evolcore 0.0.27 → 0.0.28

package/dist/cli/daemon-commands.js

@@ -9,22 +9,23 @@ import { loadDefaults, loadAllAgents, loadDaemonConfig, saveDaemonConfig } from
 import { resolveEffective } from '../config/config-manager.js';
 import { resolveAnthropicConfig } from '../agents/baseagent.js';
 import { migrateProject } from '../config-store.js';
-import { ipcQuery } from '../ipc.js';
+import { ipcQuery, IpcTransportError } from '../ipc.js';
 import { isHelpFlag } from './help.js';
 import { cmdInit, needsControlAidInit, initTail } from './init.js';
 import * as platform from '../utils/cross-platform.js';
 import { EventBus } from '../core/event-bus.js';
-import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
+import { tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
+import { ensureFreshPackageVersionInfo } from '../utils/package-version-info.js';
 import { ecwebVersionRequirementError, resolveEcwebLaunchCommand, fetchRemotePairingCode } from '../utils/ecweb-utils.js';
 import { isHostChinese } from '../utils/locale.js';
-import { scanInstances, cleanupInstances, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
+import { scanInstances, cleanupInstances, findOrphanProcesses } from '../utils/instance-registry.js';
 import { filterLogFiles, deriveLogTypes, computePreChecked, validateLogTypes, shortLogName as shortLogNameLocal, isWatchLogFile } from './watch-logs.js';
 import { displaySessionTitle } from '../core/session/session-title.js';
 import { isNonAgentSessionChannel } from '../core/system-channels.js';
 import { printCodeStats } from './code-stats.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
-import { readDelegationCredential } from '../core/auth/agent-delegation.js';
-import { WEB_CLI_BIN, WEB_PACKAGE_LATEST, WEB_PACKAGE_NAME } from '../product.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { RUNTIME_HOME_ENV, WEB_CLI_BIN, WEB_PACKAGE_LATEST, WEB_PACKAGE_NAME } from '../product.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
@@ -250,27 +251,46 @@ function runSourceBuild() {
         });
     });
 }
-/**
- * Spawn the restart monitor and confirm it actually reached its own code.
- *
- * The daemon is already stopped at this point, so a monitor that dies on
- * startup leaves nothing running and nobody watching — the exact silent
- * failure this mechanism exists to prevent.
- */
-async function spawnRestartMonitorAndConfirm(monitorEntry, reportLine) {
-    const result = await platform.launchMonitorAndConfirm([...monitorEntry.args, 'restart-monitor'], { EVOLCORE_HOME: resolvePaths().root, ...(monitorEntry.env ?? {}) }, pid => scanInstances().restartMonitors.some(m => m.alive && m.record.pid === pid), pid => scanInstances().restartMonitors.some(m => m.alive && m.record.pid !== pid));
-    if (result.ok)
-        return { ok: true };
-    for (const line of (result.stderrTail ?? '').split(/\r?\n/).filter(Boolean).slice(-8)) {
-        reportLine(`  | ${line}`);
-    }
-    return { ok: false, reason: result.reason ?? 'unknown' };
-}
 async function requireFreshSourceBuild() {
     if (!sourceBuildNeedsRefresh())
         return true;
     return await runSourceBuild();
 }
+async function launchPackageLifecycle(source, log, options = {}) {
+    if (!options.prepared)
+        await ensureFreshPackageVersionInfo(undefined, { source, log });
+    const root = resolvePaths().root;
+    const launch = platform.resolveMonitorLaunch(getPackageRoot(), path.join(root, 'data', 'monitor-stage'));
+    if (launch.note)
+        log(launch.note);
+    if (!fs.existsSync(launch.entry)) {
+        if (launch.stageDir)
+            platform.cleanupMonitorStage(launch.stageDir);
+        return { ok: false, reason: 'RESTART_ENTRY_MISSING' };
+    }
+    const args = [...launch.args, 'restart-monitor', ...(options.clear ? ['--clear'] : [])];
+    const env = { ...options.env, [RUNTIME_HOME_ENV]: root, ...launch.env, [AGENT_DELEGATION_TOKEN_ENV]: '' };
+    if (options.foreground) {
+        return new Promise(resolve => {
+            const child = spawn(process.execPath, [...args, '--foreground'], {
