evolcore 0.0.22 → 0.0.24

package/dist/channels/wechat.js

@@ -40,6 +40,8 @@ const BACKOFF_DELAY_MS = 30_000;
 const RETRY_DELAY_MS = 2_000;
 const TYPING_TICKET_TTL_MS = 5 * 60 * 1000; // 5 min cache
 const SESSION_EXPIRED_ERRCODE = -14;
+const INVALID_SYNC_CURSOR_ERRCODE = -1;
+const MAX_SYNC_CURSOR_BYTES = 64 * 1024;
 export class WechatApiError extends Error {
     endpoint;
     ret;
@@ -71,6 +73,26 @@ export class WechatContextTokenRefreshRequiredError extends Error {
         }
     }
 }
+/**
+ * iLink cursors are opaque text, so validation deliberately stays conservative:
+ * reject values that cannot be safely round-tripped through the UTF-8 state file
+ * without imposing a specific encoding on future protocol versions.
+ */
+export function validateWechatSyncCursor(cursor) {
+    if (typeof cursor !== 'string') {
+        return { valid: false, reason: 'invalid_type' };
+    }
+    if (Buffer.byteLength(cursor, 'utf8') > MAX_SYNC_CURSOR_BYTES) {
+        return { valid: false, reason: 'too_large' };
+    }
+    if (cursor.includes('\uFFFD')) {
+        return { valid: false, reason: 'invalid_utf8' };
+    }
+    if (/[\s\u0000-\u001F\u007F-\u009F]/u.test(cursor)) {
+        return { valid: false, reason: 'invalid_character' };
+    }
+    return { valid: true };
+}
 /** Classify fetch/undici failures using the categories exposed by Tencent 2.4.6. */
 export function classifyFetchError(err) {
     if (err instanceof Error && err.name === 'AbortError') {
@@ -196,6 +218,7 @@ export class WechatChannel {
     pendingContextMessages = new Map();
     typingTicketCache = new Map();
     getUpdatesBuf = '';
+    lastRejectedSyncCursor;
     syncBufPath;
     contextTokensPath;
     onSessionExpired;
@@ -243,14 +266,24 @@ export class WechatChannel {
             throw new Error('WeChat reauthentication required; run: ec init wechat');
         }
         // 恢复游标
+        this.getUpdatesBuf = '';
+        this.lastRejectedSyncCursor = undefined;
         try {
             if (fs.existsSync(this.syncBufPath)) {
-                this.getUpdatesBuf = fs.readFileSync(this.syncBufPath, 'utf-8');
-                logger.info(`[WeChat] Restored sync cursor (${this.getUpdatesBuf.length} bytes)`);
+                const restoredCursor = fs.readFileSync(this.syncBufPath, 'utf-8');
+                const validation = validateWechatSyncCursor(restoredCursor);
+                if (validation.valid) {
+                    this.getUpdatesBuf = restoredCursor;
+                    logger.info(`[WeChat] Restored sync cursor (${Buffer.byteLength(restoredCursor, 'utf8')} bytes)`);
+                }
+                else {
+                    this.clearSyncCursor(`persisted cursor is invalid (${validation.reason})`, restoredCursor);
+                }
             }
         }
-        catch {
-            // ignore
+        catch (err) {
+            logger.warn(`[WeChat] Failed to restore sync cursor; starting from an empty cursor: ${err instanceof Error ? err.message : String(err)}`);
+            this.getUpdatesBuf = '';
         }
         // 通知 ilink 后端：bot 上线
         try {
@@ -431,13 +464,22 @@ export class WechatChannel {
                 }
                 consecutiveFailures = 0;
                 // 保存游标
-                if (resp.get_updates_buf) {
-                    this.getUpdatesBuf = resp.get_updates_buf;
-                    try {
-                        fs.writeFileSync(this.syncBufPath, this.getUpdatesBuf, 'utf-8');
+                if (resp.get_updates_buf !== undefined) {
+                    const validation = validateWechatSyncCursor(resp.get_updates_buf);
+                    if (!validation.valid) {
+                        this.clearSyncCursor(`server returned an invalid cursor (${validation.reason})`, typeof resp.get_updates_buf === 'string' ? resp.get_updates_buf : undefined);
                     }
-                    catch {
-                        // best-effort
+                    else if (resp.get_updates_buf) {
+                        if (resp.get_updates_buf !== this.lastRejectedSyncCursor) {
+                            this.lastRejectedSyncCursor = undefined;
+                        }
+                        this.getUpdatesBuf = resp.get_updates_buf;
+                        try {
+                            fs.writeFileSync(this.syncBufPath, this.getUpdatesBuf, 'utf-8');
+                        }
+                        catch {
+                            // best-effort
+                        }
                     }
                 }
                 // 处理消息
@@ -450,6 +492,17 @@ export class WechatChannel {
                     return;
                 if (this.isSessionPaused())
                     return;
+                if (err instanceof WechatApiError &&
+                    err.endpoint === 'ilink/bot/getupdates' &&
+                    err.hasCode(INVALID_SYNC_CURSOR_ERRCODE) &&
+                    this.getUpdatesBuf &&
+                    this.getUpdatesBuf !== this.lastRejectedSyncCursor) {
+                    const rejectedCursor = this.getUpdatesBuf;
+                    this.clearSyncCursor('getUpdates returned ret=-1', rejectedCursor);
+                    consecutiveFailures = 0;
+                    logger.warn('[WeChat] Retrying getUpdates immediately with an empty sync cursor');
+                    continue;
+                }
                 consecutiveFailures++;
                 if (err instanceof WechatApiError) {
                     logger.error(`[WeChat] getUpdates API error (${consecutiveFailures}/${MAX_CONSECUTIVE_FAILURES}): ${err.message}`);
@@ -470,6 +523,24 @@ export class WechatChannel {
             }
         }
     }
+    clearSyncCursor(reason, rejectedCursor) {
+        if (rejectedCursor)
+            this.lastRejectedSyncCursor = rejectedCursor;
+        this.getUpdatesBuf = '';
+        try {
+            let persistedAction = 'no persisted cursor';
+            if (fs.existsSync(this.syncBufPath)) {
+                const quarantinePath = `${this.syncBufPath}.corrupt-${Date.now()}`;
+                fs.renameSync(this.syncBufPath, quarantinePath);
+                persistedAction = `quarantined as ${path.basename(quarantinePath)}`;
+            }
+            logger.warn(`[WeChat] Cleared sync cursor: ${reason} (${persistedAction})`);
+        }
+        catch (err) {
+            logger.warn(`[WeChat] Cleared in-memory sync cursor but failed to quarantine persisted cursor: ` +
+                `${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // ── Inbound Message Handler ──────────────────────────────────────────
     async handleInboundMessage(msg) {
         if (msg.message_type !== MSG_TYPE_USER)

