evolcore 0.0.23 → 0.0.24

package/dist/cli/restart-monitor.js

@@ -16,6 +16,23 @@ import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown } from './daemon-commands.js';
 const execFileAsync = promisify(execFile);
+/**
+ * The package this monitor operates on, which is not always the one it runs
+ * from.
+ *
+ * In an installed setup the monitor is copied to a staging directory before an
+ * upgrade replaces the real package (see `prepareMonitorStage`), so
+ * `getPackageRoot()` — derived from `import.meta.dirname` — would point at that
+ * throwaway copy. Every path the monitor acts on (the daemon entry it spawns,
+ * the artifact it backs up, the build it runs) must instead resolve against the
+ * package being serviced.
+ *
+ * In a checkout no staging happens and the variable is unset, so this is
+ * exactly `getPackageRoot()` and behaviour is unchanged.
+ */
+function targetPackageRoot() {
+    return process.env.EVOLCORE_TARGET_PACKAGE_ROOT || getPackageRoot();
+}
 // 清理 Claude Code 环境变量，防止 SDK 认为是嵌套会话
 function cleanEnv() {
     for (const key of [
@@ -55,7 +72,18 @@ export async function cmdRestartMonitor() {
     }
     // 立即登记自己；exit 路径上自动清理 record
     writeRestartMonitor();
-    process.on('exit', () => removeRestartMonitor());
+    process.on('exit', () => {
+        removeRestartMonitor();
+        // 安装包模式下本进程跑在 stage 副本里。cwd 不在其中（继承自调用方），
+        // 所以可以安全自删；留下来只会占磁盘。
+        const stage = process.env.EVOLCORE_MONITOR_STAGE;
+        if (stage) {
+            try {
+                platform.cleanupMonitorStage(stage);
+            }
+            catch { }
+        }
+    });
     // post-write 自检：(startedAt, pid) 选最早赢家
     {
         const verdict = isRestartMonitorWinner();
@@ -73,11 +101,17 @@ export async function cmdRestartMonitor() {
         return s.mains.some(m => m.alive);
     };
     log('Restart monitor started');
+    // Keep this path available for a failed read-only preflight so a stale
+    // restart request cannot be replayed by a later daemon startup.
+    const pendingFile = path.join(daemonControlDir(), 'restart-pending.json');
+    // 升级成功时记下版本变化，回执里要告诉 agent 实际跑的是哪个版本。
+    let upgradeVersions;
     const migrationRequirement = inspectDataMigrationRequirement(p.root);
     if (migrationRequirement.required) {
         const message = `Pending user-data migration (${migrationRequirement.operationCount} operations); leaving the current service running. Run ec data migrate --dry-run, then ec data migrate --apply.`;
         log(message);
         console.error(`❌ ${message}`);
+        cleanupPendingFile(pendingFile, log);
         process.exitCode = 2;
         return;
     }
@@ -100,7 +134,7 @@ export async function cmdRestartMonitor() {
         if (o.confirmedTestDaemon)
             return false;
         const homeMatches = o.evolcoreHome && normalizePath(o.evolcoreHome) === normalizePath(p.root);
-        const packageMatches = !o.evolcoreHome && normalizePath(o.cmdline).includes(normalizePath(getPackageRoot()));
+        const packageMatches = !o.evolcoreHome && normalizePath(o.cmdline).includes(normalizePath(targetPackageRoot()));
         return Boolean(homeMatches || packageMatches);
     });
     if (runtimeOrphans.length > 0) {
@@ -126,8 +160,6 @@ export async function cmdRestartMonitor() {
         }
         cleanupInstances();
     }
-    // restart-pending.json 只留给新主进程发送发起会话内的“重启成功”回执。
-    const pendingFile = path.join(daemonControlDir(), 'restart-pending.json');
