evolcore 0.0.25 → 0.0.27

package/dist/core/permission/sandbox-runtime.js

@@ -5,34 +5,88 @@ import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameO
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
 let sandboxInitializationCircuit;
+const sessionSandboxInitializationCircuits = new Map();
 let sandboxCircuitNoticeAt = 0;
+let sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
 export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
 export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
+function emptySandboxInitializationFailureCounters() {
+    return {
+        total: 0,
+        applySeccomp: 0,
+        byKind: { uid_map: 0, gid_map: 0, seccomp: 0, user_namespace: 0, bubblewrap: 0, unknown: 0 },
+    };
+}
+/** Classify already recognized bootstrap evidence, never arbitrary tool output. */
+function sandboxInitializationFailureKind(text) {
+    if (/\buid_map\b/i.test(text))
+        return 'uid_map';
+    if (/\bgid_map\b/i.test(text))
+        return 'gid_map';
+    if (/\bseccomp\b/i.test(text))
+        return 'seccomp';
+    if (/user namespace/i.test(text))
+        return 'user_namespace';
+    if (/\b(?:bwrap|bubblewrap)\b/i.test(text))
+        return 'bubblewrap';
+    return 'unknown';
+}
+export function getSandboxInitializationFailureCounters() {
+    return { ...sandboxInitializationFailureCounters, byKind: { ...sandboxInitializationFailureCounters.byKind } };
+}
 const SANDBOX_DIAGNOSTIC_TARGET_LIMIT = 256;
-/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
-export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
-    const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
-    sandboxInitializationCircuit = sandboxInitializationCircuit
+/** Host bootstrap failures open a process circuit; tool-result failures only
+ * affect their originating session because tool output is not host attestation. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now(), sessionId) {
+    const wrapped = createSandboxInitializationError(error, stderr);
+    const evidence = [wrapped.message, ...(wrapped.stderr ?? [])].join('\n');
+    const kind = sandboxInitializationFailureKind(evidence);
+    sandboxInitializationFailureCounters.total++;
+    sandboxInitializationFailureCounters.byKind[kind]++;
+    if (/\bapply-seccomp\b/i.test(evidence))
+        sandboxInitializationFailureCounters.applySeccomp++;
+    const detail = wrapped.message.slice(0, 512);
+    getActiveSandboxInitializationFailure(now);
+    const previous = sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : sandboxInitializationCircuit;
+    const circuit = previous
         ? {
-            ...sandboxInitializationCircuit,
+            ...previous,
             lastObservedAt: now,
-            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            occurrences: previous.occurrences + 1,
             detail,
+            kind,
         }
-        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
-    return { ...sandboxInitializationCircuit };
-}
-/** Return an active failure circuit, or allow one probe after the cooldown. */
-export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
-    if (!sandboxInitializationCircuit)
-        return undefined;
-    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail, kind };
+    if (sessionId)
+        sessionSandboxInitializationCircuits.set(sessionId, circuit);
+    else
+        sandboxInitializationCircuit = circuit;
+    return { ...circuit };
+}
+/** Expire old failures and return the process or requested session circuit. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS, sessionId) {
+    for (const [id, circuit] of sessionSandboxInitializationCircuits) {
+        if (now - circuit.lastObservedAt >= cooldownMs)
+            sessionSandboxInitializationCircuits.delete(id);
+    }
+    if (sandboxInitializationCircuit && now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
         sandboxInitializationCircuit = undefined;
         sandboxCircuitNoticeAt = 0;
-        return undefined;
     }
-    return { ...sandboxInitializationCircuit };
+    const circuit = sandboxInitializationCircuit ?? (sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : undefined);
+    return circuit ? { ...circuit } : undefined;
+}
+/** Only recognize the complete native bootstrap diagnostic, never a quotation
+ * embedded in ordinary tool output. Tool-result evidence is session-scoped. */
+export function isSandboxInitializationToolResult(content) {
+    const text = typeof content === 'string'
+        ? content
+        : Array.isArray(content) && content.every(block => block?.type === 'text' && typeof block.text === 'string')
+            ? content.map(block => block.text).join('\n')
+            : '';
+    return /^(?:Exit code [1-9]\d*\r?\n)?apply-seccomp: write \/proc\/self\/(?:uid|gid)_map: (?:Operation not permitted|Permission denied)\s*$/i
+        .test(text.trim());
 }
 /** Rate-limit human-readable warnings; structured audit still records every blocked task. */
 export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
@@ -47,11 +101,13 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         .join('\n')
         .toLowerCase();
     return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || /fs sandbox helper failed(?: with status)?\b/.test(text)
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
         || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
         || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
-        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text);
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot) create (?:file|directory) at [^\n]+: read-only file system/.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
     if (error instanceof Error
@@ -77,6 +133,39 @@ export function createSandboxInitializationError(error, stderr = []) {
 export function shouldFailIfClaudeSandboxUnavailable(platform = process.platform) {
     return platform !== 'win32';
 }
+/**
+ * In an unprivileged user namespace (for example, root in an LXC container),
+ * dropping all capabilities before apply-seccomp creates its child namespace
+ * prevents that helper from writing a mapping for UID 0 (CAP_SETFCAP).
+ * Use the SDK's nested-sandbox compatibility mode only for confirmed remapped
+ * root. Unknown host state must not opt into weaker isolation.
+ */
+export function shouldEnableClaudeWeakerNestedSandbox(platform = process.platform, effectiveUid = typeof process.geteuid === 'function' ? process.geteuid() : undefined) {
+    if (platform !== 'linux' || effectiveUid !== 0)
+        return false;
+    let uidMap;
+    try {
+        uidMap = fs.readFileSync('/proc/self/uid_map', 'utf8').trim();
+    }
+    catch {
+        return false;
+    }
+    if (!uidMap)
+        return false;
+    let remappedRoot = false;
+    for (const line of uidMap.split(/\r?\n/)) {
+        const fields = line.trim().match(/^(\d+)\s+(\d+)\s+(\d+)$/);
+        if (!fields)
+            return false;
+        const [inside, outside, count] = fields.slice(1).map(Number);
+        if (![inside, outside, count].every(Number.isSafeInteger)
+            || count === 0 || inside + count > 0xffffffff || outside + count > 0xffffffff)
+            return false;
+        if (inside === 0 && outside !== 0)
+            remappedRoot = true;
+    }
+    return remappedRoot;
+}
 function isExecutableFile(candidate) {
     if (!candidate)
         return false;
@@ -561,7 +650,9 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
     return { command: bubblewrapPath, args };
 }
 export function _resetSandboxRuntimeCache() {
+    sessionSandboxInitializationCircuits.clear();
     cachedBubblewrapPath = undefined;
     sandboxInitializationCircuit = undefined;
     sandboxCircuitNoticeAt = 0;
+    sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();
 }

