evolcore 0.0.25 → 0.0.26

package/dist/core/model/catalog-service.js

@@ -3,11 +3,21 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { appendRequestPath, appendV1RequestPath } from '../../agents/request-identity.js';
 import { atomicReadJson, atomicWriteJson } from '../../utils/atomic-write.js';
-export const CATALOG_TTL_MS = 5 * 60_000;
-export const CATALOG_STALE_MS = 24 * 60 * 60_000;
+import { parseModelId } from './context-window-suffix.js';
+/** 单页请求的超时（含响应体读取）。多页目录里每页各自享有这个预算。 */
+export const CATALOG_PAGE_TIMEOUT_MS = 4_000;
+/** 整条路由（含全部分页）的总期限，兜住慢网关无限翻页。 */
+export const CATALOG_ROUTE_TIMEOUT_MS = 15_000;
+/**
+ * 持久化快照的格式版本。**目录规范化或能力过滤规则变化时必须递增**，
+ * 否则旧规则写下的持久化快照与新快照无法区分，会继续被服务。
+ * v2：保留上下文窗口后缀（`claude-opus-5[1m]` 不再被折叠成基础 ID）。
+ * v3：保留 Codex 上游声明的 max effort，重新获取旧快照中过滤掉的能力。
+ */
+export const CATALOG_SNAPSHOT_VERSION = 3;
 export const TRANSPORT_EFFORTS = {
     claude: ['low', 'medium', 'high', 'xhigh', 'max'],
-    codex: ['none', 'minimal', 'low', 'medium', 'high', 'xhigh'],
+    codex: ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'],
     ecagent: ['minimal', 'low', 'medium', 'high', 'xhigh', 'max'],
     gemini: [],
 };
@@ -22,7 +32,7 @@ export const catalogHash = (value) => createHash('sha256').update(stable(value))
 export function catalogContextKey(context) {
     const headers = Object.fromEntries(Object.entries(context.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]));
     return catalogHash({ scope: context.scope, baseagent: context.baseagent, provider: context.provider,
-        baseUrl: context.baseUrl?.replace(/\/+$/, ''), apiKey: context.apiKey,
+        baseUrl: context.baseUrl?.replace(/\/+$/, ''), apiKey: context.apiKey, authType: context.authType,
         headers, queryParams: context.queryParams ?? {}, configUnavailable: context.configUnavailable });
 }
 const strings = (value) => Array.isArray(value)
@@ -40,37 +50,45 @@ export function parseModelList(json, _url) {
     const out = new Map();
     const items = rows(json);
     for (const item of items) {
-        const rawId = typeof item === 'string' ? item : item?.id ?? item?.slug ?? item?.name ?? item?.model;
-        if (typeof rawId !== 'string' || !rawId.trim())
-            continue;
-        // 规范化模型 ID：去掉 Claude Code SDK 的上下文窗口后缀 [1m]/[200k]
-        // 这些后缀只在传给 claude baseagent 时由 applyContextWindow 添加
-        const id = rawId.trim().replace(/\[(?:1m|200k)\]$/i, '');
-        if (out.has(id))
-            continue;
-        const rawLevels = item?.reasoningLevels ?? item?.supportedReasoningEfforts ?? item?.supported_reasoning_levels;
-        const levels = Array.isArray(rawLevels) ? strings(rawLevels.map(v => typeof v === 'string' ? v : v?.reasoningEffort ?? v?.effort)) : undefined;
-        const owner = item?.owned_by ?? item?.owner ?? item?.provider;
-        out.set(id, {
-            id, verification: 'listed',
-            ...(typeof owner === 'string' ? { owned_by: owner } : {}),
-            ...(typeof item?.created === 'number' ? { created: item.created } : {}),
-            ...(typeof (item?.displayName ?? item?.display_name) === 'string' ? { displayName: item.displayName ?? item.display_name } : {}),
-            ...(levels ? { reasoningLevels: levels } : {}),
-            ...(typeof (item?.defaultReasoningEffort ?? item?.default_reasoning_level) === 'string' ? { defaultReasoningLevel: item.defaultReasoningEffort ?? item.default_reasoning_level } : {}),
-            ...(strings(item?.protocols ?? item?.supported_protocols) ? { protocols: strings(item.protocols ?? item.supported_protocols) } : {}),
-            ...(typeof item?.capabilities?.tool_calling === 'boolean' ? { supportsTools: item.capabilities.tool_calling } : {}),
-            ...(typeof (item?.context_window ?? item?.contextWindow) === 'number' ? { contextWindow: item.context_window ?? item.contextWindow } : {}),
-            ...(typeof item?.max_output_tokens === 'number' ? { maxOutputTokens: item.max_output_tokens } : {}),
-        });
+        // 单个畸形条目只跳过自己：一条读不懂的记录不该让整份目录退化到 builtin。
+        try {
+            const rawId = typeof item === 'string' ? item : item?.id ?? item?.slug ?? item?.name ?? item?.model;
+            if (typeof rawId !== 'string' || !rawId.trim())
+                continue;
+            // 上下文窗口后缀 [1m]/[200k] 是模型身份的一部分：网关把不同窗口作为独立条目
+            // 下发，两个变体必须各自成为一条可选条目。仅规范化后缀大小写以便去重。
+            const parsed = parseModelId(rawId.trim());
+            const id = `${parsed.base}${parsed.suffix ?? ''}`;
+            if (out.has(id))
+                continue;
