evolcore 0.0.26 → 0.0.27

package/dist/cli/daemon-commands.js

@@ -23,7 +23,7 @@ import { displaySessionTitle } from '../core/session/session-title.js';
 import { isNonAgentSessionChannel } from '../core/system-channels.js';
 import { printCodeStats } from './code-stats.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { WEB_CLI_BIN, WEB_PACKAGE_LATEST, WEB_PACKAGE_NAME } from '../product.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
@@ -40,6 +40,8 @@ export function ensureCodexHookBeforeLifecycle(onRepaired) {
     try {
         const usesCodex = loadDefaults()?.active_baseagent === 'codex'
             || loadAllAgents().agents.some(agent => {
+                if (agent.enabled === false)
+                    return false;
                 try {
                     return resolveEffective({ self: agent.aid }).active_baseagent === 'codex';
                 }
@@ -146,7 +148,7 @@ function rejectPidIsolatedLifecycle(action, status, ping) {
 }
 async function tryDelegatedDaemonRestart(socketPath) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!sessionId || !delegationToken)
         return false;
     const response = await ipcQuery(socketPath, {
@@ -2720,17 +2722,18 @@ function findAliveEcweb(p) {
     return alive[0] ?? null;
 }
 /**
- * 轻量 HTTP 就绪探测：GET / 返回 2xx 即视为就绪。
- * 不走 /api/pair-code（会触发配对码刷新副作用），不走 /api/health（不存在）。
- * 根路径由 serveStatic 处理，返回 index.html，无副作用。
+ * 轻量 HTTP 就绪探测：ECWeb 的健康端点必须返回明确的服务标识。
+ * 不走 /api/pair-code（会触发配对码刷新副作用），也不依赖静态页面内容。
  */
 async function probeEcwebReady(port) {
     try {
-        const res = await fetch(`http://127.0.0.1:${port}/`, {
-            method: 'GET',
+        const res = await fetch(`http://127.0.0.1:${port}/api/health`, {
             signal: AbortSignal.timeout(2000),
         });
-        return res.ok;
+        if (!res.ok)
+            return false;
+        const body = await res.json();
+        return body.ok === true && body.service === 'ecweb';
     }
     catch {
         return false;
@@ -2756,8 +2759,9 @@ async function waitForExistingEcweb(p, timeoutMs = 3_000) {
 }
 /**
  * 输出 ECWeb 状态。判定口径：
- *   1. 进程是否存活（instance/ 下的 pid 文件 + isProcessRunning）
- *   2. HTTP 是否就绪——探测根路径 /（serveStatic → index.html, 无副作用）。
+ *   1. HTTP 是否就绪——探测 ECWeb 专用 /api/health 端点。
+ *   2. 进程是否存活（instance/ 下的 pid 文件 + isProcessRunning）仅用于补充诊断；
+ *      某些 CLI 运行在隔离 PID namespace 中，看不到宿主 ECWeb PID 是正常情况。
  */
 async function printEcwebStatus(p) {
     try {
@@ -2773,6 +2777,15 @@ async function printEcwebStatus(p) {
         // still provide an authoritative runtime status without local config access.
     }
     const entries = readEcwebInstanceEntries(p);
+    // Probe before consulting PID visibility. The daemon and CLI can be in
+    // different PID namespaces while sharing the host network namespace.
+    let readyEntry;
+    for (const entry of entries) {
+        if (await probeEcwebReady(entry.record.port)) {
+            readyEntry = entry;
+            break;
+        }
+    }
     const aliveEntries = [];
     for (const entry of entries) {
         if (platform.isProcessRunning(entry.record.pid)) {
@@ -2781,22 +2794,21 @@ async function printEcwebStatus(p) {
         else {
             // A stale EC Web record must never be used to report the PID of an
             // unrelated process that later inherited the port.
-            try {
-                fs.unlinkSync(entry.filePath);
+            // Keep a record whose dedicated health endpoint just proved live: the
+            // PID may be hidden by a namespace boundary rather than actually dead.
+            if (entry.filePath !== readyEntry?.filePath) {
+                try {
+                    fs.unlinkSync(entry.filePath);
+                }
+                catch { }
             }
-            catch { }
-        }
-    }
-    let readyEntry;
-    for (const entry of aliveEntries) {
-        if (await probeEcwebReady(entry.record.port)) {
-            readyEntry = entry;
-            break;
         }
     }
     if (readyEntry) {
         console.log('');
-        console.log(`🔭 ECWeb: 运行中 (PID: ${readyEntry.record.pid})  http://localhost:${readyEntry.record.port}`);
+        const pidVisible = aliveEntries.some(entry => entry.filePath === readyEntry.filePath);
+        const pidText = pidVisible ? `PID: ${readyEntry.record.pid}` : `PID: ${readyEntry.record.pid}（当前 namespace 不可见）`;
+        console.log(`🔭 ECWeb: 运行中 (${pidText})  http://localhost:${readyEntry.record.port}`);
         return;
     }
     const occupiedPids = new Set();
@@ -2991,7 +3003,7 @@ export async function startEcwebIfEnabled(p, options = {}) {
             console.log(`✓ ECWeb ${actionLabel} (PID: ${pid})  http://localhost:${port}`);
             if (pair) {
                 const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
-                console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，已配对过的浏览器无需重新配对)`);
+                console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，仅可配对一次，已配对过的浏览器无需重新配对)`);
             }
             else {
                 console.log('   daemon 尚未提供配对码；EvolCore 启动后可通过 /pair 或 ECWeb 页面获取');
@@ -3027,7 +3039,7 @@ async function printEcwebAccess(port) {
     }
     if (pair) {
         const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
-        console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，配对后远程访问 token 缓存 30 天)`);
+        console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，仅可配对一次，token 缓存 7 天，有访问自动续期)`);
     }
     else {
         console.log('   配对码: 暂不可用（稍后重试 ec watch web，或查看 logs/watch-web.log）');