     // 等待所有活 main 进程退出（可能不止一个）
     const oldStatus = scanInstances();
     const aliveMains = oldStatus.mains.filter(m => m.alive);
@@ -167,11 +199,29 @@ export async function cmdRestartMonitor() {
     }
     // 版本检查与自动升级
     log('Checking for updates...');
+    // 升级会原地替换整包，先留一个可回退的产物副本。备份放 EVOLCORE_HOME 而非包目录：
+    // Linux/macOS 的全局目录常常不可写，而 HOME 一定可写。
+    const upgradeBackup = await backupDistForUpgrade(p, log);
     const upgrade = await tryUpgrade();
+    let upgradeRolledBack;
     switch (upgrade.status) {
         case 'upgraded':
             log(`✅ Upgraded: ${upgrade.from} → ${upgrade.to}`);
-            await notifyDaemonOwners(p, `📦 已升级 ${upgrade.from} → ${upgrade.to}`, log);
+            if (!distArtifactIsUsable(path.join(targetPackageRoot(), 'dist'))) {
+                // npm 报成功但产物不完整：当作升级失败处理。
+                log('❌ Upgrade left an incomplete dist/');
+                if (await restoreDistBackup(upgradeBackup, log)) {
+                    upgradeRolledBack = `升级到 ${upgrade.to} 后产物不完整，已回滚到 ${upgrade.from}`;
+                    await notifyDaemonOwners(p, `⚠️ ${upgradeRolledBack}`, log);
+                }
+                else {
+                    await notifyDaemonOwners(p, `❌ 升级到 ${upgrade.to} 后产物不完整，且回滚失败，请人工检查`, log);
+                }
+            }
+            else {
+                upgradeVersions = { from: upgrade.from, to: upgrade.to };
+                await notifyDaemonOwners(p, `📦 已升级 ${upgrade.from} → ${upgrade.to}`, log);
+            }
             break;
         case 'no-update':
             log(`Already up to date (${upgrade.from})`);
@@ -183,6 +233,13 @@ export async function cmdRestartMonitor() {
             break;
         case 'failed':
             log(`⚠ Upgrade failed (${upgrade.from} → ${upgrade.to}): ${upgrade.error}`);
+            // 安装可能中途失败并留下残缺目录，此时必须用备份恢复才敢继续启动。
+            if (!distArtifactIsUsable(path.join(targetPackageRoot(), 'dist'))) {
+                log('❌ Failed upgrade left an unusable dist/');
+                if (await restoreDistBackup(upgradeBackup, log)) {
+                    upgradeRolledBack = `升级失败且产物受损，已回滚到 ${upgrade.from}`;
+                }
+            }
             await notifyDaemonOwners(p, `⚠️ evolcore 升级失败，使用当前版本继续\n${upgrade.error ?? ''}`.trim(), log);
             break;
     }
@@ -200,17 +257,81 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ ${WEB_PACKAGE_NAME} 升级失败，使用当前版本继续\n${ecwebUpgrade.error ?? ''}`.trim(), log);
             break;
     }
+    // 编译在 daemon 停止之后、拉起之前：此时没有活进程占着 dist/，
+    // 失败还能回滚到上一份可用产物，因此这一步整体是可撤销的。
+    const buildOutcome = await buildSourcesTransactionally(log);
+    if (buildOutcome.status === 'failed') {
+        const message = `服务未重启：${buildOutcome.reason ?? '构建失败'}`;
+        log(`❌ ${message}`);
+        await notifyDaemonOwners(p, `❌ ${message}`, log);
+        markRestartOutcome(pendingFile, 'build-failed', buildOutcome.reason, log);
+        process.exit(1);
+    }
+    if (buildOutcome.status === 'rolled-back') {
+        // 回滚后仍然继续启动：旧产物是可用的，服务恢复比停在这里更重要。
+        log(`↩ ${buildOutcome.reason ?? '已回滚'}；继续以上一版本启动`);
+        await notifyDaemonOwners(p, `⚠️ ${buildOutcome.reason ?? '已回滚'}，正在以上一版本启动服务`, log);
+    }
     // ECWeb is owned by the daemon. Starting it here used to race with the
     // daemon's own launcher and ECWeb's stale-instance cleanup, which could
     // leave ServiceProxy pointed at a dead PID.