+                stdio: 'inherit', detached: false, windowsHide: true, env: { ...process.env, ...env },
+            });
+            child.once('error', () => {
+                if (launch.stageDir)
+                    platform.cleanupMonitorStage(launch.stageDir);
+                resolve({ ok: false, reason: 'Foreground monitor could not start' });
+            });
+            child.once('exit', code => {
+                process.exitCode = code ?? 1;
+                resolve({ ok: code === 0, ...(code !== 0 ? { reason: 'Foreground lifecycle exited unsuccessfully' } : {}) });
+            });
+        });
+    }
+    const result = await platform.launchMonitorAndConfirm(args, env, pid => scanInstances().restartMonitors.some(item => item.alive && item.record.pid === pid), pid => scanInstances().restartMonitors.some(item => item.alive && item.record.pid !== pid));
+    if (!result.ok && launch.stageDir)
+        platform.cleanupMonitorStage(launch.stageDir);
+    return { ok: result.ok, ...(!result.ok ? { reason: result.reason } : {}) };
+}
 function requireCompletedDataMigration(root, action = 'start') {
     const requirement = inspectDataMigrationRequirement(root);
     if (!requirement.required)
@@ -291,7 +311,11 @@ function requireCompletedDataMigration(root, action = 'start') {
  * A failed upgrade is reported, but the currently installed version remains
  * usable and the caller continues with its normal lifecycle.
  */
-export async function runUpgradeChecks(upgradeFn = signal => tryUpgrade({ signal }), ecwebUpgradeFn = signal => tryUpgradeGlobalPkg(() => resolveGlobalPkg(WEB_PACKAGE_NAME), WEB_PACKAGE_NAME, { signal }), timeoutMs = 60_000) {
+export async function runUpgradeChecks(upgradeFn, ecwebUpgradeFn, timeoutMs = 60_000) {
+    if (!upgradeFn || !ecwebUpgradeFn) {
+        await ensureFreshPackageVersionInfo(undefined, { source: 'start', log: console.log });
+        return;
+    }
     console.log('📦 Checking for updates...');
     const runWithTimeout = async (label, fn) => {
         const controller = new AbortController();
@@ -470,7 +494,9 @@ export async function cmdStart(opts = {}) {
         return;
     // A stopped container may miss the daily upgrade trigger. Check once on
     // every real start so the service does not stay on an old installation.
-    await (opts.upgradeChecks ?? runUpgradeChecks)();
+    const versionInfo = await ensureFreshPackageVersionInfo(undefined, { source: 'start', log: console.log });
+    if (opts.upgradeChecks)
+        await opts.upgradeChecks();
     // 旧配置自动迁移（daemon.json → 新结构）
     const { autoMigrateIfNeeded } = await import('../config-store.js');
     autoMigrateIfNeeded();
@@ -595,6 +621,20 @@ export async function cmdStart(opts = {}) {
         return;
     }
     reportOrphans(orphans);
+    if (versionInfo.some(result => result.hasUpdate)) {
+        cleanEnv();
+        const launched = await launchPackageLifecycle('start', console.log, {
+            prepared: true, foreground: opts.foreground, env: buildDaemonEnv(p, opts),
+        });
+        if (!launched.ok) {
+            console.error(`❌ 启动事务未能建立：${launched.reason}`);
+            process.exitCode = 1;
+        }
+        else if (!opts.foreground) {
+            console.log('📦 已交由 restart-monitor 应用缓存版本并启动服务');
+        }
+        return;
+    }
     console.log('🚀 Starting EvolCore...');
     const stdoutRotation = rotateStdoutLog(p.logs);
     if (stdoutRotation.rotatedPath) {
@@ -883,126 +923,18 @@ export async function cmdRestart(opts = {}) {
         if (initialRuntimeOrphans.length === 0 && rejectPidIsolatedLifecycle('restart', initialStatus, ping))
             return;
     }
-    // 构建交给 restart-monitor：它在 daemon 停止之后才编译，dist/ 不会被活进程
-    // 占用，失败还能回滚到上一份产物。这里再编译一次会落在事务保护之外。
-    // restart-monitor owns upgrade checks. Running them here as well caused a
-    // normal restart to perform every registry lookup twice, and in installed
-    // mode could race the monitor while it was preparing its rollback point.
