evolcore 0.0.21 → 0.0.22

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
-import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -1966,7 +1966,31 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'managed_ec_discovery_forbidden',
             };
         }
-        const argv = context.sessionId ? parseCodexToolCommandArgv(input) : null;
+        const parserOptions = {
+            verifyShellExecutable: process.platform === 'win32',
+            ...(context.delegationCarrier
+                ? { expectedDelegationToken: context.delegationCarrier }
+                : {}),
+        };
+        const parsedCodex = context.sessionId ? parseCodexToolCommand(input, parserOptions) : null;
+        if (context.sessionId && parsedCodex && !parsedCodex.ok && parsedCodex.issue === 'untrusted-shell') {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 Shell 可执行文件未通过 Windows Authenticode 签名校验，禁止进入 EvolCore EC 特权路径。',
+                policyCode: 'ec_shell_untrusted_executable',
+            };
+        }
+        if (context.sessionId && parsedCodex?.ok && parsedCodex.delegationToken
+            && !context.delegationCarrier) {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 PowerShell 命令中的 EVOLCORE_DELEGATION_TOKEN 必须与当前托管 thread carrier 绑定；无法确认时拒绝执行。',
+                policyCode: 'delegation_token_unbound',
+            };
+        }
+        const argv = parsedCodex?.ok ? parsedCodex.argv : null;
         const managedAidArgv = argv?.at(-2) === '--format' && argv.at(-1) === 'json'
             ? argv.slice(0, -2)
             : argv;
@@ -2003,9 +2027,18 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         const shellDialect = stringShellCarrier?.dialect
             ?? (hasCodexCmdCarrierEcIntent(input) ? 'cmd' : undefined);
-        const ecCommand = classifyEvolcoreShellCommand(policyCommand, shellDialect
-            ? { dialect: shellDialect }
-            : {});
+        const hasPowerShellCarrierAssignment = stringShellCarrier?.dialect === 'powershell'
+            && hasPowerShellDelegationAssignment(stringShellCarrier.command);
+        const ecCommand = hasPowerShellCarrierAssignment && parsedCodex
+            ? parsedCodex.ok && parsedCodex.argv[0] === 'ec'
+                ? { kind: 'literal' }
+                : {
+                    kind: 'composite',
+                    issue: parsedCodex.ok ? 'shell-composition' : parsedCodex.issue,
+                }
+            : classifyEvolcoreShellCommand(policyCommand, shellDialect
+                ? { dialect: shellDialect, ...parserOptions }
+                : parserOptions);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -2013,6 +2046,14 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
+            if (ecCommand.issue === 'untrusted-shell') {
+                return {
+                    behavior: 'deny',
+                    input,
+                    message: '🔒 Shell 可执行文件未通过 Windows Authenticode 签名校验，禁止进入 EvolCore EC 特权路径。',
+                    policyCode: 'ec_shell_untrusted_executable',
+                };
+            }
             if (ecCommand.issue === 'unsafe-expansion') {
                 const message = shellDialect === 'powershell'
                     ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'