     // 启动并检测 ready signal
     let started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
     if (started) {
-        log('✓ Service restarted successfully');
+        if (upgradeRolledBack) {
+            markRestartOutcome(pendingFile, 'rolled-back', upgradeRolledBack, log);
+            log(`✓ Service restarted after upgrade rollback`);
+        }
+        else if (buildOutcome.status === 'rolled-back') {
+            // 让发起方的 agent 知道改动没生效，而不是以为重启成功了。
+            markRestartOutcome(pendingFile, 'rolled-back', buildOutcome.reason, log);
+            log('✓ Service restarted on the previous build');
+        }
+        else {
+            dropStaleBackup(log);
+            dropUpgradeBackup(upgradeBackup, log);
+            if (upgradeVersions?.to) {
+                markRestartOutcome(pendingFile, 'upgraded', `已升级 ${upgradeVersions.from} → ${upgradeVersions.to}`, log);
+            }
+            log('✓ Service restarted successfully');
+        }
         archiveSelfHealLog(p, log);
         // 发起会话内的“重启成功”通知由新进程自行发送，此处只负责失败/自愈告警。
         process.exit(0);
     }
+    // 升级后的新版本起不来：回退到升级前的产物再试一次。
+    if (upgradeVersions?.to && !upgradeRolledBack) {
+        if (await restoreDistBackup(upgradeBackup, log)) {
+            await notifyDaemonOwners(p, `⚠️ 升级到 ${upgradeVersions.to} 后启动失败，正在回滚到 ${upgradeVersions.from} 重试...`, log);
+            started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
+            if (started) {
+                const reason = `升级到 ${upgradeVersions.to} 后启动失败，已回滚到 ${upgradeVersions.from}`;
+                log(`✓ ${reason}`);
+                markRestartOutcome(pendingFile, 'rolled-back', reason, log);
+                await notifyDaemonOwners(p, `⚠️ ${reason}。当前运行旧版本，请检查后重试。`, log);
+                archiveSelfHealLog(p, log);
+                process.exit(0);
+            }
+            log('❌ Rolled-back version also failed to start');
+        }
+    }
+    // 新产物起不来：回退到上一份可用产物再试一次，比直接进 self-heal 快且确定。
+    if (buildOutcome.status === 'built') {
+        const reverted = await revertToPreviousBuild(log);
+        if (reverted) {
+            await notifyDaemonOwners(p, '⚠️ 新编译产物启动失败，正在回滚到上一版本重试...', log);
+            started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
+            if (started) {
+                const reason = '新编译产物启动失败，已回滚到上一个可用版本';
+                log(`✓ ${reason}`);
+                markRestartOutcome(pendingFile, 'rolled-back', reason, log);
+                await notifyDaemonOwners(p, `⚠️ ${reason}。改动未生效，请检查代码后重试。`, log);
+                archiveSelfHealLog(p, log);
+                process.exit(0);
+            }
+            log('❌ Rolled-back build also failed to start');
+        }
+    }
     // 启动失败 — 测试环境下跳过 self-heal（避免 claude -p 污染会话列表、误杀生产进程）
     if (p.root.startsWith('/tmp/') || process.env.EVOLCORE_TEST === '1') {
         log('❌ Service failed to start (test environment detected, skipping self-heal)');
@@ -320,6 +441,49 @@ function sleep(ms) {
 function normalizePath(value) {
     return value.replace(/[\\/]+/g, '/').toLowerCase();
 }
+/**
+ * Move a directory, retrying briefly before falling back to copy+delete.
+ *
+ * Windows fails `rename` with EPERM/EBUSY/EACCES while any handle inside the
+ * tree is still open — an antivirus scan or a not-quite-dead child is enough,
+ * and those clear within a second or two. When the handle does not clear we
+ * still have to make progress, so the fallback copies the tree and deletes the
+ * source afterwards: slower, but it does not need exclusive access. A failure
+ * to delete the source is not fatal, the copy already succeeded.