+    // The shared launchPackageLifecycle path delegates to launchMonitorAndConfirm;
+    // the monitor retains shutdown, orphan checks, build and rollback ownership.
+    // Network preflight must finish before a confirmed monitor stops the daemon.
     if (!requireCompletedDataMigration(resolveRoot(), 'restart'))
         return;
-    // 停止所有活 main 进程（可能不止一个）
-    const status = initialStatus;
-    const aliveMains = status.mains.filter(m => m.alive);
-    if (aliveMains.length > 0) {
-        if (aliveMains.length > 1) {
-            console.log(`⚠ 检测到 ${aliveMains.length} 个 main 实例，将一并停止: ${aliveMains.map(m => m.record.pid).join(', ')}`);
-        }
-        const mainPids = new Set(aliveMains.map(entry => entry.record.pid));
-        const currentPing = await probeDaemon(socketPath);
-        const gracefulPid = currentPing && mainPids.has(currentPing.pid)
-            ? await requestDaemonShutdown(socketPath, DAEMON_SHUTDOWN_TIMEOUT_MS, 'ec restart', mainPids)
-            : null;
-        const stopped = await Promise.all(aliveMains.map(m => stopPid(m.record.pid, m.record.pid === gracefulPid, m.record.startedAt)));
-        if (stopped.some(result => !result)) {
-            console.error('❌ Restart aborted because an existing EvolCore process could not be stopped');
-            process.exitCode = 1;
-            return;
-        }
-        await sleep(500);
-    }
-    cleanupInstances();
-    const remainingMainProcesses = scanInstances().mains.filter(entry => entry.alive);
-    if (remainingMainProcesses.length > 0) {
-        console.error(`❌ Restart aborted: EvolCore process still registered and alive (PID: ${remainingMainProcesses.map(entry => entry.record.pid).join(', ')})`);
-        process.exitCode = 1;
-        return;
-    }
-    // 孤儿处理：同 HOME/同安装包的孤儿属于本运行时，先确认退出再替换；
-    // 跨 HOME 的孤儿只在 --clear 时 kill，否则仅警告。findOrphanProcesses
-    // 在 Windows 上需要一次 CIM 查询；保留一个快照，避免同一阶段重复扫描。
-    {
-        const orphans = findOrphanProcesses();
-        const confirmedTestDaemons = orphans.filter(o => o.confirmedTestDaemon);
-        if (confirmedTestDaemons.length > 0) {
-            const killed = killOrphans(confirmedTestDaemons);
-            console.log(`☠ 已清理 ${killed.length} 个泄漏的测试 daemon: ${killed.join(', ')}`);
-            await sleep(500);
-        }
-        const runtimeOrphans = orphans.filter(o => isRuntimeOrphan(o));
-        if (runtimeOrphans.length > 0) {
-            console.log(`⚠ 检测到未登记的 EvolCore 进程，将一并停止: ${runtimeOrphans.map(o => o.pid).join(', ')}`);
-            const orphanPids = new Set(runtimeOrphans.map(orphan => orphan.pid));
-            const currentPing = await probeDaemon(socketPath);
-            const gracefulPid = currentPing && orphanPids.has(currentPing.pid)
-                ? await requestDaemonShutdown(socketPath, DAEMON_SHUTDOWN_TIMEOUT_MS, 'ec restart', orphanPids)
-                : null;
-            const stopped = await Promise.all(runtimeOrphans.map(o => stopPid(o.pid, o.pid === gracefulPid)));
-            if (stopped.some(result => !result)) {
-                console.error('❌ Restart aborted because an unregistered EvolCore process could not be stopped');
-                process.exitCode = 1;
-                return;
-            }
-            await sleep(500);
-        }
-        // stopPid() already waited for every runtime orphan above, so avoid a
-        // second scan before handling cross-HOME records.
-        const otherHome = orphans.filter(o => !o.confirmedTestDaemon && !isRuntimeOrphan(o));
-        if (opts.clear && otherHome.length > 0) {
-            const killed = killOrphans(otherHome);
-            console.log(`☠ 已 SIGKILL ${killed.length} 个跨 HOME 孤儿进程: ${killed.join(', ')}`);
-            await sleep(500);
-        }
-        else if (otherHome.length > 0) {
-            reportOrphans(otherHome);
-        }
-        // Keep the post-stop ownership guard: a process that appeared during the
-        // cleanup window must still block replacement.
