evolcore 0.0.18 → 0.0.20

package/CHANGELOG.md

@@ -3,6 +3,45 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.20 (2026-08-28)
+
+### AUN 网关与投递可靠性
+
+- 接入 SDK 网关发现结果，校验消息 ID、投递状态和显式路由，区分永久失败与可重试失败。
+- Outbox 保留永久失败诊断，并以路由条件更新避免并发投递覆盖修正后的目标。
+
+### Bootstrap 与配置生命周期
+
+- 收紧 Bootstrap 消息路由和 Agent 生命周期门禁，补充配置兼容校验及 `ec init` 的 ecagent 配置交互。
+- 增加 Agent、Daemon 和默认配置 schema 版本，权限审计记录命中的策略路径。
+
+### 观察者模式
+
+- 观察者模式默认开启，显式设置 `false` 才关闭并持久化覆盖。
+
+### 跨平台运行与安装
+
+- 统一运行时根目录解析，延长 Windows Daemon IPC 优雅关闭等待，并完善 Codex 受管目录安装准备。
+
+## 0.0.19 (2026-08-27)
+
+### PowerShell EC 命令安全
+
+- 支持 PowerShell `pwsh`/`powershell` 受管命令载体解析，拒绝拼接、展开和重定向。
+- 统一 Codex EC 命令委派与预检解析，补充 PowerShell 引号、展开和错误指引。
+
+### Bootstrap 与运行时控制
+
+- Bootstrap 阶段保留 Menu 与斜杠协议处理，普通模型任务继续按生命周期门禁。
+- 命令意外泄漏至响应引擎时统一丢弃并记录失败审计，避免进入 Agent 执行。
+
+### 跨平台安装与诊断
+
+- Windows 数据迁移固定调用系统 `bsdtar`，避免 Git Bash GNU tar 误解析 Windows 绝对路径。
+- Linux 公开安装器与 npm 全局安装/升级均幂等创建真实 `/etc/codex` 目录；root 历史实例可在启动任务时自愈缺失目录，同名文件和符号链接仍被拒绝。
+- 统一数据根解析，仅使用 `EVOLCORE_HOME` 或 `~/.evolcore`，避免因启动目录不同误用数据目录。
+- `ec start` 已运行提示新增 Daemon 持续运行时长，并支持 IPC uptime 回退探测。
+
 ## 0.0.18 (2026-08-27)
 
