evolcore 0.0.20 → 0.0.22

package/dist/cli/daemon-commands.js

@@ -18,7 +18,7 @@ import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-
 import { ecwebVersionRequirementError, fetchEcwebPairCode, resolveEcwebLaunchCommand } from '../utils/ecweb-utils.js';
 import { isHostChinese } from '../utils/locale.js';
 import { scanInstances, cleanupInstances, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
-import { filterLogFiles, deriveLogTypes, computePreChecked, validateLogTypes, shortLogName as shortLogNameLocal } from './watch-logs.js';
+import { filterLogFiles, deriveLogTypes, computePreChecked, validateLogTypes, shortLogName as shortLogNameLocal, isWatchLogFile } from './watch-logs.js';
 import { displaySessionTitle } from '../core/session/session-title.js';
 import { isNonAgentSessionChannel } from '../core/system-channels.js';
 import { printCodeStats } from './code-stats.js';
@@ -29,6 +29,7 @@ import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
 import { listCodexAppServerProcesses, unregisterCodexAppServerProcess } from '../utils/codex-app-server-registry.js';
+import { DEFAULT_ECWEB_PORT, ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
 const execFileAsync = promisify(execFile);
 async function runAutomaticInit(action) {
     try {
@@ -146,11 +147,6 @@ function buildDaemonEnv(p, opts) {
         ...(opts.bindBootstrap ? { EVOLCORE_BIND_BOOTSTRAP: '1' } : {}),
     };
 }
-export function serviceProxyNeedsEcweb(cfg) {
-    if (!cfg.serviceProxy?.enabled)
-        return false;
-    return (cfg.serviceProxy.services ?? []).some(s => s.enabled !== false && s.source === 'ecweb');
-}
 function latestSourceMtime(dir) {
     let latest = 0;
     try {
@@ -178,14 +174,35 @@ function sourceBuildNeedsRefresh() {
     const sourceMtime = Math.max(latestSourceMtime(path.join(packageRoot, 'src')), latestSourceMtime(path.join(packageRoot, 'ecagent', 'src')));
     return sourceMtime > fs.statSync(daemonEntry).mtimeMs;
 }
-function requireFreshSourceBuild() {
+function runSourceBuild() {
+    return new Promise(resolve => {
+        console.log('🔧 源码比 daemon 编译产物更新，自动重新构建...');
+        const child = spawn(platform.isWindows ? 'npm.cmd' : 'npm', ['run', 'build'], {
+            cwd: getPackageRoot(),
+            stdio: 'inherit',
+            shell: platform.isWindows,
+        });
+        child.on('error', err => {
+            console.error(`❌ 无法启动构建进程: ${err.message}`);
+            resolve(false);
+        });
+        child.on('exit', code => {
+            if (code === 0) {
+                console.log('✅ 构建完成');
+                resolve(true);
+            }
+            else {
+                console.error(`❌ 自动构建失败 (exit ${code})，服务未启动。`);
+                console.error('  请手动执行: npm run build 排查错误');
+                resolve(false);
+            }
+        });
+    });
+}
+async function requireFreshSourceBuild() {
     if (!sourceBuildNeedsRefresh())
         return true;
-    console.error('❌ 源码比 daemon 编译产物更新，服务未启动。');
-    console.error('  请先执行: ec stop && npm run build');
-    console.error('  然后执行: ec start');
-    process.exitCode = 2;
-    return false;
+    return await runSourceBuild();
 }
 function requireCompletedDataMigration(root) {
     const requirement = inspectDataMigrationRequirement(root);
@@ -310,7 +327,7 @@ export async function cmdStart(opts = {}) {
         return;
     }
     ensureDataDirs();
-    if (!requireFreshSourceBuild())
+    if (!await requireFreshSourceBuild())
         return;
     // 旧配置自动迁移（daemon.json → 新结构）
     const { autoMigrateIfNeeded } = await import('../config-store.js');
@@ -437,8 +454,6 @@ export async function cmdStart(opts = {}) {
         console.log(`  Rotated: stdout.log -> ${path.basename(stdoutRotation.rotatedPath)}`);
     }
     cleanEnv();
-    // 在启动前确保 serviceProxy 配置完整（如果 ecweb 启用但 serviceProxy 未配置）
-    ensureServiceProxyConfigBeforeStart(p);
     // 删除旧的 ready signal
     try {
         fs.unlinkSync(p.readySignal);
@@ -567,7 +582,7 @@ export async function cmdStart(opts = {}) {
             }
             console.log('');
             // 代码统计仅在开发环境显示（EVOLCORE_HOME 指向包目录）
-            if (resolveRoot() === getPackageRoot()) {
+            if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
                 printCodeStats(getPackageRoot(), p.logs);
             }
             console.log(`⏱ done in ${((Date.now() - cmdStartedAt) / 1000).toFixed(1)}s`);
@@ -687,7 +702,7 @@ export async function cmdRestart(opts = {}) {
         if (initialRuntimeOrphans.length === 0 && rejectPidIsolatedLifecycle('restart', initialStatus, ping))
             return;
     }
