evolcore 0.0.23 → 0.0.24

package/dist/cli/aun-commands.js

@@ -5,6 +5,7 @@ import { isExplicitGroupId } from '../aun/group-identity.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 import { ipcQuery } from '../ipc.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { isManagementRole } from '../config/builtin-roles.js';
 import { readBestTaskRuntimeContext } from './task-context.js';
 // ==================== AID ====================
 function resolveAunPath(args) {
@@ -13,24 +14,35 @@ function resolveAunPath(args) {
         return args[idx + 1];
     return process.env.AUN_HOME || undefined;
 }
+function isRedactedAidShowResult(info) {
+    return 'redacted' in info && info.redacted === true;
+}
 function renderAidShow(info, formatJson) {
     if (formatJson) {
         console.log(JSON.stringify(info, null, 2));
         return;
     }
     console.log(`AID: ${info.aid}`);
-    console.log(`  私钥: ${info.hasPrivateKey ? '有' : '无'}`);
+    const redacted = isRedactedAidShowResult(info);
+    if (!redacted) {
+        console.log(`  私钥: ${info.hasPrivateKey ? '有' : '无'}`);
+    }
     console.log(`  agent.md: ${info.hasAgentMd ? '有' : '无'}`);
     if (info.hasAgentMd) {
+        const signatureReason = redacted ? undefined : info.agentMdSignatureReason;
         const sigLabel = info.agentMdSignature === 'verified' ? '✓ 已验签'
             : info.agentMdSignature === 'unsigned' ? '⚠ 未签名'
-                : info.agentMdSignature === 'invalid' ? `✗ 签名无效${info.agentMdSignatureReason ? ': ' + info.agentMdSignatureReason : ''}`
+                : info.agentMdSignature === 'invalid' ? `✗ 签名无效${signatureReason ? ': ' + signatureReason : ''}`
                     : '? 未知';
         console.log(`  签名状态: ${sigLabel}`);
     }
     console.log(`  证书到期: ${info.certExpiresAt ?? '无证书'}${info.certExpired ? ' (已过期!)' : ''}`);
     if (info.certSubject)
         console.log(`  证书主体: ${info.certSubject}`);
+    if (redacted) {
+        console.log('  本地密钥状态: 已脱敏');
+        return;
+    }
     if (info.keyMatchesCert === false)
         console.log('  密钥/证书: ✗ 公钥不匹配（cert.pem 与 key.json 公钥不一致）');
     else if (info.keyMatchesCert === true)
@@ -104,7 +116,8 @@ async function runManagedAid(args, formatJson) {
     if (!parsed.ok)
         failManagedAid(formatJson, parsed.code, parsed.reason);
     const runtime = await readBestTaskRuntimeContext();
-    if (runtime?.selfAid && parsed.command.aid !== runtime.selfAid.replace(/^@/, '')) {
+    const requiresSelfAid = parsed.command.kind === 'show' || parsed.command.kind === 'agentmd.put';
+    if (requiresSelfAid && runtime?.selfAid && parsed.command.aid !== runtime.selfAid.replace(/^@/, '')) {
         failManagedAid(formatJson, 'SCOPE_MISMATCH', `托管任务只能操作当前 self AID：${runtime.selfAid}`);
     }
     const response = await ipcQuery(resolvePaths().socket, {
@@ -212,7 +225,12 @@ async function runManagedMsg(args, formatJson) {
         if (runtime && (runtime.channel !== 'aun' || runtime.chatType !== 'private')) {
             failManagedGroup(formatJson, 'SCOPE_MISMATCH', 'ec msg history/online 只能读取当前 AUN 私聊关系');
         }
-        if (runtime?.channelId && parsed.command.target !== runtime.channelId.replace(/^@/, '')) {
+        // owner/admin 可以跨对端读历史（每次查询仍只针对一个对端）。这里只是快速
+        // 预检：角色未知时放行交给 daemon 判定，daemon 侧 handleMsgOperation 才是
+        // 权威关卡，member 由 currentRelationOnly 约束、visitor 直接拒绝。
+        const mayReadCrossPeer = parsed.command.kind === 'history'
+            && (runtime?.peerRole === undefined || isManagementRole(runtime.peerRole));
+        if (!mayReadCrossPeer && runtime?.channelId && parsed.command.target !== runtime.channelId.replace(/^@/, '')) {