 ### DaemonOwner 与受管 Agent 操作

package/README.md

@@ -103,6 +103,8 @@ curl -fsSL https://download.evolai.cn/install.sh | bash
 npm install -g evolcore
 ```
 
+Linux 全局安装会在 `postinstall` 阶段准备 Codex 受管运行所需的真实目录 `/etc/codex`。如果当前 npm 全局目录属于普通用户且该系统目录尚不存在，请先执行 `sudo install -d -m 0755 /etc/codex`，再重新安装。
+
 > **Windows 用户**：首次运行前可能需要执行 `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser`
 
 **从源码安装**：

package/bin/install-codex-managed-hooks.mjs

@@ -18,6 +18,59 @@ function fail(message) {
   process.exit(1);
 }
 
+function isGlobalInstall() {
+  return ['1', 'true'].includes(String(process.env.npm_config_global || '').toLowerCase());
+}
+
+function ensureRealDirectory(directory) {
+  let stat;
+  try {
+    stat = fs.lstatSync(directory);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {
+      fail(`could not inspect the Codex managed requirements mountpoint ${directory}: ${error?.message || String(error)}`);
+    }
+  }
+
+  if (stat) {
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      fail(`Codex managed requirements mountpoint is unsafe: ${directory} must be a real directory.`);
+    }
+    return;
+  }
+
+  try {
+    fs.mkdirSync(directory, { mode: 0o755 });
+    fs.chmodSync(directory, 0o755);
+  } catch (error) {
+    if (error?.code === 'EEXIST') {
+      const raced = fs.lstatSync(directory);
+      if (raced.isDirectory() && !raced.isSymbolicLink()) return;
+    }
+    fail(
+      `Linux global installation requires the real directory ${directory}, but it could not be created: `
+      + `${error?.message || String(error)}. `
+      + `Create it first with: sudo install -d -m 0755 ${directory}`,
+    );
+  }
+
+  const created = fs.lstatSync(directory);
+  if (!created.isDirectory() || created.isSymbolicLink()) {
+    fail(`Codex managed requirements mountpoint provisioning failed: ${directory} must be a real directory.`);
+  }
+  process.stdout.write(`[evolcore] Prepared Codex managed requirements mountpoint at ${directory}.\n`);
+}
+
+function runLinuxPostinstall() {
+  const explicitMountpoint = argument('--mountpoint');
+  if (process.platform !== 'linux') return;
+  // Local source installs do not launch the Linux Codex guard and must not
+  // mutate machine-wide configuration. An explicit path is accepted only for
+  // isolated lifecycle behavior tests.
+  if (!isGlobalInstall() && !explicitMountpoint) return;
+  ensureRealDirectory(explicitMountpoint || '/etc/codex');
+}
+
 function tomlString(value) {
   return JSON.stringify(value);
 }
@@ -139,6 +192,14 @@ try {
 }
 
 function main() {
+  if (process.env.npm_lifecycle_event === 'postinstall') {
+    runLinuxPostinstall();
+    return;
+  }
+  if (process.platform === 'linux' && argument('--mountpoint')) {
+    runLinuxPostinstall();
+    return;
+  }
   if (process.platform !== 'win32' && !argument('--requirements')) {
     fail('Codex managed hook provisioning is only supported on Windows.');
   }

package/dist/agents/claude-runner.js

@@ -2041,7 +2041,7 @@ export class AgentRunner {
                 ...(updatedInput ? { updatedInput } : {}),
             },
         });
-        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode) => {
+        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode, matchedPath) => {
             const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
             if (!code)
                 return;
@@ -2061,6 +2061,7 @@ export class AgentRunner {
                 selfAid: ctx?.selfAid,
                 requestId: typeof requestId === 'string' ? requestId : undefined,
                 taskId: ctx?.taskId,
+                matchedPath: matchedPath ?? (preflight?.behavior === 'deny' ? preflight.matchedPath : undefined),
             });
             try {
                 await ctx?.recordExecutionAnomaly?.({
@@ -2186,7 +2187,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode');
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode', roResult.matchedPath);
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -2346,7 +2347,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode');
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode', roResult.matchedPath);
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };

package/dist/agents/codex-runner.js

@@ -20,7 +20,7 @@ import { buildEnvelope, sendInteractionPayload } from '../core/message/message-u
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir } from '../cli/task-context.js';
@@ -316,18 +316,20 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
-        const classification = classifyEvolcoreShellCommand(command);
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir, dialect = 'posix') {
+        const parseOptions = {
+            allowManagedTmpDir: true,
+            dialect,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        };
+        const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const argv = parseLiteralShellArgv(command, {
-            allowManagedTmpDir: true,
-            ...(managedTempDir ? { managedTempDir } : {}),
-        });
+        const argv = parseLiteralShellArgv(command, parseOptions);
         if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
             return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
@@ -343,11 +345,11 @@ export class CodexRunner {
                 ? undefined
                 : explicitArgv;
         }
-        const explicitWrappedCommand = explicitArgv
-            ? unwrapCodexShellCommandArgv(explicitArgv)
+        const explicitCarrier = explicitArgv
+            ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
-        if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
+        if (explicitCarrier !== undefined) {
+            return this.approvedLiteralEvolcoreCommandArgv(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
@@ -357,12 +359,12 @@ export class CodexRunner {
             allowManagedTmpDir: true,
             ...(managedTempDir ? { managedTempDir } : {}),
         });
-        const wrappedCommand = wrappedArgv
-            ? unwrapCodexShellCommandArgv(wrappedArgv)
+        const shellCarrier = wrappedArgv
+            ? resolveCodexShellCarrierArgv(wrappedArgv)
             : undefined;
-        return wrappedCommand === undefined
+        return shellCarrier === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
+            : this.approvedLiteralEvolcoreCommandArgv(shellCarrier.command, managedTempDir, shellCarrier.dialect);
     }
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
@@ -371,9 +373,11 @@ export class CodexRunner {
