evolcore 0.0.28 → 0.0.29

package/CHANGELOG.md

@@ -5,6 +5,18 @@
 
 ## Unreleased
 
+## 0.0.29 (2026-10-08)
+
+- 完成记忆系统 v3：支持 note 标签、三作用域工作记忆、自动整理触发、整理队列与签名索引，并完善 `ec memory`、`/memory` 命令和 ECK 注入。
+- 新增 EC Skill 开关、索引生成与变更监控；补充托管 CLI、依赖和 frontmatter 工具链。
+- 强化 Shell 与工具安全：安全输出 payload/过滤器链、受管 `cd` 与临时目录边界、禁止通过 Shell 间接调用 `apply_patch`，并统一工具错误分类、审计元数据及 Agent 作用域/sandbox 路径边界。
+- 改进 Codex 话题与会话分支：支持按消息锚点回退、持久化历史快照、并发安全的 rewind/resumeAt 管理；持久化任务 Activity，支持会话闲置事件触发 Trigger，并完善闲置监视和恢复诊断。
+- 增强 AUN 群聊和主动响应：支持可配置的自动提及决策模型与主会话自动判断、`ec group history/mention`、观察者悄悄话失败重试与恢复，以及 Menu 协议分页拉取、TTL/设备定向投递和权限校验；升级 AUN SDK 至 `0.5.18`，将文件上传/拉取上限提升至 256MiB 并改进存储兼容性。
+- 完善权限与运行稳定性：统一 Owner 鉴权，移除 daemon fullaccess 总开关，重构 Agent 数据迁移与重启预检，补充失败归档/恢复校验、重启失败自动修复配置和 Windows PowerShell 委托兼容。
+- 改进 Base Agent 运行兼容性：支持 Windows 随包探测 Claude 可执行文件，增强 Codex app-server 会话、分页回退、凭据隔离和工具错误分类，并收紧 Gemini/Codex 的 Agent 作用域保护。
+- Agent 创建与初始化支持本地文件或 HTTPS 地址头像上传，完善头像校验、托管任务附件来源和失败恢复流程。
+- 新增消息生命周期诊断，支持从 SDK 入站到 AUN 出站的阶段追踪与实时查看；统一记忆文档块解析，并迁移整理批次目录和操作记录格式。
+
 ## 0.0.28 (2026-09-24)
 