package/dist/core/session/session-manager.js

@@ -828,6 +828,7 @@ export class SessionManager {
         }
         // Create new session
         const sessionMetadata = { ...(metadata || {}) };
+        sessionMetadata.__sessionCreatedAt = Date.now();
         const newIdentity = identity ?? this.resolveIdentity(channel, userId, chatType, identityConversationId);
         const resolvedBaseagent = baseagent || 'claude';
         const session = {
@@ -1111,6 +1112,33 @@ export class SessionManager {
         }
         return 'legacy_updated';
     }
+    /**
+     * Clear a main-session backend only when the durable latest snapshot still
+     * points at the caller's expected ID. This is the recovery counterpart to
+     * provider-side "session not found" errors and must never rotate a topic.
+     */
+    async clearMainSessionBackendIfMatches(sessionId, expectedAgentSessionId, metadataKeys = []) {
+        const loaded = this.loadSessionForUpdate(sessionId);
+        if (!loaded)
+            return 'missing';
+        const { current } = loaded;
+        if (current.threadId)
+            return 'topic';
+        const currentId = normalizeBackendSessionId(current.agentSessionId);
+        if (!currentId)
+            return 'already_clear';
+        if (currentId !== normalizeBackendSessionId(expectedAgentSessionId))
+            return 'mismatch';
+        current.agentSessionId = undefined;
+        if (metadataKeys.length > 0 && current.metadata) {
+            const metadata = { ...current.metadata };
+            for (const key of metadataKeys)
+                delete metadata[key];
+            current.metadata = metadata;
+        }
+        this.persistSession(current, 'sync');
+        return 'cleared';
+    }
     async switchAgent(channel, channelId, projectPath, newBaseagent) {
         const inheritedChatType = this.getActiveChatType(channel, channelId);
         const identity = this.deriveChannelIdentity(channel, channelId);
@@ -1424,6 +1452,7 @@ export class SessionManager {
             throw new Error(`[SessionManager] createNewSession: baseagent is empty for channel=${channel} channelId=${channelId}`);
         }
         const metadata = newSessionStableMetadata(inheritedChatType, activeMetadata, identityMetadata);
+        metadata.__sessionCreatedAt = Date.now();
         if (identityMetadata?.sessionBoundaryOperationId) {
             metadata.sessionBoundaryOperationId = identityMetadata.sessionBoundaryOperationId;
         }
@@ -1586,6 +1615,7 @@ export class SessionManager {
         delete metadata.agentSessions;
         delete metadata.resumeAt;
         delete metadata.replyContext;
+        metadata.__sessionRenewedAt = Date.now();
         const session = {
             id: generateSessionId(),
             channel: sourceSession.channel,

package/dist/core/session/session-renew.js

@@ -13,6 +13,9 @@ const MAX_CONTEXT_CHARS = 16_000;
 const MAX_MESSAGE_CHARS = 2_000;
 const MODEL_TIMEOUT_MS = 10_000;
 const RECENT_DECISION_TTL_MS = 30_000;
+const FRESH_EMPTY_SESSION_TTL_MS = 30_000;
+const RENEWED_AT_METADATA_KEY = '__sessionRenewedAt';
+const CREATED_AT_METADATA_KEY = '__sessionCreatedAt';
 const NEW_CONFIDENCE_THRESHOLD = 0.85;
 const AUXILIARY_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
 const EXPLICIT_NEW_RE = /^(?:新话题|换个话题|重新开始|新开会话|新会话)[：:，,；;。！!\n]/;
@@ -91,7 +94,9 @@ export class SessionRenewService {
         const routeKey = this.routeKey(request);
         return await this.withLock(routeKey, async () => {
             const cached = this.recentDecisions.get(routeKey);
-            if (cached && cached.candidateSessionId === request.session.id && cached.expiresAt > this.now()) {
+            if (cached
+                && cached.expiresAt > this.now()
+                && (cached.candidateSessionId === request.session.id || cached.selectedSessionId === request.session.id)) {
                 const selected = cached.selectedSessionId === request.session.id
                     ? request.session
                     : await this.sessionManager.getSessionById(cached.selectedSessionId);
@@ -121,6 +126,18 @@ export class SessionRenewService {
         if (!last) {
             if (request.isNewSession)
                 return { session: request.session, renewed: false };
+            // A renewed session is intentionally created before its first inbound
+            // message is appended. A concurrent message can therefore observe an
+            // empty, freshly-created session. Treat that state as already renewed;
+            // do not create a second logical session for the same route.
+            const metadata = request.session.metadata;
+            const renewedAt = Number(metadata?.[RENEWED_AT_METADATA_KEY] ?? metadata?.[CREATED_AT_METADATA_KEY]);
+            const sessionAgeMs = Number.isFinite(renewedAt)
+                ? Math.max(0, this.now() - renewedAt)
+                : Number.POSITIVE_INFINITY;
+            if (Number.isFinite(renewedAt) && renewedAt <= this.now() && sessionAgeMs <= FRESH_EMPTY_SESSION_TTL_MS) {
+                return { session: request.session, renewed: false, decision: 'continue', source: 'missing_history' };
+            }
             const idleMs = this.now() - request.session.updatedAt;
             return await this.finishDecision(routeKey, request, 'new', 'missing_history', idleMs, evaluationStartedAt);
         }

