evolcore 0.0.23 → 0.0.25

package/dist/agents/ecagent-runner.js

@@ -18,14 +18,21 @@ import { appendRequestPath } from './request-identity.js';
 import { getManagedTaskTempDir } from '../cli/task-context.js';
 import { hasTrustedFullAccessContext } from './runner-types.js';
 const PROVIDER_ID = 'evolcore-gateway';
-const DEFAULT_SYSTEM_PROMPT = `You are ecagent, the coding agent built into EvolCore.
-Work directly in the current project. Inspect relevant files before changing them, keep edits scoped, and verify the result.
+const DEFAULT_SYSTEM_PROMPT = `You are ecagent, the coding agent built into EvolCore.
+Work directly in the current project. Inspect relevant files before changing them, keep edits scoped, and verify the result.
 Use the provided tools for filesystem and shell work. Never claim a tool action succeeded unless its result confirms success.`;
 const MAX_READ_BYTES = 1024 * 1024;
 const MAX_TOOL_OUTPUT = 200_000;
 const MAX_SCAN_FILES = 5_000;
 const MAX_SEARCH_RESULTS = 500;
 const DEFAULT_BASH_TIMEOUT_MS = 120_000;
+/**
+ * 规范化模型 ID：去掉 Claude Code SDK 专有的上下文窗口后缀 [1m]/[200k]
+ * Ecagent/OpenAI API 不认识这些后缀，必须传入标准模型 ID
+ */
+function stripContextWindowSuffix(modelId) {
+    return modelId.replace(/\[(?:1m|200k)\]$/i, '');
+}
 class AsyncEventQueue {
     values = [];
     waiters = [];
@@ -461,26 +468,27 @@ function isWithin(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false) {
+export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
     const root = fs.realpathSync(projectPath);
     const resolved = path.resolve(root, candidate || '.');
     const allowedBootstrapFile = bootstrapAgentMdPath
         ? path.resolve(bootstrapAgentMdPath)
         : undefined;
-    const isBootstrapAgentMd = allowedBootstrapFile === resolved;
-    if (!fullaccess && !isWithin(root, resolved) && !isBootstrapAgentMd) {
+    const allowedPersonalFile = personalMdPath ? path.resolve(personalMdPath) : undefined;
+    const isManagedIdentityFile = resolved === allowedBootstrapFile || resolved === allowedPersonalFile;
+    if (!fullaccess && !isWithin(root, resolved) && !isManagedIdentityFile) {
         throw new Error(`Path is outside the project: ${candidate}`);
     }
-    if (isBootstrapAgentMd) {
+    if (isManagedIdentityFile) {
         const parent = path.dirname(resolved);
         const canonicalParent = fs.realpathSync(parent);
         if (!isWithin(parent, canonicalParent) || !isWithin(canonicalParent, parent)) {
-            throw new Error(`Bootstrap agent.md parent resolves outside its declared path: ${candidate}`);
+            throw new Error(`Managed identity file parent resolves outside its declared path: ${candidate}`);
         }
         if (fs.existsSync(resolved)) {
             const canonicalFile = fs.realpathSync(resolved);
             if (!isWithin(resolved, canonicalFile) || !isWithin(canonicalFile, resolved)) {
-                throw new Error(`Bootstrap agent.md resolves outside its declared path: ${candidate}`);
+                throw new Error(`Managed identity file resolves outside its declared path: ${candidate}`);
             }
         }
         return resolved;
@@ -543,7 +551,7 @@ async function walkFiles(root, signal) {
 function textResult(text, details = {}) {
     return { content: [{ type: 'text', text: truncate(text) }], details };
 }
-function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false) {
+function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
     const read = {
         name: 'Read', label: 'Read', description: 'Read a UTF-8 text file from the project.',
         parameters: Type.Object({
@@ -552,7 +560,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             limit: Type.Optional(Type.Number({ minimum: 1 })),
         }),
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