 - 增加 npm 版本缓存，改进升级状态展示及启动、重启流程。

package/bin/ec-safe-output.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'fs';
 import path from 'path';
-import { spawn } from 'child_process';
+import { spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 
 const MAX_OUTPUT_BYTES = 1024 * 1024;
@@ -9,11 +9,102 @@ const EC_EXECUTABLES = new Set(['ec']);
 const HOST_PROCESS_EXECUTABLES = new Set(['ps', 'pgrep', 'pidof', 'kill', 'pkill', 'killall']);
 const IS_WINDOWS = process.platform === 'win32';
 const HELPER_DIR = path.dirname(fileURLToPath(import.meta.url));
-// A rooted POSIX path is not absolute on Windows: Node resolves `/usr/bin/head`
-// onto the current drive as `C:\usr\bin\head`. Keep these fixed candidates as
-// the trusted fast path where they are genuinely absolute, and discover the
-// executable through PATH everywhere else.
-const POSIX_HEAD_CANDIDATES = ['/usr/bin/head', '/bin/head'];
+
+/**
+ * stdout filters this helper will spawn. This repeats the policy allowlist in
+ * `src/core/permission/ec-command-parser.ts` on purpose: the payload is data
+ * from another process, so the helper re-validates it instead of trusting it.
+ * Only filters that read stdin and write stdout may appear here, and each
+ * filter's option grammar is an allowlist so it cannot acquire a file operand,
+ * a write target, or a process spawn.
+ */
+const STDOUT_FILTER_SPECS = new Map([
+  // `tail` follow/retry options are absent below, so `tail -f` is rejected
+  // rather than allowed to hold the pipe open.
+  ['head', {
+    flags: new Set(),
+    valueOptions: new Set(['-n', '-c', '--lines', '--bytes']),
+    maxOperands: 0,
+    numericShorthand: true,
+  }],
+  ['tail', {
+    flags: new Set(),
+    valueOptions: new Set(['-n', '-c', '--lines', '--bytes']),
+    maxOperands: 0,
+    numericShorthand: true,
+  }],
+  // `grep` takes either `-e`/`--regexp` or one leading pattern operand. With an
+  // explicit pattern option the operand budget is zero, because a bare operand
+  // would be a file to read. `-r`, `-R` and `-f` are absent, so recursion and
+  // pattern files stay out.
+  ['grep', {
+    flags: new Set([
+      '-i', '--ignore-case', '-v', '--invert-match', '-c', '--count',
+      '-l', '--files-with-matches', '-L', '--files-without-match', '-o', '--only-matching',
+      '-n', '--line-number', '-h', '--no-filename', '-H', '--with-filename',
+      '-q', '--quiet', '--silent', '-s', '--no-messages', '-w', '--word-regexp',
+      '-x', '--line-regexp', '-F', '--fixed-strings', '-E', '--extended-regexp',
+      '-G', '--basic-regexp', '-P', '--perl-regexp', '-a', '--text', '-I',
+      '-z', '--null-data', '-U', '--binary', '--line-buffered', '--no-group-separator',
+    ]),
+    valueOptions: new Set([
+      '-m', '--max-count', '-A', '--after-context', '-B', '--before-context',
+      '-C', '--context', '--color', '--colour', '--binary-files', '--label',
+      '--group-separator', '-d', '--directories', '--include', '--exclude', '--exclude-dir',
+    ]),
+    patternValueOptions: new Set(['-e', '--regexp']),
+    maxOperands: 1,
+  }],
+  // `wc`, `sort`, `cut` and `uniq` take no operands here: a path operand would
+  // read a file instead of the EC stdout. Options naming an input or output
+  // file (--files0-from, sort -o/-T/--random-source, uniq --group) are absent.
+  ['wc', {
+    flags: new Set([
+      '-c', '-m', '-l', '-w', '-L',
+      '--bytes', '--chars', '--lines', '--words', '--max-line-length',
+    ]),
+    valueOptions: new Set(),
+    maxOperands: 0,
+  }],
+  ['sort', {
+    flags: new Set([
+      '-b', '-d', '-f', '-g', '-h', '-i', '-M', '-n', '-r', '-R', '-s', '-u', '-V', '-z',
+      '--ignore-leading-blanks', '--dictionary-order', '--ignore-case', '--general-numeric-sort',
+      '--human-numeric-sort', '--ignore-nonprinting', '--month-sort', '--numeric-sort',
+      '--random-sort', '--reverse', '--stable', '--unique', '--version-sort', '--zero-terminated',
+      '--check', '--merge',
+    ]),
+    valueOptions: new Set([
+      '-k', '-t', '-S', '--key', '--field-separator',
+      '--batch-size', '--buffer-size', '--parallel', '--sort',
+    ]),
+    maxOperands: 0,
+  }],
+  ['cut', {
+    flags: new Set(['-s', '--only-delimited', '-n', '--complement', '-z', '--zero-terminated']),
+    valueOptions: new Set([
+      '-b', '-c', '-f', '-d', '--bytes', '--characters', '--fields', '--delimiter', '--output-delimiter',
+    ]),
+    maxOperands: 0,
+  }],
+  ['uniq', {
+    flags: new Set([
+      '-c', '-d', '-D', '-u', '-i', '-z',
+      '--count', '--repeated', '--all-repeated', '--unique', '--ignore-case', '--zero-terminated',
+    ]),
+    valueOptions: new Set(['-f', '-s', '--skip-fields', '--skip-chars']),
+    maxOperands: 0,
+  }],
+  // `tr` takes its character sets as operands, which are never files.
+  ['tr', {
+    flags: new Set([
+      '-c', '-C', '-d', '-s', '-t',
+      '--complement', '--delete', '--squeeze-repeats', '--truncate-set1',
+    ]),
+    valueOptions: new Set(),
+    maxOperands: 2,
+  }],
+]);
 
 function isRegularFile(candidate) {
   try {
@@ -53,16 +144,17 @@ function resolveExecutablePath(executable) {
   return undefined;
 }
 