package/dist/cli/diag.js

@@ -1,6 +1,6 @@
 import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { parseDiagArgs } from '../core/command/diag-service.js';
 import { wantsHelp } from './help.js';
 export async function cmdDiag(args) {
@@ -17,7 +17,7 @@ export async function cmdDiag(args) {
             type: 'diag', argv,
             ...(process.env.EVOLCORE_SESSION_ID ? {
                 sessionId: process.env.EVOLCORE_SESSION_ID,
-                delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+                delegationToken: readDelegationCredential(),
             } : {}),
         }, 30_000) ?? { ok: false, code: 'DAEMON_UNAVAILABLE', message: 'daemon 未返回结果，请检查其运行状态；发送结果尚未确认' };
     }

package/dist/cli/fs-command.js

@@ -5,8 +5,8 @@ import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 import { agentmdGet, getAidStore, isValidAid, loadClient, SLOT } from '../aun/aid/index.js';
 import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
-import { downloadGroupFsBytes } from '../aun/group-fs-download.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { downloadGroupFsBytes } from '../aun/group/index.js';
 class FsCliError extends Error {
     code;
     suggestion;
@@ -209,7 +209,7 @@ export async function cmdFs(args) {
 }
 async function runManagedFs(args, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     const fail = (code, message) => {
         if (formatJson)
             console.log(JSON.stringify({ ok: false, code, error: message }));

package/dist/cli/handoff-command.js

@@ -4,7 +4,7 @@ import { ipcQuery } from '../ipc.js';
 import { HANDOFF_QUERY_DEFAULT_LIMIT, HANDOFF_QUERY_MAX_LIMIT, HANDOFF_STATES } from '../core/handoff/types.js';
 import { HANDOFF_ID_RE } from '../core/handoff/store.js';
 import { isHelpFlag, wantsHelp } from './help.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 function parseLimit(value) {
     const limit = Number(value);
     if (!value || !Number.isInteger(limit) || limit < 1 || limit > HANDOFF_QUERY_MAX_LIMIT) {
@@ -186,7 +186,7 @@ Commands:
             sessionId: process.env.EVOLCORE_SESSION_ID,
             handoffId: parsed.handoffId,
             content: parsed.content,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+            delegationToken: readDelegationCredential(),
         }, 5000);
         if (!result) {
             console.error('✗ daemon 暂时不可用');
@@ -216,7 +216,7 @@ Commands:
             sessionId: process.env.EVOLCORE_SESSION_ID,
             handoffId: parsed.handoffId,
             content: parsed.content,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+            delegationToken: readDelegationCredential(),
         }, 5000);
         if (!result) {
             console.error('✗ daemon 暂时不可用');
@@ -235,7 +235,7 @@ Commands:
         }
         const result = await ipcQuery(resolvePaths().socket, {
             type: 'handoff-status', sessionId: process.env.EVOLCORE_SESSION_ID, handoffId,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+            delegationToken: readDelegationCredential(),
         }, 5000);
         if (!result) {
             console.error('✗ daemon 暂时不可用');
@@ -267,7 +267,7 @@ Commands:
             state: parsed.state,
             filterSessionId: parsed.sessionId,
             limit: parsed.limit,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+            delegationToken: readDelegationCredential(),
         }, 5000);
         if (!result) {
             console.error('✗ daemon 暂时不可用');
@@ -310,7 +310,7 @@ Commands:
             agent: parsed.agent,
             handoffId: parsed.handoffId,
             limit: parsed.limit,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+            delegationToken: readDelegationCredential(),
         }, 5000);
         if (!result) {
             console.error('✗ daemon 暂时不可用');