             const stat = await fs.promises.stat(file);
             if (stat.size > MAX_READ_BYTES)
                 throw new Error(`File exceeds ${MAX_READ_BYTES} byte read limit`);
@@ -618,7 +626,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
         name: 'Write', label: 'Write', description: 'Create or completely overwrite a project file.',
         parameters: Type.Object({ file_path: Type.String(), content: Type.String() }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath);
             await fs.promises.mkdir(path.dirname(file), { recursive: true });
             await fs.promises.writeFile(file, params.content, { encoding: 'utf8', signal });
             return textResult(`Wrote ${Buffer.byteLength(params.content)} bytes to ${path.relative(projectPath, file)}`, { file });
@@ -631,7 +639,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             replace_all: Type.Optional(Type.Boolean()),
         }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
             const value = await fs.promises.readFile(file, { encoding: 'utf8', signal });
             if (!params.old_string)
                 throw new Error('old_string must not be empty');
@@ -714,7 +722,7 @@ export class EcagentRunner {
                 configuredHeaders: config.headers,
             }),
         };
-        this.model = config.model;
+        this.model = stripContextWindowSuffix(config.model);
         this.effort = config.effort;
         this.agentAid = runtime?.agentAid;
         this.onSessionIdUpdate = callbacks?.onSessionIdUpdate;
@@ -724,7 +732,7 @@ export class EcagentRunner {
             throw new Error('ecagent requires an EvolCore Agent AID');
         return agentSessionsDir(this.agentAid);
     }
-    setModel(model) { this.model = model; }
+    setModel(model) { this.model = stripContextWindowSuffix(model); }
     getModel() { return this.model; }
     resolveModelId(model) { return model; }
     setEffort(effort) { this.effort = effort; }
@@ -851,7 +859,7 @@ export class EcagentRunner {
                 models,
                 model,
                 thinkingLevel: normalizeThinkingLevel(effort),
-                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess),
+                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess, request.modelOverride?.personalMdPath),
                 systemPrompt: [DEFAULT_SYSTEM_PROMPT, request.systemPromptAppend].filter(Boolean).join('\n\n'),
                 streamOptions: {
                     timeoutMs: this.config.timeoutMs,
@@ -995,6 +1003,13 @@ export class EcagentRunner {
         return runtime;
     }
     mapHarnessEvent(queue, event, stats, model, effort) {
+        if (event.type === 'message_update'
+            && (event.assistantMessageEvent.type === 'thinking_start'
+                || event.assistantMessageEvent.type === 'thinking_delta'
+                || event.assistantMessageEvent.type === 'thinking_end')) {
+            queue.push({ type: 'heartbeat', source: 'reasoning', turn: stats.numTurns + 1 });
+            return;
+        }
         if (event.type === 'message_update' && event.assistantMessageEvent.type === 'text_delta') {
             if (!stats.firstTextAt)
                 stats.firstTextAt = Date.now();
@@ -1202,7 +1217,7 @@ export class EcagentRunner {
                 ? cached
                 : await this.openExistingRuntime(agentSessionId, cwd);
             this.onCompactStart?.(sessionId);
-            const compactModel = modelOverride?.model || this.model;
+            const compactModel = stripContextWindowSuffix(modelOverride?.model || this.model);
             const compactEffort = modelOverride?.effortMode === 'model_default'
                 ? undefined
                 : modelOverride?.effort ?? this.effort;

