evolcore 0.0.23 → 0.0.25

package/dist/core/permission/tool-policy.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import os from 'os';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
@@ -41,6 +42,14 @@ export function expandManagedTempPath(value, options = {}) {
 }
 const WRITE_INTENT_RE = /(?:^|[\s;&|])(?:mkdir|mktemp|touch|tee|cp|mv|install|chmod|chown|ln|rm)(?:[\s;&|]|$)|(?:^|[\s])(?:\d>>?|>>?)\s*/i;
 const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/tmp(?:\/|$)|\/var\/tmp(?:\/|$)|\/dev\/shm(?:\/|$))[^\s'";&|<>)]*/g;
+function windowsTempRoots(options) {
+    if (process.platform !== 'win32')
+        return [];
+    return [os.tmpdir(), options.env?.TEMP, options.env?.TMP, process.env.TEMP, process.env.TMP]
+        .filter((value) => typeof value === 'string' && path.isAbsolute(value))
+        .map(value => resolveProtectedCandidate(value))
+        .filter((value, index, values) => values.indexOf(value) === index);
+}
 /**
  * Inspect shell write targets that look like temporary paths. Ordinary
  * project writes are left to the existing workspace/H-class policy; any
@@ -52,19 +61,32 @@ export function checkManagedTempShellCommand(command, options = {}) {
     const root = resolveManagedTempDir(options.env);
     const normalized = substituteTmpDir(command, root);
     const candidates = [...normalized.matchAll(TEMP_TOKEN_RE)].map(match => match[0].replace(/[.,:]+$/, ''));
-    if (candidates.length === 0)
+    // Windows has no portable `/tmp` spelling. Treat absolute paths below the
+    // host temporary roots as temporary operands too, so a sibling session
+    // directory cannot bypass the managed TMPDIR check.
+    if (process.platform === 'win32') {
+        const roots = windowsTempRoots(options);
+        const windowsCandidates = normalized.match(/[A-Za-z]:[\\/][^\s'";&|<>)]*/g) ?? [];
+        for (const candidate of windowsCandidates) {
+            const canonical = resolveProtectedCandidate(candidate.replace(/[.,:]+$/, ''), options.cwd);
+            if (roots.some(root => isSameOrDescendant(canonical, root)))
+                candidates.push(candidate.replace(/[.,:]+$/, ''));
+        }
+    }
+    const uniqueCandidates = [...new Set(candidates)];
+    if (uniqueCandidates.length === 0)
         return { kind: 'none' };
     if (!root) {
-        return { kind: 'deny', paths: candidates, reason: 'TMPDIR is unset or not an absolute managed path' };
+        return { kind: 'deny', paths: uniqueCandidates, reason: 'TMPDIR is unset or not an absolute managed path' };
     }
-    const outside = candidates.filter(candidate => !isManagedTempPath(candidate, {
+    const outside = uniqueCandidates.filter(candidate => !isManagedTempPath(candidate, {
         ...options,
         env: { ...(options.env ?? process.env), TMPDIR: root },
     }));
     if (outside.length > 0) {
         return { kind: 'deny', paths: outside, reason: 'temporary write target is outside the session-managed TMPDIR' };
     }
-    return { kind: 'allow', paths: candidates };
+    return { kind: 'allow', paths: uniqueCandidates };
 }
 /**
  * Replace only already-validated temporary path operands before a second
@@ -2161,10 +2183,11 @@ export function evaluateToolPreflight(toolName, input, context) {
             : command;
         const tempCheck = checkManagedTempShellCommand(commandForPolicy, managedTempOptions(context));
         if (tempCheck.kind === 'deny') {
+            const currentTmpDir = resolveManagedTempDir(managedTempOptions(context).env);
             return {
                 behavior: 'deny',
                 input,
-                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内：${tempCheck.reason}`,
+                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${tempCheck.reason}`,
                 policyCode: 'temporary_path_outside_tmpdir',
             };
         }
@@ -2215,14 +2238,20 @@ export function evaluateToolPreflight(toolName, input, context) {
         const ownAid = !!managedAidArgv
             && !!context.selfAid
             && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
-        const isSelfManagedAidRead = !!managedAidArgv
+        const isManagedAidPublicRead = !!context.selfAid
+            && !!managedAidArgv
             && managedAidArgv[0] === 'ec'
             && managedAidArgv[1] === 'aid'
-            && ownAid
-            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+            && ((managedAidArgv.length === 4 && managedAidArgv[2] === 'lookup')
                 || (managedAidArgv.length === 5
                     && managedAidArgv[2] === 'agentmd'
                     && managedAidArgv[3] === 'get'));
+        const isSelfManagedAidShow = !!managedAidArgv
+            && managedAidArgv.length === 4
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'show'
+            && ownAid;
         const isSelfAgentMdPublish = !!managedAidArgv
             && managedAidArgv.length === 5
             && managedAidArgv[0] === 'ec'
@@ -2230,16 +2259,33 @@ export function evaluateToolPreflight(toolName, input, context) {
             && managedAidArgv[2] === 'agentmd'
             && managedAidArgv[3] === 'put'
             && ownAid;
+        const avatarFileIndex = managedAidArgv?.indexOf('--file') ?? -1;
+        const avatarUrlIndex = managedAidArgv?.indexOf('--url') ?? -1;
+        const avatarSourceIndex = avatarFileIndex >= 0 ? avatarFileIndex : avatarUrlIndex;
+        const isSelfAvatarUpload = !!managedAidArgv
+            && (avatarSourceIndex === 4)
+            && managedAidArgv.length === 6
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'avatar'
+            && !!context.selfAid
+            && managedAidArgv[3]?.replace(/^@/, '') === context.selfAid.replace(/^@/, '')
+            && !!managedAidArgv[5]
+            && !managedAidArgv[5].startsWith('-');
         const canPublishSelfAgentMd = isSelfAgentMdPublish
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
-        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        const canUploadSelfAvatar = isSelfAvatarUpload
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd || canUploadSelfAvatar;
         if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
                 message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
                     ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
-                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                    : isSelfAvatarUpload && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                        ? `🔒 ${context.permissionMode} 模式禁止上传头像；请切换到 request 或 bypass 后再执行 \`ec aid avatar <当前 self AID> (--file <path> 或 --url <https-url>)\`。`
+                        : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 及 `ec aid avatar` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put/avatar。',
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }

package/dist/core/session/adapters/codex-session-file-adapter.js

@@ -32,15 +32,20 @@ function loadSqlite() {
     return sqliteModule;
 }
 export class CodexSessionFileAdapter {
+    codexHome;
     baseagent = 'codex';
     db = null;
     dbInitialized = false;
+    rolloutPathCache = new Map();
+    constructor(codexHome = path.join(os.homedir(), '.codex')) {
+        this.codexHome = codexHome;
+    }
     /**
      * 动态发现最新的 state_*.sqlite 文件
      * Codex 使用 sqlx 迁移，DB 文件名含版本号（state_5, state_6, ...）
      */
     resolveStateDbPath() {
-        const codexHome = path.join(os.homedir(), '.codex');
+        const codexHome = this.codexHome;
         if (!fs.existsSync(codexHome))
             return null;
         try {
@@ -94,11 +99,71 @@ export class CodexSessionFileAdapter {
         //    SDK 创建的 thread 不写 state_*.sqlite，但会持久化到 sessions 目录
         return !!this.findRolloutFile(agentSessionId);
     }
+    /**
+     * A row in state_*.sqlite is created before the first turn is necessarily
+     * recoverable. Require the rollout to contain both its own session metadata
+     * and the exact turn_context before EvolCore publishes a new binding.