package/dist/core/permission/tool-error-code.js

@@ -20,6 +20,21 @@ export function classifyToolErrorCode(input) {
         return 'USER_DENIED';
     return 'EXECUTION_FAILED';
 }
+/**
+ * Map the internal error taxonomy to the intentionally small AUN activity
+ * contract. The detailed code remains available to local audit consumers.
+ */
+export function classifyAunToolErrorCode(input) {
+    const code = classifyToolErrorCode(input);
+    if (code === 'POLICY_DENIED'
+        || code === 'ROLE_DENIED'
+        || code === 'USER_DENIED'
+        || code === 'APPROVAL_TIMEOUT'
+        || code === 'DELEGATION_FAILED') {
+        return 'PERMISSION_DENIED';
+    }
+    return 'EXECUTION_FAILED';
+}
 /**
  * Compatibility classifier for historical, unstructured logs only.
  * Production event producers must use classifyToolErrorCode() and explicit

package/dist/core/permission/tool-policy.js

@@ -5,7 +5,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
-import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -2209,8 +2209,9 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         const parserOptions = {
             verifyShellExecutable: process.platform === 'win32',
-            ...(context.delegationCarrier
-                ? { expectedDelegationToken: context.delegationCarrier }
+            managedTempDir: context.managedTempDir,
+            ...(context.sessionCredential
+                ? { expectedCredentialToken: context.sessionCredential }
                 : {}),
         };
         const parsedCodex = context.sessionId ? parseCodexToolCommand(input, parserOptions) : null;
@@ -2222,12 +2223,12 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'ec_shell_untrusted_executable',
             };
         }
-        if (context.sessionId && parsedCodex?.ok && parsedCodex.delegationToken
-            && !context.delegationCarrier) {
+        if (context.sessionId && parsedCodex?.ok && parsedCodex.credentialToken
+            && !context.sessionCredential) {
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 PowerShell 命令中的 EVOLCORE_DELEGATION_TOKEN 必须与当前托管 thread carrier 绑定；无法确认时拒绝执行。',
+                message: '🔒 PowerShell 命令中的会话凭据必须与当前托管 Codex thread 绑定；无法确认时拒绝执行。',
                 policyCode: 'delegation_token_unbound',
             };
         }
@@ -2292,7 +2293,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         const shellDialect = stringShellCarrier?.dialect
             ?? (hasCodexCmdCarrierEcIntent(input) ? 'cmd' : undefined);
         const hasPowerShellCarrierAssignment = stringShellCarrier?.dialect === 'powershell'
-            && hasPowerShellDelegationAssignment(stringShellCarrier.command);
+            && hasPowerShellCredentialAssignment(stringShellCarrier.command);
         const ecCommand = hasPowerShellCarrierAssignment && parsedCodex
             ? parsedCodex.ok && parsedCodex.argv[0] === 'ec'
                 ? { kind: 'literal' }
@@ -2320,7 +2321,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             }
             if (ecCommand.issue === 'unsafe-expansion') {
                 const message = shellDialect === 'powershell'
-                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    ? '🔒 EC 命令包含无法安全解析的 PowerShell 展开；临时路径仅支持已登记的当前会话 $env:TMPDIR 或 ${env:TMPDIR}，也可使用完整路径。纯文字请使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令包含未转义的 cmd.exe 展开；请不要使用 %VAR%、!VAR! 或 ^ 转义。cmd.exe 传给 ec 时必须保持原文字面量'
                         : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';