package/dist/agents/gemini-runner.js

@@ -24,6 +24,7 @@ import { normalizeExecutionPermissionMode, normalizePermissionMode } from '../co
 import { workspaceContainsHClassPaths } from '../core/permission/protected-paths.js';
 import { buildBubblewrapCommand } from '../core/permission/sandbox-runtime.js';
 import { getManagedTaskTempDir } from '../cli/task-context.js';
+import { auditPermissionLifecycle } from '../core/auth/authorization-audit.js';
 // Strip ANSI escape codes from Gemini CLI text output.
 // Gemini embeds raw terminal colors from tool stdout (e.g. vitest, npm)
 // into its assistant text, unlike Claude SDK which strips them internally.
@@ -32,6 +33,13 @@ const ANSI_RE = /\x1b\[[0-9;]*[a-zA-Z]|\x1b\].*?(?:\x1b\\|\x07)/g;
 function stripAnsi(text) {
     return text.replace(ANSI_RE, '');
 }
+/**
+ * 规范化模型 ID：去掉 Claude Code SDK 专有的上下文窗口后缀 [1m]/[200k]
+ * Gemini API 不认识这些后缀，必须传入标准模型 ID
+ */
+function stripContextWindowSuffix(modelId) {
+    return modelId.replace(/\[(?:1m|200k)\]$/i, '');
+}
 // ── MIME → 扩展名映射 ──
 const MIME_EXT = {
     'image/png': '.png',
@@ -139,6 +147,7 @@ const GEMINI_EC_COMMAND_PATTERNS = [
     // quoted arguments.
     String.raw `\x00"command":"[ ]*ec[ ]+(?:[^"\x00;&|$()<>\x60\r\n\\]|\\(?:\\|"))*"\x00`,
 ];
+const GEMINI_BOOTSTRAP_PERSONA_COMMAND_PATTERN = String.raw `^\{\x00"command":"[ ]*ec[ ]+agent[ ]+persona(?:[ ]+show|[ ]+--(?:text|file)[ ]+(?:[^"\x00;&|$()<>\x60\r\n\\]|\\(?:\\|"))+)[ ]*"\x00\}$`;
 export function resolveGeminiPermissionProfile(value, bootstrap = false) {
     if (value === 'fullaccess')
         return { mode: 'fullaccess', approvalMode: 'yolo' };
@@ -178,6 +187,9 @@ function geminiExactShellCommandPattern(command) {
     // is_background or additional_permissions during bootstrap.
     return `^\\{\\x00"command":"[ ]*${escapeGeminiArgsRegex(command)}[ ]*"\\x00\\}$`;
 }
+function geminiManagedIdentityPathPattern(filePath) {
+    return geminiJsonFieldEqualsPattern(['file_path'], path.resolve(filePath));
+}
 function appendGeminiPolicyRule(lines, toolName, decision, priority, argsPattern) {
     lines.push('[[rule]]');
     lines.push(`toolName = ${Array.isArray(toolName) ? JSON.stringify(toolName) : JSON.stringify(toolName)}`);
@@ -186,7 +198,7 @@ function appendGeminiPolicyRule(lines, toolName, decision, priority, argsPattern
     lines.push(`decision = "${decision}"`);
     lines.push(`priority = ${priority}`, '');
 }
-export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath) {
+export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath, personalMdPath) {
     const lines = [];
     if (bootstrapAgentMdPath) {
         const bootstrap = normalizeGeminiBootstrapAgentMdPath(bootstrapAgentMdPath);
@@ -204,6 +216,12 @@ export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath) {
         appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_FILE_TOOLS, 'allow', 990, writePathPattern);
         appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec aid agentmd put ${bootstrap.aid}`));
         appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, geminiExactShellCommandPattern(`ec agent ready ${bootstrap.aid}`));
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 990, GEMINI_BOOTSTRAP_PERSONA_COMMAND_PATTERN);
+        if (personalMdPath) {
+            const personalPathPattern = geminiManagedIdentityPathPattern(personalMdPath);
+            appendGeminiPolicyRule(lines, 'read_file', 'allow', 989, personalPathPattern);
+            appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_FILE_TOOLS, 'allow', 989, personalPathPattern);
+        }
         // These are Gemini's non-I/O task bookkeeping tools. They do not expose
         // project files, shell, network, MCP, or user-interaction capabilities.
         appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_LIFECYCLE_TOOLS, 'allow', 950);
@@ -223,6 +241,11 @@ export function buildGeminiAdminPolicy(profile, bootstrapAgentMdPath) {
     for (const pattern of GEMINI_L_CLASS_PATTERNS) {
         appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 997, pattern);
     }
+    if (personalMdPath) {
+        const personalPathPattern = geminiManagedIdentityPathPattern(personalMdPath);
+        appendGeminiPolicyRule(lines, 'read_file', 'allow', 989, personalPathPattern);
+        appendGeminiPolicyRule(lines, GEMINI_BOOTSTRAP_FILE_TOOLS, 'allow', 989, personalPathPattern);
+    }
     if (profile.mode === 'readonly') {
         appendGeminiPolicyRule(lines, GEMINI_READONLY_TOOLS, 'allow', 950);
         appendGeminiPolicyRule(lines, '*', 'deny', 900);
@@ -286,11 +309,11 @@ export class GeminiRunner {
     permissionContexts = new Map();
     constructor(config, callbacks) {
         this.resolved = resolveGoogleConfig(config);