             failManagedGroup(formatJson, 'SCOPE_MISMATCH', `只能读取当前 AUN 私聊对端：${runtime.channelId}`);
         }
     }
@@ -1053,7 +1071,7 @@ Commands:
   send <from> <to> --file <path> [--as <type>]         发送文件（image|video|voice|file）
   send <from> <to> --link <url> [--title T]            发送链接卡片
   send <from> <to> --payload <json>                    发送自定义 payload
-  pull <from> [--after-seq N] [--limit N]              拉取收件箱
+  pull <from> [--after-seq N] [--limit N] --app <name> 拉取收件箱（必须使用独立 slot）
   ack <from> <seq> [--app <name>]                      确认已读
   recall <from> <message-id> [<message-id>...]         撤回消息
   online <from> <target-aid> [<target-aid>...]         查询在线状态
@@ -1142,6 +1160,20 @@ Options:
     }
     const { msgSend, msgPull, msgAck, msgRecall, msgOnline, msgHistory } = await import('../aun/msg/index.js');
     const commonOpts = { aunPath, slotId: appSlot };
+    const requireConsumerSlot = (operation) => {
+        if (appSlot)
+            return appSlot;
+        const error = {
+            ok: false,
+            code: 'APP_SLOT_REQUIRED',
+            error: `${operation} requires an explicit --app <name> isolated consumer slot; refusing to access the daemon inbox`,
+        };
+        if (formatJson)
+            console.log(JSON.stringify(error));
+        else
+            console.error(`❌ ${error.error}`);
+        process.exit(1);
+    };
     if (sub === 'history') {
         const target = args[2] && !args[2].startsWith('--') ? args[2] : undefined;
         const historyValueFlags = new Set([
@@ -1389,9 +1421,7 @@ Options:
         return;
     }
     if (sub === 'pull') {
-        if (!appSlot) {
-            console.warn('⚠ 警告: 未传 --app，当前与 daemon 共享 evolcore 消费通道。pull 会看到/影响 daemon 的消息消费；如需独立消费请用 --app <name>');
-        }
+        const consumerSlot = requireConsumerSlot('ec msg pull');
         const afterSeqStr = getArgValue(args, '--after-seq');
         const limitStr = getArgValue(args, '--limit');
         const afterSeq = afterSeqStr !== undefined ? Number(afterSeqStr) : undefined;
@@ -1404,7 +1434,7 @@ Options:
             console.error(`❌ --limit 必须是数字: ${limitStr}`);
             process.exit(1);
         }
-        const result = await msgPull({ from, afterSeq, limit, ...commonOpts });
+        const result = await msgPull({ from, afterSeq, limit, aunPath, slotId: consumerSlot });
         if (!result.ok) {
             if (formatJson) {
                 console.log(JSON.stringify(result));
@@ -1440,10 +1470,8 @@ Options:
             console.error(`❌ seq 必须是数字: ${seqStr}`);
             process.exit(1);
         }
-        if (!appSlot) {
-            console.warn('⚠ 警告: 未传 --app，ack 将推进与 daemon 共享的 evolcore 消费游标，可能影响 daemon 收消息；如需独立请用 --app <name>');
-        }
-        const result = await msgAck({ from, seq, ...commonOpts });
+        const consumerSlot = requireConsumerSlot('ec msg ack');
+        const result = await msgAck({ from, seq, aunPath, slotId: consumerSlot });
         if (!result.ok) {
             if (formatJson) {
                 console.log(JSON.stringify(result));
@@ -1546,7 +1574,7 @@ export async function cmdGroup(args) {
   send <from> <group-id> <text> --return <none|required> 发送群文本（跨会话时 --return 必填）
   send <from> <group-id> --file <path> [--as <type>]   发送群文件
   send <from> <group-id> --payload <json>              发送自定义 payload
-  pull <from> <group-id> [--after-seq N] [--limit N]   拉取群消息
+  pull <from> <group-id> [--after-seq N] [--limit N] --app <name>   拉取群消息（必须使用独立 slot）
   ack <from> <group-id> <seq> [--app <name>]           确认已读
 
