evolcore 0.0.20 → 0.0.22

package/dist/core/command/role-menu.js

@@ -16,7 +16,7 @@ import { fileCache } from '../daemon-file-cache.js';
 import { currentVersion } from '../../config/schema-registry.js';
 import { loadSchema } from '../../config/schema-registry.js';
 import { rolePermissionFields, rolePermissionFieldOptions, rolePermissionFieldPatterns, validateRoleConfig, } from '../../config/role-schema.js';
-import { groupInfo, groupList } from '../../aun/msg/group.js';
+import { groupInfo, groupList, groupDirectoryErrorCode } from '../../aun/msg/group.js';
 import { aidLookup, isValidAid } from '../../aun/aid/identity.js';
 import { isExplicitGroupId } from '../../aun/group-identity.js';
 import { readJsonFile, readLastJsonlLine, scanChatDirs, scanMetaFiles } from '../session/session-fs-store.js';
@@ -341,7 +341,7 @@ function assertRequest(context, args) {
             receivingSelf: context.self,
         });
     }
-    if (context.actorRole !== 'owner' && context.actorRole !== 'admin') {
+    if (!isDaemonOwnerControl(context) && context.actorRole !== 'owner' && context.actorRole !== 'admin') {
         throw roleError('PERMISSION_DENIED', 'Role management requires Agent owner or admin', context.self, {
             kind: 'role_permission_denied',
             actorRole: context.actorRole,
@@ -350,7 +350,7 @@ function assertRequest(context, args) {
 }
 function assertRolePolicyMutationTarget(context, args) {
     const roleId = requiredRoleId(args, context.self);
-    if (context.actorRole === 'admin' && roleId === 'owner') {
+    if (!isDaemonOwnerControl(context) && context.actorRole === 'admin' && roleId === 'owner') {
         throw roleError('PERMISSION_DENIED', 'Agent admin cannot modify the owner role policy', context.self, {
             kind: 'role_hierarchy_violation',
             actorRole: context.actorRole,
@@ -485,7 +485,7 @@ function updateDefaultRoles(context, args, value) {
     const registry = readRoleRegistry(self);
     const changesAdminDefault = ['private', 'group'].some(scene => registry.defaultRoles[scene] !== nextDefaults[scene]
         && (registry.defaultRoles[scene] === 'admin' || nextDefaults[scene] === 'admin'));
-    if (context.actorRole !== 'owner' && changesAdminDefault) {
+    if (!isDaemonOwnerControl(context) && context.actorRole !== 'owner' && changesAdminDefault) {
         throw roleError('NOT_ALLOWED', 'Only an owner can set or replace an admin default role', self, {
             kind: 'admin_owner_only',
         });
@@ -521,7 +521,7 @@ async function updateAssignment(context, args, value) {
         });
     }
     const current = readRelation(target.peerKey, self);
-    if (context.actorRole !== 'owner' && (roleId === 'admin' || current?.config.role === 'admin')) {
+    if (!isDaemonOwnerControl(context) && context.actorRole !== 'owner' && (roleId === 'admin' || current?.config.role === 'admin')) {
         throw roleError('NOT_ALLOWED', 'Only an owner can grant or revoke admin', self, {
             kind: 'admin_owner_only',
             target: target.peerKey,
@@ -545,7 +545,7 @@ async function updateAssignment(context, args, value) {
 }
 async function updateAdminAssignment(context, args, value) {
     const self = context.self;
-    if (context.actorRole !== 'owner') {
+    if (!isDaemonOwnerControl(context) && context.actorRole !== 'owner') {
         throw roleError('NOT_ALLOWED', 'Only an owner can grant or revoke admin', self, { kind: 'admin_owner_only' });
     }
     let target = normalizeTarget(args?.target, self);
@@ -679,7 +679,7 @@ async function deleteRole(context, args) {
     const replacement = hasReplacement
         ? validateAssignableRole(args?.replacementRoleId, self, 'replacementRoleId')
         : undefined;
-    if (replacement === 'admin' && context.actorRole !== 'owner') {
+    if (replacement === 'admin' && !isDaemonOwnerControl(context) && context.actorRole !== 'owner') {
         throw roleError('NOT_ALLOWED', 'Only an owner can replace role assignments with admin', self, {
             kind: 'admin_owner_only',
         });
@@ -778,13 +778,19 @@ async function targetSnapshot(context, args, policyRevision) {
     const self = context.self;
     const target = await validateTargetExists(context, normalizeTarget(args?.target, self), { allowAuthenticatedPrivateActor: true });
     const relation = readRelation(target.peerKey, self);
+    const roleView = targetRoleView(self, target, relation?.config ?? null);
+    const override = target.kind === 'private'
+        ? roleView.assignment.explicitRole
+        : roleView.assignment.explicitDefaultRole;
     return {
         $schema_version: ROLE_MENU_SCHEMA_VERSION,
         self,
         policyRevision,
         target,
         relationRevision: relation?.revision ?? null,
-        ...targetRoleView(self, target, relation?.config ?? null),