-        const remainingRuntimeOrphans = findOrphanProcesses().filter(o => isRuntimeOrphan(o));
-        if (remainingRuntimeOrphans.length > 0) {
-            console.error(`❌ Restart aborted: EvolCore process still running (PID: ${remainingRuntimeOrphans.map(o => o.pid).join(', ')})`);
-            process.exitCode = 1;
-            return;
-        }
-    }
-    // 只清理 EvolCore 自己登记的 codex app-server，不能影响桌面端实例。
-    {
-        const killed = stopCodexAppServerOrphans();
-        if (killed > 0) {
-            console.log(`☠ 已清理 ${killed} 个 EvolCore codex app-server 孤儿进程`);
-            await sleep(500);
-        }
-    }
-    console.log(`⏱ restart prep done in ${((Date.now() - cmdStartedAt) / 1000).toFixed(1)}s, starting...`);
-    // 通过 restart-monitor 启动，避免在 agent 内调用时自杀。
-    // 开发仓下 monitor 从源码跑；安装包下先复制到 stage 目录，两种情况都让看门狗
-    // 不住在会被替换的产物里。
-    const monitorEntry = platform.resolveMonitorLaunch(getPackageRoot(), path.join(resolvePaths().root, 'data', 'monitor-stage'));
-    if (monitorEntry.note)
-        console.log(`ℹ ${monitorEntry.note}`);
-    if (!fs.existsSync(monitorEntry.entry)) {
-        console.error(`❌ 重启中止：找不到 restart-monitor 入口 ${monitorEntry.entry}`);
-        console.error('  请先执行 npm run build 重建产物');
+    const launched = await launchPackageLifecycle('restart', console.log, { clear: opts.clear });
+    if (!launched.ok) {
+        console.error(`❌ 重启中止：restart-monitor 未能启动（${launched.reason}）；当前服务未主动停止`);
         process.exitCode = 1;
         return;
     }
-    const monitorStarted = await spawnRestartMonitorAndConfirm(monitorEntry, log => console.error(log));
-    if (!monitorStarted.ok) {
-        if (monitorEntry.stageDir)
-            platform.cleanupMonitorStage(monitorEntry.stageDir);
-        console.error(`❌ 重启中止：restart-monitor 未能启动（${monitorStarted.reason}）`);
-        if (fs.existsSync(path.join(getPackageRoot(), 'src', 'cli', 'index.ts'))) {
-            console.error('  源码可能存在语法错误导致 tsx 无法加载。请执行 npx tsc --noEmit 检查。');
-        }
-        console.error('  服务已停止，请修复后执行 ec start。');
-        process.exitCode = 1;
-        return;
-    }
-    console.log('🔄 Restart monitor started; service is coming back online in the background...');
-    // 代码统计（开发环境）
-    if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
-        console.log('');
-        printCodeStats(getPackageRoot(), resolvePaths().logs);
-    }
+    console.log(`🔄 Restart monitor started (${((Date.now() - cmdStartedAt) / 1000).toFixed(1)}s); service is restarting...`);
 }
 function normalizeRuntimePath(value) {
     return value.replace(/[\\/]+/g, '/').toLowerCase();
@@ -1310,8 +1242,13 @@ export async function cmdStatus() {
         console.log('  请稍后再次执行 ec status。');
     }
     else {
-        console.log(ipcFailure ? '⚠ 无法确认 EvolCore 运行状态：IPC 不可用，且没有可见的存活 PID。' : '⚠ EvolCore is not running');
-        if (ipcFailure)
+        // With no live main/monitor, a missing Windows pipe is the normal stopped
+        // state. Preserve uncertainty for permissions, timeouts, unknown errors,
+        // and Unix callers that may be isolated from the daemon's PID namespace.