+     */
+    checkTurnPersisted(_projectPath, agentSessionId, turnId, _agentAid) {
+        const normalizedSessionId = agentSessionId.trim();
+        const normalizedTurnId = turnId.trim();
+        if (!normalizedSessionId || !normalizedTurnId)
+            return false;
+        let rolloutPath = null;
+        const db = this.getDb();
+        if (db) {
+            try {
+                const row = db.prepare('SELECT rollout_path FROM threads WHERE id = ? AND archived = 0').get(normalizedSessionId);
+                rolloutPath = this.resolveRolloutPath(row?.rollout_path, normalizedSessionId);
+            }
+            catch (error) {
+                logger.warn('[CodexAdapter] checkTurnPersisted DB query failed:', error);
+            }
+        }
+        rolloutPath ??= this.findRolloutFile(normalizedSessionId);
+        if (!rolloutPath)
+            return false;
+        try {
+            let hasMatchingSession = false;
+            let hasMatchingTurn = false;
+            const lines = fs.readFileSync(rolloutPath, 'utf-8').split('\n');
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const event = JSON.parse(line);
+                    if (event?.type === 'session_meta') {
+                        const persistedSessionId = event.payload?.session_id ?? event.payload?.id;
+                        const version = event.payload?.version ?? event.payload?.cli_version;
+                        const hasVersion = version !== undefined && version !== null && String(version).trim().length > 0;
+                        if (persistedSessionId === normalizedSessionId && hasVersion)
+                            hasMatchingSession = true;
+                    }
+                    else if (event?.type === 'turn_context' && event.payload?.turn_id === normalizedTurnId) {
+                        hasMatchingTurn = true;
+                    }
+                    if (hasMatchingSession && hasMatchingTurn)
+                        return true;
+                }
+                catch {
+                    // The last JSONL line may still be in flight; a later poll retries it.
+                }
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * 在 ~/.codex/sessions/ 下递归查找含 agentSessionId 的 rollout JSONL 文件
      */
     findRolloutFile(agentSessionId) {
-        const sessionsDir = path.join(os.homedir(), '.codex', 'sessions');
+        const cached = this.rolloutPathCache.get(agentSessionId);
+        if (cached && fs.existsSync(cached))
+            return cached;
+        this.rolloutPathCache.delete(agentSessionId);
+        const sessionsDir = path.join(this.codexHome, 'sessions');
         if (!fs.existsSync(sessionsDir))
             return null;
         try {
@@ -110,7 +175,9 @@ export class CodexSessionFileAdapter {
                             return found;
                     }
                     else if (entry.name.endsWith('.jsonl') && entry.name.includes(agentSessionId)) {
-                        return path.join(dir, entry.name);
+                        const rolloutPath = path.join(dir, entry.name);
+                        this.rolloutPathCache.set(agentSessionId, rolloutPath);
+                        return rolloutPath;
                     }
                 }
                 return null;
@@ -251,6 +318,7 @@ export class CodexSessionFileAdapter {
             this.db = null;
         }
         this.dbInitialized = false;
+        this.rolloutPathCache.clear();
     }
     /**
      * 从 rollout JSONL 读取第一条或最后一条 user_message

package/dist/core/session/session-manager.js

@@ -557,13 +557,29 @@ export class SessionManager {
             }
             const wasBound = !!normalizeBackendSessionId(current.agentSessionId);
             const next = JSON.parse(JSON.stringify(current));
+            const previousBaseagent = next.baseagent;
+            if (input.baseagent !== undefined) {
+                const requested = input.baseagent.trim();
+                if (!requested) {
+                    const error = new Error('backend rotation baseagent must be non-empty');
+                    error.code = 'BASEAGENT_REQUIRED';
+                    throw error;
+                }
+                next.baseagent = requested;
+            }
             next.agentSessionId = undefined;
             const nextMetadata = { ...(next.metadata ?? {}) };