package/dist/core/session/session-turn-coordinator.js

@@ -48,10 +48,14 @@ export class SessionTurnCoordinator {
             && state.lastTerminal.taskId === lease.taskId
             && state.lastTerminal.generation === lease.generation;
     }
-    invalidate(sessionId, reason) {
+    invalidate(sessionId, reason, expected) {
         const state = this.states.get(sessionId);
         if (!state)
             return undefined;
+        if (expected?.taskId && state.active?.taskId !== expected.taskId)
+            return undefined;
+        if (expected?.generation !== undefined && state.active?.generation !== expected.generation)
+            return undefined;
         if (state.active?.status === 'interrupting' && state.active.cancelReason === reason) {
             return cloneTurnMetadata(state);
         }

package/dist/index.js

@@ -88,12 +88,12 @@ import { TriggerFeedbackDispatcher } from './trigger/feedback.js';
 import { TriggerRuntimeScheduler } from './trigger/scheduler.js';
 import { TargetSessionLockRegistry } from './trigger/session-lock.js';
 import { DaemonChannel } from './channels/daemon.js';
-import { definitionRevision, normalizeTriggerDefinition } from './trigger/validation.js';
+import { definitionRevision, normalizeTriggerDefinition, splitScriptCommand } from './trigger/validation.js';
 import { applyTriggerPatch } from './trigger/patch.js';
 import { validateModelSelectionForRole } from './core/model/model-permission.js';
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride, } from './core/role/runtime-policy.js';
 import { atomicWriteJson } from './core/session/session-fs-store.js';
-import { ensureProcessManagedTempDir } from './cli/task-context.js';
+import { DAEMON_RUNTIME_EPOCH_ENV, ensureProcessManagedTempDir } from './cli/task-context.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from './core/message/message-log.js';
 import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 import { MAIN_PACKAGE_NAME } from './product.js';
@@ -1211,6 +1211,9 @@ async function main() {
         : null;
     bindService?.startCleanup();
     const agentDelegationRegistry = new AgentDelegationRegistry();
+    // Replace any inherited marker from a parent/previous daemon before child
+    // runners or in-process IPC clients are created.
+    process.env[DAEMON_RUNTIME_EPOCH_ENV] = agentDelegationRegistry.getRuntimeEpoch();
     // 创建命令处理器
     const cmdHandler = new CommandHandler(sessionManager, agentMap, messageCache, eventBus, primaryRunnerKey);
     let agentApplicationService;
@@ -2305,6 +2308,7 @@ async function main() {
             return { ok: false, code: delegation.code, error: delegation.reason };
         return cmdHandler.handleCtl(cmd, sessionId, delegation.grant);
     });
+    ipcServer.setDaemonRuntimeEpoch(agentDelegationRegistry.getRuntimeEpoch());
     // Register every IPC executor/provider before exposing the endpoint. The
     // function declaration is hoisted, while its invocation remains here so a
     // failed bind still aborts before any AUN connection is attempted.
@@ -2836,7 +2840,7 @@ async function main() {
             for (const runner of new Set(agentMap.values())) {
                 if (typeof runner?.evaluatePreToolUse !== 'function')
                     continue;
-                const result = await runner.evaluatePreToolUse(params.threadId, params.toolName, params.toolInput, params.signal);
+                const result = await runner.evaluatePreToolUse(params.threadId, params.toolName, params.toolInput, params.signal, params.callId);
                 if (result.applicable)
                     return result;
             }
@@ -4003,17 +4007,59 @@ async function main() {
                     const existing = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === cmd.triggerId);
                     if (!existing)
                         throw new Error(`trigger not found: ${cmd.triggerId}`);
+                    const rawPatch = cmd.patch && typeof cmd.patch === 'object' && !Array.isArray(cmd.patch)
+                        ? cmd.patch
+                        : {};
+                    const rawScriptFile = rawPatch.scriptFile;
+                    if (rawScriptFile !== undefined && rawScriptFile !== true) {
+                        throw new Error('scriptFile must be true');
+                    }
+                    const patchScriptFile = rawScriptFile === true;
+                    const { scriptFile: _scriptFile, ...definitionPatch } = rawPatch;
+                    const scriptFileBase64 = cmd.scriptFileBase64;