+        const stopped = !ipcFailure || (platform.isWindows && ipcFailure instanceof IpcTransportError
+            && ['ENOENT', 'ECONNREFUSED'].includes(ipcFailure.code));
+        console.log(stopped ? '⚠ EvolCore is not running' : '⚠ 无法确认 EvolCore 运行状态：IPC 不可用，且没有可见的存活 PID。');
+        if (!stopped && ipcFailure)
             console.log(`  ${ipcFailure instanceof Error ? ipcFailure.message : String(ipcFailure)}`);
     }
     // Session & Project statistics (从文件系统读)

package/dist/cli/diag.js

@@ -5,7 +5,7 @@ import { parseDiagArgs } from '../core/command/diag-service.js';
 import { wantsHelp } from './help.js';
 export async function cmdDiag(args) {
     if (wantsHelp(args)) {
-        console.log('用法：ec diag <问题描述> [--owner <daemonOwner-aid>] [--format json]\n      ec diag stop [--format json]\n未指定 --owner 时联系本机 daemon.json.owners[0]。');
+        console.log('用法：ec diag <问题描述> [--owner <daemonOwner-aid>] [--format json]\n      ec diag stop [--format json]\n未指定 --owner 时联系本机 daemon.json.owners[0]；有效诊断期间再次执行会追加到原 case。');
         return;
     }
     const json = args.at(-2) === '--format' && args.at(-1) === 'json';

package/dist/cli/menu-client.js

@@ -111,4 +111,8 @@ export async function cmdMenuClient(args) {
     else
         response = await executeMenuClientRequest(parseMenuClientArgs(args));
     console.log(JSON.stringify(response, null, 2));
+    // Transport success does not imply the requested operation succeeded.
+    // Preserve the complete wire response for callers while failing the CLI.
+    if (response?.error)
+        process.exitCode = 1;
 }

package/dist/cli/restart-monitor.js

@@ -6,19 +6,27 @@ import { resolvePaths, getPackageRoot, daemonControlDir } from '../paths.js';
 import { loadDaemonConfig } from '../config-store.js';
 import * as platform from '../utils/cross-platform.js';
 import { EventBus } from '../core/event-bus.js';
-import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
+import { applyCachedPackageUpgrades, recordPackageUpgrade } from '../utils/package-version-info.js';
 import { isValidAid } from '../aun/aid/index.js';
 import { msgSend } from '../aun/msg/index.js';
 import { scanInstances, cleanupInstances, writeRestartMonitor, removeRestartMonitor, isRestartMonitorWinner, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
-import { WEB_PACKAGE_NAME } from '../product.js';
+import { MAIN_PACKAGE_NAME, WEB_PACKAGE_NAME } from '../product.js';
 import { shouldSuppressRealRestart } from '../utils/restart-safety.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
-import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown } from './daemon-commands.js';
+import { DAEMON_SHUTDOWN_TIMEOUT_MS, requestDaemonShutdown, stopCodexAppServerOrphans } from './daemon-commands.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
 const execFileAsync = promisify(execFile);
 // Bound network notifications so they cannot hold up recovery after shutdown.
 const OWNER_NOTIFICATION_TIMEOUT_MS = 5000;
+let foregroundDaemonExit;
+async function finishSuccessfulRestart() {
+    if (foregroundDaemonExit) {
+        removeRestartMonitor();
+        process.exit(await foregroundDaemonExit);
+    }
+    process.exit(0);
+}
 /**
  * The package this monitor operates on, which is not always the one it runs
  * from.
@@ -144,13 +152,14 @@ export async function cmdRestartMonitor() {
     // still alive. Refuse to create a second daemon when an unregistered process
     // from this package is found; a duplicate would connect AUN and kick the
     // existing session before failing on IPC/port ownership.
-    const runtimeOrphans = orphanSnapshot.filter(o => {
+    const belongsToRuntime = (o) => {
         if (o.confirmedTestDaemon)
             return false;
         const homeMatches = o.evolcoreHome && normalizePath(o.evolcoreHome) === normalizePath(p.root);
         const packageMatches = !o.evolcoreHome && normalizePath(o.cmdline).includes(normalizePath(targetPackageRoot()));
         return Boolean(homeMatches || packageMatches);
-    });
+    };
+    const runtimeOrphans = orphanSnapshot.filter(belongsToRuntime);
     if (runtimeOrphans.length > 0) {
         const pids = runtimeOrphans.map(o => o.pid).join(', ');
         log(`Stopping unregistered EvolCore process(es): ${pids}`);
@@ -238,15 +247,32 @@ export async function cmdRestartMonitor() {
         // for instance-file cleanup.
         cleanupInstances();
     }
-    // 版本检查与自动升级
-    log('Checking for updates...');
+    // Preserve CLI restart's final ownership guards and optional orphan cleanup
+    // here, after election/shutdown, so no launcher stops a daemon before a
+    // watchdog has successfully loaded.