-function resolveHeadExecutable() {
+function resolveFilterExecutable(name) {
   if (!IS_WINDOWS) {
-    const fixed = POSIX_HEAD_CANDIDATES.find(isRegularFile);
+    // A rooted POSIX path is not absolute on Windows: Node resolves
+    // `/usr/bin/head` onto the current drive as `C:\usr\bin\head`. On POSIX
+    // the fixed locations are genuinely absolute, so try them first.
+    const fixed = [`/usr/bin/${name}`, `/bin/${name}`].find(isRegularFile);
     if (fixed) return fixed;
   }
-  return resolveExecutablePath('head');
+  return resolveExecutablePath(name);
 }
 
-const HEAD_EXECUTABLE = resolveHeadExecutable();
-
 /**
  * Resolve the concrete process for a validated payload.
  *
@@ -105,7 +197,10 @@ function sameOrDescendant(candidate, parent) {
 function decodePayload(encoded) {
   try {
     const value = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
-    if (!value || value.v !== 1 || !Array.isArray(value.argv) || value.argv.some(arg => typeof arg !== 'string')) return null;
+    // v3 carries a chain of stdin-only filters in `filterChain`. v1 named only
+    // the filter's arguments and v2 carried a single `filterArgv`, so both are
+    // rejected rather than misread.
+    if (!value || value.v !== 3 || !Array.isArray(value.argv) || value.argv.some(arg => typeof arg !== 'string')) return null;
     return value;
   } catch {
     return null;
@@ -119,18 +214,33 @@ function validateCommand(payload) {
   return !payload.argv.some(arg => /\bnode(?:js|\.exe)?\b/i.test(arg));
 }
 
-function validateStdinOnlyHeadArgs(args) {
-  if (args === undefined) return true;
-  if (!Array.isArray(args) || args.some(arg => typeof arg !== 'string')) return false;
+/**
+ * Re-validate the filter argv the policy layer chose. The helper never trusts
+ * the payload: the executable must be a known stdin-only filter, every option
+ * must appear in that filter's allowlist, and non-option operands must stay
+ * within the filter's operand budget.
+ */
+function resolveFilterArgv(filterArgv) {
+  if (filterArgv === undefined) return { executable: undefined, args: [] };
+  if (!Array.isArray(filterArgv) || filterArgv.length === 0
+    || filterArgv.some(arg => typeof arg !== 'string')) return null;
+  const spec = STDOUT_FILTER_SPECS.get(filterArgv[0]);
+  if (!spec) return null;
+  // 单级校验：可执行文件名必须在白名单表内，选项必须逐项命中该过滤器的允许表，
+  // 非选项操作数不得超出其预算。链上每一级都走这里，所以多一级不放松任何一项。
+
+  let operands = 0;
+  let sawPatternValue = false;
   let optionsEnded = false;
   let expectsOptionValue = false;
-  for (const arg of args) {
+  for (let index = 1; index < filterArgv.length; index++) {
+    const arg = filterArgv[index];
     if (expectsOptionValue) {
       expectsOptionValue = false;
       continue;
     }
     if (optionsEnded) {
-      if (arg !== '-') return false;
+      if (arg !== '-') operands++;
       continue;
     }
     if (arg === '--') {
@@ -138,12 +248,49 @@ function validateStdinOnlyHeadArgs(args) {
       continue;
     }
     if (arg === '-') continue;
-    if (!arg.startsWith('-')) return false;
-    if (arg === '-n' || arg === '-c' || arg === '--lines' || arg === '--bytes') {
-      expectsOptionValue = true;
+    if (!arg.startsWith('-')) {
+      operands++;
+      continue;
     }
+    if (spec.numericShorthand && /^-\d+$/.test(arg)) continue;
+    const option = arg.split('=', 1)[0];
+    if (spec.patternValueOptions?.has(option)) {
+      sawPatternValue = true;
+      if (!arg.includes('=') && arg.length === option.length) expectsOptionValue = true;
+      continue;
+    }
+    if (spec.valueOptions.has(option)) {
+      if (!arg.includes('=') && arg.length === option.length) expectsOptionValue = true;
+      continue;
+    }
+    if (spec.flags.has(arg)) continue;
+    return null;
+  }
+
+  const operandBudget = sawPatternValue ? 0 : spec.maxOperands;
+  if (operands > operandBudget) return null;
+  if (spec.patternValueOptions && !sawPatternValue && operands === 0) return null;
+
+  const executable = resolveFilterExecutable(filterArgv[0]);
+  if (!executable) return null;
+  return { executable, args: filterArgv.slice(1) };
+}
+
+/**
+ * 复验 policy 选出的过滤器链。每一级都必须独立通过 resolveFilterArgv，
+ * 任何一级不合格就整条拒绝——链式不放宽单级的标准。
+ * 返回 null 表示拒绝；返回 [] 表示无过滤器（直接输出）。
+ */
+function resolveFilterChain(filterChain) {
+  if (filterChain === undefined) return [];
+  if (!Array.isArray(filterChain)) return null;
+  const resolved = [];
+  for (const stage of filterChain) {
+    const one = resolveFilterArgv(stage);
+    if (one === null || one.executable === undefined) return null;
+    resolved.push(one);
   }
-  return true;
+  return resolved;
 }
 