 群管理:
@@ -1877,12 +1905,18 @@ Options:
     }
     if (sub === 'pull') {
         const groupId = requireGroupId();
-        if (!appSlot) {
-            console.warn('⚠ 警告: 未传 --app，当前与 daemon 共享 evolcore 消费通道。pull 会看到/影响 daemon 的消息消费；如需独立消费请用 --app <name>');
+        const consumerSlot = appSlot;
+        if (!consumerSlot) {
+            const error = 'ec group pull requires an explicit --app <name> isolated consumer slot; refusing to access the daemon inbox';
+            if (formatJson)
+                console.log(JSON.stringify({ ok: false, code: 'APP_SLOT_REQUIRED', error }));
+            else
+                console.error(`❌ ${error}`);
+            process.exit(1);
         }
         const afterSeq = parseNumberFlag('--after-seq', '--after-seq');
         const limit = parseNumberFlag('--limit', '--limit');
-        const result = await groupPull({ from, groupId, afterSeq, limit, ...commonOpts });
+        const result = await groupPull({ from, groupId, afterSeq, limit, aunPath, slotId: consumerSlot });
         outputResult(result, () => {
             const r = result;
             console.log(`✓ ${r.messages.length} 条消息，latest_seq=${r.latest_message_seq}${r.has_more ? '（还有更多）' : ''}`);
@@ -1905,10 +1939,16 @@ Options:
             console.error(`❌ seq 必须是数字: ${seqStr}`);
             process.exit(1);
         }
-        if (!appSlot) {
-            console.warn('⚠ 警告: 未传 --app，ack 将推进与 daemon 共享的 evolcore 消费游标，可能影响 daemon 收消息；如需独立请用 --app <name>');
+        const consumerSlot = appSlot;
+        if (!consumerSlot) {
+            const error = 'ec group ack requires an explicit --app <name> isolated consumer slot; refusing to access the daemon inbox';
+            if (formatJson)
+                console.log(JSON.stringify({ ok: false, code: 'APP_SLOT_REQUIRED', error }));
+            else
+                console.error(`❌ ${error}`);
+            process.exit(1);
         }
-        const result = await groupAck({ from, groupId, seq, ...commonOpts });
+        const result = await groupAck({ from, groupId, seq, aunPath, slotId: consumerSlot });
         outputResult(result, () => {
             const r = result;
             console.log(`✓ ack_seq=${r.ack_seq}`);

package/dist/cli/ctl-command.js

@@ -7,6 +7,7 @@ const CTL_HELP = `用法: ec ctl <command> [args...]
 
 查询:
   status                    查看会话状态
+  status --format json      查看当前任务的结构化运行上下文
   pwd                       显示当前项目路径
   help                      显示帮助
 
@@ -20,6 +21,7 @@ const CTL_HELP = `用法: ec ctl <command> [args...]
 
 示例:
   ec ctl status
+  ec ctl status --format json
   ec ctl name "新会话名称"
   ec ctl send "任务已完成"
   ec ctl file report.md

