evolcore 0.0.26 → 0.0.28

package/dist/cli/model.js

@@ -20,7 +20,7 @@ import { ipcQuery } from '../ipc.js';
 import { parsePeerKey } from '../core/relation/peer-identity.js';
 import { resolvePeerRoleDetail } from '../config/peer-role-resolver.js';
 import { getFieldPermission } from '../config/roles.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { formatModelCheck, runModelCheck } from '../core/model/model-diagnostics.js';
 import { validateRuntimeStringFieldOverride } from '../core/role/runtime-policy.js';
 const ALL_EFFORTS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'auto'];
@@ -61,7 +61,7 @@ async function runCtlCommand(cmd, formatJson, timeoutMs = 10_000) {
         type: 'ctl',
         cmd,
         sessionId,
-        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+        delegationToken: readDelegationCredential(),
     }, timeoutMs);
     if (!result)
         fail(formatJson, 'DAEMON_UNAVAILABLE', '无法连接 evolcore 服务');
@@ -80,7 +80,7 @@ async function runManagedConfigOperation(args, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
     if (!sessionId)
         fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID 未设置');
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!delegationToken) {
         fail(formatJson, 'DELEGATION_REQUIRED', `${AGENT_DELEGATION_TOKEN_ENV} 未设置`);
     }

package/dist/cli/queue-command.js

@@ -1,6 +1,6 @@
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 export async function cmdQueue(args) {
     if (args.length === 0 || isHelpFlag(args[0]) || wantsHelp(args)) {
@@ -98,7 +98,7 @@ JSON 时间字段:
         after,
         before,
         sessionId: managed,
-        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+        delegationToken: readDelegationCredential(),
     } : {
         type: 'queue-snapshot',
         agent,

package/dist/cli/response.js

@@ -17,7 +17,7 @@ import { ResponseModeRegistry } from '../response-system/registry.js';
 import { registerBuiltinModes } from '../response-system/modes/index.js';
 import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 const RESPONSE_MODE_FIELD = 'responseMode';
 const RESPONSE_MODE_PARAMS_FIELD = 'responseModeParams';
 /**
@@ -59,7 +59,7 @@ function fail(formatJson, code, message) {
 }
 async function managedConfig(fieldArgs, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!sessionId)
         fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID is not set');
     if (!delegationToken)