-        this.model = this.resolved.model;
+        this.model = stripContextWindowSuffix(this.resolved.model);
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
     }
     // ── ModelSwitcher ──
-    setModel(model) { this.model = model; }
+    setModel(model) { this.model = stripContextWindowSuffix(model); }
     getModel() { return this.model; }
     async listModels() { const catalog = await getCatalog(undefined, 'gemini'); assertCatalogSelectable(catalog); return catalog.models.map(m => m.id); }
     // ── Effort (not applicable) ──
@@ -357,6 +380,9 @@ export class GeminiRunner {
         const bootstrapAgentMdPath = modelOverride?.bootstrapAgentMdPath
             ? normalizeGeminiBootstrapAgentMdPath(modelOverride.bootstrapAgentMdPath).filePath
             : undefined;
+        const personalMdPath = modelOverride?.personalMdPath
+            ? path.resolve(modelOverride.personalMdPath)
+            : undefined;
         const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode, !!bootstrapAgentMdPath);
         const callModel = modelOverride?.model || this.model;
         const managedTaskTmpDir = getManagedTaskTempDir(runtimeEnv);
@@ -374,6 +400,7 @@ export class GeminiRunner {
                 ...(runtimeDir ? [runtimeDir] : []),
                 ...(runtimeLockDir ? [runtimeLockDir] : []),
                 ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+                ...(personalMdPath ? [personalMdPath] : []),
             ],
         });
         if (executionPermissionMode !== 'fullaccess' && !sandboxProbe && workspaceContainsHClassPaths(projectPath)) {
@@ -402,7 +429,7 @@ export class GeminiRunner {
             }
             else {
                 const policyPath = path.join(managedTmpDir, `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
-                fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile, bootstrapAgentMdPath), { mode: 0o600, flag: 'wx' });
+                fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile, bootstrapAgentMdPath, personalMdPath), { mode: 0o600, flag: 'wx' });
                 tempFiles.push(policyPath);
                 args.push(...buildGeminiPermissionArgs(permissionProfile, policyPath, !!sandboxProbe));
             }
@@ -444,6 +471,7 @@ export class GeminiRunner {
                 ...(runtimeDir ? [runtimeDir] : []),
                 ...(runtimeLockDir ? [runtimeLockDir] : []),
                 ...(bootstrapAgentMdPath ? [bootstrapAgentMdPath] : []),
+                ...(personalMdPath ? [personalMdPath] : []),
             ],
             readonlyPaths: tempFiles,
         });
@@ -687,6 +715,56 @@ export class GeminiRunner {
             logger.info(`[GeminiRunner] interaction.auto_resolved kind=${normalizeGeminiToolName(toolName)} session=${sessionId}`);
             return;
         }
+        const lifecycleRequestId = requestId ?? `gemini-approval-${crypto.randomUUID()}`;
+        const auditSummary = `${toolName} runtime authorization denied by Gemini headless policy`;
+        auditPermissionLifecycle({
+            phase: 'request',
+            requestId: lifecycleRequestId,
+            sessionId,
+            toolName,
+            decision: 'pending',
+            decisionSource: 'approval',
+            permissionMode: context.permissionMode,
+            agentAid: context.selfAid,
+            agentName: context.agentName,
+            role: context.role,
+            taskId: context.taskId,
+            summary: auditSummary,
+        });
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId: lifecycleRequestId,
+            sessionId,
+            toolName,
+            decision: 'deny',
+            decisionSource: 'policy',
+            policyCode: 'permission_mode_denied',
+            reason: auditSummary,
+            permissionMode: context.permissionMode,
+            agentAid: context.selfAid,
+            agentName: context.agentName,
+            role: context.role,
+            taskId: context.taskId,
+            summary: auditSummary,
+            response: 'deny',
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId: lifecycleRequestId,
+            sessionId,
+            toolName,
+            decision: 'deny',
+            decisionSource: 'policy',
+            policyCode: 'permission_mode_denied',
+            reason: auditSummary,
+            permissionMode: context.permissionMode,
+            agentAid: context.selfAid,
+            agentName: context.agentName,
+            role: context.role,
+            taskId: context.taskId,
+            summary: auditSummary,
+            response: 'deny',
+        });
         try {
             await context.recordExecutionAnomaly?.({
                 code: 'runtime_permission_denied',