package/dist/cli/daemon-commands.js

@@ -30,8 +30,50 @@ import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
 import { listCodexAppServerProcesses, unregisterCodexAppServerProcess } from '../agents/codex/app-server-registry.js';
 import { DEFAULT_ECWEB_PORT, ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
-import { checkCodexProjectPath, inspectCodexManagedHook } from '../agents/codex/diagnostics.js';
+import { checkCodexProjectPath, inspectCodexManagedHook, ensureCodexManagedHook, runCodexHookLaunchDiagnostic, } from '../agents/codex/diagnostics.js';
 const execFileAsync = promisify(execFile);
+/** Run before launch, and before restart stops any existing daemon. */
+export function ensureCodexHookBeforeLifecycle(onRepaired) {
+    if (!platform.isWindows)
+        return true;
+    try {
+        const usesCodex = loadDefaults()?.active_baseagent === 'codex'
+            || loadAllAgents().agents.some(agent => {
+                try {
+                    return resolveEffective({ self: agent.aid }).active_baseagent === 'codex';
+                }
+                catch (error) {
+                    console.warn(`⚠ Agent ${agent.aid} 配置解析失败：${error instanceof Error ? error.message : String(error)}`);
+                    return false;
+                }
+            });
+        if (!usesCodex)
+            return true;
+        const result = ensureCodexManagedHook({
+            packageRoot: getPackageRoot(),
+            onInstallRequired: () => console.log('🔧 Codex 运行组件缺失，正在自动安装；Windows 提示管理员授权时请选择“是”。'),
+        });
+        if (result.status === 'installed') {
+            if (result.repaired) {
+                console.log('✅ Codex Windows managed hook 已自动安装并验证');
+                onRepaired?.();
+            }
+            return true;
+        }
+        console.error(`❌ Codex Windows managed hook 未就绪：${result.error || result.reason || result.status}`);
+        if (result.status === 'missing') {
+            console.error('  本次操作已停止。下次启动或重启会再次自动尝试安装，需要允许 Windows 管理员授权。');
+        }
+        else {
+            console.error('  本次操作已停止。现有 Codex 策略或文件访问异常，需要管理员核对；自动安装不会覆盖异常策略。');
+        }
+    }
+    catch (error) {
+        console.error(`❌ Codex 启动检查失败：${error instanceof Error ? error.message : String(error)}`);
+    }
+    process.exitCode = 1;
+    return false;
+}
 async function runAutomaticInit(action) {
     try {
         return await action();
@@ -66,8 +108,8 @@ function printNoSelfAgentHints(options) {
 // taskkill, even though the daemon is healthy and able to shut down gracefully.
 const DAEMON_PROBE_TIMEOUT_MS = platform.isWindows ? 5_000 : 1_000;
 export const DAEMON_SHUTDOWN_TIMEOUT_MS = platform.isWindows ? 10_000 : 3_000;
-async function probeDaemon(socketPath, timeoutMs = DAEMON_PROBE_TIMEOUT_MS) {
-    const response = await ipcQuery(socketPath, { type: 'ping' }, timeoutMs);
+async function probeDaemon(socketPath, timeoutMs = DAEMON_PROBE_TIMEOUT_MS, throwOnError = false) {
+    const response = await ipcQuery(socketPath, { type: 'ping' }, timeoutMs, { throwOnError });
     if (response?.pong !== true || !Number.isInteger(response.pid) || response.pid <= 0)
         return null;
     return response;
@@ -205,19 +247,39 @@ function runSourceBuild() {
         });
     });
 }
+/**
+ * Spawn the restart monitor and confirm it actually reached its own code.
+ *
+ * The daemon is already stopped at this point, so a monitor that dies on
+ * startup leaves nothing running and nobody watching — the exact silent
+ * failure this mechanism exists to prevent.
+ */
+async function spawnRestartMonitorAndConfirm(monitorEntry, reportLine) {
+    const result = await platform.launchMonitorAndConfirm([...monitorEntry.args, 'restart-monitor'], { EVOLCORE_HOME: resolvePaths().root, ...(monitorEntry.env ?? {}) }, pid => scanInstances().restartMonitors.some(m => m.alive && m.record.pid === pid), pid => scanInstances().restartMonitors.some(m => m.alive && m.record.pid !== pid));
+    if (result.ok)
+        return { ok: true };
+    for (const line of (result.stderrTail ?? '').split(/\r?\n/).filter(Boolean).slice(-8)) {
+        reportLine(`  | ${line}`);
+    }
+    return { ok: false, reason: result.reason ?? 'unknown' };
+}
 async function requireFreshSourceBuild() {
     if (!sourceBuildNeedsRefresh())
         return true;
     return await runSourceBuild();
 }
-function requireCompletedDataMigration(root) {
+function requireCompletedDataMigration(root, action = 'start') {
     const requirement = inspectDataMigrationRequirement(root);
     if (!requirement.required)
         return true;
-    console.error(`❌ 检测到 ${requirement.operationCount} 项待确认的用户数据迁移，服务未启动。`);