-    if (!requireFreshSourceBuild())
+    if (!await requireFreshSourceBuild())
         return;
     // 版本检查与自动升级
     console.log('📦 Checking for updates...');
@@ -808,7 +823,7 @@ export async function cmdRestart(opts = {}) {
     console.log('🔄 Restart monitor started, waiting for service to come back online...');
     await sleep(2000);
     // 代码统计（开发环境）
-    if (resolveRoot() === getPackageRoot()) {
+    if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
         console.log('');
         printCodeStats(getPackageRoot(), resolvePaths().logs);
     }
@@ -975,7 +990,17 @@ export async function cmdStatus() {
     const p = resolvePaths();
     const status = scanInstances();
     const aliveMains = status.mains.filter(m => m.alive);
-    const ping = await probeDaemon(p.socket);
+    // Start all read-only daemon queries together. On a busy Windows host each
+    // query can otherwise wait behind the same IPC/event-loop delay and make the
+    // total `ec status` time the sum of several individual timeouts.
+    const pingPromise = probeDaemon(p.socket).catch(() => null);
+    const statusPromise = ipcQuery(p.socket, { type: 'status' }).catch(() => null);
+    const aidsPromise = ipcQuery(p.socket, { type: 'aun-aids' }).catch(() => null);
+    const agentsPromise = ipcQuery(p.socket, { type: 'evolagent.list' }).catch(() => null);
+    // Only the ping is needed to decide whether to show the live-daemon
+    // sections. The remaining responses continue in parallel while local
+    // process/session information is rendered.
+    const ping = await pingPromise;
     const pid = ping?.pid ?? (aliveMains.length > 0 ? aliveMains[0].record.pid : null);
     const processVisible = !!pid && aliveMains.some(entry => entry.record.pid === pid);
     if (aliveMains.length > 1) {
@@ -1131,42 +1156,47 @@ export async function cmdStatus() {
     }
     // Channel status. A running daemon is authoritative and avoids reading
     // protected config files from the CLI's potentially sandboxed process.
+    let agentsResponse = null;
     if (pid) {
         console.log('');
-        const status = await ipcQuery(p.socket, { type: 'status' });
-        if (status) {
+        const [statusResponse, aidsResponse, agentResponse] = await Promise.all([
+            statusPromise,
+            aidsPromise,
+            agentsPromise,
+        ]);
+        agentsResponse = agentResponse;
+        if (statusResponse) {
             // 🔑 AUN AIDs 表格（详细 AUN 实例状态）
             try {
-                const aidsResp = await ipcQuery(p.socket, { type: 'aun-aids' });
-                if (aidsResp?.ok && aidsResp.aids?.length > 0) {
+                if (aidsResponse?.ok && aidsResponse.aids?.length > 0) {
                     console.log('🔑 AUN AIDs:');
-                    renderAunAidsTable(aidsResp.aids);
+                    renderAunAidsTable(aidsResponse.aids);
                 }
             }
             catch { /* ignore */ }
             // 控制 AID（daemon 进程身份）状态
-            if (status.controlAid) {
-                const state = status.controlAid.connected ? 'connected' : 'disconnected';
-                console.log(`control: ${status.controlAid.aid}  [${state}]`);
+            if (statusResponse.controlAid) {
+                const state = statusResponse.controlAid.connected ? 'connected' : 'disconnected';
+                console.log(`control: ${statusResponse.controlAid.aid}  [${state}]`);
             }
             else {
                 console.log('control: not configured');
             }
-            if (status.stats) {
+            if (statusResponse.stats) {
                 console.log('');
                 console.log('📊 Last hour:');
-                console.log(`  Messages: ${status.stats.received} received, ${status.stats.completed} completed`);
-                if (status.stats.errors > 0)
-                    console.log(`  Errors: ${status.stats.errors}`);
-                if (status.stats.completed > 0)
-                    console.log(`  Avg response: ${(status.stats.avgResponseMs / 1000).toFixed(1)}s`);
+                console.log(`  Messages: ${statusResponse.stats.received} received, ${statusResponse.stats.completed} completed`);
+                if (statusResponse.stats.errors > 0)
+                    console.log(`  Errors: ${statusResponse.stats.errors}`);
+                if (statusResponse.stats.completed > 0)
+                    console.log(`  Avg response: ${(statusResponse.stats.avgResponseMs / 1000).toFixed(1)}s`);
             }
         }
         else {
             // IPC unreachable but PID exists — fall back to local config if readable.