+                    if (patchScriptFile && scriptFileBase64 === undefined) {
+                        throw new Error('--script-file requires scriptFileBase64');
+                    }
+                    if (!patchScriptFile && scriptFileBase64 !== undefined) {
+                        throw new Error('scriptFileBase64 requires --script-file');
+                    }
+                    if (scriptFileBase64 !== undefined) {
+                        if (typeof scriptFileBase64 !== 'string') {
+                            throw new Error('scriptFileBase64 must be a base64 string');
+                        }
+                        if (!actor.daemonPrivileged) {
+                            throw new Error('updating a script Trigger requires DaemonOwner');
+                        }
+                        if (existing.execution.type !== 'script' || !existing.execution.script) {
+                            throw new Error('--script-file only applies to script Triggers');
+                        }
+                        if (scriptFileBase64.length > 6 * 1024 * 1024
+                            || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(scriptFileBase64)) {
+                            throw new Error('scriptFileBase64 is invalid or exceeds the 4 MiB limit');
+                        }
+                        const scriptBytes = Buffer.from(scriptFileBase64, 'base64');
+                        if (scriptBytes.length > 4 * 1024 * 1024)
+                            throw new Error('script file exceeds the 4 MiB limit');
+                    }
                     const currentRevision = definitionRevision(existing);
                     if (cmd.expectedRevision !== undefined && cmd.expectedRevision !== currentRevision) {
                         throw new Error(`trigger revision conflict: expected ${cmd.expectedRevision}, current ${currentRevision}`);
                     }
-                    let definition = applyTriggerPatch(existing, cmd.patch, { fromPromptFile: cmd.promptFile === true });
+                    let definition = Object.keys(definitionPatch).length > 0
+                        ? applyTriggerPatch(existing, definitionPatch, { fromPromptFile: cmd.promptFile === true })
+                        : existing;
                     rejectUnapprovedFullAccessConfiguration(definition, actor);
                     definition = withFullAccessConfigurationProvenance(definition, actor);
                     validateTriggerDefinitionForActor(definition, actor);
                     validateTriggerFeedbackChannels(definition);
                     const scheduler = schedulerFor(agentAid);
-                    const trigger = scheduler.update(cmd.triggerId, definition);
+                    const files = scriptFileBase64 !== undefined && existing.execution.script
+                        ? [{
+                                relativePath: splitScriptCommand(existing.execution.script.path).path,
+                                contentBase64: scriptFileBase64,
+                            }]
+                        : [];
+                    const trigger = scheduler.update(cmd.triggerId, definition, files);
                     if (trigger.execution.permissionMode === 'fullaccess') {
                         auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, existing.execution.permissionMode === 'fullaccess'
                             ? 'fullaccess Trigger updated through IPC'
@@ -4152,6 +4198,19 @@ async function main() {
                 await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.suspendForDaemonExit()));
             });
             await shutdownStep('interrupt active message queue tasks', async () => { await queueShutdown; });
+            await shutdownStep('dispose agent runners', async () => {
+                const currentInstances = [...agentMap.entries()].map(([key, agent]) => {
+                    const split = key.lastIndexOf('::');
+                    return {
+                        evolagentName: split > 0 ? key.slice(0, split) : '<unknown>',
+                        baseagent: split > 0 ? key.slice(split + 2) : 'unknown',
+                        agent,
+                    };
+                });
+                await disposeAgentInstances(currentInstances, (instance, error) => {
+                    logger.warn(`[Shutdown] Failed to dispose runner ${instance.evolagentName}::${instance.baseagent}: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            });
             eventBus.publish({
                 type: 'system:shutdown',
                 timestamp: Date.now()