+        scope: 'relation',
+        override,
+        ...roleView,
         ...(target.kind === 'group' ? { requesterRole: requesterRoleResult(context) } : {}),
         relationConfig: relationConfigView(context, target, relation?.config ?? null),
     };
@@ -926,10 +932,11 @@ async function validateTargetExists(context, target, options = {}) {
         }
         return target;
     }
-    const info = await directory.getGroup({ from: context.self, groupId: target.groupId, required: ['member'] });
+    const info = await directory.getGroup({ from: context.self, groupId: target.groupId, required: ['member', 'state'] });
     if (!info.ok) {
-        throw roleError('NOT_FOUND', info.error || 'Group Role target was not found', context.self, {
-            kind: 'target_not_found', target,
+        const code = groupDirectoryErrorCode(info.code, info.error);
+        throw roleError(code, info.error || 'Unable to verify Group Role target', context.self, {
+            kind: code === 'NOT_FOUND' ? 'target_not_found' : 'target_source_unavailable', target,
         });
     }
     const group = info.group;
@@ -1168,6 +1175,9 @@ function requesterRoleResult(context) {
             : false,
     };
 }
+function isDaemonOwnerControl(context) {
+    return context.isDaemonOwner === true && context.fromControlChannel === true;
+}
 function readAgent(self) {
     const agent = read(ConfigTarget.Agent, { self }, { cache: false });
     if (!agent)

package/dist/core/command/slash-gate.js

@@ -1,7 +1,62 @@
+/**
+ * Maps already-collected activity evidence to a command decision. Collection
+ * stays at the caller because topic management needs a barrier snapshot while
+ * legacy guards intentionally retain their narrower, non-atomic evidence.
+ */
+export function evaluateSessionActivity(evidence) {
+    const signals = [
+        evidence.active,
+        evidence.dispatching,
+        evidence.processing,
+        evidence.activeTurn,
+        evidence.paused,
+        evidence.activeStream,
+        evidence.pendingPermission,
+        evidence.pendingInteraction,
+        evidence.activeHandoff,
+        evidence.openHandoffTarget,
+    ];
+    if ((evidence.prequeue ?? 0) > 0 || (evidence.queued ?? 0) > 0 || signals.some(signal => signal === true)) {
+        return 'busy';
+    }
+    return signals.some(signal => signal === 'unknown') ? 'unknown' : 'idle';
+}
+/** Collect synchronous probes consistently; a configured probe failure is unknown, not idle. */
+export function probeSessionActivity(evidence, probes) {
+    const collected = { ...evidence };
+    // Queue/turn evidence is authoritative enough to reject immediately. Avoid
+    // touching secondary probes after BUSY is already proven (and preserve the
+    // existing paused-thread short-circuit behavior).
+    if (evaluateSessionActivity(collected) === 'busy')
+        return 'busy';
+    for (const key of Object.keys(probes)) {
+        const probe = probes[key];
+        if (!probe)
+            continue;
+        try {
+            collected[key] = probe();
+        }
+        catch {
+            collected[key] = 'unknown';
+        }
+    }
+    return evaluateSessionActivity(collected);
+}
 // 支持的命令列表
-const commands = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/stop', '/pause', '/compact', '/repair', '/fork', '/del', '/perm', '/file', '/check', '/rewind', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
+const commands = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/stop', '/pause', '/compact', '/renew', '/repair', '/fork', '/del', '/perm', '/file', '/check', '/rewind', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
 const deprecatedCommands = ['/clear'];
 const exactBoundaryCommands = new Set(['/pause', '/resume', '/stop']);
+/** Parse the execution command without treating it as a quick/result command. */
+export function parseFullAccessCommand(content) {
+    const match = content.match(/^\s*(\/fa|\/fullaccess)(?=\s|$)([\s\S]*)$/);
+    if (!match)
+        return { matched: false };
+    return {
+        matched: true,
+        command: match[1],
+        prompt: match[2].trim(),
+    };
+}
 // 命令别名映射
 const aliases = {
     '/s': '/session',
@@ -10,7 +65,7 @@ const aliases = {
     '/base': '/baseagent',
 };
 // 命令快速路径前缀（所有命令都不进入消息队列）
-const quickCommandPrefixes = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/repair', '/fork', '/stop', '/pause', '/clear', '/compact', '/del', '/perm', '/file', '/check', '/s ', '/name', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/base ', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
+const quickCommandPrefixes = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/repair', '/fork', '/stop', '/pause', '/clear', '/compact', '/renew', '/del', '/perm', '/file', '/check', '/s ', '/name', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/base ', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