package/dist/cli/restart-monitor.js

@@ -6,17 +6,27 @@ import { resolvePaths, getPackageRoot, daemonControlDir } from '../paths.js';
 import { loadDaemonConfig } from '../config-store.js';
 import * as platform from '../utils/cross-platform.js';
 import { EventBus } from '../core/event-bus.js';
-import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
+import { applyCachedPackageUpgrades, recordPackageUpgrade } from '../utils/package-version-info.js';
 import { isValidAid } from '../aun/aid/index.js';
 import { msgSend } from '../aun/msg/index.js';
 import { scanInstances, cleanupInstances, writeRestartMonitor, removeRestartMonitor, isRestartMonitorWinner, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
-import { WEB_PACKAGE_NAME } from '../product.js';
+import { MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME } from '../product.js';
 import { shouldSuppressRealRestart } from '../utils/restart-safety.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
-import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown } from './daemon-commands.js';
+import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown, stopCodexAppServerOrphans } from './daemon-commands.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
 const execFileAsync = promisify(execFile);
+// Bound network notifications so they cannot hold up recovery after shutdown.
+const OWNER_NOTIFICATION_TIMEOUT_MS = 5000;
+let foregroundDaemonExit;
+async function finishSuccessfulRestart() {
+    if (foregroundDaemonExit) {
+        removeRestartMonitor();
+        process.exit(await foregroundDaemonExit);
+    }
+    process.exit(0);
+}
 /**
  * The package this monitor operates on, which is not always the one it runs
  * from.
@@ -142,13 +152,14 @@ export async function cmdRestartMonitor() {
     // still alive. Refuse to create a second daemon when an unregistered process
     // from this package is found; a duplicate would connect AUN and kick the
     // existing session before failing on IPC/port ownership.
-    const runtimeOrphans = orphanSnapshot.filter(o => {
+    const belongsToRuntime = (o) => {
         if (o.confirmedTestDaemon)
             return false;
         const homeMatches = o.evolcoreHome && normalizePath(o.evolcoreHome) === normalizePath(p.root);
         const packageMatches = !o.evolcoreHome && normalizePath(o.cmdline).includes(normalizePath(targetPackageRoot()));
         return Boolean(homeMatches || packageMatches);
-    });
+    };
+    const runtimeOrphans = orphanSnapshot.filter(belongsToRuntime);
     if (runtimeOrphans.length > 0) {
         const pids = runtimeOrphans.map(o => o.pid).join(', ');
         log(`Stopping unregistered EvolCore process(es): ${pids}`);
@@ -236,15 +247,32 @@ export async function cmdRestartMonitor() {
         // for instance-file cleanup.
         cleanupInstances();
     }
-    // 版本检查与自动升级
-    log('Checking for updates...');
+    // Preserve CLI restart's final ownership guards and optional orphan cleanup
+    // here, after election/shutdown, so no launcher stops a daemon before a
+    // watchdog has successfully loaded.
+    const remaining = findOrphanProcesses();
+    if (scanInstances().mains.some(item => item.alive) || remaining.some(belongsToRuntime)) {
+        log('Restart aborted: a runtime process appeared or survived shutdown');
+        cleanupPendingFile(pendingFile, log);
+        process.exit(1);
+    }
+    const otherHome = remaining.filter(o => !o.confirmedTestDaemon && !belongsToRuntime(o));
+    if (process.argv.includes('--clear') && otherHome.length) {
+        log(`Cleaned cross-HOME orphans: ${killOrphans(otherHome).join(', ')}`);
+    }
+    else if (otherHome.length) {
+        log(`Other HOME orphan processes left running: ${otherHome.map(o => o.pid).join(', ')}`);
+    }
+    const stoppedCodex = stopCodexAppServerOrphans();
+    if (stoppedCodex)
+        log(`Cleaned ${stoppedCodex} EvolCore codex app-server orphan(s)`);
+    // Apply only the preflight cache. There is no registry VERSION query after
+    // shutdown (npm still downloads the exact cached package when needed).
+    log('Applying cached version information...');
     // 升级会原地替换整包，先留一个可回退的产物副本。备份放 EVOLCORE_HOME 而非包目录：
     // Linux/macOS 的全局目录常常不可写，而 HOME 一定可写。
     const upgradeBackup = await backupDistForUpgrade(p, log);
-    const [upgrade, ecwebUpgrade] = await Promise.all([
-        tryUpgrade(),
-        tryUpgradeGlobalPkg(() => resolveGlobalPkg(WEB_PACKAGE_NAME), WEB_PACKAGE_NAME),
-    ]);
+    const [upgrade, ecwebUpgrade] = await applyCachedPackageUpgrades(undefined, { log });
     let upgradeRolledBack;
     switch (upgrade.status) {
         case 'upgraded':
@@ -285,8 +313,7 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ evolcore 升级失败，使用当前版本继续\n${upgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // EC Web 是独立全局包，已安装时单独检查升级；与 EvolCore registry