+ */
+async function moveDirWithFallback(from, to, log) {
+    for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+            fs.renameSync(from, to);
+            return true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (attempt < 3 && (code === 'EPERM' || code === 'EBUSY' || code === 'EACCES')) {
+                log(`rename ${path.basename(from)} -> ${path.basename(to)} failed (${code}), retry ${attempt}/2`);
+                await sleep(attempt * 700);
+                continue;
+            }
+            log(`rename failed (${code ?? 'unknown'}), falling back to copy: ${path.basename(from)}`);
+            try {
+                fs.cpSync(from, to, { recursive: true });
+                try {
+                    fs.rmSync(from, { recursive: true, force: true });
+                }
+                catch {
+                    // Copy is what matters; a leftover source only wastes disk.
+                    log(`WARN: copied ${path.basename(from)} but could not remove the original`);
+                }
+                return true;
+            }
+            catch (copyError) {
+                log(`ERROR: copy fallback failed: ${copyError.message}`);
+                return false;
+            }
+        }
+    }
+    return false;
+}
 function hasStartupResourceConflict(p) {
     let daemonLog = null;
     try {
@@ -341,6 +505,266 @@ function hasStartupResourceConflict(p) {
         }
     });
 }
+/** Entry files that must exist for a build artifact to be considered usable. */
+function distArtifactIsUsable(distDir) {
+    return ['index.js', path.join('cli', 'index.js')].every(rel => {
+        try {
+            return fs.statSync(path.join(distDir, rel)).size > 0;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Rebuild `dist/` transactionally when sources are newer than the artifact.
+ *
+ * The daemon is already stopped when this runs, so the build cannot pull the
+ * rug from under a live process — but a failed build still leaves `dist/`
+ * half-deleted, and that is the state that used to make the service
+ * unrecoverable. So the previous artifact is moved aside first and restored
+ * whenever the build fails or produces something unusable: the caller either
+ * gets a fresh `dist/` or exactly the one it had before.
+ *
+ * Installed packages ship `dist/` without `src/`, so they skip all of this and
+ * keep using the artifact npm delivered.
+ */
+async function buildSourcesTransactionally(log) {
+    const packageRoot = targetPackageRoot();
+    const sourceCli = path.join(packageRoot, 'src', 'cli', 'index.ts');
+    if (!fs.existsSync(sourceCli))
+        return { status: 'skipped' };
+    const distDir = path.join(packageRoot, 'dist');
+    const backupDir = path.join(packageRoot, 'dist.prev');
+    const daemonEntry = path.join(distDir, 'index.js');
+    const latestSource = Math.max(latestMtimeIn(path.join(packageRoot, 'src')), latestMtimeIn(path.join(packageRoot, 'ecagent', 'src')));
+    const distIsUsable = distArtifactIsUsable(distDir);
+    if (distIsUsable) {
+        let distMtime = 0;
+        try {
+            distMtime = fs.statSync(daemonEntry).mtimeMs;
+        }
+        catch { }
+        if (latestSource <= distMtime)
+            return { status: 'skipped' };
+    }
+    // Clear a leftover backup from an interrupted run before creating a new one.
+    if (fs.existsSync(backupDir)) {
+        try {
+            fs.rmSync(backupDir, { recursive: true, force: true });
+        }
+        catch { }
+    }
+    let haveBackup = false;
+    if (distIsUsable) {
+        haveBackup = await moveDirWithFallback(distDir, backupDir, log);
+        if (!haveBackup) {
+            // Without a rollback point a failed build would strand the service.