 /**
  * 计算两个字符串的 Levenshtein 距离（编辑距离）
  */
@@ -61,11 +116,13 @@ export function isRecognizedSlashCommand(content) {
 export function guardThreadCommand(content, threadId) {
     if (!threadId)
         return undefined;
-    const threadBlocked = ['/new', '/slist', '/s', '/session', '/fork', '/del'];
-    const isBlocked = threadBlocked.some(c => content === c || content.startsWith(c + ' '));
-    const isBaseagentSwitch = content.startsWith('/baseagent ');
-    const isBaseAliasSwitch = content.startsWith('/base ');
-    if (!isBlocked && !isBaseagentSwitch && !isBaseAliasSwitch)
+    const threadBlocked = ['/new', '/slist', '/s', '/session', '/fork', '/del', '/repair'];
+    const hasCommandArgument = (command) => new RegExp(`^${command.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|$)`).test(content);
+    const isBlocked = threadBlocked.some(hasCommandArgument);
+    const isBaseagentSwitch = /^\/baseagent\s/.test(content);
+    const isBaseAliasSwitch = /^\/base\s/.test(content);
+    const isRewindMutation = /^\/rewind\s/.test(content);
+    if (!isBlocked && !isBaseagentSwitch && !isBaseAliasSwitch && !isRewindMutation)
         return undefined;
     return { kind: 'command.error', text: '⚠️ 话题中不支持此命令' };
 }
@@ -83,7 +140,7 @@ export function guardRoleCommand(content, activeChatType, isAdmin) {
         : [
             ...userGroupCommands,
             // 私聊 visitor/member 额外可用：会话自管理 + 私聊专属的 /rewind 历史查看
-            '/slist', '/new', '/session', '/rename', '/name', '/del', '/s ', '/rewind',
+            '/slist', '/new', '/session', '/rename', '/name', '/del', '/s ', '/rewind', '/renew',
         ];
     const isUserCommand = userCommands.some(cmd => content === cmd.trimEnd() || content.startsWith(cmd));
     if (isUserCommand || isAdmin)
@@ -102,10 +159,16 @@ export async function guardIdleCommand(opts) {
     // - 仅带参时需要 idle（无参是列表/用法）：/session /baseagent /rewind
     // - /chatmode：在 handler 内部自行做写操作的 idle 检查
     // - /mentionmode：在 handler 内部自行做写操作的 idle 检查
+    // /renew owns a stronger gate + authoritative probe and deliberately skips
+    // this realtime precheck so delayed retries can return their committed
+    // idempotent result even while later work is busy.
     const idleAlways = ['/compact', '/repair', '/fork', '/new'];
     const idleWhenArg = ['/session', '/baseagent', '/rewind'];
-    const needsIdle = idleAlways.some(cmd => opts.content === cmd || opts.content.startsWith(cmd + ' ')) ||
-        idleWhenArg.some(cmd => opts.content.startsWith(cmd + ' '));
+    const usesTopicBackendBoundary = !!opts.threadId
+        && opts.content === '/compact'
+        && typeof opts.messageQueue?.withSessionBarrier === 'function';
+    const needsIdle = !usesTopicBackendBoundary && (idleAlways.some(cmd => opts.content === cmd || opts.content.startsWith(cmd + ' ')) ||
+        idleWhenArg.some(cmd => opts.content.startsWith(cmd + ' ')));
     if (!needsIdle)
         return undefined;
     if (opts.threadId) {
@@ -121,10 +184,12 @@ export async function guardIdleCommand(opts) {
             catch {
                 // Runner mismatch should not block recovery commands such as /baseagent.
             }
-            const isBusy = hasActiveStream
-                || opts.messageQueue?.isProcessing(threadSession.id)
-                || (opts.messageQueue?.getQueueLength(threadSession.id) ?? 0) > 0;
-            if (isBusy) {
+            const activity = evaluateSessionActivity({
+                queued: opts.messageQueue?.getQueueLength(threadSession.id) ?? 0,
+                processing: opts.messageQueue?.isProcessing(threadSession.id) ?? false,
+                activeStream: hasActiveStream,
+            });
+            if (activity === 'busy') {
                 return { kind: 'command.error', text: '⚠️ 当前正在处理消息，请稍后再试\n使用 /stop 中断当前任务后重试' };
             }
         }
@@ -132,10 +197,12 @@ export async function guardIdleCommand(opts) {
     else if (opts.activeSession) {
         if (opts.isSessionPaused?.(opts.activeSession.id))
             return undefined;
-        const isBusy = (opts.activeAgent?.hasActiveStream(opts.activeSession.id) ?? false) ||
-            opts.messageQueue?.isProcessing(opts.activeSession.id) ||
-            (opts.messageQueue?.getQueueLength(opts.activeSession.id) ?? 0) > 0;
-        if (isBusy) {
+        const activity = evaluateSessionActivity({
+            queued: opts.messageQueue?.getQueueLength(opts.activeSession.id) ?? 0,
+            processing: opts.messageQueue?.isProcessing(opts.activeSession.id) ?? false,
+            activeStream: opts.activeAgent?.hasActiveStream(opts.activeSession.id) ?? false,
+        });
+        if (activity === 'busy') {
             return { kind: 'command.error', text: '⚠️ 当前正在处理消息，请稍后再试\n使用 /stop 中断当前任务后重试' };
         }
     }