package/dist/cli/index.js

@@ -5,7 +5,7 @@ import fs from 'fs';
 import path from 'path';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { cmdInit } from './init.js';
 import { cmdInitWechat, cmdInitFeishu, cmdInitDingtalk, cmdInitQQBot, cmdInitWecom, cmdInitAun } from './init-channel.js';
 import { isHelpFlag, wantsHelp, getArgValue } from './help.js';
@@ -34,6 +34,7 @@ Agent 与会话:
   agent             管理 EvolAgent
   ctl               当前托管会话的控制命令
   queue             查询或操作 agent 消息队列
+  task              恢复暂停或异常中断的会话任务
   trigger           管理定时与事件触发器
   handoff           查询和完成跨会话回流
   model             查看或设置模型与推理强度
@@ -247,7 +248,7 @@ export async function main(args) {
             }
             if (process.env.EVOLCORE_SESSION_ID) {
                 const sessionId = process.env.EVOLCORE_SESSION_ID;
-                const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+                const delegationToken = readDelegationCredential();
                 const result = await ipcQuery(resolvePaths().socket, {
                     type: 'status.auth', sessionId, delegationToken,
                 });
@@ -328,6 +329,11 @@ export async function main(args) {
         case 'queue':
             await cmdQueue(args.slice(1));
             break;
+        case 'task': {
+            const { cmdTask } = await import('./task-command.js');
+            await cmdTask(args.slice(1));
+            break;
+        }
         case 'trigger':
             {
                 const { cmdTrigger } = await import('./trigger-command.js');

package/dist/cli/init.js

@@ -7,7 +7,7 @@ import { commandExists } from '../utils/cross-platform.js';
 import { scanInstances } from '../utils/instance-registry.js';
 import { saveDefaultsSafe, loadAllAgents, loadDaemonConfig, saveDaemonConfig } from '../config-store.js';
 import { ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
-import { generateControlAid, resolveControlAidDomain } from '../aun/aid/control-aid.js';
+import { ensureControlAgentMd, generateControlAid, resolveControlAidDomain } from '../aun/aid/control-aid.js';
 import { getCodexAppServerAvailability } from '../agents/codex-runner.js';
 import { DEFAULT_ECAGENT_BASE_URL, resolveEcagentConfig } from '../agents/baseagent.js';
 import { defaultProjectsRoot } from '../utils/project-path.js';
@@ -484,6 +484,12 @@ export async function initTail(options = {}) {
     let ownerBindingInterrupted = false;
     if (daemonConfig.aid) {
         console.log(`✓ 控制 AID 已存在: ${daemonConfig.aid}`);
+        try {
+            await ensureControlAgentMd(daemonConfig.aid);
+        }
+        catch (e) {
+            console.error(`⚠️ 控制 AID agent.md 补全失败（本次继续，后续启动会重试）: ${e?.message || e}`);
+        }
     }
     else {
         try {
@@ -861,6 +867,33 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
             fail('CONTROL_AID_CREATE_FAILED', `control AID creation failed: ${e?.message || e}`, EXIT_RUNTIME, format);
         }
     }
+    if (controlAid) {
+        const certPath = path.join(resolvePaths().root, 'AIDs', controlAid, 'public', 'cert.pem');
+        if (!fs.existsSync(certPath)) {
+            // An externally supplied/pre-created AID without a local certificate
+            // cannot be signed or uploaded by this process. Avoid entering the SDK
+            // network path during non-interactive init; later daemon startup can
+            // retry once the identity material is provisioned.
+            console.error(`control AID agent.md publish skipped: local certificate not found for ${controlAid}`);
+        }
+        else {
+            try {
+                await ensureControlAgentMd(controlAid);
+            }
+            catch (e) {
+                // A registered control AID remains usable when the Name Service is
+                // temporarily unavailable; startup and the next init retry publication.
+                if (format === 'json') {
+                    // Keep the successful init result machine-readable; surface the
+                    // warning through stderr so stdout remains valid JSON.
+                    console.error(`control AID agent.md publish warning: ${e?.message || e}`);
+                }
+                else {
+                    console.error(`⚠️ 控制 AID agent.md 补全失败（本次继续，后续启动会重试）: ${e?.message || e}`);
+                }
+            }
+        }
+    }
     // ── 9. 写 daemon.json（aid + owners + ecweb）──
     try {
         const next = {