+    const remaining = findOrphanProcesses();
+    if (scanInstances().mains.some(item => item.alive) || remaining.some(belongsToRuntime)) {
+        log('Restart aborted: a runtime process appeared or survived shutdown');
+        cleanupPendingFile(pendingFile, log);
+        process.exit(1);
+    }
+    const otherHome = remaining.filter(o => !o.confirmedTestDaemon && !belongsToRuntime(o));
+    if (process.argv.includes('--clear') && otherHome.length) {
+        log(`Cleaned cross-HOME orphans: ${killOrphans(otherHome).join(', ')}`);
+    }
+    else if (otherHome.length) {
+        log(`Other HOME orphan processes left running: ${otherHome.map(o => o.pid).join(', ')}`);
+    }
+    const stoppedCodex = stopCodexAppServerOrphans();
+    if (stoppedCodex)
+        log(`Cleaned ${stoppedCodex} EvolCore codex app-server orphan(s)`);
+    // Apply only the preflight cache. There is no registry VERSION query after
+    // shutdown (npm still downloads the exact cached package when needed).
+    log('Applying cached version information...');
     // 升级会原地替换整包，先留一个可回退的产物副本。备份放 EVOLCORE_HOME 而非包目录：
     // Linux/macOS 的全局目录常常不可写，而 HOME 一定可写。
     const upgradeBackup = await backupDistForUpgrade(p, log);
-    const [upgrade, ecwebUpgrade] = await Promise.all([
-        tryUpgrade(),
-        tryUpgradeGlobalPkg(() => resolveGlobalPkg(WEB_PACKAGE_NAME), WEB_PACKAGE_NAME),
-    ]);
+    const [upgrade, ecwebUpgrade] = await applyCachedPackageUpgrades(undefined, { log });
     let upgradeRolledBack;
     switch (upgrade.status) {
         case 'upgraded':
@@ -287,8 +313,7 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ evolcore 升级失败，使用当前版本继续\n${upgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // EC Web 是独立全局包，已安装时单独检查升级；与 EvolCore registry
-    // 查询并行执行，npm 安装阶段由 npm-ops 的全局锁串行化。
+    // EC Web independently applies a valid cached result under the install lock.
     switch (ecwebUpgrade.status) {
         case 'upgraded':
             log(`✅ ${WEB_PACKAGE_NAME} upgraded: ${ecwebUpgrade.from} → ${ecwebUpgrade.to}`);
@@ -322,6 +347,13 @@ export async function cmdRestartMonitor() {
     // 启动并检测 ready signal
     let started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
     if (started) {
+        if (upgrade.status === 'upgraded' || upgrade.status === 'failed') {
+            await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+                from: upgrade.from, to: upgrade.to, at: new Date().toISOString(),
+                status: upgradeRolledBack ? 'rolled-back' : upgrade.status === 'upgraded' ? 'succeeded' : 'failed',
+                error: upgradeRolledBack ?? upgrade.error,
+            }, log);
+        }
         if (upgradeRolledBack) {
             markRestartOutcome(pendingFile, 'rolled-back', upgradeRolledBack, log);
             log(`✓ Service restarted after upgrade rollback`);
@@ -341,15 +373,21 @@ export async function cmdRestartMonitor() {
         }
         archiveSelfHealLog(p, log);
         // 发起会话内的“重启成功”通知由新进程自行发送，此处只负责失败/自愈告警。
-        process.exit(0);
+        await finishSuccessfulRestart();
     }
     // 升级后的新版本起不来：回退到升级前的产物再试一次。
     if (upgradeVersions?.to && !upgradeRolledBack) {
+        await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+            ...upgradeVersions, at: new Date().toISOString(), status: 'failed', error: 'Upgraded daemon failed its ready check',
+        }, log);
         if (await restoreDistBackup(upgradeBackup, log)) {
             await notifyDaemonOwners(p, `⚠️ 升级到 ${upgradeVersions.to} 后启动失败，正在回滚到 ${upgradeVersions.from} 重试...`, log);
             started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
             if (started) {
                 const reason = `升级到 ${upgradeVersions.to} 后启动失败，已回滚到 ${upgradeVersions.from}`;
+                await recordPackageUpgrade(MAIN_PACKAGE_NAME, {
+                    ...upgradeVersions, at: new Date().toISOString(), status: 'rolled-back', error: reason,