+            const rawLevels = item?.reasoningLevels ?? item?.supportedReasoningEfforts ?? item?.supported_reasoning_levels;
+            const levels = Array.isArray(rawLevels) ? strings(rawLevels.map(v => typeof v === 'string' ? v : v?.reasoningEffort ?? v?.effort)) : undefined;
+            const owner = item?.owned_by ?? item?.owner ?? item?.provider;
+            out.set(id, {
+                id, verification: 'listed',
+                ...(typeof owner === 'string' ? { owned_by: owner } : {}),
+                ...(typeof item?.created === 'number' ? { created: item.created } : {}),
+                ...(typeof (item?.displayName ?? item?.display_name) === 'string' ? { displayName: item.displayName ?? item.display_name } : {}),
+                ...(levels ? { reasoningLevels: levels } : {}),
+                ...(typeof (item?.defaultReasoningEffort ?? item?.default_reasoning_level) === 'string' ? { defaultReasoningLevel: item.defaultReasoningEffort ?? item.default_reasoning_level } : {}),
+                ...(strings(item?.protocols ?? item?.supported_protocols) ? { protocols: strings(item.protocols ?? item.supported_protocols) } : {}),
+                ...(typeof item?.capabilities?.tool_calling === 'boolean' ? { supportsTools: item.capabilities.tool_calling } : {}),
+                // 网关显式给出的 context_window 优先；缺失时用后缀声明的窗口兜底。
+                ...(typeof (item?.context_window ?? item?.contextWindow) === 'number' ? { contextWindow: item.context_window ?? item.contextWindow }
+                    : parsed.contextWindow !== undefined ? { contextWindow: parsed.contextWindow } : {}),
+                ...(typeof item?.max_output_tokens === 'number' ? { maxOutputTokens: item.max_output_tokens } : {}),
+            });
+        }
+        catch { /* Skip the offending entry; the rest of the page stays usable. */ }
     }
+    // 全部条目都无法解析仍视为不可信响应：避免把一个格式不符的 200 当成空目录。
     if (items.length && !out.size)
         throw new Error('Model list contains no valid IDs');
     return [...out.values()];
 }
 const BUILTIN_IDS = {
     codex: ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'gpt-5.2'],
-    claude: ['claude-opus-4-7', 'claude-opus-4-6', 'claude-sonnet-4-6', 'claude-haiku-4-5-20251001', 'deepseek-v4-pro', 'deepseek-v4-flash', 'kimi-k2.6', 'kimi-k2.5', 'glm-5.1', 'glm-5', 'glm-4.7', 'MiniMax-M2.7'],
+    claude: ['claude-opus-5', 'claude-sonnet-5', 'claude-opus-4-8', 'claude-opus-4-7', 'claude-opus-4-6', 'claude-sonnet-4-6', 'claude-haiku-4-5-20251001', 'deepseek-v4-pro', 'deepseek-v4-flash', 'kimi-k2.6', 'kimi-k2.5', 'glm-5.1', 'glm-5', 'glm-4.7', 'MiniMax-M2.7'],
     ecagent: ['claude-sonnet-4-6'],
     gemini: ['gemini-2.5-pro', 'gemini-2.5-flash', 'gemini-2.5-flash-lite'],
 };
@@ -89,9 +107,14 @@ export function deriveAliases(models, baseagent) {
         if (!match)
             continue;
         const [, family, major, minor = '0'] = match;
+        // 同版本的多个窗口变体：取窗口最大的一条，别名才不会随网关下发顺序漂移。
+        const window = parseModelId(id).contextWindow ?? 0;
         const current = best[family];
-        if (!current || +major > current.major || (+major === current.major && +minor > current.minor))
-            best[family] = { id, major: +major, minor: +minor };
+        const better = !current || +major > current.major
+            || (+major === current.major && +minor > current.minor)
+            || (+major === current.major && +minor === current.minor && window > current.window);
+        if (better)
+            best[family] = { id, major: +major, minor: +minor, window };
     }
     return Object.fromEntries(Object.entries(best).map(([family, info]) => [family, info.id]));
 }
@@ -133,12 +156,17 @@ async function gatewayModels(context, fetcher) {
             const models = [];
             const seen = new Set();
             let next = url;
-            // Bound the whole route, including response bodies and pagination.
-            const signal = AbortSignal.timeout(4000);
+            // 每页各自计时，避免多页目录被一个覆盖全程的超时提前掐断；
+            // 同时用总期限兜住整条路由，防止慢网关无限翻页。
+            const deadline = Date.now() + CATALOG_ROUTE_TIMEOUT_MS;
             for (let page = 0; page < 100; page++) {
                 if (seen.has(next))
                     throw new GatewayError();
                 seen.add(next);
+                const remaining = deadline - Date.now();
+                if (remaining <= 0)
+                    throw new GatewayError();
+                const signal = AbortSignal.timeout(Math.min(CATALOG_PAGE_TIMEOUT_MS, remaining));
                 const headers = new Headers(context.headers);
                 if (context.apiKey && !headers.has('authorization')) {
