evolcore 0.0.18 → 0.0.19

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.19 (2026-08-27)
+
+### PowerShell EC 命令安全
+
+- 支持 PowerShell `pwsh`/`powershell` 受管命令载体解析，拒绝拼接、展开和重定向。
+- 统一 Codex EC 命令委派与预检解析，补充 PowerShell 引号、展开和错误指引。
+
+### Bootstrap 与运行时控制
+
+- Bootstrap 阶段保留 Menu 与斜杠协议处理，普通模型任务继续按生命周期门禁。
+- 命令意外泄漏至响应引擎时统一丢弃并记录失败审计，避免进入 Agent 执行。
+
+### 跨平台安装与诊断
+
+- Windows 数据迁移固定调用系统 `bsdtar`，避免 Git Bash GNU tar 误解析 Windows 绝对路径。
+- Linux 安装器幂等创建真实 `/etc/codex` 目录，拒绝同名文件和符号链接。
+- 统一数据根解析，仅使用 `EVOLCORE_HOME` 或 `~/.evolcore`，避免因启动目录不同误用数据目录。
+- `ec start` 已运行提示新增 Daemon 持续运行时长，并支持 IPC uptime 回退探测。
+
 ## 0.0.18 (2026-08-27)
 
 ### DaemonOwner 与受管 Agent 操作

package/dist/agents/codex-runner.js

@@ -20,7 +20,7 @@ import { buildEnvelope, sendInteractionPayload } from '../core/message/message-u
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir } from '../cli/task-context.js';
@@ -316,18 +316,20 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
-        const classification = classifyEvolcoreShellCommand(command);
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir, dialect = 'posix') {
+        const parseOptions = {
+            allowManagedTmpDir: true,
+            dialect,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        };
+        const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const argv = parseLiteralShellArgv(command, {
-            allowManagedTmpDir: true,
-            ...(managedTempDir ? { managedTempDir } : {}),
-        });
+        const argv = parseLiteralShellArgv(command, parseOptions);
         if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
             return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
@@ -343,11 +345,11 @@ export class CodexRunner {
                 ? undefined
                 : explicitArgv;
         }
-        const explicitWrappedCommand = explicitArgv
-            ? unwrapCodexShellCommandArgv(explicitArgv)
+        const explicitCarrier = explicitArgv
+            ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
-        if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
+        if (explicitCarrier !== undefined) {
+            return this.approvedLiteralEvolcoreCommandArgv(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
@@ -357,12 +359,12 @@ export class CodexRunner {
             allowManagedTmpDir: true,
             ...(managedTempDir ? { managedTempDir } : {}),
         });
-        const wrappedCommand = wrappedArgv
-            ? unwrapCodexShellCommandArgv(wrappedArgv)
+        const shellCarrier = wrappedArgv
+            ? resolveCodexShellCarrierArgv(wrappedArgv)
             : undefined;
-        return wrappedCommand === undefined
+        return shellCarrier === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
+            : this.approvedLiteralEvolcoreCommandArgv(shellCarrier.command, managedTempDir, shellCarrier.dialect);
     }
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
@@ -371,9 +373,11 @@ export class CodexRunner {
                 return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
-            const wrappedCommand = unwrapCodexShellCommandArgv(rawArgv);
-            return wrappedCommand !== undefined
-                && classifyEvolcoreShellCommand(wrappedCommand).kind !== 'none';
+            const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
+            return shellCarrier !== undefined
+                && classifyEvolcoreShellCommand(shellCarrier.command, {
+                    dialect: shellCarrier.dialect,
+                }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';