package/dist/agents/runner-types.js

@@ -63,7 +63,7 @@ export function usageForContext(usage) {
     return lastIteration ?? usage;
 }
 /** Models whose base ID uses a 1M context window when sent to the SDK with [1m]. */
-export const ONE_M_CONTEXT_MODEL_PREFIXES = ['claude-opus-4-8', 'claude-sonnet-4-6'];
+export const ONE_M_CONTEXT_MODEL_PREFIXES = ['claude-opus-5', 'claude-opus-4-8', 'claude-sonnet-4-6'];
 const ONE_M_CONTEXT_MODEL_ALIASES = ['opus', 'sonnet'];
 const CLAUDE_CONTEXT_MODEL_ALIASES = ['opus', 'sonnet', 'haiku'];
 export function isClaudeContextUsageModel(model) {

package/dist/aun/aid/agentmd.js

@@ -4,6 +4,51 @@ import { parseDocument } from 'yaml';
 import { getAidStore, loadAid, SLOT } from './store.js';
 import { agentMdPath, aidLocalDir, resolveRoot } from '../../paths.js';
 export const DEFAULT_AGENT_DESCRIPTION = 'EvolCore AI agent.';
+export const AGENT_TAG_MIN_COUNT = 3;
+export const AGENT_TAG_MAX_COUNT = 6;
+export const AGENT_TAG_MAX_LENGTH = 50;
+const AGENT_TAG_PATTERN = /^[\p{L}\p{N}]+$/u;
+/** Return a human-readable validation error for one tag, or null when valid. */
+export function validateAgentTag(tag) {
+    if (typeof tag !== 'string' || !tag.trim())
+        return 'must be a non-empty string';
+    const normalized = tag.trim();
+    if (Array.from(normalized).length > AGENT_TAG_MAX_LENGTH) {
+        return `must be at most ${AGENT_TAG_MAX_LENGTH} characters`;
+    }
+    if (!AGENT_TAG_PATTERN.test(normalized)) {
+        return 'must contain only Unicode letters and numbers';
+    }
+    return null;
+}
+/**
+ * Validate an agent.md tags value. Count constraints are optional because
+ * existing published agent.md files may contain fewer than three tags.
+ */
+export function validateAgentTags(tags, options = {}) {
+    if (!Array.isArray(tags))
+        return ['must be an array of strings'];
+    const errors = [];
+    const normalized = new Set();
+    tags.forEach((tag, index) => {
+        const error = validateAgentTag(tag);
+        if (error) {
+            errors.push(`tag ${index + 1} ${error}`);
+            return;
+        }
+        const value = tag.trim();
+        normalized.add(value);
+    });
+    const minCount = options.minCount;
+    const maxCount = options.maxCount;
+    if (minCount !== undefined && normalized.size < minCount) {
+        errors.push(`must contain at least ${minCount} unique tags`);
+    }
+    if (maxCount !== undefined && normalized.size > maxCount) {
+        errors.push(`must contain at most ${maxCount} unique tags`);
+    }
+    return errors;
+}
 const displayNameCache = new Map();
 const displayNamePending = new Map();
 const displayNameRevision = new Map();
@@ -87,7 +132,12 @@ export function buildInitialAgentMd(opts) {
     const agentName = opts.name?.trim() || opts.aid.split('.')[0];
     const agentType = opts.type || 'ai';
     const description = opts.description?.trim() || DEFAULT_AGENT_DESCRIPTION;
-    return `---\naid: ${yamlDoubleQuote(opts.aid)}\nname: ${yamlDoubleQuote(agentName)}\ntype: ${yamlDoubleQuote(agentType)}\nversion: "1.0.0"\ndescription: ${yamlDoubleQuote(description)}\ntags:\n  - evolcore\n---\n`;
+    const rawTags = opts.tags?.length ? opts.tags : ['evolcore'];
+    const tagErrors = validateAgentTags(rawTags);
+    if (tagErrors.length > 0)
+        throw new Error(`Invalid agent.md tags: ${tagErrors.join('; ')}`);
+    const tags = [...new Set(rawTags.map(tag => tag.trim()))];
+    return `---\naid: ${yamlDoubleQuote(opts.aid)}\nname: ${yamlDoubleQuote(agentName)}\ntype: ${yamlDoubleQuote(agentType)}\nversion: "1.0.0"\ndescription: ${yamlDoubleQuote(description)}\ntags:\n${tags.map(tag => `  - ${yamlDoubleQuote(tag)}\n`).join('')}---\n`;
 }
 function ensureTrailingNewline(content) {
     return content.endsWith('\n') ? content : `${content}\n`;
@@ -145,9 +195,11 @@ export function validateAgentMdFrontmatter(content, expectedAid) {
     if (description && description.length > 100) {
         errors.push('agent.md frontmatter description must be at most 100 characters');
     }
-    if (values.tags !== undefined && (!Array.isArray(values.tags)
-        || values.tags.some(tag => typeof tag !== 'string' || !tag.trim()))) {
-        errors.push('agent.md frontmatter tags must be an array of non-empty strings');
+    if (values.tags !== undefined) {
+        const tagErrors = validateAgentTags(values.tags);
+        if (tagErrors.length > 0) {
+            errors.push(`agent.md frontmatter tags ${tagErrors.join('; ')}`);
+        }
     }
     return { valid: errors.length === 0, errors };
 }