package/dist/ipc.js

@@ -8,18 +8,20 @@ import path from 'path';
 import { logger } from './utils/logger.js';
 import { withMenuProcessingTime, logMenuRequestCompleted, logMenuRequestReceived } from './core/command/menu-protocol.js';
 import { fileCache } from './core/daemon-file-cache.js';
+import { DAEMON_RUNTIME_EPOCH_ENV } from './cli/task-context.js';
 import { HANDOFF_QUERY_MAX_LIMIT, HANDOFF_STATES } from './core/handoff/types.js';
 import { AgentReloadBusyError } from './core/agent-reload-coordinator.js';
-import { getWindowsInstanceSocketPathCandidates, resolvePaths } from './paths.js';
+import { getWindowsInstanceSocketPathCandidates, normalizeIpcEndpoint, resolvePaths } from './paths.js';
 import { getProcessStartTime, isSameOrOlderProcess } from './utils/process-introspect.js';
 import { classifyProcessTree, ProcessTreeSampler, readProcessMetrics } from './utils/process-tree-stats.js';
 import { readSystemMemoryUsage } from './utils/system-memory.js';
 import { hashCurrentDelegatedCommand } from './core/auth/agent-delegation.js';
 import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 const isWindows = process.platform === 'win32';
-const isNamedPipe = (p) => isWindows && p.startsWith('\\\\.\\pipe\\');
+const isNamedPipe = (p) => isWindows && p.toLowerCase().startsWith('\\\\.\\pipe\\');
 const CPU_SAMPLE_INTERVAL_MS = 1000;
 const PROCESS_TREE_SAMPLE_INTERVAL_MS = 5000;
+const MONITOR_LEASE_TTL_MS = 15_000;
 const PROCESS_TREE_SAMPLE_WARN_MS = 250;
 const EVENT_LOOP_LAG_WARN_MS = 100;
 const SAMPLE_WARN_LOG_INTERVAL_MS = 60_000;
@@ -43,6 +45,8 @@ const LOCAL_CONTROL_COMMANDS = new Set([
     'evolagent.resync',
     'menu.exec',
     'monitor-snapshot',
+    'monitor-subscribe',
+    'monitor-unsubscribe',
     'shutdown',
 ]);
 let ipcQuerySequence = 0;
@@ -80,9 +84,9 @@ export function summarizeMonitorAgents(agents, aids) {
     };
 }
 export class IpcServer {
-    socketPath;
     getStatus;
     commandExecutor;
+    socketPath;
     server = null;
     agentRegistry;
     agentApplicationService;
@@ -122,6 +126,7 @@ export class IpcServer {
     wecomContactBindExecutor;
     wechatContactBindExecutor;
     controlToken;
+    daemonRuntimeEpoch;
     // CPU 占用追踪：IPC handler 是一次性同步调用，无法在响应里做 200ms 异步采样，
     // 故用后台 1s interval 累积 process.cpuUsage() 增量，handler 直接读最近值。
     // procCpuPercent = 本 daemon 进程占单核的百分比（可 >100% 仅当多核，已 clamp 到 100）；
@@ -138,6 +143,7 @@ export class IpcServer {
     processTreeWorkerRequestStartedAt = 0;
     processTreeWorkerRequestTimer = null;
     processTreeSamplingInFlight = false;
+    processTreeMonitorLeases = new Map();
     lastCpuTickMono = null;
     eventLoopLagMs = 0;
     maxEventLoopLagMs = 0;
@@ -155,9 +161,9 @@ export class IpcServer {
         lastError: null,
     };
     constructor(socketPath, getStatus, commandExecutor) {
-        this.socketPath = socketPath;
         this.getStatus = getStatus;
         this.commandExecutor = commandExecutor;
+        this.socketPath = normalizeIpcEndpoint(socketPath);
     }
     /** Inject EvolAgentRegistry for evolagent.* IPC handlers */
     setAgentRegistry(registry) {
@@ -171,6 +177,10 @@ export class IpcServer {
     setControlToken(token) {
         this.controlToken = Buffer.from(token);
     }
+    /** Set the process-lifetime marker used to reject stale managed children. */
+    setDaemonRuntimeEpoch(epoch) {
+        this.daemonRuntimeEpoch = epoch;
+    }
     /** Inject menu.* executor (ECWeb Control proxies menu requests through this) */
     setMenuExecutor(executor) {
         this.menuExecutor = executor;
@@ -296,11 +306,10 @@ export class IpcServer {
     setWechatContactBindExecutor(executor) {
         this.wechatContactBindExecutor = executor;
     }
-    /** Start the background CPU and process-tree sampling loops. Call after start(). */