package/dist/cli/daemon-commands.js

@@ -218,6 +218,33 @@ function formatLocalTime(ms) {
     const d = new Date(ms);
     return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}`;
 }
+function formatRunningDuration(ms) {
+    const totalSeconds = Math.max(0, Math.floor(ms / 1000));
+    const seconds = totalSeconds % 60;
+    const totalMinutes = Math.floor(totalSeconds / 60);
+    if (totalMinutes === 0)
+        return `${seconds}秒`;
+    const minutes = totalMinutes % 60;
+    const totalHours = Math.floor(totalMinutes / 60);
+    if (totalHours === 0)
+        return `${minutes}分${seconds}秒`;
+    const hours = totalHours % 24;
+    const days = Math.floor(totalHours / 24);
+    if (days === 0)
+        return `${hours}小时${minutes}分${seconds}秒`;
+    return `${days}天${hours}小时${minutes}分${seconds}秒`;
+}
+function resolveRunningDuration(pid, uptime) {
+    if (typeof uptime === 'number' && Number.isFinite(uptime) && uptime >= 0) {
+        return formatRunningDuration(uptime);
+    }
+    const processStartedAt = getProcessStartTime(pid);
+    if (processStartedAt !== null) {
+        return formatRunningDuration(Date.now() - processStartedAt);
+    }
+    const instance = scanInstances().mains.find(entry => entry.alive && entry.record.pid === pid);
+    return instance ? formatRunningDuration(Date.now() - instance.record.startedAt) : '未知';
+}
 function printStartupInfo(opts = {}) {
     const pkgRoot = getPackageRoot();
     const isNpmInstall = pkgRoot.includes('node_modules');
@@ -273,7 +300,7 @@ export async function cmdStart(opts = {}) {
     const existingDaemon = await probeDaemon(p.socket);
     if (existingDaemon) {
         console.log(`  EvolCore is already running (PID: ${existingDaemon.pid}, IPC reachable)`);
-        console.log('  已在运行；部署/脚本可直接复用当前实例');
+        console.log(`  已在运行；已运行时长: ${resolveRunningDuration(existingDaemon.pid, existingDaemon.uptime)}；部署/脚本可直接复用当前实例`);
         return;
     }
     ensureDataDirs();
@@ -373,7 +400,7 @@ export async function cmdStart(opts = {}) {
                 console.log(`    ${symbol} ${aid} — 最后活动 ${ago} (${info.event})`);
             }
         }
-        console.log('  已在运行；部署/脚本可继续轮询 IPC ready，或直接复用当前实例');
+        console.log(`  已在运行；已运行时长: ${formatRunningDuration(Date.now() - first.record.startedAt)}；部署/脚本可继续轮询 IPC ready，或直接复用当前实例`);
         console.log('  使用 ec restart 重启，或 ec stop 先停止');
         return;
     }

package/dist/core/data-migration.js

@@ -1295,8 +1295,14 @@ function finalizationSourcePaths(root, manifest) {
 function archiveHash(filePath) {
     return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
 }
-function verifyArchiveContains(archivePath, sourcePaths) {
-    const tar = process.platform === 'win32' ? 'tar.exe' : 'tar';
+function systemTar() {
+    if (process.platform !== 'win32')
+        return 'tar';
+    // Git Bash puts GNU tar ahead of Windows bsdtar on PATH. GNU tar treats the
+    // drive colon in an absolute archive path as host:path remote syntax.
+    return path.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe');
+}
+function verifyArchiveContains(archivePath, sourcePaths, tar) {
     const normalizeArchivePath = (value) => value
         .trim()
         .replace(/\\/g, '/')
@@ -1402,14 +1408,14 @@ export function finalizeDataMigration(root, manifest) {
     }
     fs.mkdirSync(path.dirname(archivePath), { recursive: true });
     const temporary = `${archivePath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
-    const tar = process.platform === 'win32' ? 'tar.exe' : 'tar';
+    const tar = systemTar();
     try {
         execFileSync(tar, ['-czf', temporary, ...sourcePaths], {
             cwd: root,
             stdio: 'pipe',
             windowsHide: process.platform === 'win32',
         });
-        verifyArchiveContains(temporary, sourcePaths);
+        verifyArchiveContains(temporary, sourcePaths, tar);
         fs.renameSync(temporary, archivePath);
     }
     catch (error) {