package/dist/channels/wecom.js

@@ -1461,7 +1461,8 @@ export class WecomChannelPlugin {
                         return;
                     case 'status.started':
                     case 'status.queued':
-                    case 'status.progress': return;
+                    case 'status.progress':
+                    case 'status.notice': return;
                     case 'status.requires_action':
                         await channel.sendMessage(channelId, '等待 owner 审批', envelope.replyContext);
                         return;

package/dist/cli/agent-command.js

@@ -69,6 +69,7 @@ Options:
         return;
     }
     const { agentList, agentShow, agentCreateInteractive, agentCreateNonInteractive, agentReload, agentEnable, agentDisable, agentGet, agentSet, agentRename, agentDelete, agentReady, runManagedAgentOperation, } = await import('./agent.js');
+    const { parseAgentOwnerArgs, resolveAgentCreatePlan, validateAgentCreatePlan } = await import('./agent-create.js');
     if (process.env.EVOLCORE_SESSION_ID && !wantsHelp(args) && !new Set(['get', 'set', 'ready']).has(sub)) {
         if (sub === 'new' && !args.includes('--non-interactive')) {
             const error = {
@@ -210,6 +211,8 @@ Options:
   --baseagent <claude|codex|gemini|ecagent>
                                       默认: defaults 配置，否则检测本机可用基座
   --owner <aid>                       默认: daemon.json 第一个 owner
+  --owners <json-array>               多个 Owner；与 --owner 互斥
+  --handoff <context>                 当前任务的 Bootstrap 上下文
   --name <display-name>               默认: package.json name，否则目录名
   --description <text>                默认: package.json description，否则使用 EvolCore 默认描述
   --dry-run                           只预览最终参数，不注册 AID、不写文件
@@ -223,6 +226,15 @@ Options:
   ec agent new mybot.agentid.pub --non-interactive --project ../project --baseagent claude`);
             return;
         }
+        if (args.includes('--handoff')) {
+            const result = { ok: false, code: 'MANAGED_ONLY', error: '--handoff requires a managed Agent task' };
+            if (formatJson)
+                console.log(JSON.stringify(result));
+            else
+                console.error(result.error);
+            process.exitCode = 1;
+            return;
+        }
         const name = args[1];
         const nonInteractive = args.includes('--non-interactive');
         if (nonInteractive) {
@@ -234,12 +246,25 @@ Options:
                 const idx = args.indexOf(flag);
                 return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : undefined;
             };
-            const { resolveAgentCreatePlan, validateAgentCreatePlan } = await import('./agent.js');
+            let ownerOptions;
+            try {
+                ownerOptions = parseAgentOwnerArgs(args);
+            }
+            catch (error) {
+                const result = { ok: false, error: error instanceof Error ? error.message : String(error) };
+                if (formatJson)
+                    console.log(JSON.stringify(result));
+                else
+                    console.error(`❌ ${result.error}`);
+                process.exitCode = 1;
+                return;
+            }
             const plan = resolveAgentCreatePlan({
                 aid: name,
                 project: getArg('--project'),
                 baseagent: getArg('--baseagent'),
-                owner: getArg('--owner'),
+                ...ownerOptions,
+                handoff: getArg('--handoff'),
                 name: getArg('--name'),
                 description: getArg('--description'),
                 force: args.includes('--force'),
@@ -263,7 +288,7 @@ Options:
                     console.log(`  AID: ${plan.aid}`);
                     console.log(`  Project: ${plan.project}`);
                     console.log(`  Baseagent: ${plan.baseagent} (${plan.baseagentSource})`);
-                    console.log(`  Owner: ${plan.owner || '未设置'} (${plan.ownerSource})`);
+                    console.log(`  Owner: ${plan.owners?.join(', ') || plan.owner || '未设置'} (${plan.ownerSource})`);
                     console.log(`  Name: ${plan.name} (${plan.nameSource})`);
                     if (plan.description)
                         console.log(`  Description: ${plan.description} (${plan.descriptionSource})`);
@@ -276,6 +301,7 @@ Options:
                 baseagent: plan.baseagent,
                 project: plan.project,
                 owner: plan.owner,
+                owners: plan.owners,
                 name: plan.name,
                 description: plan.description,
                 force: args.includes('--force'),