             const config = readStatusDefaultsConfig(p.defaultsConfig);
             if (config) {
-                console.log('🔌 Channels (IPC unreachable):');
+                console.log('🔌 Channels (live status unavailable; configuration is stale):');
                 showConfigChannels(config);
             }
         }
@@ -1182,7 +1212,7 @@ export async function cmdStatus() {
     // EvolAgent summary (via IPC, only when running)
     if (pid) {
         try {
-            const agentResult = await ipcQuery(p.socket, { type: 'evolagent.list' });
+            const agentResult = agentsResponse;
             if (agentResult?.ok && agentResult.agents?.length > 0) {
                 const agents = agentResult.agents;
                 if (agents.length > 0) {
@@ -1196,6 +1226,22 @@ export async function cmdStatus() {
                     }
                 }
             }
+            else {
+                const { EvolAgentRegistry } = await import('../core/evolagent-registry.js');
+                const diskRegistry = new EvolAgentRegistry(p.agentsDir);
+                diskRegistry.loadAll();
+                const agents = diskRegistry.list();
+                if (agents.length > 0) {
+                    console.log('');
+                    console.log('🤖 EvolAgents (live status unavailable; stale configuration):');
+                    for (const a of agents) {
+                        const diskStatus = a.status === 'disabled' || a.status === 'error' ? a.status : 'unknown';
+                        const channels = summarizeChannelFingerprints(a.channels || []);
+                        const shortName = a.name.replace(/\.agentid\.pub$/, '');
+                        console.log(`  ? ${shortName.padEnd(20)} ${`${diskStatus} (stale)`.padEnd(18)} ${channels}`);
+                    }
+                }
+            }
         }
         catch {
             // IPC query for agents failed — skip section
@@ -1789,10 +1835,10 @@ async function cmdWatchLogsFlow() {
         console.log(`❌ Log directory not found: ${p.logs}`);
         process.exit(1);
     }
-    const files = fs.readdirSync(p.logs).filter(f => f.endsWith('.log'));
+    const files = fs.readdirSync(p.logs).filter(isWatchLogFile);
     const types = deriveLogTypes(files);
     if (types.length === 0) {
-        console.log(`⚠ ${p.logs} 下暂无 .log 文件`);
+        console.log(`⚠ ${p.logs} 下暂无可监听日志文件`);
         return;
     }
     const fileCount = new Map();
@@ -1863,7 +1909,7 @@ function cmdWatch(filterTypes) {
         return c;
     };
     const listLogs = () => {
-        const all = fs.readdirSync(p.logs).filter(f => f.endsWith('.log')).map(f => path.join(p.logs, f));
+        const all = fs.readdirSync(p.logs).filter(isWatchLogFile).map(f => path.join(p.logs, f));
         return filterLogFiles(all, filterTypes);
     };
     const shortName = shortLogNameLocal;
@@ -1885,7 +1931,7 @@ function cmdWatch(filterTypes) {
         const content = formatWatchContent(line);
         return `${timeStr} ${paddedName} ${content}`;
     };
-    console.log(`🔭 Watching ${p.logs}/*.log (ESC to stop)\n`);
+    console.log(`🔭 Watching ${p.logs}/* log files (ESC to stop)\n`);
     // 显示当前实例信息和 AID 状态
     const instStatus = scanInstances();
     const aliveMainEntries = instStatus.mains.filter(m => m.alive);
@@ -2508,9 +2554,9 @@ async function waitForExistingEcweb(p, timeoutMs = 3_000) {
 async function printEcwebStatus(p) {
     try {
         const cfg = loadDaemonConfig();
-        if (cfg.ecweb?.enabled === false) {