package/dist/aun/aid/index.js

@@ -1,3 +1,4 @@
+export { AGENT_TAG_MIN_COUNT, AGENT_TAG_MAX_COUNT, AGENT_TAG_MAX_LENGTH, validateAgentTag, validateAgentTags, } from './agentmd.js';
 export { isValidAid, aidList, aidListVerified, aidCreate, aidShow, aidDelete, aidLookup, verifySignAbility, probePkiRecoverability, appendAidLifecycle, readAidLifecycle } from './identity.js';
 export { DEFAULT_AGENT_DESCRIPTION, buildInitialAgentMd, validateAgentMdFrontmatter, agentmdGet, agentmdPut, agentmdSync, invalidateAgentDisplayName, parseAgentDisplayName, refreshAgentDisplayName, resolveAgentDisplayName, stripAgentMdSignature, updateAgentMdFrontmatterAvatar, updateAgentMdFrontmatterName, } from './agentmd.js';
 export { MIN_AUN_CORE_SDK, AUN_CORE_SDK_PKG, isAunSdkVersionOk, resolveAunCoreSdkPkg, ensureAunSdk, isAunSdkReady, downloadCaRoot, suppressSdkLogs, } from './client.js';

package/dist/aun/aid/managed-operation.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { resolveRoot } from '../../paths.js';
 import { agentmdGet, agentmdPut } from './agentmd.js';
+import { uploadAvatarBuffer, uploadAvatarUrl } from '../../utils/avatar-upload.js';
 import { aidLookup, aidShow } from './identity.js';
 import { isValidAid } from './validation.js';
 export class ManagedAidOperationError extends Error {
@@ -28,13 +29,42 @@ function parseAid(value) {
         return { ok: false, code: 'INVALID_AID', reason: `invalid AID: ${aid}` };
     return { ok: true, aid };
 }
+function parseAvatar(args) {
+    const aidResult = parseAid(args[1]);
+    if (!aidResult.ok)
+        return aidResult;
+    const sourceFlag = args[2];
+    const sourceValue = args[3];
+    if (sourceFlag !== '--file' && sourceFlag !== '--url') {
+        return { ok: false, code: 'INVALID_ARGUMENT', reason: 'avatar requires exactly one of --file <path> or --url <https-url>' };
+    }
+    if (!sourceValue || sourceValue.startsWith('-')) {
+        return { ok: false, code: 'INVALID_ARGUMENT', reason: `${sourceFlag} requires a non-empty value` };
+    }
+    if (args.length !== 4 && !(args.length === 6 && args[4] === '--format' && args[5] === 'json')) {
+        return { ok: false, code: 'NOT_ALLOWED', reason: 'avatar only supports an optional --format json suffix' };
+    }
+    return {
+        ok: true,
+        command: {
+            kind: 'avatar',
+            aid: aidResult.aid,
+            ...(sourceFlag === '--file' ? { filePath: sourceValue } : { url: sourceValue }),
+            operationId: 'ec.aid.avatar',
+            canonicalArgv: ['aid', 'avatar', aidResult.aid, sourceFlag, sourceValue],
+        },
+    };
+}
 /**
- * The daemon accepts only the self-scoped AID commands exposed to managed
- * tasks. Parsing here is deliberately narrower than the standalone CLI.
+ * The daemon accepts only the narrowly scoped AID commands exposed to managed
+ * tasks. Public lookup/get may name any valid AID; local show/publish remain
+ * subject to the self-AID boundary enforced by the command handler.
  */
 export function resolveManagedAidOperation(argv) {
     const args = argv[0] === 'aid' ? argv.slice(1) : argv;
     const subcommand = args[0];
+    if (subcommand === 'avatar')
+        return parseAvatar(args);
     if ((subcommand === 'show' || subcommand === 'lookup') && hasOnlyOptionalJsonFormat(args, 1)) {
         const parsedAid = parseAid(args[1]);
         if (!parsedAid.ok)