+            log('❌ Could not set aside the current dist/; skipping rebuild to keep the working artifact');
+            return { status: 'failed', reason: '无法备份当前 dist/，已跳过重建以保住可用产物' };
+        }
+        log('Backed up dist/ -> dist.prev');
+    }
+    const restoreBackup = async () => {
+        if (!haveBackup)
+            return false;
+        try {
+            fs.rmSync(distDir, { recursive: true, force: true });
+        }
+        catch { }
+        const restored = await moveDirWithFallback(backupDir, distDir, log);
+        log(restored ? '↩ Rolled back to the previous dist/' : '❌ Rollback failed: dist.prev could not be restored');
+        return restored;
+    };
+    log('🔧 Sources are newer than dist/, rebuilding...');
+    const built = await runBuildCommand(log);
+    if (!built) {
+        const rolledBack = await restoreBackup();
+        return rolledBack
+            ? { status: 'rolled-back', reason: '编译失败，已回滚到上一个可用产物' }
+            : { status: 'failed', reason: '编译失败，且回滚未成功' };
+    }
+    if (!distArtifactIsUsable(distDir)) {
+        log('❌ Build reported success but dist/ is missing an entry file');
+        const rolledBack = await restoreBackup();
+        return rolledBack
+            ? { status: 'rolled-back', reason: '编译产物不完整，已回滚到上一个可用产物' }
+            : { status: 'failed', reason: '编译产物不完整，且回滚未成功' };
+    }
+    // Keep dist.prev until the new artifact has actually served a ready signal;
+    // the caller decides when to drop it.
+    return { status: 'built' };
+}
+/** Latest mtime under a directory tree, 0 when unreadable. */
+function latestMtimeIn(dir) {
+    let latest = 0;
+    try {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            latest = entry.isDirectory()
+                ? Math.max(latest, latestMtimeIn(full))
+                : Math.max(latest, fs.statSync(full).mtimeMs);
+        }
+    }
+    catch { }
+    return latest;
+}
+/** Run `npm run build` in the package root, resolving to false on any failure. */
+function runBuildCommand(log) {
+    return new Promise(resolve => {
+        // Windows cannot spawn the npm .cmd shim directly with shell:false on
+        // recent Node versions; invoke cmd.exe explicitly instead.
+        const command = platform.isWindows ? (process.env.ComSpec ?? process.env.COMSPEC ?? 'cmd.exe') : 'npm';
+        const args = platform.isWindows ? ['/d', '/c', 'npm.cmd', 'run', 'build'] : ['run', 'build'];
+        const child = spawn(command, args, {
+            cwd: targetPackageRoot(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        let tail = '';
+        const capture = (chunk) => {
+            tail = (tail + chunk.toString()).slice(-4000);
+        };
+        child.stdout?.on('data', capture);
+        child.stderr?.on('data', capture);
+        child.on('error', err => {
+            log(`❌ Failed to launch the build: ${err.message}`);
+            resolve(false);
+        });
+        child.on('exit', code => {
+            if (code === 0) {
+                log('✅ Build finished');
+                resolve(true);
+                return;
+            }
+            log(`❌ Build failed (exit ${code})`);
+            for (const line of tail.split(/\r?\n/).filter(Boolean).slice(-12))
+                log(`  | ${line}`);
+            resolve(false);
+        });
+    });
+}
+/**
+ * Annotate restart-pending.json with how the restart actually ended.
+ *
+ * The new daemon reads this file to send its "restart done" receipt into the
+ * originating session. Without an outcome the agent cannot tell a clean restart
+ * from one that silently fell back to the previous build and would assume its
+ * code change took effect. Older daemons ignore unknown fields, so writing this
+ * stays safe when the rolled-back artifact predates the field.
+ */
+function markRestartOutcome(pendingFile, outcome, reason, log) {
+    try {
+        if (!fs.existsSync(pendingFile))
+            return;
+        const info = JSON.parse(fs.readFileSync(pendingFile, 'utf-8'));
+        info.outcome = outcome;
+        if (reason)
+            info.outcomeReason = reason;
+        fs.writeFileSync(pendingFile, JSON.stringify(info));
+        log(`Marked restart-pending.json outcome=${outcome}`);
+    }
+    catch (error) {
+        log(`WARN: could not annotate restart-pending.json: ${error.message}`);
+    }
+}
+/** Drop the rollback point once the freshly built artifact is serving. */
+function dropStaleBackup(log) {
+    const backupDir = path.join(targetPackageRoot(), 'dist.prev');
+    if (!fs.existsSync(backupDir))
+        return;
+    try {
+        fs.rmSync(backupDir, { recursive: true, force: true });
+        log('Removed dist.prev (new build verified)');
+    }
+    catch {
+        // Harmless: the next build clears it before creating its own backup.
