evolcore 0.0.22 → 0.0.24

package/dist/core/command/menu-protocol.js

@@ -12,11 +12,102 @@ export const MENU_REQUEST_TYPES = new Set([
     'menu.update',
     'menu.action',
 ]);
+export function buildMenuClientProtectedHeaders(input) {
+    const clientName = input.clientName ?? 'evol';
+    if (clientName === 'ec-menu-client') {
+        const clientVersion = input.clientVersion?.trim();
+        if (!parseStableSemver(clientVersion)) {
+            throw Object.assign(new Error('ec-menu-client requires a stable X.Y.Z client version'), { code: 'INVALID_CLIENT' });
+        }
+        return {
+            client_name: clientName,
+            client_version: clientVersion,
+            ...(input.remoteAccessToken || input.ecwebToken ? { auth_method: 'remote-access-token', remote_access_token: input.remoteAccessToken ?? input.ecwebToken } : {}),
+        };
+    }
+    const appClientVersion = input.clientVersion?.trim();
+    return {
+        ...(clientName === 'Evol App' ? { client_name: clientName } : {}),
+        ...(input.evolVersion ? { evol_version: input.evolVersion } : {}),
+        ...(clientName === 'Evol App' && appClientVersion ? { client_version: appClientVersion } : {}),
+        ...(input.remoteAccessToken || input.ecwebToken ? { auth_method: 'remote-access-token', remote_access_token: input.remoteAccessToken ?? input.ecwebToken } : {}),
+    };
+}
+export function parseMenuClientProtectedHeaders(value) {
+    if (!value)
+        return {};
+    const normalized = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (typeof raw !== 'string')
+            continue;
+        normalized[key.trim().toLowerCase()] = raw;
+    }
+    const result = {};
+    if (normalized.client_name === 'evol' || normalized.client_name === 'Evol App' || normalized.client_name === 'ec-menu-client')
+        result.client_name = normalized.client_name;
+    else if (normalized.client_name !== undefined)
+        result.client_name = normalized.client_name;
+    if (normalized.client_version !== undefined)
+        result.client_version = normalized.client_version;
+    if (normalized.evol_version !== undefined)
+        result.evol_version = normalized.evol_version;
+    if (normalized.auth_method === 'daemon-owner' || normalized.auth_method === 'remote-access-token' || normalized.auth_method === 'ecweb-token')
+        result.auth_method = normalized.auth_method;
+    else if (normalized.auth_method !== undefined)
+        result.auth_method = normalized.auth_method;
+    if (normalized.remote_access_token !== undefined)
+        result.remote_access_token = normalized.remote_access_token;
+    if (normalized.ecweb_token !== undefined)
+        result.ecweb_token = normalized.ecweb_token;
+    return result;
+}
+/** Validate client identity separately from authorization. These fields never grant access. */
+export function evaluateMenuClientCompatibility(input) {
+    const headers = parseMenuClientProtectedHeaders(input.protectedHeaders);
+    const clientName = headers.client_name ?? 'evol';
+    if (clientName === 'ec-menu-client') {
+        if (!input.encrypted || !parseStableSemver(headers.client_version)) {
+            return {
+                code: 'INVALID_CLIENT',
+                message: 'ec-menu-client requires encrypted protected headers and a stable X.Y.Z client_version',
+            };
+        }
+        return null;
+    }
+    if (clientName !== 'evol' && clientName !== 'Evol App') {
+        return { code: 'INVALID_CLIENT', message: `Unsupported Menu client: ${String(clientName)}` };
+    }
+    return evaluateEvolMenuVersionGate(input);
+}
+export function parseMenuResponse(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw Object.assign(new Error('Menu response must be an object'), { code: 'INVALID_RESPONSE' });
+    }
+    const response = value;
+    if (response.type !== 'menu.response' || typeof response.id !== 'string' || !response.id.trim()) {
+        throw Object.assign(new Error('Invalid Menu response type or id'), { code: 'INVALID_RESPONSE' });
+    }
+    const hasData = Object.prototype.hasOwnProperty.call(response, 'data');
+    const hasError = Object.prototype.hasOwnProperty.call(response, 'error');
+    if (hasData === hasError) {
+        throw Object.assign(new Error('Menu response must contain exactly one of data or error'), { code: 'INVALID_RESPONSE' });
+    }
+    if (hasError) {
+        const error = response.error;
+        if (!error || typeof error !== 'object' || Array.isArray(error)
+            || typeof error.code !== 'string'
+            || typeof error.message !== 'string') {
+            throw Object.assign(new Error('Invalid Menu response error'), { code: 'INVALID_RESPONSE' });
+        }
+    }
+    return value;
+}
 export const MENU_NAME_COMMANDS = Object.freeze({
     pwd: '/pwd',
     session: '/session',
     topic: '/topic',
     baseagent: '/baseagent',
+    'baseagent-models': '/baseagent-models',
     model: '/model',
     effort: '/effort',
     chatmode: '/chatmode',
@@ -259,6 +350,25 @@ export function menuFailure(header, error) {
         },
     };
 }
+export function enforceMenuResponseSize(response, maxBytes = 128 * 1024) {
+    let bytes;
+    try {
+        bytes = Buffer.byteLength(JSON.stringify(response), 'utf8');
+    }
+    catch {
+        return menuFailure({ id: response.id, ...(response.name ? { name: response.name } : {}) }, {
+            code: 'INTERNAL_ERROR',
+            message: 'Menu response is not serializable',
+        });
+    }
+    if (bytes <= maxBytes)
+        return response;
+    return menuFailure({ id: response.id, ...(response.name ? { name: response.name } : {}) }, {
+        code: 'RESPONSE_TOO_LARGE',
+        message: `Menu response exceeds the ${maxBytes}-byte limit`,
+        data: { bytes, maxBytes },
+    });
+}
 const INVALID_ARGUMENT_CODES = new Set([
     'ARGUMENT_MISMATCH', 'FILE_TOO_LARGE', 'INVALID_ARGS', 'INVALID_DELEGATION',
     'INVALID_FIELD', 'INVALID_REVISION', 'INVALID_SCOPE', 'INVALID_TYPE', 'INVALID_VALUE', 'MISSING_AID',
@@ -273,6 +383,8 @@ const STABLE_CODES = new Set([
     'MENU_TOKEN_REQUIRED', 'MENU_TOKEN_REJECTED', 'MENU_TOKEN_ENCRYPTION_REQUIRED',
     'INVALID_CONTEXT', 'SCHEMA_VERSION_UNSUPPORTED', 'DEPENDENCY_UNAVAILABLE',
     'RATE_LIMITED', 'CATALOG_STALE', 'DATA_MIGRATION_REQUIRED',
+    'INVALID_CLIENT', 'REMOTE_ACCESS_TOKEN_INVALID', 'ECWEB_TOKEN_INVALID', 'CLIENT_BUSY', 'INVALID_RESPONSE', 'TIMEOUT',
+    'RESPONSE_TOO_LARGE',
 ]);
 export function normalizeMenuError(error) {
     const source = error && typeof error === 'object' ? error : {};
@@ -493,6 +605,9 @@ function menuFlowBaseRecord(request, context) {
         requestId: menuRequestId(request),
         messageId: context.messageId,
         selfAid: context.selfAid,
+        requesterAid: context.requesterAid,
+        authMethod: context.authMethod,
+        clientName: context.clientName,
     };
 }
 function menuRequestBusinessFields(request) {
@@ -531,11 +646,19 @@ export function logMenuRequestCompleted(request, response, context, options) {
     const processingMs = response && typeof response.processing_ms === 'number'
         ? response.processing_ms
         : undefined;
+    let responseBytes;
+    if (response) {
+        try {
+            responseBytes = Buffer.byteLength(JSON.stringify(response), 'utf8');
+        }
+        catch { }
+    }
     writeMenuFlowRecord({
         ...menuFlowBaseRecord(request, context),
         event: options.delivery === 'failed' ? 'menu.request.failed' : 'menu.request.completed',
         delivery: options.delivery,
         processingMs,
+        responseBytes,
         reason: options.reason,
         result: response && 'data' in response ? sanitizeMenuLogValue(response.data) : undefined,
         warning: response && 'warning' in response ? sanitizeMenuLogValue(response.warning) : undefined,