@@ -67,7 +97,21 @@ export function resolveManagedAidOperation(argv) {
     return {
         ok: false,
         code: 'NOT_ALLOWED',
-        reason: 'Managed AID operations only allow exact self-scoped show, lookup, agentmd get, or agentmd put commands with an optional --format json suffix',
+        reason: 'Managed AID operations only allow exact show, lookup, agentmd get, agentmd put, or avatar commands with supported options',
+    };
+}
+export function managedAidShowViewForRole(role) {
+    return role === 'owner' || role === 'admin' ? 'full' : 'redacted';
+}
+export function redactAidShowResult(value) {
+    return {
+        aid: value.aid,
+        redacted: true,
+        hasAgentMd: value.hasAgentMd,
+        certExpiresAt: value.certExpiresAt,
+        certSubject: value.certSubject,
+        certExpired: value.certExpired,
+        agentMdSignature: value.agentMdSignature,
     };
 }
 const defaultDependencies = () => ({
@@ -78,14 +122,23 @@ const defaultDependencies = () => ({
     agentmdPut,
     existsSync: fs.existsSync,
     readFileSync: fs.readFileSync,
+    uploadAvatarBuffer,
+    uploadAvatarUrl,
 });
 /** Execute a validated AID operation from the daemon-owned host filesystem. */
-export async function executeManagedAidOperation(command, overrides = {}) {
+export async function executeManagedAidOperation(command, options = {}) {
+    const { showView = 'full', ...overrides } = options;
     const deps = { ...defaultDependencies(), ...overrides };
     const aunPath = deps.root;
     switch (command.kind) {
-        case 'show':
-            return { kind: command.kind, aid: command.aid, value: await deps.aidShow(command.aid, { aunPath }) };
+        case 'show': {
+            const value = await deps.aidShow(command.aid, { aunPath });
+            return {
+                kind: command.kind,
+                aid: command.aid,
+                value: showView === 'redacted' ? redactAidShowResult(value) : value,
+            };
+        }
         case 'lookup':
             return { kind: command.kind, aid: command.aid, value: await deps.aidLookup(command.aid) };
         case 'agentmd.get':
@@ -103,5 +156,26 @@ export async function executeManagedAidOperation(command, overrides = {}) {
             await deps.agentmdPut(content, { aid: command.aid, aunPath });
             return { kind: command.kind, aid: command.aid, path: localPath };
         }
+        case 'avatar': {
+            const result = command.url
+                ? await deps.uploadAvatarUrl(command.aid, command.url, { aunPath })
+                : await deps.uploadAvatarBuffer(command.aid, options.avatarBuffer ?? deps.readFileSync(command.filePath), { aunPath });
+            if (!result.ok) {
+                throw new ManagedAidOperationError(result.code ?? 'UPLOAD_FAILED', result.error ?? 'avatar upload failed');
+            }
+            return {
+                kind: 'avatar',
+                aid: command.aid,
+                avatar: result.publicUrl,
+                objectKey: result.objectKey,
+                sha256: result.sha256,
+                mime: result.mime,
+                width: result.width,
+                height: result.height,
+                aspectRatio: result.aspectRatio,
+            };
+        }
+        default:
+            throw new ManagedAidOperationError('NOT_ALLOWED', `Unsupported managed AID operation: ${command.kind}`);
     }
 }

