ * Read process settings through the config facade. A delegated CLI can run
+ * inside a sandbox where daemon.json is intentionally unreadable; sending a
+ * message must still use the protocol defaults instead of surfacing EACCES.
+ */
+function readDaemonConfigForSend() {
+    try {
+        return loadDaemonConfig();
+    }
+    catch {
+        return {};
+    }
+}
 export function daemonTaskSendIpcTimeoutMs(file = false) {
     let idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS;
-    try {
-        const config = JSON.parse(fs.readFileSync(resolvePaths().daemonConfig, 'utf8'));
-        const seconds = config.idleMonitor?.timeout;
-        if (typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0) {
-            idleTimeoutMs = seconds * 1000;
-        }
+    // Use the ConfigStore read path so managed tasks never open daemon.json
+    // directly. The daemon-owned config reader handles missing, invalid, and
+    // protected files without leaking a filesystem access error into IMRenderer.
+    const seconds = readDaemonConfigForSend().idleMonitor?.timeout;
+    if (typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0) {
+        idleTimeoutMs = seconds * 1000;
     }
-    catch { }
     return Math.min(MAX_TIMER_MS, Math.max(file ? 120_000 : 5_000, idleTimeoutMs + DAEMON_SEND_TIMEOUT_GRACE_MS));
 }
 export function resolveAunMessageEncrypt(explicit) {
     if (typeof explicit === 'boolean')
         return explicit;
-    return loadDaemonConfig().aun?.defaultEncrypt ?? true;
+    return readDaemonConfigForSend().aun?.defaultEncrypt ?? true;
 }
 function buildSimplePayload(body) {
     switch (body.mode) {