+    console.error(action === 'restart'
+        ? `❌ 检测到 ${requirement.operationCount} 项待确认的用户数据迁移，本次不停止当前服务。`
+        : `❌ 检测到 ${requirement.operationCount} 项待确认的用户数据迁移，服务未启动。`);
     console.error('  先执行: ec data migrate --dry-run');
     console.error('  确认后: ec data migrate --apply');
     console.error('  迁移成功并校验后，再执行 ec start 或 ec restart。');
+    if (action === 'restart')
+        console.error('  本次 ec restart 仅完成只读检查，未停止当前服务。');
     process.exitCode = 2;
     return false;
 }
@@ -386,6 +448,14 @@ export async function cmdStart(opts = {}) {
     const p = resolvePaths();
     const existingDaemon = await probeDaemon(p.socket);
     if (existingDaemon) {
+        let hookRepaired = false;
+        if (!ensureCodexHookBeforeLifecycle(() => { hookRepaired = true; }))
+            return;
+        if (hookRepaired) {
+            console.log('🔄 Codex 运行组件已补齐，正在自动重启服务以加载策略...');
+            await cmdRestart({ diagnose: opts.diagnose });
+            return;
+        }
         console.log(`  EvolCore is already running (PID: ${existingDaemon.pid}, IPC reachable)`);
         console.log(`  已在运行；已运行时长: ${resolveRunningDuration(existingDaemon.pid, existingDaemon.uptime)}；部署/脚本可直接复用当前实例`);
         return;
@@ -424,6 +494,11 @@ export async function cmdStart(opts = {}) {
             console.log('\n初始化完成，开始启动 EvolCore ....');
         }
     }
+    // The initialization path can create the first Codex agent, so perform the
+    // machine-hook check after config migration/auto-init and before any daemon
+    // process is launched.
+    if (!ensureCodexHookBeforeLifecycle())
+        return;
     // 控制 AID 门禁：缺 aid 且交互式 → 只补全控制 AID + owners（不重走 baseagent 向导）。
     // 非 TTY（restart-monitor/systemd/管道）不补全（无法交互），只提示后继续启动，daemon 侧 warn 兜底。
     const daemonCfgStart = loadDaemonConfig();
@@ -758,6 +833,8 @@ export async function cmdStop() {
 export async function cmdRestart(opts = {}) {
     const cmdStartedAt = Date.now();
     console.log('🔄 Restarting EvolCore...');
+    if (!ensureCodexHookBeforeLifecycle())
+        return;
     const initialStatus = scanInstances();
     const initialOrphans = findOrphanProcesses();
     const initialRuntimeOrphans = initialOrphans.filter(orphan => isRuntimeOrphan(orphan));
@@ -769,12 +846,12 @@ export async function cmdRestart(opts = {}) {
         if (initialRuntimeOrphans.length === 0 && rejectPidIsolatedLifecycle('restart', initialStatus, ping))
             return;
     }
-    if (!await requireFreshSourceBuild())
-        return;
+    // 构建交给 restart-monitor：它在 daemon 停止之后才编译，dist/ 不会被活进程
+    // 占用，失败还能回滚到上一份产物。这里再编译一次会落在事务保护之外。
     // Keep restart behavior identical to startup: both paths use one upgrade
     // check implementation and continue when an upgrade is unavailable.
     await runUpgradeChecks();
-    if (!requireCompletedDataMigration(resolveRoot()))
+    if (!requireCompletedDataMigration(resolveRoot(), 'restart'))
         return;
     // 停止所有活 main 进程（可能不止一个）
     const status = scanInstances();
@@ -854,11 +931,30 @@ export async function cmdRestart(opts = {}) {
         }
     }
     console.log(`⏱ restart prep done in ${((Date.now() - cmdStartedAt) / 1000).toFixed(1)}s, starting...`);
-    // 通过 restart-monitor 启动，避免在 agent 内调用时自杀
-    const appCli = path.join(getPackageRoot(), 'dist', 'cli', 'index.js');
-    platform.spawnDetachedNode([appCli, 'restart-monitor'], {
-        EVOLCORE_HOME: resolvePaths().root,
-    });
+    // 通过 restart-monitor 启动，避免在 agent 内调用时自杀。
+    // 开发仓下 monitor 从源码跑；安装包下先复制到 stage 目录，两种情况都让看门狗
+    // 不住在会被替换的产物里。
+    const monitorEntry = platform.resolveMonitorLaunch(getPackageRoot(), path.join(resolvePaths().root, 'data', 'monitor-stage'));
+    if (monitorEntry.note)
+        console.log(`ℹ ${monitorEntry.note}`);
+    if (!fs.existsSync(monitorEntry.entry)) {
+        console.error(`❌ 重启中止：找不到 restart-monitor 入口 ${monitorEntry.entry}`);
+        console.error('  请先执行 npm run build 重建产物');
+        process.exitCode = 1;
+        return;
+    }
+    const monitorStarted = await spawnRestartMonitorAndConfirm(monitorEntry, log => console.error(log));
+    if (!monitorStarted.ok) {
+        if (monitorEntry.stageDir)
+            platform.cleanupMonitorStage(monitorEntry.stageDir);
+        console.error(`❌ 重启中止：restart-monitor 未能启动（${monitorStarted.reason}）`);
+        if (fs.existsSync(path.join(getPackageRoot(), 'src', 'cli', 'index.ts'))) {
+            console.error('  源码可能存在语法错误导致 tsx 无法加载。请执行 npx tsc --noEmit 检查。');
+        }
+        console.error('  服务已停止，请修复后执行 ec start。');
+        process.exitCode = 1;
+        return;
+    }