+    /** Start the lightweight background CPU sampling loop. Call after start(). */
     startCpuTracking() {
         if (this.cpuTimer)
             return;
-        this.sampleProcessTree();
         this.lastCpuTickMono = performance.now();
         this.cpuTimer = setInterval(() => {
             const tickMono = performance.now();
@@ -342,17 +351,30 @@ export class IpcServer {
         }, CPU_SAMPLE_INTERVAL_MS);
         // Don't keep the event loop alive for sampling alone.
         this.cpuTimer.unref?.();
-        // Process enumeration is substantially more expensive on Windows than
-        // process.cpuUsage()/os.cpus(), so keep it at a lower refresh rate.
-        this.processTreeTimer = setInterval(() => this.sampleProcessTree(), PROCESS_TREE_SAMPLE_INTERVAL_MS);
-        this.processTreeTimer.unref?.();
     }
-    /** Stop the CPU and process-tree sampling loops. */
+    /** Stop all CPU and process-tree sampling loops. */
     stopCpuTracking() {
         if (this.cpuTimer) {
             clearInterval(this.cpuTimer);
             this.cpuTimer = null;
         }
+        this.processTreeMonitorLeases.clear();
+        this.stopProcessTreeTracking();
+        this.lastCpuTickMono = null;
+    }
+    startProcessTreeTracking() {
+        if (this.processTreeTimer)
+            return;
+        this.sampleProcessTree();
+        this.processTreeTimer = setInterval(() => {
+            this.pruneExpiredMonitorLeases();
+            if (this.processTreeMonitorLeases.size === 0)
+                return;
+            this.sampleProcessTree();
+        }, PROCESS_TREE_SAMPLE_INTERVAL_MS);
+        this.processTreeTimer.unref?.();
+    }
+    stopProcessTreeTracking() {
         if (this.processTreeTimer) {
             clearInterval(this.processTreeTimer);
             this.processTreeTimer = null;
@@ -372,7 +394,31 @@ export class IpcServer {
         this.processTreeWorker = null;
         if (worker)
             void worker.terminate();
-        this.lastCpuTickMono = null;
+        this.processTreeSnapshot = null;
+        this.associatedProcessKinds.clear();
+    }
+    acquireProcessTreeMonitor(leaseId) {
+        this.processTreeMonitorLeases.set(leaseId, Date.now() + MONITOR_LEASE_TTL_MS);
+        this.startProcessTreeTracking();
+    }
+    refreshProcessTreeMonitor(leaseId) {
+        if (typeof leaseId !== 'string' || !this.processTreeMonitorLeases.has(leaseId))
+            return;
+        this.processTreeMonitorLeases.set(leaseId, Date.now() + MONITOR_LEASE_TTL_MS);
+    }
+    releaseProcessTreeMonitor(leaseId) {
+        this.processTreeMonitorLeases.delete(leaseId);
+        if (this.processTreeMonitorLeases.size === 0)
+            this.stopProcessTreeTracking();
+    }
+    pruneExpiredMonitorLeases() {
+        const now = Date.now();
+        for (const [leaseId, expiresAt] of this.processTreeMonitorLeases) {
+            if (expiresAt <= now)
+                this.processTreeMonitorLeases.delete(leaseId);
+        }
+        if (this.processTreeMonitorLeases.size === 0)
+            this.stopProcessTreeTracking();
     }
     sampleProcessTree() {
         if (isWindows) {
@@ -654,6 +700,17 @@ export class IpcServer {
         if (requiresLocalControlToken(cmd) && !this.hasValidControlToken(cmd.controlToken)) {
             return { ok: false, code: 'INVALID_CONTROL_TOKEN', error: 'valid local control token is required' };
         }
+        if (typeof cmd.sessionId === 'string' && cmd.sessionId
+            && typeof cmd.delegationToken === 'string' && cmd.delegationToken
+            && this.daemonRuntimeEpoch
+            && cmd.daemonRuntimeEpoch !== this.daemonRuntimeEpoch) {
+            logger.warn(`[IPC] stale delegation rejected: session=${ipcLogToken(cmd.sessionId)} type=${ipcLogToken(cmd.type)} cause=daemon_runtime_epoch_mismatch`);