-    // 查询并行执行，npm 安装阶段由 npm-ops 的全局锁串行化。
+    // EC Web independently applies a valid cached result under the install lock.
     switch (ecwebUpgrade.status) {
         case 'upgraded':
             log(`✅ ${WEB_PACKAGE_NAME} upgraded: ${ecwebUpgrade.from} → ${ecwebUpgrade.to}`);
@@ -320,6 +347,13 @@ export async function cmdRestartMonitor() {
     // 启动并检测 ready signal
     let started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
     if (started) {
+        if (upgrade.status === 'upgraded' || upgrade.status === 'failed') {
+            await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+                from: upgrade.from, to: upgrade.to, at: new Date().toISOString(),
+                status: upgradeRolledBack ? 'rolled-back' : upgrade.status === 'upgraded' ? 'succeeded' : 'failed',
+                error: upgradeRolledBack ?? upgrade.error,
+            }, log);
+        }
         if (upgradeRolledBack) {
             markRestartOutcome(pendingFile, 'rolled-back', upgradeRolledBack, log);
             log(`✓ Service restarted after upgrade rollback`);
@@ -339,15 +373,21 @@ export async function cmdRestartMonitor() {
         }
         archiveSelfHealLog(p, log);
         // 发起会话内的“重启成功”通知由新进程自行发送，此处只负责失败/自愈告警。
-        process.exit(0);
+        await finishSuccessfulRestart();
     }
     // 升级后的新版本起不来：回退到升级前的产物再试一次。
     if (upgradeVersions?.to && !upgradeRolledBack) {
+        await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+            ...upgradeVersions, at: new Date().toISOString(), status: 'failed', error: 'Upgraded daemon failed its ready check',
+        }, log);
         if (await restoreDistBackup(upgradeBackup, log)) {
             await notifyDaemonOwners(p, `⚠️ 升级到 ${upgradeVersions.to} 后启动失败，正在回滚到 ${upgradeVersions.from} 重试...`, log);
             started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
             if (started) {
                 const reason = `升级到 ${upgradeVersions.to} 后启动失败，已回滚到 ${upgradeVersions.from}`;
+                await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+                    ...upgradeVersions, at: new Date().toISOString(), status: 'rolled-back', error: reason,
+                }, log);
                 log(`✓ ${reason}`);
                 markRestartOutcome(pendingFile, 'rolled-back', reason, log);
                 await notifyDaemonOwners(p, `⚠️ ${reason}。当前运行旧版本，请检查后重试。`, log);
@@ -480,6 +520,18 @@ async function sendHealSummary(p, attempts, log) {
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
+function withTimeout(promise, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timeout after ${timeoutMs}ms`)), timeoutMs);
+        // Keep the monitor alive until recovery can resume, even if the SDK's
+        // pending operation has no referenced handles of its own.
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+    });
+}
 function normalizePath(value) {
     return value.replace(/[\\/]+/g, '/').toLowerCase();
 }
@@ -844,9 +896,10 @@ async function spawnAndWaitReady(p, log, timeout) {
     const out = fs.openSync(stdoutLog, 'a');
     const err = fs.openSync(stdoutLog, 'a');
     const appMain = path.join(targetPackageRoot(), 'dist', 'index.js');
+    const foreground = process.argv.includes('--foreground');
     const child = spawn(process.execPath, ['--no-warnings=ExperimentalWarning', appMain], {
-        detached: true,
-        stdio: ['ignore', out, err],
+        detached: !foreground,
+        stdio: foreground ? 'inherit' : ['ignore', out, err],
         windowsHide: true,
         env: {
             ...process.env,
@@ -858,7 +911,16 @@ async function spawnAndWaitReady(p, log, timeout) {
         }
     });
     const childPid = child.pid;
-    child.unref();
+    if (foreground) {
+        foregroundDaemonExit = new Promise(resolve => {
+            child.once('error', () => resolve(1));
+            child.once('exit', code => resolve(code ?? 1));
+        });
+    }
+    else
+        child.unref();
+    fs.closeSync(out);
+    fs.closeSync(err);
     log(`Spawned new process PID: ${childPid}, waiting for ready signal...`);
     // 轮询等待 ready.signal 出现
     const start = Date.now();
@@ -1009,12 +1071,12 @@ async function notifyDaemonOwners(p, message, log) {
     const text = formatDaemonOwnerNotice(p, message);
     for (const owner of validOwners) {
         try {
-            const result = await msgSend({
+            const result = await withTimeout(msgSend({
                 from: daemonAid,
                 to: owner,
                 body: { mode: 'text', text },
                 slotId: 'restart-monitor',
-            });
+            }), OWNER_NOTIFICATION_TIMEOUT_MS);
             if (!result.ok) {
                 log(`Daemon owner notification failed for ${owner}: ${result.error}`);
                 continue;