+        if (ecwebService(cfg.services)?.enabled === false) {
             console.log('');
-            console.log('🔭 ECWeb: 已禁用 (daemon.json → ecweb.enabled: false)');
+            console.log('🔭 ECWeb: 已禁用 (daemon.json → services[name=ecweb].enabled: false)');
             return;
         }
     }
@@ -2608,7 +2654,7 @@ export function stopCodexAppServerOrphans() {
 /** 若 ecweb 在运行则杀掉并确认 pid/端口都已释放。 */
 async function stopEcwebIfRunning(p) {
     const alive = findAliveEcweb(p);
-    const port = loadDaemonConfig().ecweb?.port ?? 42705;
+    const port = ecwebService(loadDaemonConfig().services)?.port ?? DEFAULT_ECWEB_PORT;
     const pids = new Set([
         ...(alive ? [alive.pid] : []),
         ...platform.findProcessByPort(port),
@@ -2634,78 +2680,6 @@ async function waitForPortRelease(port, timeoutMs) {
     }
     return platform.findProcessByPort(port).length === 0;
 }
-/**
- * 后台 detached 启动 ecweb；若已运行则先停再启（确保加载最新代码）。
- * 启动后轮询端口确认 HTTP 服务真正就绪，打印明确的成功/失败结论（而非模糊的「已在后台启动」状态描述）。
- * 返回 true=本次确实启动成功，false=未启用/未安装/启动失败。
- */
-/**
- * 启动前检查并补全 serviceProxy 配置（如果 ecweb 启用但 serviceProxy 未配置）
- */
-function ensureServiceProxyConfigBeforeStart(p) {
-    const cfg = loadDaemonConfig();
-    // 仅在 ecweb 启用 + 控制 AID 已配置 + serviceProxy 未配置 ecweb 时自动添加
-    if (!cfg.ecweb?.enabled || !cfg.aid)
-        return;
-    const hasEcwebService = (cfg.serviceProxy?.services ?? []).some(s => s.name === 'ecweb' || s.source === 'ecweb');
-    if (!hasEcwebService) {
-        const updatedCfg = {
-            ...cfg,
-            serviceProxy: {
-                enabled: true,
-                ...(cfg.serviceProxy ?? {}),
-                services: [
-                    ...(cfg.serviceProxy?.services ?? []),
-                    {
-                        name: 'ecweb',
-                        source: 'ecweb',
-                        serviceType: 'http',
-                        visibility: 'public',
-                        enabled: true,
-                        metadata: {
-                            label: 'EvolCore Dashboard',
-                        },
-                    },
-                ],
-            },
-        };
-        saveDaemonConfig(updatedCfg);
-        console.log(`✓ 自动配置 Service Proxy: https://${cfg.aid}/proxy/ecweb/`);
-    }
-}
-/**
- * 确保 serviceProxy 配置包含 ecweb 服务（ECWeb 启动成功后自动配置）
- */
-function ensureServiceProxyConfig(cfg, port) {
-    // 仅在控制 AID 已配置时自动添加 serviceProxy
-    if (!cfg.aid)
-        return;
-    const hasEcwebService = (cfg.serviceProxy?.services ?? []).some(s => s.name === 'ecweb' || s.source === 'ecweb');
-    if (!hasEcwebService) {
-        const updatedCfg = {
-            ...cfg,
-            serviceProxy: {
-                enabled: true,
-                ...(cfg.serviceProxy ?? {}),
-                services: [
-                    ...(cfg.serviceProxy?.services ?? []),
-                    {
-                        name: 'ecweb',
-                        source: 'ecweb',
-                        serviceType: 'http',
-                        visibility: 'public',
-                        enabled: true,
-                        metadata: {
-                            label: 'EvolCore Dashboard',
-                        },
-                    },
-                ],
-            },
-        };
-        saveDaemonConfig(updatedCfg);
-        console.log(`   自动配置 Service Proxy: https://${cfg.aid}/proxy/ecweb/`);
-    }
-}
 /**
  * Start the separately installed `ec-web` process for a configured runtime.