+        log('WARN: could not remove dist.prev');
+    }
+}
+/** Swap the freshly built dist/ back to the previous artifact after a failed start. */
+async function revertToPreviousBuild(log) {
+    const packageRoot = targetPackageRoot();
+    const distDir = path.join(packageRoot, 'dist');
+    const backupDir = path.join(packageRoot, 'dist.prev');
+    if (!fs.existsSync(backupDir))
+        return false;
+    try {
+        fs.rmSync(distDir, { recursive: true, force: true });
+    }
+    catch { }
+    const restored = await moveDirWithFallback(backupDir, distDir, log);
+    log(restored ? '↩ Restored the previous dist/' : '❌ Could not restore dist.prev');
+    return restored;
+}
+/**
+ * Copy the current dist/ aside so a bad upgrade can be undone.
+ *
+ * Unlike the build path — where dist/ is *moved* to dist.prev because it is
+ * about to be deleted anyway — an upgrade replaces dist/ in place, so the
+ * original must stay usable until npm succeeds. Hence a copy.
+ *
+ * The backup lives under EVOLCORE_HOME rather than in the package directory:
+ * on Linux/macOS the global prefix is frequently root-owned, and a rollback
+ * that cannot be written is worthless. Returns null when there is nothing to
+ * back up or the copy failed — the caller then knows rollback is unavailable.
+ */
+async function backupDistForUpgrade(p, log) {
+    const distDir = path.join(targetPackageRoot(), 'dist');
+    if (!distArtifactIsUsable(distDir))
+        return null;
+    const backupDir = path.join(p.root, 'data', 'package-backup', 'dist.prev');
+    try {
+        fs.mkdirSync(path.dirname(backupDir), { recursive: true });
+        fs.rmSync(backupDir, { recursive: true, force: true });
+        fs.cpSync(distDir, backupDir, { recursive: true });
+        log(`Backed up dist/ -> ${backupDir}`);
+        return backupDir;
+    }
+    catch (error) {
+        log(`WARN: could not back up dist/ before upgrade: ${error.message}`);
+        return null;
+    }
+}
+/** Restore a backup produced by backupDistForUpgrade. */
+async function restoreDistBackup(backupDir, log) {
+    if (!backupDir || !fs.existsSync(backupDir)) {
+        log('❌ No usable dist backup to restore from');
+        return false;
+    }
+    const distDir = path.join(targetPackageRoot(), 'dist');
+    for (let attempt = 1; attempt <= 3; attempt++) {
+        try {
+            fs.rmSync(distDir, { recursive: true, force: true });
+            fs.cpSync(backupDir, distDir, { recursive: true });
+            log('↩ Restored dist/ from backup');
+            return true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (attempt < 3 && (code === 'EPERM' || code === 'EBUSY' || code === 'EACCES')) {
+                log(`restore failed (${code}), retry ${attempt}/2`);
+                await sleep(attempt * 700);
+                continue;
+            }
+            log(`❌ Could not restore dist/: ${error.message}`);
+            return false;
+        }
+    }
+    return false;
+}
+/** Drop the upgrade rollback point once the new version is confirmed serving. */
+function dropUpgradeBackup(backupDir, log) {
+    if (!backupDir || !fs.existsSync(backupDir))
+        return;
+    try {
+        fs.rmSync(backupDir, { recursive: true, force: true });
+        log('Removed upgrade backup (new version verified)');
+    }
+    catch {
+        log('WARN: could not remove upgrade backup');
+    }
+}
 function cleanupPendingFile(filePath, log) {
     try {
         if (fs.existsSync(filePath)) {
@@ -372,7 +796,7 @@ async function spawnAndWaitReady(p, log, timeout) {
     const stdoutLog = path.join(p.logs, 'stdout.log');
     const out = fs.openSync(stdoutLog, 'a');
     const err = fs.openSync(stdoutLog, 'a');
-    const appMain = path.join(getPackageRoot(), 'dist', 'index.js');
+    const appMain = path.join(targetPackageRoot(), 'dist', 'index.js');