package/dist/cli/task-command.js

@@ -0,0 +1,59 @@
+import { resolvePaths } from '../paths.js';
+import { ipcQuery } from '../ipc.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { wantsHelp } from './help.js';
+const TASK_HELP = `用法: ec task resume <sessionId> [--format json]
+
+恢复指定 EvolCore 会话的暂停任务或异常中断任务。
+暂停时释放工具门控；异常中断时继续原 baseagent 会话。
+已完成、正在执行或等待必要输入/审批的任务不会重复启动。
+
+独立 CLI 使用本地 control token；托管任务使用当前会话的 delegation，
+需有 Agent 管理权限，普通托管任务只能恢复本 Agent 的会话。`;
+export async function cmdTask(args) {
+    if (!args.length || wantsHelp(args)) {
+        console.log(TASK_HELP);
+        return;
+    }
+    const json = args.includes('--format') && args[args.indexOf('--format') + 1] === 'json';
+    const printError = (code, error) => {
+        if (json)
+            console.log(JSON.stringify({ ok: false, code, error }));
+        else
+            console.error(error);
+        process.exitCode = 1;
+    };
+    const targetSessionId = args[1]?.trim();
+    if (args[0] !== 'resume' || !targetSessionId || targetSessionId.startsWith('-')
+        || !(args.length === 2 || (args.length === 4 && args[2] === '--format' && args[3] === 'json'))) {
+        printError('INVALID_ARGUMENT', TASK_HELP);
+        return;
+    }
+    const sessionId = process.env.EVOLCORE_SESSION_ID;
+    const delegationToken = readDelegationCredential();
+    if (sessionId !== undefined && !sessionId.trim()) {
+        printError('INVALID_DELEGATION', 'EVOLCORE_SESSION_ID 不能为空');
+        return;
+    }
+    if (sessionId && !delegationToken) {
+        printError('DELEGATION_REQUIRED', '托管任务缺少 delegation token');
+        return;
+    }
+    const result = await ipcQuery(resolvePaths().socket, {
+        type: 'task.resume',
+        targetSessionId,
+        ...(sessionId ? { sessionId, delegationToken } : {}),
+    }, 10_000);
+    if (!result) {
+        printError('IPC_UNAVAILABLE', '无法连接 EvolCore 服务；请查询任务状态后再决定是否重试');
+        return;
+    }
+    if (json)
+        console.log(JSON.stringify(result));
+    else if ('message' in result)
+        console.log(result.message);
+    else
+        console.error(result.error);
+    if (!result.ok)
+        process.exitCode = 1;
+}