                     headers.set('authorization', `Bearer ${context.apiKey}`);
@@ -176,7 +204,7 @@ async function gatewayModels(context, fetcher) {
 /** One instance per daemon. Offline clients use the same persistence format. */
 export class ModelCatalogService {
     options;
-    cache = new Map();
+    latest = new Map();
     successes = new Map();
     inflight = new Map();
     constructor(options = {}) {
@@ -192,41 +220,43 @@ export class ModelCatalogService {
             try {
                 const file = this.file(context);
                 const saved = file ? atomicReadJson(file) : undefined;
-                if (saved?.version === 1 && saved.snapshot && Array.isArray(saved.snapshot.models) && ['gateway', 'native'].includes(saved.snapshot.source))
+                // 版本不匹配的快照按冷启动处理：其 ID 可能出自已废弃的规范化规则。
+                if (saved?.version === CATALOG_SNAPSHOT_VERSION && saved.snapshot && Array.isArray(saved.snapshot.models) && ['gateway', 'native'].includes(saved.snapshot.source))
                     snapshot = saved.snapshot;
             }
             catch { /* A missing/corrupt cache is a cold load. */ }
             if (snapshot)
                 this.successes.set(key, snapshot);
         }
-        return snapshot && this.now() - Date.parse(snapshot.fetchedAt) <= CATALOG_STALE_MS ? snapshot : undefined;
+        return snapshot;
     }
     peek(context) {
-        return structuredClone(this.cache.get(this.key(context))?.snapshot ?? this.previous(context) ?? this.make(context, 'builtin', 'fallback', this.legacyBuiltins(context), [{ code: 'BUILTIN', message: '内置候选，未经当前连接验证' }]));
+        return structuredClone(this.latest.get(this.key(context)) ?? this.previous(context) ?? this.make(context, 'builtin', 'fallback', this.legacyBuiltins(context), [{ code: 'BUILTIN', message: '内置候选，未经当前连接验证' }]));
     }
     async get(context, refresh = false) {
         const key = this.key(context);
-        const cached = this.cache.get(key);
-        if (!refresh && cached && cached.retryAt > this.now())
-            return structuredClone(cached.snapshot);
-        const previous = this.previous(context);
-        if (!refresh && previous && this.now() - Date.parse(previous.fetchedAt) < CATALOG_TTL_MS && !cached) {
-            this.cache.set(key, { snapshot: previous, retryAt: Date.parse(previous.fetchedAt) + CATALOG_TTL_MS });
-            return structuredClone(previous);
-        }
+        const previous = this.latest.get(key) ?? this.previous(context);
         let pending = this.inflight.get(key);
         if (!pending) {
             pending = this.load(context, previous).then(snapshot => {
-                this.cache.set(key, { snapshot, retryAt: this.now() + (snapshot.freshness === 'fresh' ? CATALOG_TTL_MS : 30_000) });
+                // Keep any usable first result (including builtin/native fallback), but
+                // never let a failed refresh replace the last usable snapshot.
+                if (snapshot.freshness !== 'stale')
+                    this.latest.set(key, snapshot);
                 return snapshot;
             }).finally(() => this.inflight.delete(key));
             this.inflight.set(key, pending);
         }
-        if (!refresh && previous)
-            return structuredClone({ ...previous, freshness: 'stale', diagnostics: [...(cached?.snapshot.diagnostics ?? []), { code: 'STALE_CACHE', message: '显示同一连接的最近成功目录，正在刷新' }] });
+        if (!refresh && previous) {
+            // Serve the last successful catalog immediately on every ordinary read,
+            // while each read also asks the shared background job to refresh it.
+            // Explicit refresh callers still await that same in-flight request.
+            void pending.catch(() => undefined);
+            return structuredClone(previous);
+        }
         return structuredClone(await pending);
     }
-    clear() { this.cache.clear(); this.successes.clear(); }
+    clear() { this.latest.clear(); this.successes.clear(); }
     make(context, source, freshness, models, diagnostics) {
         const entries = adapt(models, context.baseagent);
         const fetchedAt = new Date(this.now()).toISOString();
@@ -241,7 +271,7 @@ export class ModelCatalogService {
             const file = this.file(context);
             if (file) {
                 fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-                atomicWriteJson(file, { version: 1, snapshot });
+                atomicWriteJson(file, { version: CATALOG_SNAPSHOT_VERSION, snapshot });
             }
         }
         catch { /* Persistence failure does not discard a live result. */ }