     const child = spawn(process.execPath, ['--no-warnings=ExperimentalWarning', appMain], {
         detached: true,
         stdio: ['ignore', out, err],
@@ -423,7 +847,7 @@ async function spawnAndWaitReady(p, log, timeout) {
  * 调用 claude CLI 进行自动修复
  */
 async function invokeClaude(claudePath, p, attempt, maxAttempts, timeout, log) {
-    const projectDir = getPackageRoot();
+    const projectDir = targetPackageRoot();
     const selfHealLog = p.selfHealLog;
     const stdoutLog = path.join(p.logs, 'stdout.log');
     const selfHealExists = fs.existsSync(selfHealLog) ? '存在，请先阅读之前的修复记录' : '不存在（首次修复）';

package/dist/cli/stats.js

@@ -3,6 +3,7 @@
  */
 import { resolveRoot } from '../paths.js';
 import { wantsHelp } from './help.js';
+import { readBestTaskRuntimeContext } from './task-context.js';
 import { queryAggregated, querySessionTurns, queryContextBreakdown, queryTopPeers, queryTopModels, queryMessageAggregated, queryPeerList, querySummary, queryPeerDaily, queryTaskModelCalls, querySessionModelCalls } from '../stats/query.js';
 import { getBudgetStatus } from '../stats/budget.js';
 const HELP = `ec stats — Token 用量与费用统计
@@ -102,6 +103,98 @@ function parseDateArg(s) {
         throw new Error(`Invalid date: ${s}`);
     return d.getTime();
 }
+/**
+ * Views that read the whole stats database rather than one authorized scope.
+ * `--sql` is a read-only escape hatch over every table, and `--rebuild` writes.
+ * Neither can be narrowed to a relation, so both stay outside managed tasks.
+ */
+const MANAGED_FORBIDDEN_FLAGS = ['sql', 'rebuild'];
+/**
+ * Views that enumerate peers other than the caller. They are meaningful only
+ * for an agent-wide scope, so a relation-scoped caller cannot use them.
+ */
+const AGENT_SCOPE_FLAGS = ['peers', 'groups', 'top-peers'];
+/** Relation roles allowed to read usage across the whole agent. */
+const AGENT_SCOPE_ROLES = new Set(['owner', 'admin']);
+/**
+ * Resolve the authorized stats scope for a managed Agent task.
+ *
+ * `ec stats` reads the usage database directly, so authorization has to happen
+ * here: owner and admin may read the whole agent, and every other relation role
+ * is confined to its own relation and session. Returns undefined outside a
+ * managed task, leaving direct terminal usage unchanged.
+ */
+async function resolveManagedStatsScope(flags, isJson) {
+    if (!process.env.EVOLCORE_SESSION_ID)
+        return undefined;
+    const runtime = await readBestTaskRuntimeContext();
+    const role = runtime?.peerRole?.trim();
+    const selfAid = runtime?.selfAid?.trim();
+    // Fail closed: without a resolved identity and role there is no scope to
+    // authorize against, and a managed caller must never fall back to full access.
+    if (!selfAid || !role || role === 'none') {
+        fail(isJson, 'NOT_ALLOWED', 'stats 在托管任务中需要已解析的关系身份与角色');
+    }
+    for (const flag of MANAGED_FORBIDDEN_FLAGS) {
+        if (flags[flag])
+            fail(isJson, 'NOT_ALLOWED', `--${flag} 在托管任务中不可用`);
+    }
+    if (AGENT_SCOPE_ROLES.has(role))
+        return { agentWide: true, agentAid: selfAid, role };
+    for (const flag of AGENT_SCOPE_FLAGS) {
+        if (flags[flag])
+            fail(isJson, 'NOT_ALLOWED', `--${flag} 仅 owner/admin 可用`);
+    }
+    const channel = runtime?.channel?.trim();
+    const peerId = runtime?.peerId?.trim();
+    if (!channel || !peerId) {
+        fail(isJson, 'NOT_ALLOWED', `角色 ${role} 只能查看自己的关系用量，但当前对端标识不完整`);
+    }
+    const sessionId = process.env.EVOLCORE_SESSION_ID;
+    return {
+        agentWide: false,
+        agentAid: selfAid,
+        peerKey: `${channel}#${encodeURIComponent(peerId)}`,
+        sessionId,
+        role,
+    };
+}
+/**
+ * Reject an explicit selector that points outside the authorized scope instead
+ * of silently narrowing it, so a caller never reads a value as their own.