package/dist/core/relation/peer-identity.js

@@ -37,6 +37,10 @@ export function parsePeerKey(key) {
 export class PeerIdentityCache {
     /** 缓存最大时效：30 天 */
     static CACHE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+    static invalidationRevisions = new Map();
+    static nextInvalidationRevision = 0;
+    /** Missing agent.md is recoverable; do not retain this negative result for 30 days. */
+    static UNKNOWN_CACHE_MAX_AGE_MS = 5 * 60 * 1000;
     /**
      * 获取 peer-identity.json 文件路径
      */
@@ -58,6 +62,22 @@ export class PeerIdentityCache {
             return null;
         }
     }
+    /** Expire only the freshness check; retain the last snapshot and its trust level. */
+    static invalidate(channelType, peerId, agentDir) {
+        const cached = this.get(channelType, peerId, agentDir);
+        if (!cached)
+            return;
+        const filePath = this.getFilePath(channelType, peerId, agentDir);
+        this.invalidationRevisions.set(filePath, ++this.nextInvalidationRevision);
+        if (cached.lastCheckedAt === 0)
+            return;
+        try {
+            fs.writeFileSync(filePath, JSON.stringify({ ...cached, lastCheckedAt: 0 }, null, 2), 'utf-8');
+        }
+        catch (error) {
+            logger.warn(`[PeerIdentityCache] Failed to invalidate ${channelType}#${peerId}: ${error}`);
+        }
+    }
     /**
      * 检查缓存是否需要刷新
      * @param maxAgeMs 最大缓存时间（默认 30 天）
@@ -67,7 +87,10 @@ export class PeerIdentityCache {
         const cached = this.get(channelType, peerId, agentDir);
         if (!cached)
             return true;
-        return Date.now() - cached.lastCheckedAt > maxAgeMs;
+        const effectiveMaxAge = cached.source === 'unknown'
+            ? Math.min(maxAgeMs, this.UNKNOWN_CACHE_MAX_AGE_MS)
+            : maxAgeMs;
+        return cached.lastCheckedAt === 0 || Date.now() - cached.lastCheckedAt > effectiveMaxAge;
     }
     /**
      * 从 agent.md 更新身份信息
@@ -95,7 +118,7 @@ export class PeerIdentityCache {
         };
         const filePath = this.getFilePath(channelType, peerId, agentDir);
         try {
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.mkdirSync(path.join(path.dirname(filePath), 'shared'), { recursive: true });
             fs.writeFileSync(filePath, JSON.stringify(identity, null, 2), 'utf-8');
             logger.debug(`[PeerIdentityCache] Updated: ${channelType}#${peerId} type=${type} isAgent=${isAgent} source=${source}`);
         }
@@ -132,7 +155,7 @@ export class PeerIdentityCache {
         };
         const filePath = this.getFilePath(channelType, peerId, agentDir);
         try {
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.mkdirSync(path.join(path.dirname(filePath), 'shared'), { recursive: true });
             fs.writeFileSync(filePath, JSON.stringify(identity, null, 2), 'utf-8');
             logger.debug(`[PeerIdentityCache] Marked unknown: ${channelType}#${peerId}`);
         }
@@ -149,8 +172,13 @@ export class PeerIdentityCache {
      * @param agentDir agent 数据根目录
      * @param store AIDStore 实例（由调用方提供，负责 checkAgentMd + downloadAgentMd）
      * @param forceRefresh 强制刷新（忽略缓存时效）
+     * @param aunPath AUN SDK 数据根目录；与关系缓存所在的 agentDir 分开
      */
-    static async resolve(channelType, peerId, agentDir, store, forceRefresh = false) {
+    static async resolve(channelType, peerId, agentDir, store, forceRefresh = false, aunPath) {