 function resolveExecutionPaths(payload) {
@@ -218,8 +365,10 @@ function openOutputFile(payload, paths) {
 const payload = decodePayload(process.argv[2]);
 if (!payload) fail('invalid payload');
 if (!validateCommand(payload)) fail('command is not permitted');
-if (!validateStdinOnlyHeadArgs(payload.headArgs)) fail('head may only consume stdin');
-if (payload.headArgs !== undefined && !HEAD_EXECUTABLE) fail('trusted head executable is unavailable');
+const filterChain = resolveFilterChain(payload.filterChain);
+if (filterChain === null) fail('stdout filter may only consume stdin');
+const suffixArgv = resolveSuffixArgv(payload.suffixArgv);
+if (suffixArgv === null) fail('trailing command must be an inert echo/pwd');
 
 // Resolve the child executable before anything with a side effect: an
 // unresolvable command must not leave an empty create-only output file behind.
@@ -249,19 +398,25 @@ function writeLimited(chunk) {
   }
 }
 
-const head = payload.headArgs === undefined
-  ? undefined
-  : spawn(HEAD_EXECUTABLE, payload.headArgs, {
-      cwd: paths.cwd,
-      env: process.env,
-      stdio: ['pipe', 'pipe', 'inherit'],
-    });
-if (head) {
-  head.stdout.on('data', writeLimited);
+// 过滤器链：逐级 spawn，前一级的 stdout 接后一级的 stdin。
+// 最后一级的输出才进入 writeLimited（终端或输出文件）。
+const filterProcesses = filterChain.map((stage) => {
+  const proc = spawn(stage.executable, stage.args, {
+    cwd: paths.cwd,
+    env: process.env,
+    // stdout 恒为 pipe：链尾由本进程消费，中间级接给下一级。
+    stdio: ['pipe', 'pipe', 'inherit'],
+  });
   // Early-exit options such as --help or a small -n/-c close stdin before the
   // EC process finishes. Ignore EPIPE and keep draining EC output below.
-  head.stdin.on('error', () => {});
-}
+  proc.stdin.on('error', () => {});
+  // 同理：下游提前退出（如 `| head -3`）后上游仍会写，忽略其 stdout EPIPE，
+  // 否则 Node 会把未处理的 'error' 事件升级成进程崩溃。
+  proc.stdout.on('error', () => {});
+  return proc;
+});
+const filterProcess = filterProcesses[filterProcesses.length - 1];
+if (filterProcess) filterProcess.stdout.on('data', writeLimited);
 