package/dist/core/model/context-window-suffix.js

@@ -0,0 +1,33 @@
+/**
+ * Claude Code SDK 的上下文窗口后缀（如 `claude-opus-5[1m]`）。
+ *
+ * 网关会把同一模型的不同窗口作为独立条目下发，所以后缀是**模型身份的一部分**，
+ * 目录与选择界面必须原样保留——两个变体各成一条可选条目。
+ * 只有按基础 ID 归档的场景（查价、计费、能力参数表）才剥离后缀。
+ */
+/** 后缀 token → 该后缀声明的上下文窗口。 */
+export const CONTEXT_WINDOW_SUFFIX_TOKENS = {
+    '1m': 1_000_000,
+    '200k': 200_000,
+};
+const SUFFIX_RE = /\[(1m|200k)\]$/i;
+/** 拆分模型 ID 的基础部分与上下文窗口后缀。 */
+export function parseModelId(modelId) {
+    const match = SUFFIX_RE.exec(modelId);
+    if (!match)
+        return { base: modelId };
+    const token = match[1].toLowerCase();
+    return {
+        base: modelId.slice(0, match.index),
+        suffix: `[${token}]`,
+        contextWindow: CONTEXT_WINDOW_SUFFIX_TOKENS[token],
+    };
+}
+/** 去掉上下文窗口后缀。仅用于查价/计费/能力表这类按基础 ID 归档的场景。 */
+export function stripContextWindowSuffix(modelId) {
+    return modelId.replace(SUFFIX_RE, '');
+}
+/** 该 ID 是否已带网关显式给出的上下文窗口后缀。 */
+export function hasContextWindowSuffix(modelId) {
+    return SUFFIX_RE.test(modelId);
+}