+ */
+function enforceManagedSelector(scope, flags, isJson) {
+    // owner/admin read across the host, so an explicit --agent stays available to
+    // them. Every other role is pinned to the agent that owns this task.
+    if (scope.agentWide)
+        return;
+    const requestedAgent = typeof flags.agent === 'string' ? flags.agent.trim() : undefined;
+    if (requestedAgent && requestedAgent !== scope.agentAid) {
+        fail(isJson, 'NOT_ALLOWED', `角色 ${scope.role} 只能查看 ${scope.agentAid} 的用量`);
+    }
+    const normalizePeer = (value) => value.includes('#') ? value : `aun#${encodeURIComponent(value)}`;
+    for (const flag of ['peer', 'peer-detail']) {
+        const raw = flags[flag];
+        if (typeof raw !== 'string' || !raw.trim())
+            continue;
+        if (normalizePeer(raw.trim()) !== scope.peerKey) {
+            fail(isJson, 'NOT_ALLOWED', `角色 ${scope.role} 只能查看自己的关系用量`);
+        }
+    }
+    for (const flag of ['session', 'context', 'session-calls']) {
+        const raw = flags[flag];
+        if (typeof raw !== 'string' || !raw.trim())
+            continue;
+        if (raw.trim() !== scope.sessionId) {
+            fail(isJson, 'NOT_ALLOWED', `角色 ${scope.role} 只能查看当前会话的用量`);
+        }
+    }
+    // A task id cannot be checked against this relation without a second lookup,
+    // and it addresses one runQuery across the whole agent. Keep it privileged.
+    if (typeof flags['task-calls'] === 'string' && flags['task-calls'].trim()) {
+        fail(isJson, 'NOT_ALLOWED', '--task-calls 仅 owner/admin 可用');
+    }
+}
 export async function handleStats(args) {
     // Help
     if (wantsHelp(args)) {
@@ -130,6 +223,11 @@ export async function handleStats(args) {
         }
     }
     const isJson = flags.format === 'json';
+    // Authorize before any branch runs: `--rebuild` writes, and every read view
+    // below would otherwise see the whole database.
+    const managedScope = await resolveManagedStatsScope(flags, isJson);
+    if (managedScope)
+        enforceManagedSelector(managedScope, flags, isJson);
     // 全量重建日聚合表（运维兜底/排查），不依赖时间范围。
     if (flags.rebuild) {
         const { rebuildDailyRollup, getDb } = await import('../stats/db.js');
@@ -223,6 +321,18 @@ export async function handleStats(args) {
         filter.model = flags.model;
     if (flags.session && typeof flags.session === 'string')
         filter.session_id = flags.session;
+    // Pin the authorized scope into the filter itself. Rejecting an out-of-scope
+    // selector is not enough: a relation-scoped caller that passes no selector at
+    // all would otherwise aggregate across every agent and peer in the database.
+    if (managedScope && !managedScope.agentWide) {
+        filter.agent_aid = managedScope.agentAid;
+        filter.peer_key = managedScope.peerKey;
+        // A bare peer id would take the LIKE branch below and could also match the
+        // same id on another channel. Pin the exact key that was authorized.
+        if (typeof flags['peer-detail'] === 'string' && managedScope.peerKey) {
+            flags['peer-detail'] = managedScope.peerKey;
+        }
+    }
     // ── 结构化查询：私聊/群聊列表、总消耗汇总、对端按天明细 ──────────────────
     if (flags.peers || flags.groups) {
         const peerType = flags.peers ? 'private' : 'group';