 const child = spawn(childCommand.file, childCommand.args, {
   cwd: paths.cwd,
@@ -270,11 +425,35 @@ const child = spawn(childCommand.file, childCommand.args, {
   windowsHide: IS_WINDOWS,
 });
 const sourceStreams = [child.stdout, ...(payload.mergeStderr ? [child.stderr] : [])];
-if (head) {
-  for (const stream of sourceStreams) {
-    // The no-op data listener keeps draining the source if head exits early.
+
+/**
+ * 把一组上游流接到某个下游 stdin，并保证 EOF 会传播。
+ *
+ * 这里刻意不用 `pipe(dst, { end: true })`：多个上游（stdout + 合并的 stderr）
+ * 共用一个下游时，任何一个上游结束都会提前关掉下游 stdin，丢掉另一路数据。
+ * 改为全部上游结束后再显式 end()，链上每一级都遵循同一约定，否则
+ * 下游永远等不到 EOF，整条链会挂住而不退出。
+ */
+function pipeAllWithEnd(streams, dst) {
+  let pending = streams.length;
+  const onDone = () => {
+    if (--pending === 0 && !dst.destroyed) dst.end();
+  };
+  for (const stream of streams) {
+    // The no-op data listener keeps draining the source if the filter exits
+    // early, e.g. `head -n 1`.
     stream.on('data', () => {});
-    stream.pipe(head.stdin, { end: false });
+    stream.on('end', onDone);
+    stream.on('close', onDone);
+    stream.pipe(dst, { end: false });
+  }
+}
+
+if (filterProcesses.length > 0) {
+  pipeAllWithEnd(sourceStreams, filterProcesses[0].stdin);
+  // 链内串接：第 i 级的 stdout → 第 i+1 级的 stdin（同样等上游结束后再 end）。
+  for (let index = 0; index + 1 < filterProcesses.length; index++) {
+    pipeAllWithEnd([filterProcesses[index].stdout], filterProcesses[index + 1].stdin);
   }
 } else {
   for (const stream of sourceStreams) stream.on('data', writeLimited);
@@ -290,11 +469,25 @@ child.once('error', error => {
 
 let sourceClosed = false;
 let sourceCode = 1;
-let headClosed = !head;
-let headCode = 1;
+let filterClosed = filterProcesses.length === 0;
+let filterStarted = false;
+
+/**
+ * 复验 policy 选出的尾部命令。只允许 `echo` 与 `pwd`，实参必须是纯字面量
+ * （无 `$`/反引号/通配/重定向/管道），与 parser 侧的判据保持一致——
+ * helper 从不相信 payload。
+ */
+function resolveSuffixArgv(suffixArgv) {
+  if (suffixArgv === undefined) return undefined;
+  if (!Array.isArray(suffixArgv) || suffixArgv.length === 0
+    || suffixArgv.some(arg => typeof arg !== 'string')) return null;
+  if (suffixArgv[0] !== 'echo' && suffixArgv[0] !== 'pwd') return null;
+  if (suffixArgv.some(arg => /[$`*?\[\]{}()<>|;&]/.test(arg))) return null;
+  return suffixArgv;
+}
 
 function finish() {
-  if (!sourceClosed || !headClosed) return;
+  if (!sourceClosed || !filterClosed) return;
   if (output) {
     try { fs.closeSync(output.fd); } catch { writeFailed = true; }
   }
@@ -303,25 +496,48 @@ function finish() {
     fail('failed to write command output');
   }
   if (output) process.stderr.write(`Saved output to ${output.target}\n`);
-  process.exitCode = head ? headCode : sourceCode;
+  // 尾部零副作用命令（`&& echo done`）在 ec 输出之后执行一次，输出直连终端。
+  // 失败不影响退出码——它只是提示，不表达 ec 是否成功。
+  if (suffixArgv) {
+    try {
+      const res = spawnSync(suffixArgv[0], suffixArgv.slice(1), {
+        cwd: paths.cwd,
+        env: process.env,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        windowsHide: IS_WINDOWS,
+      });
+      void res;
+    } catch { /* 忽略：尾部命令失败不改变 ec 的结果 */ }
+  }
+  // The caller's exit code describes the EC command, not the filter. `grep`
+  // and `uniq` exit 1 to mean "no lines matched"/"nothing unique", which says
+  // nothing about whether the EC command itself succeeded.
+  process.exitCode = sourceCode;
 }
 
-if (head) {
-  head.once('error', error => {
-    writeFailed = true;
-    process.stderr.write(`ec-safe-output: unable to start head: ${error.message}\n`);
-  });
-  head.once('close', code => {
-    headCode = code ?? 1;
-    headClosed = true;
-    for (const stream of sourceStreams) stream.unpipe(head.stdin);
-    finish();
-  });
+if (filterProcesses.length > 0) {
+  for (const [index, proc] of filterProcesses.entries()) {
+    const isLast = index === filterProcesses.length - 1;
+    proc.once('error', error => {
+      writeFailed = true;
+      process.stderr.write(`ec-safe-output: unable to start stdout filter: ${error.message}\n`);
+    });
+    proc.once('spawn', () => { if (isLast) filterStarted = true; });
+    proc.once('close', () => {
+      // 只有链尾关闭才算整条链结束；中间级提前退出时下游仍可能有余量可读。
+      if (!isLast) return;
+      filterClosed = true;
+      for (const stream of sourceStreams) stream.unpipe(filterProcesses[0].stdin);
+      finish();
+    });
+  }
 }
 