package/dist/cli/managed-command-guard.js

@@ -20,6 +20,7 @@ const MANAGED_TASK_COMMANDS = new Set([
     'stats',
     'status',
     'storage',
+    'task',
     'trigger',
     'version',
     '-v',
@@ -30,7 +31,7 @@ export class ManagedCommandNotAllowedError extends Error {
     command;
     code = 'NOT_ALLOWED';
     constructor(command) {
-        super(`Command ${command} is not available in a managed Agent task`);
+        super(`Command ${command} is not available in a managed Agent task; run it from the host terminal after the task completes`);
         this.command = command;
         this.name = 'ManagedCommandNotAllowedError';
     }

package/dist/cli/menu-client.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import { getArgValue, wantsHelp } from './help.js';
-import { executeMenuClientRequest, MenuClientError } from '../aun/menu-client.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { executeMenuClientRequest, MenuClientError } from '../aun/menu/index.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 function parseDurationMs(value) {
     if (value === undefined)
         return undefined;
@@ -94,12 +94,16 @@ export async function cmdMenuClient(args) {
     }
     let response;
     if (process.env.EVOLCORE_SESSION_ID) {
-        const { ipcQuery } = await import('../ipc.js');
+        const { ipcQuery, IpcTransportError } = await import('../ipc.js');
         const { resolvePaths } = await import('../paths.js');
         const result = await ipcQuery(resolvePaths().socket, {
             type: 'menu-client.request', argv: args, sessionId: process.env.EVOLCORE_SESSION_ID,
-            delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
-        }, 250_000);
+            delegationToken: readDelegationCredential(),
+        }, 250_000, { throwOnError: true }).catch(error => {
+            if (!(error instanceof IpcTransportError))
+                throw error;
+            throw new MenuClientError(error.code, error.message);
+        });
         if (!result?.ok)
             throw new MenuClientError(result?.code ?? 'DAEMON_UNAVAILABLE', result?.error ?? 'Managed Menu daemon is unavailable');
         response = result.response;

package/dist/cli/model.js

@@ -20,7 +20,7 @@ import { ipcQuery } from '../ipc.js';
 import { parsePeerKey } from '../core/relation/peer-identity.js';
 import { resolvePeerRoleDetail } from '../config/peer-role-resolver.js';
 import { getFieldPermission } from '../config/roles.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { formatModelCheck, runModelCheck } from '../core/model/model-diagnostics.js';
 import { validateRuntimeStringFieldOverride } from '../core/role/runtime-policy.js';
 const ALL_EFFORTS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'auto'];
@@ -61,7 +61,7 @@ async function runCtlCommand(cmd, formatJson, timeoutMs = 10_000) {
         type: 'ctl',
         cmd,
         sessionId,
-        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+        delegationToken: readDelegationCredential(),
     }, timeoutMs);
     if (!result)
         fail(formatJson, 'DAEMON_UNAVAILABLE', '无法连接 evolcore 服务');
@@ -80,7 +80,7 @@ async function runManagedConfigOperation(args, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
     if (!sessionId)
         fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID 未设置');
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!delegationToken) {
         fail(formatJson, 'DELEGATION_REQUIRED', `${AGENT_DELEGATION_TOKEN_ENV} 未设置`);
     }

package/dist/cli/queue-command.js

@@ -1,6 +1,6 @@
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 export async function cmdQueue(args) {
     if (args.length === 0 || isHelpFlag(args[0]) || wantsHelp(args)) {
@@ -98,7 +98,7 @@ JSON 时间字段:
         after,
         before,
         sessionId: managed,
-        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+        delegationToken: readDelegationCredential(),
     } : {
         type: 'queue-snapshot',
         agent,