package/dist/core/command/slash-gate.js

@@ -43,9 +43,9 @@ export function probeSessionActivity(evidence, probes) {
     return evaluateSessionActivity(collected);
 }
 // 支持的命令列表
-const commands = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/stop', '/pause', '/compact', '/renew', '/repair', '/fork', '/del', '/perm', '/file', '/check', '/rewind', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
+const commands = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/stop', '/pause', '/compact', '/renew', '/repair', '/fork', '/del', '/perm', '/file', '/check', '/rewind', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade', '/pair'];
 const deprecatedCommands = ['/clear'];
-const exactBoundaryCommands = new Set(['/pause', '/resume', '/stop']);
+const exactBoundaryCommands = new Set(['/pause', '/resume', '/stop', '/pair']);
 /** Parse the execution command without treating it as a quick/result command. */
 export function parseFullAccessCommand(content) {
     const match = content.match(/^\s*(\/fa|\/fullaccess)(?=\s|$)([\s\S]*)$/);
@@ -65,7 +65,7 @@ const aliases = {
     '/base': '/baseagent',
 };
 // 命令快速路径前缀（所有命令都不进入消息队列）
-const quickCommandPrefixes = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/repair', '/fork', '/stop', '/pause', '/clear', '/compact', '/renew', '/del', '/perm', '/file', '/check', '/s ', '/name', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/base ', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade'];
+const quickCommandPrefixes = ['/new', '/pwd', '/help', '/evolhelp', '/status', '/restart', '/reload', '/model', '/effort', '/baseagent', '/slist', '/session', '/rename', '/repair', '/fork', '/stop', '/pause', '/clear', '/compact', '/renew', '/del', '/perm', '/file', '/check', '/s ', '/name', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode', '/mentionmode', '/ask', '/resume', '/base ', '/aid', '/rpc', '/storage', '/agent', '/trigger', '/upgrade', '/pair'];
 /**
  * 计算两个字符串的 Levenshtein 距离（编辑距离）
  */
@@ -119,10 +119,8 @@ export function guardThreadCommand(content, threadId) {
     const threadBlocked = ['/new', '/slist', '/s', '/session', '/fork', '/del', '/repair'];
     const hasCommandArgument = (command) => new RegExp(`^${command.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|$)`).test(content);
     const isBlocked = threadBlocked.some(hasCommandArgument);
-    const isBaseagentSwitch = /^\/baseagent\s/.test(content);
-    const isBaseAliasSwitch = /^\/base\s/.test(content);
     const isRewindMutation = /^\/rewind\s/.test(content);
-    if (!isBlocked && !isBaseagentSwitch && !isBaseAliasSwitch && !isRewindMutation)
+    if (!isBlocked && !isRewindMutation)
         return undefined;
     return { kind: 'command.error', text: '⚠️ 话题中不支持此命令' };
 }