 child.once('close', code => {
   sourceCode = code ?? 1;
   sourceClosed = true;
-  if (head && !head.stdin.destroyed) head.stdin.end();
+  // EOF 由 pipeAllWithEnd 在 source 流真正结束后传播（child 'close' 早于
+  // stdout 'end'，此处主动 end 会把还没读完的输出截断）。这里只在过滤器从未
+  // 启动成功时兜底收尾，避免 helper 永远等一个收不到 EOF 的进程。
   finish();
 });

package/dist/agents/baseagent-availability.js

@@ -1,6 +1,40 @@
 import { normalizeBaseagent } from './baseagent.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { getCodexAppServerAvailability } from './codex-runner.js';
+import { createRequire } from 'module';
+import fs from 'fs';
+import path from 'path';
+const _resolveModule = createRequire(import.meta.url);
+/**
+ * Check whether the bundled Claude SDK native binary is present on disk.
+ * This covers Windows installations where the npm global shim may be absent
+ * but the SDK ships claude.exe alongside evolcore's own node_modules.
+ */
+function isBundledClaudeAvailable() {
+    if (process.platform !== 'win32')
+        return false;
+    const nativePackage = process.arch === 'arm64'
+        ? '@anthropic-ai/claude-agent-sdk-win32-arm64'
+        : process.arch === 'x64'
+            ? '@anthropic-ai/claude-agent-sdk-win32-x64'
+            : undefined;
+    if (!nativePackage)
+        return false;
+    try {
+        const exe = _resolveModule.resolve(`${nativePackage}/claude.exe`);
+        if (fs.existsSync(exe))
+            return true;
+    }
+    catch { /* fall through */ }
+    try {
+        const sdkEntry = _resolveModule.resolve('@anthropic-ai/claude-agent-sdk');
+        const exe = path.resolve(path.dirname(sdkEntry), '..', '@anthropic-ai', nativePackage.slice('@anthropic-ai/'.length), 'claude.exe');
+        return fs.existsSync(exe);
+    }
+    catch {
+        return false;
+    }
+}
 export const BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini', 'ecagent'];
 export const AUTO_BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini'];
 /**
@@ -14,11 +48,13 @@ export function detectAvailableBaseagents(codexAvailability = getCodexAppServerA
             return true;
         if (baseagent === 'codex')
             return codexAvailability.available;
+        if (baseagent === 'claude')
+            return commandExists(baseagent) || isBundledClaudeAvailable();
         return commandExists(baseagent);
     });
 }
 export function detectBaseagentDetails(codexAvailability = getCodexAppServerAvailability()) {
-    const claude = commandExists('claude');
+    const claude = commandExists('claude') || isBundledClaudeAvailable();
     const gemini = commandExists('gemini');
     return [
         {