package/dist/core/message/message-bridge.js

@@ -695,12 +695,6 @@ export class MessageBridge {
                 const channelKey = adapter?.channelKey || channelName;
                 const owningAgent = this.agentRegistry?.resolveByChannel(channelKey)
                     ?? this.agentRegistry?.resolveByChannel(channelName);
-                // Agent-owned business controls bypass ResponseEngine entirely, so
-                // expose them only after bootstrap has explicitly reached active.
-                // Missing lifecycle fails closed; control channels without an owning
-                // EvolAgent keep their existing command behavior.
-                const allowsNormalCommandRouting = !owningAgent
-                    || owningAgent.config?.lifecycle === 'active';
                 const parsedChannelKey = tryParseChannelKey(channelKey);
                 const chatType = msg.chatType || 'private';
                 const delivery = chatType === 'group'
@@ -779,7 +773,10 @@ export class MessageBridge {
                     logger.info(`[MessageBridge] Inbound admission denied before business routing: self=${selfAid} actor=${actorId ?? '<none>'} channel=${channelKey} reason=${admissionDecision.reason}`);
                     return;
                 }
-                const menuControl = allowsNormalCommandRouting && resolvedChannelType === 'aun'
+                // Menu is a protocol control plane. Its parsing and response path must
+                // remain available throughout the agent lifecycle; lifecycle gates
+                // ordinary model execution, not protocol handling.
+                const menuControl = resolvedChannelType === 'aun'
                     ? parseMenuControl(content)
                     : { isMenu: false };
                 let menuResponseWarning;
@@ -930,8 +927,7 @@ export class MessageBridge {
                 // 2. 命令快速路径（去除引用前缀后检查，兼容话题中引用上文的情况）
                 const contentForCmd = content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
                 const cmdContent = contentForCmd || content;
-                const isCmd = allowsNormalCommandRouting
-                    && msg.source !== 'handoff'
+                const isCmd = msg.source !== 'handoff'
                     && this.cmdHandler.isCommand(cmdContent);
                 if (isCmd) {
                     logger.debug(`[MessageBridge] Command detected: "${cmdContent}", routing to handler`);
@@ -969,8 +965,7 @@ export class MessageBridge {
                         logger.debug(`[MessageBridge] Failed to log inbound command: ${e}`);
                     }
                 }
-                if (allowsNormalCommandRouting
-                    && msg.source !== 'handoff'
+                if (msg.source !== 'handoff'
                     && await this.handleCommand(cmdContent, channelName, msg.channelId, (text) => {
                         const taskId = `cmd-${msg.messageId || Date.now()}`;
                         logger.channelOut({ channel: channelName, channelId: msg.channelId, taskId, correlationId: taskId, sessionId: msg.replyContext?.sessionId, agentAid: msg.selfAID, payload: { kind: 'command.result', text } });