+        // AIDStore is authoritative for the SDK cache root. Callers that predate
+        // the explicit aunPath parameter must still fall back to that same root,
+        // otherwise the error path could read a different agent.md tree.
+        const resolvedAunPath = aunPath ?? store.aunPath;
         // A malformed transport envelope must never turn into a relation key such
         // as `aun#` or trigger an agent.md lookup for an empty AID.  Keep the
         // fallback in-memory so callers can safely render an unknown peer without
@@ -177,15 +205,36 @@ export class PeerIdentityCache {
                 return cached;
             }
         }
+        const cachePath = this.getFilePath(channelType, peerId, agentDir);
+        const revision = this.invalidationRevisions.get(cachePath) ?? 0;
+        const stale = this.get(channelType, peerId, agentDir);
         // 2. 通过 agentmdSync 拉取（内部走 store.checkAgentMd → store.downloadAgentMd）
         try {
             logger.debug(`[PeerIdentityCache] Syncing agent.md: ${channelType}#${peerId}`);
             const { agentmdSync } = await import('../../aun/aid/agentmd.js');
-            const result = await agentmdSync(peerId, { store });
+            const invalidated = stale?.lastCheckedAt === 0 || revision > 0;
+            const result = await agentmdSync(peerId, {
+                store,
+                aunPath: resolvedAunPath,
+                forceRefresh: invalidated,
+                ttlDays: stale?.source === 'unknown' ? 0 : undefined,
+            });
+            if ((this.invalidationRevisions.get(cachePath) ?? 0) !== revision) {
+                // A newer event arrived during this read. Its next lookup must refresh.
+                return this.get(channelType, peerId, agentDir) ?? {
+                    aid: peerId, type: 'unknown', isAgent: true, agentMdHash: '', agentMdUpdatedAt: 0,
+                    verifiedAt: 0, lastCheckedAt: 0, source: 'unknown',
+                };
+            }
+            // A failed refresh may return old local bytes. Keep the invalidated
+            // snapshot so the next lookup retries instead of caching it for 30 days.
+            if (invalidated && !result.verification && stale)
+                return stale;
             const content = result.content;
             if (!content) {
                 throw new Error('agent.md content unavailable');
             }
+            this.invalidationRevisions.delete(cachePath);
             // 验签通过 → 可信（source=agentmd）；否则 type 仍解析但标记未验证
             const verified = result.verification?.status === 'verified';
             const source = verified ? 'agentmd' : 'agentmd-unverified';
@@ -201,10 +250,12 @@ export class PeerIdentityCache {
             return this.updateFromAgentMd(channelType, peerId, agentDir, content, verified ? Date.now() : 0, source);
         }
         catch (err) {
+            if (stale?.lastCheckedAt === 0)
+                return stale;
             // 4. agentmdSync 抛错（非网络失败——网络失败时它内部已 fallback 返回本地内容；
             //    这里通常是无内容或解析异常）。兜底读本地文件，但无法重新验签，
             //    故沿用缓存里已有的可信级别，绝不凭空升级为已验签。
-            const localPath = agentMdPath(peerId);
+            const localPath = agentMdPath(peerId, resolvedAunPath);
             try {
                 if (fs.existsSync(localPath)) {
                     const localContent = fs.readFileSync(localPath, 'utf-8');