+            return {
+                ok: false,
+                code: 'DAEMON_RESTARTED',
+                error: 'The task delegation token belongs to a previous daemon runtime; start a new task authorization and do not retry this command in the current task',
+            };
+        }
         switch (cmd.type) {
             case 'status':
                 return this.getStatus();
@@ -670,6 +727,7 @@ export class IpcServer {
                         threadId: cmd.threadId,
                         toolName: cmd.toolName,
                         toolInput: cmd.toolInput,
+                        callId: typeof cmd.callId === 'string' ? cmd.callId : undefined,
                         signal: requestSignal,
                     });
                 }
@@ -1328,6 +1386,7 @@ export class IpcServer {
                 }
             }
             case 'monitor-snapshot': {
+                this.refreshProcessTreeMonitor(cmd.leaseId);
                 // watch web Monitor 页用：进程级 + 系统级运行指标 + 全局 stats + per-agent 汇总。
                 const mem = process.memoryUsage();
                 const systemMemory = readSystemMemoryUsage();
@@ -1407,6 +1466,20 @@ export class IpcServer {
                     },
                 };
             }
+            case 'monitor-subscribe': {
+                const leaseId = typeof cmd.leaseId === 'string' ? cmd.leaseId.trim() : '';
+                if (!leaseId || leaseId.length > 128)
+                    return { ok: false, error: 'invalid monitor lease id' };
+                this.acquireProcessTreeMonitor(leaseId);
+                return { ok: true, leaseTtlMs: MONITOR_LEASE_TTL_MS };
+            }
+            case 'monitor-unsubscribe': {
+                const leaseId = typeof cmd.leaseId === 'string' ? cmd.leaseId.trim() : '';
+                if (!leaseId || leaseId.length > 128)
+                    return { ok: false, error: 'invalid monitor lease id' };
+                this.releaseProcessTreeMonitor(leaseId);
+                return { ok: true };
+            }
             default:
                 return { error: `unknown command: ${cmd.type}` };
         }
@@ -1425,14 +1498,15 @@ export class IpcServer {
  */
 /** Pass `null` as timeoutMs to wait without a client-side deadline. */
 export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
-    let socketCandidates = [socketPath];
-    if (isNamedPipe(socketPath)) {
+    const endpoint = normalizeIpcEndpoint(socketPath);
+    let socketCandidates = [endpoint];
+    if (isNamedPipe(endpoint)) {
         const paths = resolvePaths();
-        if (socketPath === paths.socket)
+        if (endpoint === paths.socket)
             socketCandidates = getWindowsInstanceSocketPathCandidates(paths.root);
     }
     if (socketCandidates.length <= 1)
-        return ipcQueryOnce(socketPath, cmd, timeoutMs);
+        return ipcQueryOnce(endpoint, cmd, timeoutMs);
     return (async () => {
         const startedAt = Date.now();
         for (const candidate of socketCandidates) {
@@ -1464,7 +1538,13 @@ function ipcQueryOnce(socketPath, cmd, timeoutMs = 3000) {
         && typeof authenticatedCmd.delegationCommandHash !== 'string'
         ? hashCurrentDelegatedCommand()
         : undefined;
-    const request = delegationCommandHash ? { ...authenticatedCmd, delegationCommandHash } : authenticatedCmd;
+    const request = {
+        ...(delegationCommandHash ? { ...authenticatedCmd, delegationCommandHash } : authenticatedCmd),
+        ...(process.env[DAEMON_RUNTIME_EPOCH_ENV]
+            && typeof authenticatedCmd.delegationToken === 'string'
+            ? { daemonRuntimeEpoch: process.env[DAEMON_RUNTIME_EPOCH_ENV] }
+            : {}),
+    };
     return new Promise((resolve) => {
         const startedAtMono = performance.now();
         const queryId = nextIpcQueryId(request);