package/dist/cli/response.js

@@ -17,7 +17,7 @@ import { ResponseModeRegistry } from '../response-system/registry.js';
 import { registerBuiltinModes } from '../response-system/modes/index.js';
 import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 const RESPONSE_MODE_FIELD = 'responseMode';
 const RESPONSE_MODE_PARAMS_FIELD = 'responseModeParams';
 /**
@@ -59,7 +59,7 @@ function fail(formatJson, code, message) {
 }
 async function managedConfig(fieldArgs, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!sessionId)
         fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID is not set');
     if (!delegationToken)

package/dist/cli/restart-monitor.js

@@ -17,6 +17,8 @@ import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown } from './daemon-commands.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
 const execFileAsync = promisify(execFile);
+// Bound network notifications so they cannot hold up recovery after shutdown.
+const OWNER_NOTIFICATION_TIMEOUT_MS = 5000;
 /**
  * The package this monitor operates on, which is not always the one it runs
  * from.
@@ -480,6 +482,18 @@ async function sendHealSummary(p, attempts, log) {
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
+function withTimeout(promise, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timeout after ${timeoutMs}ms`)), timeoutMs);
+        // Keep the monitor alive until recovery can resume, even if the SDK's
+        // pending operation has no referenced handles of its own.
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+    });
+}
 function normalizePath(value) {
     return value.replace(/[\\/]+/g, '/').toLowerCase();
 }
@@ -1009,12 +1023,12 @@ async function notifyDaemonOwners(p, message, log) {
     const text = formatDaemonOwnerNotice(p, message);
     for (const owner of validOwners) {
         try {
-            const result = await msgSend({
+            const result = await withTimeout(msgSend({
                 from: daemonAid,
                 to: owner,
                 body: { mode: 'text', text },
                 slotId: 'restart-monitor',
-            });
+            }), OWNER_NOTIFICATION_TIMEOUT_MS);
             if (!result.ok) {
                 log(`Daemon owner notification failed for ${owner}: ${result.error}`);
                 continue;

package/dist/cli/task-command.js

@@ -0,0 +1,59 @@
+import { resolvePaths } from '../paths.js';
+import { ipcQuery } from '../ipc.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { wantsHelp } from './help.js';
+const TASK_HELP = `用法: ec task resume <sessionId> [--format json]
+
+恢复指定 EvolCore 会话的暂停任务或异常中断任务。
+暂停时释放工具门控；异常中断时继续原 baseagent 会话。
+已完成、正在执行或等待必要输入/审批的任务不会重复启动。
+
+独立 CLI 使用本地 control token；托管任务使用当前会话的 delegation，
+需有 Agent 管理权限，普通托管任务只能恢复本 Agent 的会话。`;
+export async function cmdTask(args) {
+    if (!args.length || wantsHelp(args)) {
+        console.log(TASK_HELP);
+        return;
+    }
+    const json = args.includes('--format') && args[args.indexOf('--format') + 1] === 'json';
+    const printError = (code, error) => {
+        if (json)
+            console.log(JSON.stringify({ ok: false, code, error }));
+        else
+            console.error(error);
+        process.exitCode = 1;
+    };
+    const targetSessionId = args[1]?.trim();
+    if (args[0] !== 'resume' || !targetSessionId || targetSessionId.startsWith('-')
+        || !(args.length === 2 || (args.length === 4 && args[2] === '--format' && args[3] === 'json'))) {
+        printError('INVALID_ARGUMENT', TASK_HELP);
+        return;
+    }
+    const sessionId = process.env.EVOLCORE_SESSION_ID;
+    const delegationToken = readDelegationCredential();
+    if (sessionId !== undefined && !sessionId.trim()) {
+        printError('INVALID_DELEGATION', 'EVOLCORE_SESSION_ID 不能为空');
+        return;
+    }
+    if (sessionId && !delegationToken) {
+        printError('DELEGATION_REQUIRED', '托管任务缺少 delegation token');
+        return;
+    }
+    const result = await ipcQuery(resolvePaths().socket, {
+        type: 'task.resume',
+        targetSessionId,
+        ...(sessionId ? { sessionId, delegationToken } : {}),
+    }, 10_000);
+    if (!result) {
+        printError('IPC_UNAVAILABLE', '无法连接 EvolCore 服务；请查询任务状态后再决定是否重试');
+        return;
+    }
+    if (json)
+        console.log(JSON.stringify(result));
+    else if ('message' in result)
+        console.log(result.message);
+    else
+        console.error(result.error);
+    if (!result.ok)
+        process.exitCode = 1;
+}