package/dist/core/relation/shared-data.js

@@ -0,0 +1,106 @@
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { agentRelationDir, agentRelationSharedDir, agentRelationsDir, resolvePaths } from '../../paths.js';
+import { parsePeerKey } from './peer-identity.js';
+import { logger } from '../../utils/logger.js';
+export const RELATION_SHARED_FILE_ALLOWLIST = Object.freeze(['rules.md']);
+function isAllowedSharedFile(relativePath) {
+    return RELATION_SHARED_FILE_ALLOWLIST.includes(relativePath);
+}
+function copyFileAtomically(source, target) {
+    const targetDir = path.dirname(target);
+    fs.mkdirSync(targetDir, { recursive: true });
+    const temporary = path.join(targetDir, `.${path.basename(target)}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+    try {
+        fs.copyFileSync(source, temporary);
+        const sourceStat = fs.statSync(source);
+        fs.utimesSync(temporary, sourceStat.atime, sourceStat.mtime);
+        fs.renameSync(temporary, target);
+    }
+    finally {
+        try {
+            fs.rmSync(temporary, { force: true });
+        }
+        catch { }
+    }
+}
+export function ensureRelationSharedDirectory(selfAid, peerKey) {
+    parsePeerKey(peerKey);
+    const sharedDir = agentRelationSharedDir(selfAid, peerKey);
+    fs.mkdirSync(sharedDir, { recursive: true });
+    return sharedDir;
+}
+export function syncRelationSharedFile(selfAid, peerKey, relativePath) {
+    if (!isAllowedSharedFile(relativePath)) {
+        throw Object.assign(new Error(`Relation shared file is not allowlisted: ${relativePath}`), {
+            code: 'SHARED_FILE_NOT_ALLOWED',
+        });
+    }
+    parsePeerKey(peerKey);
+    const relationDir = agentRelationDir(selfAid, peerKey);
+    const source = path.join(relationDir, relativePath);
+    const target = path.join(ensureRelationSharedDirectory(selfAid, peerKey), relativePath);
+    let sourceStat;
+    try {
+        sourceStat = fs.statSync(source);
+    }
+    catch {
+        return { copied: false, target };
+    }
+    if (!sourceStat.isFile())
+        return { copied: false, target };
+    try {
+        const targetStat = fs.statSync(target);
+        if (targetStat.isFile()
+            && targetStat.size === sourceStat.size
+            && Math.abs(targetStat.mtimeMs - sourceStat.mtimeMs) < 1) {
+            return { copied: false, target };
+        }
+    }
+    catch { }
+    copyFileAtomically(source, target);
+    return { copied: true, target };
+}
+export function migrateRelationSharedDirectories() {
+    const agentsDir = resolvePaths().agentsDir;
+    let relations = 0;
+    let copied = 0;
+    if (!fs.existsSync(agentsDir))
+        return { relations, copied };
+    for (const agentEntry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
+        if (!agentEntry.isDirectory())
+            continue;
+        const selfAid = agentEntry.name;
+        const relationsDir = agentRelationsDir(selfAid);
+        let relationEntries;
+        try {
+            relationEntries = fs.readdirSync(relationsDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const relationEntry of relationEntries) {
+            if (!relationEntry.isDirectory() || relationEntry.name.startsWith('_'))
+                continue;
+            try {
+                parsePeerKey(relationEntry.name);
+            }
+            catch {
+                continue;
+            }
+            relations += 1;
+            try {
+                ensureRelationSharedDirectory(selfAid, relationEntry.name);
+                for (const file of RELATION_SHARED_FILE_ALLOWLIST) {
+                    if (syncRelationSharedFile(selfAid, relationEntry.name, file).copied)
+                        copied += 1;
+                }
+            }
+            catch (error) {
+                logger.warn(`[RelationShared] failed self=${selfAid} peer=${relationEntry.name}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    return { relations, copied };
+}