     console.log('🔄 Restart monitor started, waiting for service to come back online...');
     await sleep(2000);
     // 代码统计（开发环境）
@@ -1032,7 +1128,11 @@ export async function cmdStatus() {
     // Start all read-only daemon queries together. On a busy Windows host each
     // query can otherwise wait behind the same IPC/event-loop delay and make the
     // total `ec status` time the sum of several individual timeouts.
-    const pingPromise = probeDaemon(p.socket).catch(() => null);
+    let ipcFailure;
+    const pingPromise = probeDaemon(p.socket, DAEMON_PROBE_TIMEOUT_MS, true).catch(error => {
+        ipcFailure = error;
+        return null;
+    });
     const statusPromise = ipcQuery(p.socket, { type: 'status' }).catch(() => null);
     const aidsPromise = ipcQuery(p.socket, { type: 'aun-aids' }).catch(() => null);
     const agentsPromise = ipcQuery(p.socket, { type: 'evolagent.list' }).catch(() => null);
@@ -1049,6 +1149,11 @@ export async function cmdStatus() {
     }
     if (pid) {
         printStartupInfo({ pid, running: true });
+        if (!ping) {
+            console.log('⚠ 仅确认 daemon PID 存活，IPC 不可用，不能据此判断服务健康。');
+            if (ipcFailure)
+                console.log(`  ${ipcFailure instanceof Error ? ipcFailure.message : String(ipcFailure)}`);
+        }
         console.log('');
         console.log('📊 Process Info:');
         if (processVisible) {
@@ -1159,7 +1264,9 @@ export async function cmdStatus() {
         }
     }
     else {
-        console.log('⚠ EvolCore is not running');
+        console.log(ipcFailure ? '⚠ 无法确认 EvolCore 运行状态：IPC 不可用，且没有可见的存活 PID。' : '⚠ EvolCore is not running');
+        if (ipcFailure)
+            console.log(`  ${ipcFailure instanceof Error ? ipcFailure.message : String(ipcFailure)}`);
     }
     // Session & Project statistics (从文件系统读)
     if (fs.existsSync(p.sessionsDir)) {
@@ -2905,7 +3012,12 @@ async function cmdWatchWeb() {
     const cfg = loadDaemonConfig();
     const currentService = ecwebService(cfg.services);
     const port = currentService?.port ?? DEFAULT_ECWEB_PORT;
-    saveDaemonConfig({ ...cfg, services: setEcwebEnabled(cfg.services, true, port) });
+    // Avoid rewriting daemon.json on every invocation once ECWeb is already
+    // enabled on the requested port. The persisted config is the daemon's
+    // lifecycle source of truth, but an unchanged desired state needs no write.
+    if (currentService?.enabled !== true || currentService.port !== port) {
+        saveDaemonConfig({ ...cfg, services: setEcwebEnabled(cfg.services, true, port) });
+    }
     const ok = await startEcwebIfEnabled(p, { forceRestart: true });
     if (!ok)
         process.exit(1); // 失败原因已由 startEcwebIfEnabled 打印
@@ -2944,9 +3056,10 @@ export async function cmdMv(oldDir, newDir) {
     }
 }
 // ==================== Diagnose ====================
-export async function cmdDiagnose() {
+export async function cmdDiagnose(args = []) {
     const p = resolvePaths();
     let hasError = false;
+    const runHookLaunchProbe = args.includes('--codex-hook');
     // 1. 检查数据目录
     console.log(`[diagnose] EVOLCORE_HOME = ${p.root}`);
     if (!fs.existsSync(p.root)) {
@@ -3010,6 +3123,24 @@ export async function cmdDiagnose() {
             const hook = inspectCodexManagedHook({ packageRoot: getPackageRoot() });
             if (hook.status === 'installed') {
                 console.log(`[diagnose] ✓ Codex managed hook 已安装: ${hook.hookPath}`);
+                if (runHookLaunchProbe) {
+                    try {
+                        const launch = runCodexHookLaunchDiagnostic({ packageRoot: getPackageRoot() });
+                        if (launch.status === 'ok') {
+                            console.log('[diagnose] ✓ Codex managed hook 启动探针报告: ' + launch.output);
+                            for (const result of launch.results) {
+                                console.log('[diagnose]   ' + result.label + ': exit=' + result.exitCode + ' pid=' + (result.pid ?? 'unknown'));
+                            }
+                        }
+                        else {
+                            console.log('[diagnose] - Codex managed hook 启动探针: 跳过（' + (launch.reason || 'not applicable') + '）');
+                        }
+                    }
+                    catch (error) {
+                        console.error('[diagnose] ❌ Codex managed hook 启动探针失败: ' + (error instanceof Error ? error.message : String(error)));
+                        hasError = true;
+                    }
+                }
             }
             else if (hook.status === 'skipped') {
                 console.log(`[diagnose] - Codex managed hook: 跳过（${hook.reason}）`);