package/dist/cli/task-context.js

@@ -1,14 +1,18 @@
 import { normalizeCausation } from '../core/causation/context.js';
 import { RUNTIME_LOCK_DIR_ENV } from '../core/runtime-lock.js';
 import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { resolveRoot } from '../paths.js';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
 export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
 export const DAEMON_RUNTIME_EPOCH_ENV = 'EVOLCORE_DAEMON_RUNTIME_EPOCH';
 export { RUNTIME_LOCK_DIR_ENV };
 const generatedProcessManagedTempDirs = new Set();
+const preparedWindowsSessionRuntimeDirs = new Set();
 let processTempCleanupRegistered = false;
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
@@ -37,7 +41,9 @@ function normalizeTaskRuntimeContext(value) {
         processRole: optionalProcessRole(value.processRole),
         dataScope: optionalDataScope(value.dataScope),
         authorizedBy: optionalString(value.authorizedBy),
-        executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
+        executionSource: value.executionSource === 'fullaccess-command'
+            || value.executionSource === 'trigger'
+            || value.executionSource === 'agent-policy'
             ? value.executionSource : undefined,
         daemonRuntimeEpoch: optionalString(value.daemonRuntimeEpoch),
         threadId: optionalString(value.threadId),
@@ -189,29 +195,81 @@ export function ensureProcessManagedTempDir() {
         throw error;
     }
 }
-function isRunnerOwnedSessionRuntimeDir(directory) {
-    const resolved = path.resolve(directory);
-    const base = path.basename(resolved);
-    const parent = path.dirname(resolved);
-    // Codex allocates a private, direct child named with a 24-character digest
-    // below its private evolcore-codex-* parent. The runner has already checked
-    // canonical containment before returning this path to the response engine.
-    const isCodexRuntime = /^[a-f0-9]{24}$/.test(base)
-        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(parent));
-    return isCodexRuntime && isPrivateDirectory(parent) && isPrivateDirectory(resolved);
+function canonicalHome() {
+    const configured = path.resolve(resolveRoot());
+    let canonical;
+    try {
+        canonical = fs.realpathSync.native(configured);
+    }
+    catch {
+        canonical = configured;
+    }
+    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+}
+function systemTempRoot() {
+    const testRoot = process.env.EVOLCORE_TEST === '1' && process.env.TMPDIR?.trim();
+    const candidate = testRoot && path.isAbsolute(testRoot)
+        ? testRoot
+        : process.platform === 'win32'
+            ? path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'Temp')
+            : process.platform === 'linux'
+                ? '/tmp'
+                : os.tmpdir();
+    try {
+        return fs.realpathSync.native(candidate);
+    }
+    catch {
+        return path.resolve(candidate);
+    }
+}
+function sessionRuntimeName(sessionId) {
+    const digest = crypto.createHash('sha256')
+        .update(canonicalHome())
+        .update('\0')
+        .update(sessionId)
+        .digest('hex')
+        .slice(0, 24);
+    return `ec-session-${digest}`;
 }
-/** Whether a task-provided runtime directory stays inside the process-managed
- * TMPDIR and is safe to use for transient writes. */
+/**
+ * Windows Codex sandbox accounts and ordinary runner accounts are members of
+ * BUILTIN\Users. Session isolation is enforced by the distinct path plus the
+ * runner filesystem policy, so the runtime directory only needs a portable
+ * writable ACL rather than host-user secrecy.
+ */
+function ensureWindowsSessionRuntimeAccess(directory) {
+    if (process.platform !== 'win32' || preparedWindowsSessionRuntimeDirs.has(directory))
+        return;
+    const icacls = path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'System32', 'icacls.exe');
+    execFileSync(icacls, [
+        directory,
+        '/grant',
+        '*S-1-5-32-545:(OI)(CI)M',
+        '/Q',
+    ], { windowsHide: true, stdio: 'pipe' });
+    preparedWindowsSessionRuntimeDirs.add(directory);
+}
+/** Whether a task-provided runtime directory is a stable EvolCore session root. */
 export function isManagedSessionRuntimeDir(directory, managedRoot) {
-    const tmpDir = (managedRoot ?? process.env.TMPDIR)?.trim();
-    if (!directory || !path.isAbsolute(directory) || !tmpDir || !path.isAbsolute(tmpDir))
+    if (!directory || !path.isAbsolute(directory))
         return false;
-    const root = path.resolve(tmpDir);
     const resolved = path.resolve(directory);
-    const relative = path.relative(root, resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+    const suppliedRoot = managedRoot?.trim();
+    const candidateRoot = suppliedRoot && path.isAbsolute(suppliedRoot)
+        ? path.resolve(suppliedRoot)
+        : systemTempRoot();
+    const root = candidateRoot === resolved ? path.dirname(resolved) : candidateRoot;
+    if (path.dirname(resolved) !== root || !/^ec-session-[a-f0-9]{24}$/.test(path.basename(resolved)))
+        return false;
+    try {
+        const rootStat = fs.lstatSync(root);
+        if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+            return false;