package/dist/core/role/runtime-policy.js

@@ -1,5 +1,9 @@
 import { getRoleDefinition } from '../../config/roles.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
+import { ConfigTarget, read } from '../../config/config-manager.js';
+import { resolvePrincipal } from '../../config/contact-book.js';
+import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
+import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 const PERMISSION_MODE_AUTHORITY = {
     readonly: 0,
     auto: 1,
@@ -139,3 +143,63 @@ export function validateRuntimeStringFieldOverride(input) {
     }
     return { ok: true };
 }
+/**
+ * Resolve the Agent-level host execution policy for one authenticated principal.
+ * The Agent flag is subordinate to daemon fullaccess and independent of role permissionMode values.
+ */
+export function agentFullAccessStatus(agentAid, principalId) {
+    const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });
+    const daemon = loadDaemonConfig();
+    const enabled = config?.fullaccess?.enabled === true;
+    const hostEnabled = isFullAccessEnabled(daemon);
+    const eligible = !!principalId
+        && !!config?.owners?.includes(principalId)
+        && !!daemon.owners?.includes(principalId);
+    return { enabled, hostEnabled, eligible, effective: enabled && hostEnabled && eligible };
+}
+/** Create a trusted per-call claim for a direct private message. */
+export function createAgentPolicyAuthorization(input) {
+    if (input.chatType !== 'private'
+        || (input.source !== undefined && input.source !== 'user')
+        || ['agent', 'ai', 'bot', 'service', 'group'].includes((input.peerType ?? '').toLowerCase())
+        || !hasTrustedPrincipal(input.actor))
+        return undefined;
+    if (!agentFullAccessStatus(input.agentAid, input.actor.principalId).effective)
+        return undefined;
+    return {
+        permissionMode: 'fullaccess',
+        processRole: 'fullaccess-run',
+        dataScope: 'daemon',
+        source: 'agent-policy',
+        agentAid: input.agentAid,
+        authorizedBy: input.actor.principalId,
+        policyActor: { ...input.actor },
+    };
+}
+/** Revalidate a claim before Runner calls, retries, and daemon IPC. */
+export function assertAgentPolicyAuthorization(authorization) {
+    const actor = authorization.policyActor;
+    if (!authorization.agentAid || !hasTrustedPrincipal(actor)) {
+        throw new Error('Agent fullaccess policy lacks authenticated origin');
+    }
+    const current = resolvePrincipal(authorization.agentAid, actor.operatorChannelType, actor.operatorId, actor.operatorChannelKey);
+    if (!hasTrustedPrincipal({ ...actor, ...current }) || current.principalId !== authorization.authorizedBy) {
+        throw new Error('Agent fullaccess policy origin identity changed');
+    }
+    if (!agentFullAccessStatus(authorization.agentAid, authorization.authorizedBy).effective) {
+        throw new Error('Agent fullaccess policy disabled or current owner is no longer eligible');
+    }
+}
+/** Only the authenticated EC Web Agent settings may mutate this policy. */
+export function agentFullAccessWriteError(input) {
+    if (!input.ecwebManagement) {
+        return 'Agent fullaccess can only be configured from ECWeb';
+    }
+    if (!input.daemonOwner || input.delegated) {
+        return 'Only authenticated ECWeb management may configure Agent fullaccess';
+    }
+    if (input.enabled && !isFullAccessEnabled()) {
+        return 'Host fullaccess is disabled';
+    }
+    return undefined;
+}