package/dist/agents/baseagent.js

@@ -15,6 +15,7 @@ import os from 'os';
 import { buildCliLaunchCommand, commandExists, isWindows, resolvePowerShellShimPath, resolveProbePath, } from '../utils/cross-platform.js';
 import { execFileSync } from 'child_process';
 import { parse as parseToml } from 'smol-toml';
+import { readRuntimeEnvironmentVariable } from '../config/runtime-env.js';
 /** Resolve the installed Codex CLI entrypoint, including npm shims on Windows. */
 export function resolveCodexCliPath() {
     return resolveProbePath('codex');
@@ -136,7 +137,7 @@ function loadClaudeSettings() {
  * A pair must come from one source so partial configuration cannot be mixed
  * across Agent config, the process environment, and Claude Code settings.
  */
-export function resolveAnthropicDirectConfig(override) {
+export function resolveAnthropicDirectConfig(override, runtime) {
     const explicit = directInferencePair(override?.apiKey, override?.baseUrl);
     if (explicit) {
         return {
@@ -144,7 +145,7 @@ export function resolveAnthropicDirectConfig(override) {
             ...normalizeRequestMetadata(override),
         };
     }
-    const environment = directInferencePair(directInferenceValue(process.env.ANTHROPIC_AUTH_TOKEN, process.env.ANTHROPIC_API_KEY), process.env.ANTHROPIC_BASE_URL);
+    const environment = directInferencePair(directInferenceValue(readRuntimeEnvironmentVariable('ANTHROPIC_AUTH_TOKEN', runtime?.agentAid, runtime?.projectPath).value, readRuntimeEnvironmentVariable('ANTHROPIC_API_KEY', runtime?.agentAid, runtime?.projectPath).value), readRuntimeEnvironmentVariable('ANTHROPIC_BASE_URL', runtime?.agentAid, runtime?.projectPath).value);
     if (environment) {
         return {
             ...environment,
@@ -160,21 +161,30 @@ export function resolveAnthropicDirectConfig(override) {
         }
         : undefined;
 }
-export function resolveAnthropicConfig(config, override) {
+export function resolveAnthropicConfig(config, override, runtime) {
     const settings = loadClaudeSettings();
     const isPlaceholder = (v) => !v || v.includes('your-') || v.includes('placeholder');
-    const overrideApiKey = isPlaceholder(override?.apiKey) ? undefined : override?.apiKey;
-    const globalApiKey = isPlaceholder(config.agents?.claude?.apiKey) ? undefined : config.agents?.claude?.apiKey;
-    const apiKey = resolveAnthropicApiKey(overrideApiKey, globalApiKey, process.env.ANTHROPIC_AUTH_TOKEN, process.env.ANTHROPIC_API_KEY, settings.env?.ANTHROPIC_AUTH_TOKEN, settings.env?.ANTHROPIC_API_KEY);
+    const resolveGatewayReference = (value) => {
+        const name = value?.match(/^\$\{(ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY)\}$/u)?.[1];
+        return name ? readRuntimeEnvironmentVariable(name, runtime?.agentAid, runtime?.projectPath).value : value;
+    };
+    const overrideApiKey = resolveGatewayReference(override?.apiKey);
+    const globalApiKey = resolveGatewayReference(config.agents?.claude?.apiKey);
+    const runtimeAuthToken = readRuntimeEnvironmentVariable('ANTHROPIC_AUTH_TOKEN', runtime?.agentAid, runtime?.projectPath).value;
+    const runtimeApiKey = readRuntimeEnvironmentVariable('ANTHROPIC_API_KEY', runtime?.agentAid, runtime?.projectPath).value;
+    const apiKey = resolveAnthropicApiKey(isPlaceholder(overrideApiKey) ? undefined : overrideApiKey, isPlaceholder(globalApiKey) ? undefined : globalApiKey, runtimeAuthToken, runtimeApiKey, settings.env?.ANTHROPIC_AUTH_TOKEN, settings.env?.ANTHROPIC_API_KEY);
     if (!apiKey) {
         throw new Error('No API key found for Claude. Set baseagents.claude.apiKey, env ANTHROPIC_AUTH_TOKEN or ANTHROPIC_API_KEY, or the corresponding variable in ~/.claude/settings.json');
     }
     const isPlaceholderUrl = (v) => !v || v.includes('api.anthropic.com');
-    const overrideBaseUrl = isPlaceholderUrl(override?.baseUrl) ? undefined : override?.baseUrl;
-    const globalBaseUrl = isPlaceholderUrl(config.agents?.claude?.baseUrl) ? undefined : config.agents?.claude?.baseUrl;
+    const overrideBaseUrlValue = resolveGatewayReference(override?.baseUrl);
+    const globalBaseUrlValue = resolveGatewayReference(config.agents?.claude?.baseUrl);
+    const overrideBaseUrl = isPlaceholderUrl(overrideBaseUrlValue) ? undefined : overrideBaseUrlValue;
+    const globalBaseUrl = isPlaceholderUrl(globalBaseUrlValue) ? undefined : globalBaseUrlValue;
+    const runtimeBaseUrl = readRuntimeEnvironmentVariable('ANTHROPIC_BASE_URL', runtime?.agentAid, runtime?.projectPath).value;
     const baseUrl = overrideBaseUrl
         || globalBaseUrl
-        || process.env.ANTHROPIC_BASE_URL
+        || runtimeBaseUrl
         || settings.env?.ANTHROPIC_BASE_URL;
     const headers = normalizeStringMap(override?.headers ?? config.agents?.claude?.headers, 'headers');
     const queryParams = normalizeStringMap(override?.queryParams ?? config.agents?.claude?.queryParams, 'queryParams');