+    }
+    catch {
         return false;
-    return isPrivateDirectory(root) && isPrivateDirectory(resolved);
+    }
+    return isPrivateDirectory(resolved);
 }
 /**
  * Resolve the session-owned temporary root for a managed child process.
@@ -241,58 +299,43 @@ export function getManagedTaskTempDir(runtimeEnv) {
         && (!processRoot || !path.isAbsolute(processRoot) || path.resolve(configured) !== path.resolve(processRoot))
         && contextDir
         && path.resolve(contextDir) === path.resolve(configured)
-        && (isManagedSessionRuntimeDir(configured) || isRunnerOwnedSessionRuntimeDir(configured));
+        && isManagedSessionRuntimeDir(configured);
     if (!trusted) {
         throw new Error('managed session TMPDIR is unavailable or untrusted');
     }
     return path.resolve(configured);
 }
 /**
- * Create a private runtime directory below the process-provided TMPDIR.
- * There is deliberately no os.tmpdir() fallback: managed sessions must not
- * silently escape the session-owned temporary workspace.
+ * Create the stable private runtime directory for one EvolCore session.
+ * Its identity is independent of daemon/runner lifetimes and rotates only
+ * when EvolCore creates a new session id.
  */
 export function ensureSessionRuntimeDir(sessionId) {
     if (!sessionId)
         return undefined;
-    let base = process.env.TMPDIR?.trim();
-    try {
-        if (!base || !path.isAbsolute(base) || !isPrivateDirectory(path.resolve(base))) {
-            base = ensureProcessManagedTempDir();
-        }
-    }
-    catch {
-        return undefined;
-    }
-    if (!base || !path.isAbsolute(base))
-        return undefined;
-    const root = path.resolve(base);
-    const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
-    const directory = path.join(root, `evolcore-runtime-${digest}`);
+    const root = systemTempRoot();
+    const directory = path.join(root, sessionRuntimeName(sessionId));
     try {
         fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-        if (!isPrivateDirectory(root))
-            return undefined;
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        ensureWindowsSessionRuntimeAccess(directory);
         fs.mkdirSync(path.join(directory, 'locks'), { recursive: true, mode: 0o700 });
-        return isManagedSessionRuntimeDir(directory) ? directory : undefined;
+        return isManagedSessionRuntimeDir(directory, root) ? directory : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Shared by tasks in one daemon runtime, while remaining outside each
- * session's history/files area. The caller must still pass this path through
- * the task environment before a sandboxed child can use it. */
+/** Return the lock namespace inside the session-owned runtime directory. */
 export function ensureRuntimeLockDir(sessionRuntimeDir) {
     if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
         return undefined;
-    if (!isManagedSessionRuntimeDir(sessionRuntimeDir) && !isRunnerOwnedSessionRuntimeDir(sessionRuntimeDir))
+    if (!isManagedSessionRuntimeDir(sessionRuntimeDir))
         return undefined;
-    const parent = path.dirname(path.resolve(sessionRuntimeDir));
+    const parent = path.resolve(sessionRuntimeDir);
     if (!isPrivateDirectory(parent))
         return undefined;
-    const directory = path.join(parent, 'evolcore-locks');
+    const directory = path.join(parent, 'locks');
     try {
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
         return isPrivateDirectory(directory) ? directory : undefined;
@@ -325,7 +368,7 @@ export function parseTaskRuntimeContext(raw) {
 export function readTaskRuntimeContextFromEnv(env = process.env) {
     return parseTaskRuntimeContext(env[TASK_RUNTIME_CONTEXT_ENV]);
 }
-export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500) {
+export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500, env = process.env) {
     if (!sessionId)
         return undefined;
     try {
@@ -333,7 +376,12 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
             import('../paths.js'),
             import('../ipc.js'),
         ]);
-        const response = await ipcQuery(resolvePaths().socket, { type: 'task-runtime-context', sessionId }, timeoutMs);
+        const response = await ipcQuery(resolvePaths().socket, {
+            type: 'task-runtime-context',
+            sessionId,
+            delegationToken: readDelegationCredential(env),
+            daemonRuntimeEpoch: env[DAEMON_RUNTIME_EPOCH_ENV],
+        }, timeoutMs);
         return response?.ok && response.context ? response.context : undefined;
     }
     catch {
@@ -343,7 +391,7 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
 export async function readBestTaskRuntimeContext(env = process.env) {
     const envContext = readTaskRuntimeContextFromEnv(env);
     const sessionId = env.EVOLCORE_SESSION_ID || envContext?.sessionId;
-    return (await readTaskRuntimeContextFromDaemon(sessionId)) ?? envContext;
+    return (await readTaskRuntimeContextFromDaemon(sessionId, 500, env)) ?? envContext;
 }
 export function buildTaskRuntimeEnv(ctx) {
     const clean = normalizeTaskRuntimeContext(ctx);