package/dist/core/model/model-catalog.js

@@ -88,7 +88,7 @@ export function resolveCatalogContext(self, ba) {
             : baseagent === 'claude' ? resolveAnthropicConfig(cfg, block.claude)
                 : baseagent === 'ecagent' ? resolveEcagentConfig(cfg, block.ecagent) : undefined;
         if (resolved) {
-            Object.assign(context, { baseUrl: resolved.baseUrl, apiKey: resolved.apiKey, queryParams: resolved.queryParams,
+            Object.assign(context, { baseUrl: resolved.baseUrl, apiKey: resolved.apiKey, authType: 'authType' in resolved ? resolved.authType : undefined, queryParams: resolved.queryParams,
                 provider: 'provider' in resolved ? resolved.provider : undefined,
                 headers: buildModelRequestHeaders({ baseagent: baseagent, baseUrl: resolved.baseUrl, agentAid: self, configuredHeaders: resolved.headers }) });
         }

package/dist/core/model/model-permission.js

@@ -1,10 +1,19 @@
 import { getFieldPermission } from '../../config/roles.js';
+import { stripContextWindowSuffix } from './context-window-suffix.js';
 export function isModelAllowedByPatterns(model, allowedModels) {
     if (allowedModels.includes('*'))
         return true;
-    return allowedModels.some(pattern => pattern.endsWith('*')
-        ? model.startsWith(pattern.slice(0, -1))
-        : model === pattern);
+    // 窗口变体是同一模型的不同上下文窗口：白名单写基础 ID（`claude-opus-5`）即同时
+    // 授权其窗口变体（`claude-opus-5[1m]`）。反向不成立——白名单显式写了某个变体时，
+    // 只授权那一个变体，其它变体和裸 ID 仍被拒绝。
+    const candidates = new Set([model, stripContextWindowSuffix(model)]);
+    return allowedModels.some(pattern => {
+        if (pattern.endsWith('*')) {
+            const prefix = pattern.slice(0, -1);
+            return [...candidates].some(candidate => candidate.startsWith(prefix));
+        }
+        return candidates.has(pattern);
+    });
 }
 function normalizeBaseagent(baseagent) {
     const normalized = typeof baseagent === 'string' ? baseagent.trim() : '';