  * Kept public for restart-monitor, which launches the daemon directly and
@@ -2713,7 +2687,8 @@ function ensureServiceProxyConfig(cfg, port) {
  */
 export async function startEcwebIfEnabled(p, options = {}) {
     const cfg = loadDaemonConfig();
-    if (!cfg.ecweb?.enabled)
+    const service = ecwebService(cfg.services);
+    if (!service?.enabled)
         return false;
     // The daemon is the lifecycle owner.  CLI callers normally only need to
     // ensure ECWeb is available, so adopt a healthy process instead of killing
@@ -2750,7 +2725,7 @@ export async function startEcwebIfEnabled(p, options = {}) {
         console.log(`❌ EC Web 旧进程未清理干净，取消启动: ${error instanceof Error ? error.message : String(error)}`);
         return false;
     }
-    const port = cfg.ecweb.port ?? 42705;
+    const port = service.port ?? DEFAULT_ECWEB_PORT;
     const args = ['--home', p.root, '--port', String(port)];
     const launch = resolveEcwebLaunchCommand(args, { installedPkg });
     if (!launch) {
@@ -2880,10 +2855,9 @@ async function cmdWatchWeb() {
     }
     // 2. 启动（后台）并同步配置。默认行为是替换旧实例，确保新配置/新版静态资源生效。
     const cfg = loadDaemonConfig();
-    const port = cfg.ecweb?.port ?? 42705;
-    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: true, port } });
-    // 自动配置 serviceProxy（如果控制 AID 已配置）
-    ensureServiceProxyConfigBeforeStart(p);
+    const currentService = ecwebService(cfg.services);
+    const port = currentService?.port ?? DEFAULT_ECWEB_PORT;
+    saveDaemonConfig({ ...cfg, services: setEcwebEnabled(cfg.services, true, port) });
     const ok = await startEcwebIfEnabled(p, { forceRestart: true });
     if (!ok)
         process.exit(1); // 失败原因已由 startEcwebIfEnabled 打印
@@ -3011,8 +2985,9 @@ export async function cmdDiagnose() {
     // 6. 检查 EC Web 端口与实例记录是否一致。
     try {
         const cfg = loadDaemonConfig();
-        if (cfg.ecweb?.enabled) {
-            const port = cfg.ecweb.port ?? 42705;
+        const service = ecwebService(cfg.services);
+        if (service?.enabled) {
+            const port = service.port ?? DEFAULT_ECWEB_PORT;
             const portPids = platform.findProcessByPort(port);
             const recordedPids = new Set(readEcwebInstanceEntries(p).map(entry => entry.record.pid));
             const unregisteredPids = portPids.filter(pid => !recordedPids.has(pid));
@@ -3083,7 +3058,7 @@ export async function cmdWatchCommand(args) {
         if (requested.length > 0) {
             const p2 = resolvePaths();
             const avail = fs.existsSync(p2.logs)
-                ? deriveLogTypes(fs.readdirSync(p2.logs).filter(f => f.endsWith('.log')))
+                ? deriveLogTypes(fs.readdirSync(p2.logs).filter(isWatchLogFile))
                 : [];
             const invalid = validateLogTypes(requested, avail);
             if (invalid.length > 0) {

package/dist/cli/init.js

@@ -6,6 +6,7 @@ import { resolvePaths, ensureDataDirs } from '../paths.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { scanInstances } from '../utils/instance-registry.js';
 import { saveDefaultsSafe, loadAllAgents, loadDaemonConfig, saveDaemonConfig } from '../config-store.js';
+import { ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
 import { generateControlAid, resolveControlAidDomain } from '../aun/aid/control-aid.js';
 import { getCodexAppServerAvailability } from '../agents/codex-runner.js';
 import { DEFAULT_ECAGENT_BASE_URL, resolveEcagentConfig } from '../agents/baseagent.js';
@@ -421,6 +422,12 @@ export async function cmdInit(options) {
                 const lower = normalized.toLowerCase();
                 return !lower.includes('your-') && !lower.includes('placeholder');
             };
+            const configuredBaseUrl = [
+                configured?.baseUrl,
+                process.env.ECAGENT_BASE_URL,
+                DEFAULT_ECAGENT_BASE_URL,
+            ].find(usable) || DEFAULT_ECAGENT_BASE_URL;
+            const baseUrl = (await ask(rl, `ecagent Base URL [${configuredBaseUrl}]: `)).trim() || configuredBaseUrl;
             const configuredApiKey = usable(configured?.apiKey) ? configured.apiKey.trim() : undefined;