package/dist/paths.js

@@ -179,6 +179,24 @@ function windowsSocketPathForRoot(root) {
     const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 12);
     return `\\\\.\\pipe\\${WINDOWS_PIPE_PREFIX}-${hash}`;
 }
+/**
+ * Normalize an IPC endpoint before it reaches node:net.
+ *
+ * Windows does not support Unix-domain socket files at ordinary filesystem
+ * paths. Callers that construct an ad-hoc `.sock` path (tests and embedded
+ * runtimes in particular) must therefore use the same deterministic named
+ * pipe on both the server and client sides. Existing named pipes and all
+ * non-Windows endpoints are preserved verbatim.
+ */
+export function normalizeIpcEndpoint(endpoint) {
+    // Windows object-manager paths are case-insensitive. Preserve an explicit
+    // named pipe verbatim even when a caller spells the namespace as `PIPE`.
+    if (!isWindows || endpoint.toLowerCase().startsWith('\\\\.\\pipe\\'))
+        return endpoint;
+    const normalized = path.win32.resolve(endpoint).toLowerCase();
+    const hash = crypto.createHash('sha1').update(normalized).digest('hex').slice(0, 20);
+    return `\\\\.\\pipe\\${WINDOWS_PIPE_PREFIX}-endpoint-${hash}`;
+}
 /**
  * Return the canonical and pre-normalization Windows daemon pipe names.
  *

package/dist/response-system/engines/v1/proactive-flow.js

@@ -197,6 +197,7 @@ export const proactiveFlow = {
                 const queueMsg = queueLen >= 5
                     ? `⚠️ 有 ${queueLen} 条消息未读，请尽快完成当前任务，或使用 ec ctl queue 读取后同步处理。`
                     : `⚠️ 有 ${queueLen} 条消息未读，可使用 ec ctl queue 读取。`;
+                ctx.recordReminder?.({ kind: 'queue_unread', text: queueMsg, queueLength: queueLen });
                 ctx.injectToModel(queueMsg);
             }
         }
@@ -208,13 +209,17 @@ export const proactiveFlow = {
             state.toolReportPending = true;
             const cmdHint = state.chatType === 'group' ? 'ec group send' : 'ec msg send';
             const target = state.chatType === 'group' ? '群里' : '对方';
-            ctx.injectToModel(`⚠️ 工具调用已达到 ${state.toolCount} 次，请立即用 ${cmdHint} 向${target}汇报当前情况和下一步意图。`);
+            const reportMsg = `⚠️ 工具调用已达到 ${state.toolCount} 次，请立即用 ${cmdHint} 向${target}汇报当前情况和下一步意图。`;
+            ctx.recordReminder?.({ kind: 'tool_report', text: reportMsg, toolCount: state.toolCount });
+            ctx.injectToModel(reportMsg);
         }
     },
     // ─── onToolResult：成功发送回执后解除门禁 ───
     onToolResult(ctx) {
         const state = ctx.state.get(STATE_KEY);
-        if (!state || !ctx.isSendCommand(ctx.toolName, ctx.toolInput))
+        if (!state)
+            return;
+        if (!ctx.isSendCommand(ctx.toolName, ctx.toolInput))
             return;
         if (!hasSuccessfulSendReceipt(ctx.result, ctx.isError || !!ctx.error))
             return;

package/dist/stats/price-resolver.js

@@ -5,6 +5,10 @@
 import { resolvePriceRow, BILLING_FNS } from './billing.js';
 import fs from 'fs';
 import path from 'path';
+/** Keep wire/log metadata readable while preserving full precision in storage. */
+export function roundCostForOutput(value) {
+    return Number.isFinite(value) ? Number(value.toFixed(4)) : value;
+}
 // 网关价格表缓存（从用户覆盖层 model-prices-gateway.jsonl 读取）
 let _gatewayPriceCache = null;
 let _gatewayPriceCacheTs = 0;