package/dist/core/message/response-engine.js

@@ -48,7 +48,58 @@ import { SessionTurnCoordinator } from '../session/session-turn-coordinator.js';
 import { recordTriggerExecutionAnomaly } from '../../trigger/anomaly-store.js';
 import { classifyToolErrorCode } from '../permission/tool-error-code.js';
 import { buildToolLifecycleEventKey } from '../audit/event-key.js';
-import { PauseController } from './pause-controller.js';
+export class PauseController {
+    state = 'running';
+    waiters = new Set();
+    requestPause() {
+        if (this.state !== 'running')
+            return false;
+        this.state = 'pause_requested';
+        return true;
+    }
+    isPauseRequested() { return this.state === 'pause_requested'; }
+    isPaused() { return this.state === 'paused'; }
+    waitAtToolBoundary(signal) {
+        if (signal?.aborted)
+            return Promise.resolve('cancelled');
+        if (this.state === 'running')
+            return Promise.resolve('none');
+        this.state = 'paused';
+        return new Promise(resolve => {
+            const waiter = { resolve: () => { }, abort: undefined };
+            const finish = (result) => {
+                this.waiters.delete(waiter);
+                if (waiter.abort)
+                    signal?.removeEventListener('abort', waiter.abort);
+                resolve(result);
+            };
+            waiter.resolve = finish;
+            if (signal) {
+                waiter.abort = () => finish('cancelled');
+                signal.addEventListener('abort', waiter.abort, { once: true });
+            }
+            this.waiters.add(waiter);
+            if (this.state === 'running')
+                finish('released');
+            else if (signal?.aborted)
+                finish('cancelled');
+        });
+    }
+    resume() {
+        if (this.state === 'running')
+            return false;
+        this.state = 'running';
+        for (const waiter of [...this.waiters])
+            waiter.resolve('released');
+        return true;
+    }
+    cancel() {
+        this.state = 'running';
+        for (const waiter of [...this.waiters])
+            waiter.resolve('cancelled');
+    }
+    clear() { this.cancel(); }
+}
 function isShowActivitiesMode(value) {
     return value === 'all' || value === 'text' || value === 'none';
 }
@@ -1577,7 +1628,7 @@ export class ResponseEngine {
         // 二次拦截：如果命令消息绕过 MessageBridge 的 handleCommand 泄漏到这里，
         // 静默丢弃而不是发送给 Agent（命令已在 MessageBridge 层处理过）
         const rawContent = message.content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
-        if (!isBootstrapping && rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
+        if (rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
             logger.warn(`[ResponseEngine] Command leaked past MessageBridge, dropped: "${rawContent.substring(0, 40)}"`);
             this.publishTriggerExecutionFailure(message, 'trigger_command_not_supported');
             return;