package/dist/core/runtime-lock.js

@@ -17,28 +17,21 @@ export function resolveManagedLockPath(namespace, identity, legacyPath) {
 }
 function isTrustedRuntimeLockDir(candidate) {
     const resolved = path.resolve(candidate);
-    if (path.basename(resolved) !== 'evolcore-locks')
-        return false;
     const tmpRoot = process.env.TMPDIR?.trim();
     if (!tmpRoot || !path.isAbsolute(tmpRoot))
         return false;
     const resolvedTmpRoot = path.resolve(tmpRoot);
-    const relative = path.relative(resolvedTmpRoot, resolved);
-    const isWithinTmp = relative !== '..'
-        && !relative.startsWith(`..${path.sep}`)
-        && !path.isAbsolute(relative);
-    // The daemon supplies each task either a generic evolcore-runtime-* child
-    // or Codex's private digest directory. Both share a sibling evolcore-locks
-    // directory so mutations from separate sessions still serialize. Do not
-    // accept arbitrary TMPDIR siblings supplied by a child process.
     const tmpBase = path.basename(resolvedTmpRoot);
-    const tmpParent = path.dirname(resolvedTmpRoot);
-    const isGenericSessionRuntime = /^evolcore-runtime-[a-f0-9]{24}$/.test(tmpBase);
-    const isCodexSessionRuntime = /^[a-f0-9]{24}$/.test(tmpBase)
-        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(tmpParent));
-    const isManagedSessionSibling = (isGenericSessionRuntime || isCodexSessionRuntime)
-        && path.dirname(resolved) === tmpParent;
-    if (!isWithinTmp && !isManagedSessionSibling)
+    const isSessionLockDir = /^ec-session-[a-f0-9]{24}$/.test(tmpBase)
+        && path.basename(resolved) === 'locks'
+        && path.dirname(resolved) === resolvedTmpRoot;
+    // The app-server process has no EvolCore session yet and retains its own
+    // process-lifetime lock namespace. Both process and session roots use the
+    // same `$TMPDIR/locks` layout.
+    const isProcessLockDir = /^evolcore-managed-tmp-/.test(tmpBase)
+        && path.basename(resolved) === 'locks'
+        && path.dirname(resolved) === resolvedTmpRoot;
+    if (!isSessionLockDir && !isProcessLockDir)
         return false;
     try {
         // Windows Stats.mode does not describe ACL privacy. The managed runtime
@@ -53,15 +46,6 @@ function isTrustedRuntimeLockDir(candidate) {
             return false;
         if (!isWindows && (tmpStat.mode & 0o077) !== 0)
             return false;
-        if (isManagedSessionSibling) {
-            const parentStat = fs.lstatSync(tmpParent);
-            if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
-                return false;
-            if (!isWindows && typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
-                return false;
-            if (!isWindows && (parentStat.mode & 0o077) !== 0)
-                return false;
-        }
         const stat = fs.lstatSync(resolved);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             return false;