             delete nextMetadata.resumeAt;
             delete nextMetadata.agentSessions;
             next.metadata = nextMetadata;
             this.persistConfirmedTopicBoundary(current, found, next);
-            return { status: 'rotated', sessionId: input.sessionId, wasBound };
+            return {
+                status: 'rotated',
+                sessionId: input.sessionId,
+                wasBound,
+                previousBaseagent,
+                baseagent: next.baseagent,
+            };
         });
     }
     /**
@@ -830,7 +846,10 @@ export class SessionManager {
         const sessionMetadata = { ...(metadata || {}) };
         sessionMetadata.__sessionCreatedAt = Date.now();
         const newIdentity = identity ?? this.resolveIdentity(channel, userId, chatType, identityConversationId);
-        const resolvedBaseagent = baseagent || 'claude';
+        const resolvedBaseagent = typeof baseagent === 'string' ? baseagent.trim() : '';
+        if (!resolvedBaseagent) {
+            throw new Error(`[SessionManager] getOrCreateSession: baseagent is empty for channel=${channel} channelId=${channelId}`);
+        }
         const session = {
             id: generateSessionId(),
             channel,
@@ -857,6 +876,7 @@ export class SessionManager {
             projectPath: defaultProjectPath,
             name: session.name,
             chatType: session.chatType,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;
@@ -868,9 +888,9 @@ export class SessionManager {
         if (!loaded)
             return;
         const { current } = loaded;
-        if (current.threadId && updates.baseagent !== undefined) {
-            const error = new Error('topic baseagent is immutable while backend rotation is managed');
-            error.code = 'TOPIC_BASEAGENT_IMMUTABLE';
+        if (updates.baseagent !== undefined) {
+            const error = new Error('session baseagent is immutable; use explicit agent switch or backend rotation');
+            error.code = 'BASEAGENT_IMMUTABLE';
             throw error;
         }
         if (current.threadId && Object.prototype.hasOwnProperty.call(updates, 'agentSessionId')) {
@@ -878,8 +898,6 @@ export class SessionManager {
             error.code = 'TOPIC_BACKEND_BINDING_PROTECTED';
             throw error;
         }
-        if (updates.baseagent !== undefined)
-            current.baseagent = updates.baseagent;
         if (updates.chatType !== undefined)
             current.chatType = updates.chatType;
         if (updates.name !== undefined)
@@ -988,7 +1006,7 @@ export class SessionManager {
         const mainActive = readJsonFile(path.join(chatDir, 'active.json'));
         // 兼容旧字段名
         const mainBaseagent = mainActive?.baseagent || mainActive?.agentType;
-        const inheritedBaseagent = baseagent || mainBaseagent;
+        const inheritedBaseagent = mainBaseagent || baseagent;
         if (!inheritedBaseagent) {
             throw new Error('[SessionManager] getOrCreateThreadSession: baseagent is empty');
         }
@@ -1022,6 +1040,7 @@ export class SessionManager {
             channelId,
             projectPath,
             name: session.name,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;
@@ -1072,6 +1091,7 @@ export class SessionManager {
             channelId,
             projectPath: newProjectPath,
             name: session.name,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;
@@ -1180,6 +1200,7 @@ export class SessionManager {
             channelId,
             projectPath,
             name: session.name,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;
@@ -1428,7 +1449,7 @@ export class SessionManager {
             }
         }
     }
-    async createNewSession(channel, channelId, projectPath, name, baseagent, identityMetadata) {
+    async createNewSession(channel, channelId, projectPath, name, baseagent, identityMetadata, eventMetadata) {
         const inheritedChatType = this.getActiveChatType(channel, channelId);
         // Derive selfAID and channelType from existing sessions
         const existingDir = this.findExistingChatDir(channel, channelId);
@@ -1480,6 +1501,8 @@ export class SessionManager {
             channelId,
             projectPath,
             name: session.name,
+            baseagent: session.baseagent,