package/dist/aun/aid/store.js

@@ -7,6 +7,7 @@ import { AUN_KEYSTORE_ENCRYPTION_SEED } from './encryption-seed-policy.js';
 // pages so a large backlog is drained without monopolizing the sync loop.
 const FULL_GROUP_PULL_MAX_PAGES = 10;
 const GROUP_PULL_PAGINATION_PATCH = Symbol('evolcore.groupPullPaginationPatch');
+const RELIABLE_MESSAGE_DELIVERY_PATCH = Symbol('evolcore.reliableMessageDeliveryPatch');
 /**
  * Slot 命名约定（基于 fastaun 0.4.3 隔离键语义）。
  *
@@ -106,6 +107,46 @@ export function enableFullGroupPullPagination(client) {
     target._pullGroupV2 = wrappedPull;
     return true;
 }
+/**
+ * Make SDK pull delivery wait until EvolCore's application handlers finish.
+ *
+ * fastaun 0.5.13 publishes message events with dispatcher.enqueue(), then
+ * advances its sequence tracker immediately.  That is a transport watermark,
+ * so a daemon restart can acknowledge a message before the application has
+ * durably claimed it.  The SDK keeps _publishAppEvent private, but the public
+ * client is intentionally adapted here in one place: preserve the SDK's
+ * normal publication path and wait for its dispatcher queue for pulled
+ * message events before the pull operation commits the sequence.
+ */
+export function enableReliableMessageDelivery(client) {
+    const target = client;
+    if (target[RELIABLE_MESSAGE_DELIVERY_PATCH])
+        return false;
+    const publish = target._publishAppEvent;
+    const dispatcher = target._dispatcher;
+    if (typeof publish !== 'function' || !dispatcher || typeof dispatcher.flush !== 'function')
+        return false;
+    const wrappedPublish = async function (event, payload, source, ...rest) {
+        const result = await publish.call(this, event, payload, source, ...rest);
+        // Pull/recovery paths must not advance SeqTracker until the application
+        // handlers have completed. Push delivery has no pull commit to gate and
+        // remains asynchronous as intended by the SDK.
+        const reliable = (event === 'message.received' || event === 'group.message_created')
+            && source !== 'push'
+            && source !== 'inline-push';
+        if (reliable)
+            await dispatcher.flush();
+        return result;
+    };
+    Object.defineProperty(target, RELIABLE_MESSAGE_DELIVERY_PATCH, {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false,
+    });
+    target._publishAppEvent = wrappedPublish;
+    return true;
+}
 /** 加载本地 AID 值对象（用于离线签名/验签，无需连接）。load 失败抛 AidLoadError。 */
 export function loadAid(store, aid) {
     const r = store.load(aid);

package/dist/aun/msg/managed-operation.js

@@ -797,7 +797,12 @@ export function resolveManagedFsOperation(argv) {
         const destination = remoteOrError(positionals[1]);
         if (!('groupId' in destination))
             return destination;
-        const source = positionals[0].includes(':') ? remoteOrError(positionals[0]) : undefined;
+        // Windows absolute paths contain a drive-letter colon, but are local
+        // upload sources rather than managed group references.
+        const isWindowsAbsolutePath = /^[A-Za-z]:[\\/]/.test(positionals[0]);
+        const source = positionals[0].includes(':') && !isWindowsAbsolutePath
+            ? remoteOrError(positionals[0])
+            : undefined;
         if (source && !('groupId' in source))
             return source;
         if (source && source.groupId !== destination.groupId)