             const environmentApiKeyName = !configuredApiKey
                 ? (usable(process.env.ECAGENT_API_KEY)
@@ -435,12 +442,6 @@ export async function cmdInit(options) {
                 if (!apiKey)
                     console.log('  API Key 不能为空，请重新输入');
             }
-            const configuredBaseUrl = [
-                configured?.baseUrl,
-                process.env.ECAGENT_BASE_URL,
-                DEFAULT_ECAGENT_BASE_URL,
-            ].find(usable) || DEFAULT_ECAGENT_BASE_URL;
-            const baseUrl = (await ask(rl, `ecagent Base URL [${configuredBaseUrl}]: `)).trim() || configuredBaseUrl;
             return { apiKey, baseUrl };
         }
         try {
@@ -618,25 +619,34 @@ export async function initTail(options = {}) {
     }
     async function handleEcwebPrompt(rl) {
         const daemonConfigForEcweb = loadDaemonConfig();
-        if (daemonConfigForEcweb.ecweb?.enabled === undefined) {
+        if (ecwebService(daemonConfigForEcweb.services)?.enabled === undefined) {
             const ans = (await ask(rl, '\n是否在 ec start 时自动启动 ECWeb 控制台？[y/N] ')).trim().toLowerCase();
             if (ans === 'y' || ans === 'yes') {
                 const installResult = await ensureEcwebInstalledForInit();
                 if (installResult.ok) {
                     const cfg = loadDaemonConfig();
-                    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: true } });
+                    saveDaemonConfig({
+                        ...cfg,
+                        services: setEcwebEnabled(cfg.services, true),
+                    });
                     console.log('  ✓ 已启用 ECWeb（ec start 将自动在后台启动）');
                     console.log('  提示：首次访问运行 ec watch web 查看配对码和 URL');
                 }
                 else {
                     const cfg = loadDaemonConfig();
-                    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: false } });
+                    saveDaemonConfig({
+                        ...cfg,
+                        services: setEcwebEnabled(cfg.services, false),
+                    });
                     console.log('  提示：安装完成后运行 ec start；如需立即打开控制台，运行 ec watch web');
                 }
             }
             else {
                 const cfg = loadDaemonConfig();
-                saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: false } });
+                saveDaemonConfig({
+                    ...cfg,
+                    services: setEcwebEnabled(cfg.services, false),
+                });
                 console.log('  已跳过（可日后运行 ec watch web 手动启动，或编辑 daemon.json）');
             }
         }
@@ -658,7 +668,7 @@ export async function initTail(options = {}) {
     const finalCfg = loadDaemonConfig();
     console.log(`  控制 AID: ${finalCfg.aid || '(未配置)'}`);
     console.log(`  管理者: ${finalCfg.owners?.join(', ') || '(未配置)'}`);
-    console.log(`  ECWeb 自启动: ${finalCfg.ecweb?.enabled ? '已启用' : '已禁用'}`);
+    console.log(`  ECWeb 自启动: ${ecwebService(finalCfg.services)?.enabled ? '已启用' : '已禁用'}`);
     const { agents: finalAgents } = loadAllAgents();
     if (finalAgents.length === 0) {
         console.log('\n📌 下一步：创建 agent');
@@ -826,11 +836,11 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
         const ensureEcweb = dependencies.ensureEcweb ?? (() => ensureEcwebInstalledForInit({ quiet: true }));
         const installResult = await ensureEcweb();
         if (!installResult.ok) {
-            if (existingCfg.ecweb?.enabled === true) {
+            if (ecwebService(existingCfg.services)?.enabled === true) {
                 try {
                     saveDaemonConfig({
                         ...existingCfg,
-                        ecweb: { ...(existingCfg.ecweb ?? {}), enabled: false },
+                        services: setEcwebEnabled(existingCfg.services, false),
                     });
                 }
                 catch (e) {
@@ -866,7 +876,9 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
             $schema_version: existingCfg.$schema_version ?? 1,
             aid: controlAid,
             owners: [ownerAid],