+            ...eventMetadata,
             timestamp: Date.now(),
         });
         return session;
@@ -1527,6 +1550,7 @@ export class SessionManager {
             channelId: sourceSession.channelId,
             projectPath: sourceSession.projectPath,
             name: session.name,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;
@@ -1602,6 +1626,7 @@ export class SessionManager {
             name: session.name,
             chatType: session.chatType,
             threadId: session.threadId,
+            baseagent: session.baseagent,
             timestamp: now,
         });
         return session;
@@ -1624,7 +1649,7 @@ export class SessionManager {
             selfAID: sourceSession.selfAID,
             projectPath: sourceSession.projectPath,
             threadId: '',
-            baseagent: sourceSession.baseagent,
+            baseagent: context?.baseagent || sourceSession.baseagent,
             sessionKey: formatSessionKey(sourceSession.channelType || sourceSession.channel, sourceSession.channelId, DEFAULT_THREAD_ID),
             chatType: sourceSession.chatType || 'private',
             metadata,
@@ -1642,6 +1667,7 @@ export class SessionManager {
             projectPath: session.projectPath,
             name: session.name,
             chatType: session.chatType,
+            baseagent: session.baseagent,
             cause: 'renew',
             sourceSessionId: sourceSession.id,
             renewSource: context?.source,
@@ -1684,6 +1710,12 @@ export class SessionManager {
             return false;
         return adapter.checkExists(projectPath, agentSessionId, agentAid);
     }
+    checkSessionTurnPersisted(projectPath, agentSessionId, baseagent, turnId, agentAid) {
+        const adapter = this.getFileAdapter(baseagent);
+        if (!adapter?.checkTurnPersisted)
+            return false;
+        return adapter.checkTurnPersisted(projectPath, agentSessionId, turnId, agentAid);
+    }
     readSessionFirstMessage(projectPath, agentSessionId, baseagent, agentAid) {
         const adapter = this.getFileAdapter(baseagent);
         if (!adapter)
@@ -1725,10 +1757,13 @@ export class SessionManager {
         }
         return matched[0];
     }
-    async importCliSession(channel, channelId, projectPath, agentSessionId, baseagent = 'claude', agentAid) {
+    async importCliSession(channel, channelId, projectPath, agentSessionId, baseagent, agentAid) {
+        const resolvedBaseagent = typeof baseagent === 'string' ? baseagent.trim() : '';
+        if (!resolvedBaseagent)
+            throw new Error('[SessionManager] importCliSession: baseagent is required');
         const inheritedChatType = this.getActiveChatType(channel, channelId);
         const resolvedAgentAid = agentAid || this.deriveChannelIdentity(channel, channelId).selfAID;
-        const fileInfo = this.getSessionFileInfo(projectPath, agentSessionId, baseagent, resolvedAgentAid);
+        const fileInfo = this.getSessionFileInfo(projectPath, agentSessionId, resolvedBaseagent, resolvedAgentAid);
         const name = fileInfo.title || `CLI会话-${new Date().toLocaleString('zh-CN', { month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit' })}`;
         // Derive selfAID and channelType from existing sessions
         const existingDir = this.findExistingChatDir(channel, channelId);
@@ -1750,7 +1785,7 @@ export class SessionManager {
             selfAID,
             projectPath,
             threadId: '',
-            baseagent,
+            baseagent: resolvedBaseagent,
             sessionKey: formatSessionKey(channelType, channelId, DEFAULT_THREAD_ID),
             chatType: inheritedChatType,
             agentSessionId,
@@ -1767,6 +1802,7 @@ export class SessionManager {
             channelId,
             projectPath,
             name,
+            baseagent: session.baseagent,
             timestamp: Date.now(),
         });
         return session;

package/dist/core/session/session-renew.js

@@ -191,6 +191,7 @@ export class SessionRenewService {
             ? await this.sessionManager.createRenewedSession(request.session, {
                 source,
                 causation: request.causation,
+                baseagent: request.currentBaseagent,
             })
             : request.session;
         selected.identity = request.session.identity;