+                }, log);
                 log(`✓ ${reason}`);
                 markRestartOutcome(pendingFile, 'rolled-back', reason, log);
                 await notifyDaemonOwners(p, `⚠️ ${reason}。当前运行旧版本，请检查后重试。`, log);
@@ -858,9 +896,10 @@ async function spawnAndWaitReady(p, log, timeout) {
     const out = fs.openSync(stdoutLog, 'a');
     const err = fs.openSync(stdoutLog, 'a');
     const appMain = path.join(targetPackageRoot(), 'dist', 'index.js');
+    const foreground = process.argv.includes('--foreground');
     const child = spawn(process.execPath, ['--no-warnings=ExperimentalWarning', appMain], {
-        detached: true,
-        stdio: ['ignore', out, err],
+        detached: !foreground,
+        stdio: foreground ? 'inherit' : ['ignore', out, err],
         windowsHide: true,
         env: {
             ...process.env,
@@ -872,7 +911,16 @@ async function spawnAndWaitReady(p, log, timeout) {
         }
     });
     const childPid = child.pid;
-    child.unref();
+    if (foreground) {
+        foregroundDaemonExit = new Promise(resolve => {
+            child.once('error', () => resolve(1));
+            child.once('exit', code => resolve(code ?? 1));
+        });
+    }
+    else
+        child.unref();
+    fs.closeSync(out);
+    fs.closeSync(err);
     log(`Spawned new process PID: ${childPid}, waiting for ready signal...`);
     // 轮询等待 ready.signal 出现
     const start = Date.now();

package/dist/core/command/command-handler.js

@@ -1,5 +1,6 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { loadedBaseagentIds } from '../../agents/baseagent-availability.js';
+import { closeDiagnosticSession, diagnosticTokenHash, isDiagnosticSessionActive } from './diag-service.js';
 import { parseMenuClientArgs } from '../../cli/menu-client.js';
 import { ensureSessionRuntimeDir } from '../../cli/task-context.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
@@ -166,7 +167,34 @@ export class CommandHandler {
                     throw new Error('Menu request file must be a regular file of at most 128 KiB');
                 return fs.readFileSync(target, 'utf8');
             });
-            return { ok: true, response: await send(options) };
+            const binding = session.metadata?.diagnostic;
+            if (binding || session.metadata?.diagnosticStatus === 'cancelled') {
+                if (!isDiagnosticSessionActive(session, this.sessionManager.getChatDir(session))) {
+                    return { ok: false, code: 'DIAG_CLOSED', error: '诊断授权已结束，禁止旧会话继续访问' };
+                }
+                if (binding && (options.targetAid !== binding.controlAid
+                    || diagnosticTokenHash(options.remoteAccessToken ?? options.ecwebToken ?? '') !== binding.tokenHash)) {
+                    return { ok: false, code: 'DIAG_SCOPE_MISMATCH', error: '诊断请求必须使用本会话绑定的主机和 Token' };
+                }
+            }
+            const guardedOptions = binding
+                ? {
+                    ...options,
+                    beforeSend: () => {
+                        if (!isDiagnosticSessionActive(session, this.sessionManager.getChatDir(session))) {
+                            const error = new Error('诊断授权已结束，禁止旧会话继续访问');
+                            error.code = 'DIAG_CLOSED';
+                            throw error;
+                        }
+                    },
+                }
+                : options;
+            const response = await send(guardedOptions);
+            if (binding && response?.error?.code === 'REMOTE_ACCESS_TOKEN_INVALID') {
+                closeDiagnosticSession(session, this.sessionManager.getChatDir(session));
+                this.messageQueue?.clearBySession(session.id);
+            }
+            return { ok: true, response };
         }
         catch (error) {
             return { ok: false, code: error.code ?? 'MENU_REQUEST_FAILED', error: error.message };