-            ...(opts.ecweb === true ? { ecweb: { ...(existingCfg.ecweb ?? {}), enabled: true } } : {}),
+            ...(opts.ecweb === true
+                ? { services: setEcwebEnabled(existingCfg.services, true) }
+                : {}),
         };
         saveDaemonConfig(next);
     }
@@ -894,7 +906,7 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
         controlAid: controlAid,
         ownerAid,
         owners: [ownerAid],
-        ecwebEnabled: opts.ecweb === true || existingCfg.ecweb?.enabled === true,
+        ecwebEnabled: opts.ecweb === true || ecwebService(existingCfg.services)?.enabled === true,
         baseagent: chosenBaseagent,
         projectsDefaultPath: projectsDefaultPath ?? null,
         defaultsPath: p.defaultsConfig,

package/dist/cli/task-context.js

@@ -6,6 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
 export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
+export const DAEMON_RUNTIME_EPOCH_ENV = 'EVOLCORE_DAEMON_RUNTIME_EPOCH';
 export { RUNTIME_LOCK_DIR_ENV };
 const generatedProcessManagedTempDirs = new Set();
 let processTempCleanupRegistered = false;
@@ -32,6 +33,13 @@ function normalizeTaskRuntimeContext(value) {
         peerName: optionalString(value.peerName),
         peerType: optionalString(value.peerType),
         peerRole: optionalString(value.peerRole),
+        permissionMode: optionalString(value.permissionMode),
+        processRole: optionalProcessRole(value.processRole),
+        dataScope: optionalDataScope(value.dataScope),
+        authorizedBy: optionalString(value.authorizedBy),
+        executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
+            ? value.executionSource : undefined,
+        daemonRuntimeEpoch: optionalString(value.daemonRuntimeEpoch),
         threadId: optionalString(value.threadId),
         sessionRuntimeDir: optionalAbsolutePath(value.sessionRuntimeDir),
         runtimeLockDir: optionalAbsolutePath(value.runtimeLockDir),
@@ -39,6 +47,13 @@ function normalizeTaskRuntimeContext(value) {
         causation: normalizeCausation(value.causation),
     };
 }
+function optionalProcessRole(value) {
+    return value === 'daemon-owner' || value === 'daemon-service' || value === 'fullaccess-run' || value === 'none'
+        ? value : undefined;
+}
+function optionalDataScope(value) {
+    return value === 'relation' || value === 'agent' || value === 'daemon' ? value : undefined;
+}
 /**
  * Codex's shell carrier can leave one JSON-style escape layer in a message
  * argument (for example, the two characters `\\` and `n`). Decode only that
@@ -198,6 +213,40 @@ export function isManagedSessionRuntimeDir(directory, managedRoot) {
         return false;
     return isPrivateDirectory(root) && isPrivateDirectory(resolved);
 }
+/**
+ * Resolve the session-owned temporary root for a managed child process.
+ *
+ * A direct runner call without task context is intentionally left alone for
+ * backwards-compatible tests and low-level integrations. Once the daemon has
+ * injected the task-context marker, however, falling back to the daemon's
+ * process-wide TMPDIR would break session isolation. Require the injected
+ * value to be present, identical to TMPDIR, and still owned by a trusted
+ * managed namespace before any runner-side helper writes a file.
+ */
+export function getManagedTaskTempDir(runtimeEnv) {
+    if (typeof runtimeEnv?.[TASK_RUNTIME_CONTEXT_ENV] !== 'string')
+        return undefined;
+    const configured = runtimeEnv[SESSION_RUNTIME_DIR_ENV]?.trim();
+    const inherited = runtimeEnv.TMPDIR?.trim();
+    const context = parseTaskRuntimeContext(runtimeEnv[TASK_RUNTIME_CONTEXT_ENV]);
+    const contextDir = context?.sessionRuntimeDir;
+    const processRoot = process.env.TMPDIR?.trim();
+    const trusted = configured
+        && inherited
+        && path.isAbsolute(configured)
+        && path.isAbsolute(inherited)
+        && path.resolve(configured) === path.resolve(inherited)
+        // The process root is shared by all sessions. It may contain a session
+        // directory, but must never itself become the task's TMPDIR capability.