package/dist/cli/index.js

@@ -80,7 +80,7 @@ function printLifecycleHelp(command) {
         logs: `用法: ec logs [选项]\n\n  --level <error|warn|info|debug>  最低日志级别\n  --module <name>                  只显示指定模块\n  --raw                            原始输出\n  --no-color                       禁用颜色`,
         watch: `用法: ec watch [logs|log|aid|msg|web|session]\n\n  ec watch                 打开监控选择菜单\n  ec watch logs            选择日志类型后监控\n  ec watch log <类型...>   直接监控指定日志类型\n  ec watch aid             监控 AID 连接\n  ec watch msg             打开消息 TUI\n  ec watch web             安装/升级并启动 EC Web\n  ec watch session         ec watch web 的兼容别名`,
         'restart-monitor': '用法: ec restart-monitor\n\n运行内 daemon 重启与升级监控器。',
-        diagnose: '用法: ec diagnose\n\n检查配置、数据库、进程和编译产物。',
+        diagnose: '用法: ec diagnose [--codex-hook]\n\n检查配置、数据库、进程和编译产物。\n\n  --codex-hook 运行 Windows Codex managed hook 启动探针。',
         mv: '用法: ec mv <old-directory> <new-directory>\n\n迁移项目目录以及 Claude、Codex 和 EvolCore 会话路径。',
     };
     console.log(help[command]);
@@ -309,7 +309,7 @@ export async function main(args) {
                 printLifecycleHelp('diagnose');
                 break;
             }
-            await cmdDiagnose();
+            await cmdDiagnose(args.slice(1));
             break;
         case 'data': {
             const { cmdData } = await import('./data-command.js');

package/dist/cli/managed-command-guard.js

@@ -12,6 +12,9 @@ const MANAGED_TASK_COMMANDS = new Set([
     'msg',
     'queue',
     'response',
+    // `stats` reads the usage database directly. It authorizes each managed call
+    // against the task's relation role in `resolveManagedStatsScope`.
+    'stats',
     'status',
     'storage',
     'trigger',