package/dist/core/permission/ec-command-parser.js

@@ -1,14 +1,21 @@
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
-// accept an arbitrary `sh -c` string or unwrap shell composition here.
-const CODEX_SHELL_EXECUTABLES = new Set([
+// accept an arbitrary shell command string or unwrap composition here.
+const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
     'bash', '/bin/bash', '/usr/bin/bash',
     'sh', '/bin/sh', '/usr/bin/sh',
 ]);
+const CODEX_POWERSHELL_EXECUTABLES = new Set([
+    'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
+]);
+const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
+const POWERSHELL_UNQUOTED_META = new Set([
+    ';', '&', '|', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#', '@',
+]);
 const AMBIGUOUS_FILE_PATH_RE = /[\0\r\n$`*?\[\]{}<>|;&]/;
 const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
 function trimShellSpacing(value) {
@@ -83,6 +90,106 @@ function isLiteralArgBoundary(value) {
 function isShellParameterExpansionStart(value) {
     return value === '(' || value === '{' || !!value && /[A-Za-z0-9_@*#?$!\-]/.test(value);
 }
+function parseLiteralPowerShellCommand(command) {
+    const input = trimShellSpacing(command);
+    if (!input)
+        return { ok: false, issue: 'empty-command' };
+    if (input.includes('\0'))
+        return { ok: false, issue: 'invalid-control-char' };
+    const argv = [];
+    let token = '';
+    let tokenStarted = false;
+    let quote = null;
+    const finishToken = () => {
+        if (!tokenStarted)
+            return;
+        argv.push(token);
+        token = '';
+        tokenStarted = false;
+    };
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (quote === 'single') {
+            if (char === "'" && input[index + 1] === "'") {
+                token += "'";
+                index++;
+            }
+            else if (char === "'") {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+            }
+            else {
+                token += char;
+            }
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"') {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+                continue;
+            }
+            if (char === '`') {
+                const next = input[++index];
+                if (next === undefined)
+                    return { ok: false, issue: 'invalid-quote' };
+                if (next === '\r' || next === '\n')
+                    return { ok: false, issue: 'structural-newline' };
+                token += next;
+                continue;
+            }
+            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+                return { ok: false, issue: 'unsafe-expansion' };
+            }
+            token += char;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            finishToken();
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return { ok: false, issue: 'structural-newline' };
+        if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
+            return { ok: false, issue: 'invalid-control-char' };
+        }
+        if (char === "'") {
+            tokenStarted = true;
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            tokenStarted = true;
+            quote = 'double';
+            continue;
+        }
+        if (char === '`') {
+            const next = input[++index];
+            if (next === undefined)
+                return { ok: false, issue: 'invalid-quote' };
+            if (next === '\r' || next === '\n')
+                return { ok: false, issue: 'structural-newline' };
+            tokenStarted = true;
+            token += next;
+            continue;
+        }
+        const isWordInitialMeta = (char === '#' || char === '@') && !tokenStarted;
+        const isAlwaysMeta = POWERSHELL_UNQUOTED_META.has(char) && char !== '#' && char !== '@';
+        if (isAlwaysMeta || isWordInitialMeta || (char === '~' && !tokenStarted)) {
+            return { ok: false, issue: 'shell-composition' };
+        }
+        tokenStarted = true;
+        token += char;
+    }
+    if (quote)
+        return { ok: false, issue: 'invalid-quote' };
+    finishToken();
+    return argv.length > 0
+        ? { ok: true, argv }
+        : { ok: false, issue: 'empty-command' };
+}
 function doubleQuotedIssueAt(input, index) {
     const char = input[index];
     if (char === '`' || (char === '$' && isShellParameterExpansionStart(input[index + 1]))) {
@@ -102,6 +209,9 @@ function doubleQuotedIssueAt(input, index) {
  * Anything outside this subset is never granted the privileged EC path.
  */
 export function parseLiteralShellCommand(command, options = {}) {
+    if (options.dialect === 'powershell') {
+        return parseLiteralPowerShellCommand(command);
+    }
     const input = trimShellSpacing(options.allowManagedTmpDir
         ? substituteManagedTmpDirToken(command)
         : command);
@@ -209,15 +319,21 @@ export function parseLiteralShellArgv(command, options = {}) {
     const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
-/**
- * Return the command string carried by Codex's literal `/bin/bash -lc ...`
- * wrapper. The wrapper is accepted only in its exact three-argv form and the
- * caller must parse the returned string with the literal shell parser again.
- */
-export function unwrapCodexShellCommandArgv(argv) {
-    if (argv.length !== 3 || argv[1] !== '-lc')
+export function resolveCodexShellCarrierArgv(argv) {
+    if (argv.length !== 3)
         return undefined;
-    return CODEX_SHELL_EXECUTABLES.has(argv[0]) ? argv[2] : undefined;
+    if (argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
+        return { command: argv[2], dialect: 'posix' };
+    }
+    const powershellExecutable = argv[0].toLowerCase();
+    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
+    return isPowerShell && argv[1].toLowerCase() === '-command'
+        ? { command: argv[2], dialect: 'powershell' }
+        : undefined;
+}
+export function unwrapCodexShellCommandArgv(argv) {
+    return resolveCodexShellCarrierArgv(argv)?.command;
 }
 /**
  * Parse either a bare literal command or the exact shell carrier emitted by
@@ -228,8 +344,10 @@ export function parseCodexShellCommandArgv(command, options = {}) {
     const outer = parseLiteralShellArgv(command, options);
     if (!outer)
         return null;
-    const wrapped = unwrapCodexShellCommandArgv(outer);
-    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
+    const carrier = resolveCodexShellCarrierArgv(outer);
+    return carrier === undefined
+        ? outer
+        : parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
@@ -239,10 +357,13 @@ export function parseCodexShellCommandArgv(command, options = {}) {
 export function parseCodexToolCommandArgv(input) {
     if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
         const outer = input.commandArgv;
-        const wrapped = unwrapCodexShellCommandArgv(outer);
-        return wrapped === undefined
+        const carrier = resolveCodexShellCarrierArgv(outer);
+        return carrier === undefined
             ? outer
-            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
+            : parseLiteralShellArgv(carrier.command, {
+                allowManagedTmpDir: true,
+                dialect: carrier.dialect,
+            });
     }
     const command = typeof input.command === 'string' ? input.command : '';
     return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
@@ -924,24 +1045,29 @@ export function parseBoundedOutputShellCommand(command) {
  * policy must not interpret EC subcommands or arguments: a single literal
  * invocation may leave the sandbox, while shell composition may not.
  */
-export function classifyEvolcoreShellCommand(command) {
-    const parseOptions = { allowManagedTmpDir: true };
+export function classifyEvolcoreShellCommand(command, options = {}) {
+    const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
         if (literal.argv[0] === 'ec')
             return { kind: 'literal' };
-        const wrapped = unwrapCodexShellCommandArgv(literal.argv);
-        if (wrapped !== undefined) {
-            const nested = parseLiteralShellCommand(wrapped, parseOptions);
+        const carrier = resolveCodexShellCarrierArgv(literal.argv);
+        if (carrier !== undefined) {
+            const nested = parseLiteralShellCommand(carrier.command, {
+                ...parseOptions,
+                dialect: carrier.dialect,
+            });
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
+            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(carrier.command)) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
         return { kind: 'none' };
     }
-    const boundedOutput = parseBoundedOutputShellCommand(command);
+    const boundedOutput = options.dialect === 'powershell'
+        ? null
+        : parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
         return { kind: 'bounded-output', command: boundedOutput };
     }