package/dist/core/permission/ec-command-parser.js

@@ -183,6 +183,10 @@ function substituteManagedTmpDirToken(value) {
     }
     return result;
 }
+function containsManagedTmpDirReference(value) {
+    return /\$TMPDIR|\$\{TMPDIR\}/.test(value)
+        || /\$env:TMPDIR|\$\{env:TMPDIR\}/i.test(value);
+}
 function restoreManagedTmpDirToken(value, managedTempDir) {
     return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
 }
@@ -362,7 +366,7 @@ function parseFailure(issue, input, offset, tokenIndex, dialect) {
         inputLength: input.length,
     };
 }
-function parseLiteralPowerShellCommand(command) {
+function parseLiteralPowerShellCommand(command, options = {}) {
     const input = trimShellSpacing(command);
     if (!input)
         return parseFailure('empty-command', input, 0, 0, 'powershell');
@@ -372,6 +376,9 @@ function parseLiteralPowerShellCommand(command) {
     let token = '';
     let tokenStarted = false;
     let quote = null;
+    // Environment variable names are case-insensitive on Windows. Require a
+    // complete variable name, including PowerShell's Unicode/name characters.
+    const managedTmpDirReference = new RegExp('^\\$(?:env:TMPDIR(?![\\p{L}\\p{Nd}_?:])|\\{env:TMPDIR\\})', process.platform === 'win32' ? 'iu' : 'u');
     const finishToken = () => {
         if (!tokenStarted)
             return;
@@ -396,6 +403,23 @@ function parseLiteralPowerShellCommand(command) {
             }
             continue;
         }
+        if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+            const reference = managedTmpDirReference.exec(input.slice(index))?.[0];
+            const next = reference ? input[index + reference.length] : undefined;
+            if (!reference) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            if (!options.allowManagedTmpDir || !options.managedTempDir
+                || (next !== undefined && !/[\\/\s"']/u.test(next))) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            // Append the registered value directly: spaces remain in this argument,
+            // and characters in the directory are never interpreted as shell syntax.
+            token += options.managedTempDir;
+            tokenStarted = true;
+            index += reference.length - 1;
+            continue;
+        }
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
@@ -412,9 +436,6 @@ function parseLiteralPowerShellCommand(command) {
                 token += next;
                 continue;
             }
-            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
-                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
-            }
             token += char;
             continue;
         }
@@ -729,7 +750,7 @@ function doubleQuotedIssueAt(input, index) {
  */
 export function parseLiteralShellCommand(command, options = {}) {
     if (options.dialect === 'powershell') {
-        return parseLiteralPowerShellCommand(command);
+        return parseLiteralPowerShellCommand(command, options);
     }
     if (options.dialect === 'cmd') {
         return parseLiteralCmdCommand(command, options);
@@ -1416,16 +1437,16 @@ export function parseCodexExecToolCommand(input) {
     }
     return decoded;
 }
-function parseProactiveToolCommandArgv(toolName, input) {
+function parseProactiveToolCommand(toolName, input) {
     const options = {
         verifyShellExecutable: process.platform === 'win32',
     };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input, options);
+        return parseCodexToolCommand(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
+    return command ? parseCodexToolCommand({ command }, options) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1711,13 +1732,13 @@ function findSingleFileOption(argv, startIndex) {
 const PROACTIVE_SEND_VALUE_FLAGS = new Set([
     '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
     '--title', '--description', '--text', '--transcript', '--as',
-    '--content-type', '--mention', '--aun-path', '--thread', '--return',
+    '--content-type', '--mention', '--aun-path', '--thread', '--return', '--handoff-context',
 ]);
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
 ]);
 const SEND_CONTENT_VALUE_FLAGS = new Set([
-    '--payload', '--title', '--description', '--text', '--transcript',
+    '--payload', '--title', '--description', '--text', '--transcript', '--handoff-context',
 ]);
 const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
 /**
@@ -1728,7 +1749,7 @@ const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
  */
 export function containsLiteralManagedTmpDirOutsideSendContent(argv) {
     const literalIndexes = argv
-        .map((value, index) => value.includes('$TMPDIR') ? index : -1)
+        .map((value, index) => containsManagedTmpDirReference(value) ? index : -1)
         .filter(index => index >= 0);
     if (literalIndexes.length === 0)
         return false;
@@ -1903,7 +1924,8 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
     // is represented as `exec` and is handled only for one literal inner call.
     if (!selfAid)
         return false;
-    const argv = parseProactiveToolCommandArgv(toolName, input);
+    const result = parseProactiveToolCommand(toolName, input);
+    const argv = result?.ok ? result.argv : null;
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed || parsed.action !== 'send')
         return false;
@@ -1914,3 +1936,20 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
         && !!argv
         && hasExecutableProactiveSendPayload(argv, expectedScope);
 }
+/** Diagnostic only: this never broadens the exact-send authorization check. */
+export function describeProactiveSendCommandFailure(toolName, input) {
+    if (!['Bash', 'Shell', 'exec'].includes(toolName) || !input || typeof input !== 'object')
+        return undefined;
+    const commandText = [input.command, input.input, ...(Array.isArray(input.commandArgv) ? input.commandArgv : [])]
+        .filter((value) => typeof value === 'string').join(' ');
+    if (!/\bec(?:\.cmd|\.exe)?\s+(?:group|msg)\s+send\b/i.test(commandText))
+        return undefined;
+    const result = parseProactiveToolCommand(toolName, input);
+    if (!result)
+        return '当前汇报命令未通过规范解析：只支持单次、字面量的发送调用，请将发送作为独立工具调用。';
+    if (!result.ok) {
+        return `当前汇报命令未通过规范解析（${result.issue}，${result.dialect}，位置 ${result.offset}）；`
+            + '请检查引号和转义，并将发送作为一条独立命令。';
+    }
+    return '当前汇报命令不符合当前会话的发送要求；请核对发送者、私聊或群目标，以及正文和参数。';
+}