+        && (!processRoot || !path.isAbsolute(processRoot) || path.resolve(configured) !== path.resolve(processRoot))
+        && contextDir
+        && path.resolve(contextDir) === path.resolve(configured)
+        && (isManagedSessionRuntimeDir(configured) || isRunnerOwnedSessionRuntimeDir(configured));
+    if (!trusted) {
+        throw new Error('managed session TMPDIR is unavailable or untrusted');
+    }
+    return path.resolve(configured);
+}
 /**
  * Create a private runtime directory below the process-provided TMPDIR.
  * There is deliberately no os.tmpdir() fallback: managed sessions must not
@@ -290,6 +339,7 @@ export function buildTaskRuntimeEnv(ctx) {
     const clean = normalizeTaskRuntimeContext(ctx);
     return {
         EVOLCORE_SESSION_ID: ctx.sessionId ?? '',
+        ...(ctx.daemonRuntimeEpoch ? { [DAEMON_RUNTIME_EPOCH_ENV]: ctx.daemonRuntimeEpoch } : {}),
         [TASK_RUNTIME_CONTEXT_ENV]: JSON.stringify(clean),
         // Every managed child receives the session directory as TMPDIR. This keeps
         // ordinary temporary files and runtime-only fallbacks out of shared agent

package/dist/cli/trigger-command.js

@@ -32,7 +32,7 @@ export async function cmdTrigger(args) {
         return;
     }
     if (process.env.EVOLCORE_SESSION_ID
-        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path'))) {
+        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path') || hasOption(rest, '--script-file'))) {
         throw new Error('Managed tasks cannot read trigger definitions, prompts, or scripts from local files; use inline prompt content');
     }
     try {
@@ -110,7 +110,7 @@ Create 参数模式支持:
   --baseagent <name>  (仅 --exec trigger-session)
   --model <模型>  --effort <low|medium|high|xhigh|max>
   --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
-  --permission <readonly|auto|request|bypass>（省略则继承当前身份配置）
+  --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
   --tz <时区> (仅 cron)
   --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
   --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)
@@ -123,7 +123,7 @@ Create 参数模式支持:
 
 Update 仅支持常用字段:
   --once | --delay | --at | --cron | --every | --event [--tz]
-  --prompt <文本> | --prompt-file <路径>  --name <名称>
+  --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
   --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
   --max-runs <次数>  --max-duration <时长>
   --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
@@ -399,19 +399,28 @@ function shellQuoteArg(value) {
 }
 async function updateTrigger(args, json) {
     const agentAid = resolveAgentAid(args);
-    const triggerId = positional(args, 0, ['--agent', '--format', '--if-revision', '--prompt-file']);
+    const triggerId = positional(args, 0, ['--agent', '--format', '--if-revision', '--prompt-file', '--script-file']);
     const usesPromptFile = hasOption(args, '--prompt-file');
+    const usesScriptFile = hasOption(args, '--script-file');
+    const scriptFilePath = usesScriptFile ? requireFlag(args, '--script-file') : undefined;
     const { parseTriggerUpdateArgv } = await import('../trigger/parser.js');
     const parsed = parseTriggerUpdateArgv(triggerId, withPromptFromFile(triggerUpdateArgs(args)), { allowLongPrompt: usesPromptFile });
     if (!parsed.ok)
         throw new Error(parsed.error);
+    const scriptFileRequested = parsed.value.scriptFile !== undefined;
+    const { scriptFile: _scriptFile, ...patchFields } = parsed.value;
+    const patch = scriptFileRequested ? { ...patchFields, scriptFile: true } : patchFields;
     const expectedRevision = flagValue(args, '--if-revision');
+    const scriptFileBase64 = scriptFilePath
+        ? fs.readFileSync(scriptFilePath).toString('base64')
+        : undefined;
     const res = await request({
         type: 'trigger.update',
         agentAid,
         triggerId,
-        patch: parsed.value,
+        patch,
         ...(usesPromptFile ? { promptFile: true } : {}),
+        ...(scriptFileBase64 !== undefined ? { scriptFileBase64 } : {}),
         ...(expectedRevision ? { expectedRevision } : {}),
     }, 30_000);
     if (json)