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -1352,7 +1352,8 @@ export function evaluateToolPreflight(toolName, input, context) {
             ? input.commandArgv
             : undefined;
         const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
-        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const shellCarrier = outerArgv ? resolveCodexShellCarrierArgv(outerArgv) : undefined;
+        const wrappedCommand = shellCarrier?.command;
         const policyCommand = wrappedCommand ?? command;
         if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
@@ -1397,7 +1398,9 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
-        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand, shellCarrier
+            ? { dialect: shellCarrier.dialect }
+            : {});
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -1406,25 +1409,34 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         if (ecCommand.kind === 'composite') {
             if (ecCommand.issue === 'unsafe-expansion') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    message,
                     policyCode: 'ec_shell_unsafe_expansion',
                 };
             }
             if (ecCommand.issue === 'invalid-quote') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 正文内的双引号请用反引号转义，或改用单引号包裹纯文字'
+                    : '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                    message,
                     policyCode: 'ec_shell_invalid_quote',
                 };
             }
+            const message = shellCarrier?.dialect === 'powershell'
+                ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。'
+                : '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。';
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                message,
                 policyCode: 'ec_shell_composite_command',
             };
         }

package/dist/ipc.js

@@ -435,7 +435,12 @@ export class IpcServer {
                 }
             }
             case 'ping':
-                return { pong: true, pid: process.pid, protocolVersion: 1 };
+                return {
+                    pong: true,
+                    pid: process.pid,
+                    protocolVersion: 1,
+                    uptime: Math.round(process.uptime() * 1000),
+                };
             case 'shutdown': {
                 if (!this.shutdownExecutor)
                     return { ok: false, error: 'shutdown executor not configured' };

package/dist/paths.js

@@ -11,9 +11,6 @@ export function resolveRoot() {
     if (process.env[RUNTIME_HOME_ENV]) {
         _root = process.env[RUNTIME_HOME_ENV];
     }
-    else if (fs.existsSync(path.join(process.cwd(), 'agents', 'defaults.json'))) {
-        _root = process.cwd();
-    }
     else {
         _root = path.join(os.homedir(), DEFAULT_RUNTIME_HOME_DIRNAME);
     }