package/dist/core/permission/sandbox-runtime.js

@@ -5,34 +5,55 @@ import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameO
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
 let sandboxInitializationCircuit;
+const sessionSandboxInitializationCircuits = new Map();
 let sandboxCircuitNoticeAt = 0;
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
 export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
 export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
 const SANDBOX_DIAGNOSTIC_TARGET_LIMIT = 256;
-/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
-export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
+/** Host bootstrap failures open a process circuit; tool-result failures only
+ * affect their originating session because tool output is not host attestation. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now(), sessionId) {
     const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
-    sandboxInitializationCircuit = sandboxInitializationCircuit
+    getActiveSandboxInitializationFailure(now);
+    const previous = sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : sandboxInitializationCircuit;
+    const circuit = previous
         ? {
-            ...sandboxInitializationCircuit,
+            ...previous,
             lastObservedAt: now,
-            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            occurrences: previous.occurrences + 1,
             detail,
         }
         : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
-    return { ...sandboxInitializationCircuit };
-}
-/** Return an active failure circuit, or allow one probe after the cooldown. */
-export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
-    if (!sandboxInitializationCircuit)
-        return undefined;
-    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+    if (sessionId)
+        sessionSandboxInitializationCircuits.set(sessionId, circuit);
+    else
+        sandboxInitializationCircuit = circuit;
+    return { ...circuit };
+}
+/** Expire old failures and return the process or requested session circuit. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS, sessionId) {
+    for (const [id, circuit] of sessionSandboxInitializationCircuits) {
+        if (now - circuit.lastObservedAt >= cooldownMs)
+            sessionSandboxInitializationCircuits.delete(id);
+    }
+    if (sandboxInitializationCircuit && now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
         sandboxInitializationCircuit = undefined;
         sandboxCircuitNoticeAt = 0;
-        return undefined;
     }
-    return { ...sandboxInitializationCircuit };
+    const circuit = sandboxInitializationCircuit ?? (sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : undefined);
+    return circuit ? { ...circuit } : undefined;
+}
+/** Only recognize the complete native bootstrap diagnostic, never a quotation
+ * embedded in ordinary tool output. Tool-result evidence is session-scoped. */
+export function isSandboxInitializationToolResult(content) {
+    const text = typeof content === 'string'
+        ? content
+        : Array.isArray(content) && content.every(block => block?.type === 'text' && typeof block.text === 'string')
+            ? content.map(block => block.text).join('\n')
+            : '';
+    return /^(?:Exit code [1-9]\d*\r?\n)?apply-seccomp: write \/proc\/self\/(?:uid|gid)_map: (?:Operation not permitted|Permission denied)\s*$/i
+        .test(text.trim());
 }
 /** Rate-limit human-readable warnings; structured audit still records every blocked task. */
 export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
@@ -561,6 +582,7 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
     return { command: bubblewrapPath, args };
 }
 export function _resetSandboxRuntimeCache() {
+    sessionSandboxInitializationCircuits.clear();
     cachedBubblewrapPath = undefined;
     sandboxInitializationCircuit = undefined;
     sandboxCircuitNoticeAt = 0;

package/dist/core/permission/tool-policy.js

@@ -2209,6 +2209,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         const parserOptions = {
             verifyShellExecutable: process.platform === 'win32',
+            managedTempDir: context.managedTempDir,
             ...(context.delegationCarrier
                 ? { expectedDelegationToken: context.delegationCarrier }
                 : {}),
@@ -2320,7 +2321,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             }
             if (ecCommand.issue === 'unsafe-expansion') {
                 const message = shellDialect === 'powershell'
-                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    ? '🔒 EC 命令包含无法安全解析的 PowerShell 展开；临时路径仅支持已登记的当前会话 $env:TMPDIR 或 ${env:TMPDIR}，也可使用完整路径。纯文字请使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令包含未转义的 cmd.exe 展开；请不要使用 %VAR%、!VAR! 或 ^ 转义。cmd.exe 传给 ec 时必须保持原文字面量'
                         : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';