                 return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
-            const wrappedCommand = unwrapCodexShellCommandArgv(rawArgv);
-            return wrappedCommand !== undefined
-                && classifyEvolcoreShellCommand(wrappedCommand).kind !== 'none';
+            const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
+            return shellCarrier !== undefined
+                && classifyEvolcoreShellCommand(shellCarrier.command, {
+                    dialect: shellCarrier.dialect,
+                }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';
@@ -2352,7 +2356,7 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
-        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied') => {
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied', matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
@@ -2368,6 +2372,7 @@ export class CodexRunner {
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
                 taskId: permissionContext?.taskId,
+                matchedPath,
             });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -2409,7 +2414,7 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
                 `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied');
+                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
             return 'deny';
         }

package/dist/agents/ecagent-runner.js

@@ -987,7 +987,7 @@ export class EcagentRunner {
     }
     async authorizeTool(sessionId, projectPath, mode, toolName, input) {
         const permissionContext = this.permissionContexts.get(sessionId);
-        const recordBlockedOperation = async (policyCode, operationInput = input) => {
+        const recordBlockedOperation = async (policyCode, operationInput = input, matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
@@ -1002,6 +1002,7 @@ export class EcagentRunner {
                 role: permissionContext?.role,
                 selfAid: permissionContext?.selfAid,
                 taskId: permissionContext?.taskId,
+                matchedPath,
             });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -1039,7 +1040,7 @@ export class EcagentRunner {
         });
         if (preflight.behavior === 'deny') {
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode, input);
+                await recordBlockedOperation(preflight.policyCode, input, preflight.matchedPath);
             }
             return { block: true, reason: preflight.message };
         }

package/dist/aun/aid/agentmd.js

@@ -266,6 +266,13 @@ export async function agentmdSync(aid, opts) {
     const ownStore = !opts?.store;
     const localPath = agentMdPath(aid);
     try {
+        // AIDStore owns the agent.md consistency API in fastaun 0.5.x.  Keep this
+        // runtime guard because callers and test doubles can still accidentally
+        // pass an AUNClient (which deliberately does not expose these methods).
+        const candidate = store;
+        if (typeof candidate.checkAgentMd !== 'function' || typeof candidate.downloadAgentMd !== 'function') {
+            throw new TypeError('invalid AIDStore: checkAgentMd/downloadAgentMd unavailable');
+        }
         const check = await store.checkAgentMd(aid, 30);
         // In sync (cache fresh) — return local file content with cached verification status.
         if (check.ok && !check.data.needs_update && check.data.local_found) {

package/dist/aun/msg/group.js

@@ -211,12 +211,23 @@ export async function groupSend(args) {
         const encrypt = resolveAunMessageEncrypt(args.encrypt);
         const sendParams = { group_id: args.groupId, payload, encrypt };
         const result = await conn.call('group.send', sendParams);
-        const messageId = typeof result?.message?.message_id === 'string' ? result.message.message_id : undefined;
-        if (messageId)
-            appendGroupSendOutboundLog(args, messageId, payload, runtimeContext, encrypt);
+        const messageId = typeof result?.message?.message_id === 'string' && result.message.message_id.trim()
+            ? result.message.message_id
+            : typeof result?.message_id === 'string' && result.message_id.trim()
+                ? result.message_id
+                : undefined;
+        if (!messageId) {
+            return {
+                ok: false,
+                error: 'group.send returned no message_id',
+                code: 'MISSING_MESSAGE_ID',
+            };
+        }
+        appendGroupSendOutboundLog(args, messageId, payload, runtimeContext, encrypt);
         return {
             ok: true,
             group_id: result?.group_id ?? args.groupId,
+            message_id: messageId,
             message: result?.message,
             event: result?.event,
         };

package/dist/aun/msg/p2p.js

@@ -289,24 +289,34 @@ export async function msgSend(args) {
         const encrypt = resolveAunMessageEncrypt(args.encrypt);
         const sendParams = { to: args.to, payload, encrypt };
         const result = await conn.call('message.send', sendParams);
+        const messageId = typeof result?.message_id === 'string' && result.message_id.trim()
+            ? result.message_id
+            : typeof result?.message?.message_id === 'string' && result.message.message_id.trim()
+                ? result.message.message_id
+                : undefined;
+        if (!messageId) {
+            return {
+                ok: false,
+                error: 'message.send returned no message_id',
+                code: 'MISSING_MESSAGE_ID',
+            };
+        }
         // 5. 写出方向 jsonl（与 daemon 一致格式，标记 source）
         // source 标记：
         // - 'cli': 用户手动调用 ec msg send
         // - 'msg': agent 在会话中调用 ec msg send
-        if (result?.message_id) {
-            try {
-                await appendMsgSendOutboundLog(args, { ok: true, message_id: result.message_id }, {
-                    payload,
-                    runtimeContext,
-                    chatmode,
-                    encrypt,
-                });
-            }
-            catch { }
+        try {
+            await appendMsgSendOutboundLog(args, { ok: true, message_id: messageId }, {
+                payload,
+                runtimeContext,
+                chatmode,
+                encrypt,
+            });
         }
+        catch { }
         return {
             ok: true,
-            message_id: result?.message_id,
+            message_id: messageId,
             seq: result?.seq,
             timestamp: result?.timestamp,
             status: result?.status,