package/kits/docs/path-registry.md

@@ -7,7 +7,7 @@
 
 | 名称 | 含义 | 来源 |
 |------|------|------|
-| `$EVOLCORE_HOME` | evolcore 用户数据根 | `resolveRoot()`：环境变量 `EVOLCORE_HOME` → cwd 下有 `agents/defaults.json` 则取 cwd → `~/.evolcore` |
+| `$EVOLCORE_HOME` | evolcore 用户数据根 | `resolveRoot()`：环境变量 `EVOLCORE_HOME` → `~/.evolcore` |
 | `$PACKAGE_ROOT` | evolcore 包根目录 | `getPackageRoot()`，由 `import.meta` 推出（不是 `require.resolve`） |
 | `$CURRENT_PROJECT` | 当前工作目录 | 会话的 projectPath |
 

package/kits/rules/02-navigation.md

@@ -6,7 +6,7 @@
 
 | 路径 | 含义 |
 |------|------|
-| `$EVOLCORE_HOME` | 用户数据根。解析顺序：`EVOLCORE_HOME` 环境变量 → cwd 下有 `agents/defaults.json` 则取 cwd → `~/.evolcore`（第二步意味着**包根和数据根可能是同一个目录**） |
+| `$EVOLCORE_HOME` | 用户数据根。解析顺序：`EVOLCORE_HOME` 环境变量 → `~/.evolcore` |
 | `$PACKAGE_ROOT` | evolcore 包根目录（由 `getPackageRoot()` 从 `import.meta` 推出） |
 | `$CURRENT_PROJECT` | 当前工作目录 |
 
@@ -82,7 +82,7 @@ agent 级索引范围：`$CURRENT_PROJECT` + `$AGENT_DIR`。
 ## Bootstrap（独立使用 ECK 时）
 
 无 evolcore 动态注入时，路径确定顺序：
-1. `$EVOLCORE_HOME`：环境变量 → cwd 下有 `agents/defaults.json` 则取 cwd → `~/.evolcore`
+1. `$EVOLCORE_HOME`：环境变量 → `~/.evolcore`
 2. `$PACKAGE_ROOT`：evolcore 安装目录（dev 模式下可能与上一步同一个目录）
 3. 按上面的派生规则构造其余路径
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.18",
+  "version": "0.0.19",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",

package/dist/core/message/pause-controller.js

@@ -1,53 +0,0 @@
-/** Per-session gate used only at the next tool boundary. */
-export class PauseController {
-    state = 'running';
-    waiters = new Set();
-    requestPause() {
-        if (this.state !== 'running')
-            return false;
-        this.state = 'pause_requested';
-        return true;
-    }
-    isPauseRequested() { return this.state === 'pause_requested'; }
-    isPaused() { return this.state === 'paused'; }
-    waitAtToolBoundary(signal) {
-        if (signal?.aborted)
-            return Promise.resolve('cancelled');
-        if (this.state === 'running')
-            return Promise.resolve('none');
-        this.state = 'paused';
-        return new Promise(resolve => {
-            const waiter = { resolve: () => { }, abort: undefined };
-            const finish = (result) => {
-                this.waiters.delete(waiter);
-                if (waiter.abort)
-                    signal?.removeEventListener('abort', waiter.abort);
-                resolve(result);
-            };
-            waiter.resolve = finish;
-            if (signal) {
-                waiter.abort = () => finish('cancelled');
-                signal.addEventListener('abort', waiter.abort, { once: true });
-            }
-            this.waiters.add(waiter);
-            if (this.state === 'running')
-                finish('released');
-            else if (signal?.aborted)
-                finish('cancelled');
-        });
-    }
-    resume() {
-        if (this.state === 'running')
-            return false;
-        this.state = 'running';
-        for (const waiter of [...this.waiters])
-            waiter.resolve('released');
-        return true;
-    }
-    cancel() {
-        this.state = 'running';
-        for (const waiter of [...this.waiters])
-            waiter.resolve('cancelled');
-    }
-    clear() { this.cancel(); }
-}