package/dist/cli/trigger-command.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
 import { isHelpFlag, wantsHelp } from './help.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { readTaskRuntimeContextFromEnv } from './task-context.js';
 import { normalizeTriggerDefinition, resolveScriptPath, } from '../trigger/validation.js';
 export async function cmdTrigger(args) {
@@ -101,13 +101,15 @@ function printHelp() {
 
 Create 参数模式支持:
   --once | --delay <时长> | --at <ISO时间> | --cron <表达式> | --every <时长> | --event <事件模式>
+  --event-filter <JSON>  (仅 --event；按事件 payload 字段匹配)
   --exec <script|trigger-session|target-session>  (必填)
   --prompt <文本> | --prompt-file <路径>
     Shell 双引号内的双引号、反引号和变量形式的美元符号都需在前面加反斜杠；trigger 保存的是还原后的原文
   --script-path <路径> --script-runtime <node|python|bash>
   --script-args <JSON> --script-timeout <时长>
-  --feedback <target>  (origin/silent 仅可通过 --file 导入)
+  --feedback <target|event-session>  (event-session 使用事件来源会话)
   --baseagent <name>  (仅 --exec trigger-session)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
   --model <模型>  --effort <low|medium|high|xhigh|max>
   --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
   --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
@@ -125,10 +127,11 @@ Update 参数:
   --once | --delay | --at | --cron | --every | --event [--tz]
   --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
   --description <文本>  (空字符串删除)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
   --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
   --max-runs <次数>  --max-duration <时长>
   --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
-  --feedback <origin|target|silent>
+  --feedback <origin|target|event-session|silent>
   --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
   --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
   --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
@@ -189,6 +192,7 @@ async function showTrigger(args, json) {
     if (t.execution.type === 'script')
         console.log(`script: ${scriptCommandLabel(t.execution.script)}`);
     console.log(`model: ${t.execution.model ?? 'inherit'}`);
+    console.log(`executionTimeoutMs: ${t.execution.timeoutMs ?? 'default'}`);
     console.log(`effort: ${t.execution.effort ?? 'inherit'}`);
     console.log(`permission: ${t.execution.permissionMode ?? 'inherit'}`);
     console.log(`feedback: ${t.feedback.strategy}${t.feedback.target ? ` -> ${t.feedback.target.channelKey}/${t.feedback.target.channelId}/${t.feedback.target.session}` : ''}`);
@@ -266,13 +270,14 @@ async function createTrigger(args, json) {
     }
     const parsed = parseResult.value;
     const agentAid = parsed.agentId ?? resolveAgentAid(args);
-    if (parsed.feedbackStrategy !== 'target') {
+    const eventSession = parsed.feedbackStrategy === 'event_session';
+    if (parsed.feedbackStrategy !== 'target' && !eventSession) {
         throw new Error('CLI flag 模式仅支持 --feedback target；origin/silent 请使用 /trigger 或 --file 导入 Trigger V3 第二阶段 JSON');
     }
-    if (!parsed.targetChannel || !parsed.targetChannelId) {
+    if (!eventSession && (!parsed.targetChannel || !parsed.targetChannelId)) {
         throw new Error('CLI flag 模式需要显式指定 --target-channel <channelKey> --target-channel-id <id>');
     }
-    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel.startsWith('aun#');
+    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel?.startsWith('aun#');
     if (targetIsAun && !parsed.targetChatType) {
         throw new Error('AUN 目标必须显式指定 --target-chat-type private 或 group');
     }
@@ -299,6 +304,7 @@ async function createTrigger(args, json) {
             type: parsed.executionType,
             ...(script ? { script } : { prompt: parsed.prompt }),
             ...(parsed.model ? { model: parsed.model } : {}),
+            ...(parsed.executionTimeoutMs !== undefined ? { timeoutMs: parsed.executionTimeoutMs } : {}),
             ...(parsed.effort ? { effort: parsed.effort } : {}),
             ...(parsed.permissionMode ? { permissionMode: parsed.permissionMode } : {}),
             ...(parsed.executionType === 'trigger_session' ? {
@@ -308,7 +314,7 @@ async function createTrigger(args, json) {
             onError: 'retry',
             noopSentinel: '[[NOOP]]',
         },
-        feedback: {
+        feedback: eventSession ? { strategy: 'event_session' } : {
             strategy: 'target',
             target: {
                 channelKey: parsed.targetChannel,
@@ -362,8 +368,12 @@ function sourceFromParsed(parsed) {
     }
     if (parsed.scheduleType === 'interval')
         return { type: 'interval', everyMs: Number(parsed.scheduleValue) };
-    if (parsed.scheduleType === 'event')
-        return { type: 'event', eventPattern: parsed.scheduleValue };
+    if (parsed.scheduleType === 'event') {
+        const source = { type: 'event', eventPattern: parsed.scheduleValue };
+        if (parsed.eventFilter !== undefined)
+            source.filter = parsed.eventFilter;
+        return source;
+    }
     throw new Error(`unsupported scheduleType: ${parsed.scheduleType}`);
 }
 function executionTypeFromFlag(args) {
@@ -565,7 +575,7 @@ function handleTemplate(args) {
 }
 async function request(cmd, timeoutMs = 10_000) {
     const actorSessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     let controlToken;
     if (!actorSessionId) {
         try {