evolcore 0.0.28 → 0.0.29

package/dist/core/memory/memory-document.js

@@ -0,0 +1,100 @@
+/**
+ * Shared representation for memory Markdown documents.
+ *
+ * Memory files have two mutable blocks: YAML-like frontmatter and Markdown
+ * body. AUN signature blocks are stripped while parsing and are never exposed
+ * as a document block; consolidated writers sign the serialized result again.
+ */
+import { parseSignatureBlock } from './memory-signature.js';
+function parseArray(raw) {
+    const value = raw.match(/^\[([^\]]*)\]$/)?.[1] ?? raw;
+    return value
+        .split(',')
+        .map(item => item.trim().replace(/^['"]|['"]$/g, ''))
+        .filter(Boolean);
+}
+function formatValue(value) {
+    return Array.isArray(value) ? `[${value.join(', ')}]` : value;
+}
+function splitDocument(content) {
+    const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    if (!normalized.startsWith('---\n'))
+        return { frontmatter: [], body: normalized, hasFrontmatter: false };
+    const end = normalized.indexOf('\n---\n', 4);
+    if (end < 0)
+        return { frontmatter: [], body: normalized, hasFrontmatter: false };
+    return {
+        frontmatter: normalized.slice(4, end).split('\n'),
+        body: normalized.slice(end + 5).replace(/^\n/, ''),
+        hasFrontmatter: true,
+    };
+}
+/** Parse frontmatter and body; an existing AUN signature is ignored. */
+export function parseMemoryDocument(content) {
+    const signature = parseSignatureBlock(content);
+    // A malformed marker may be ordinary body text. Only strip a signature when
+    // the signature parser accepted the block; otherwise preserve every byte.
+    const unsigned = signature.fields ? signature.payload : content;
+    const parts = splitDocument(unsigned);
+    const fields = {};
+    const fieldOrder = [];
+    const extraFrontmatterLines = [];
+    for (const line of parts.frontmatter) {
+        const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+        if (!match) {
+            extraFrontmatterLines.push(line);
+            continue;
+        }
+        const [, key, raw] = match;
+        if (!(key in fields))
+            fieldOrder.push(key);
+        fields[key] = raw.startsWith('[') ? parseArray(raw) : raw.trim();
+    }
+    return { fields, fieldOrder, extraFrontmatterLines, body: parts.body, hasFrontmatter: parts.hasFrontmatter };
+}
+export function getMemoryField(document, key) {
+    return document.fields[key];
+}
+export function getMemoryString(document, key) {
+    const value = getMemoryField(document, key);
+    return typeof value === 'string' ? value : undefined;
+}
+export function getMemoryArray(document, key) {
+    const value = getMemoryField(document, key);
+    return Array.isArray(value) ? [...value] : value ? parseArray(value) : [];
+}
+export function replaceMemoryBlock(document, block, value) {
+    if (block === 'body') {
+        document.body = value;
+        return;
+    }
+    const parsed = parseMemoryDocument(`---\n${value}\n---\n\n${document.body}`);
+    document.fields = parsed.fields;
+    document.fieldOrder = parsed.fieldOrder;
+    document.extraFrontmatterLines = parsed.extraFrontmatterLines;
+    document.hasFrontmatter = true;
+}
+export function getMemoryBlock(document, block) {
+    if (block === 'body')
+        return document.body;
+    return document.fieldOrder
+        .filter(key => key in document.fields)
+        .map(key => `${key}: ${formatValue(document.fields[key])}`)
+        .concat(document.extraFrontmatterLines)
+        .join('\n');
+}
+export function setMemoryField(document, key, value) {
+    if (value === undefined) {
+        delete document.fields[key];
+        return;
+    }
+    if (!(key in document.fields))
+        document.fieldOrder.push(key);
+    document.fields[key] = value;
+}
+export function serializeMemoryDocument(document) {
+    const frontmatter = getMemoryBlock(document, 'frontmatter');
+    if (!document.hasFrontmatter && !frontmatter)
+        return `${document.body.trimEnd()}\n`;
+    return `---\n${frontmatter}\n---\n\n${document.body.trimEnd()}\n`;
+}

package/dist/core/memory/memory-session-policy.js

@@ -0,0 +1,41 @@
+/**
+ * memory-session-policy.ts — 整理会话（sessionType=memory）的工具策略
+ *
+ * 整理会话的产出只能经 `ec memory create|update|archive` 走 daemon IPC 落盘
+ * （签名、索引、ops 流水都在那一侧）。所以：
+ *   - 直接写文件的工具一律拦（Claude 的 Write/Edit/MultiEdit/NotebookEdit，Codex 的 FileChange）
+ *   - 子代理、PowerShell 这类能绕开本策略的入口也拦
+ *   - Bash 只放行 `ec memory create|update|archive`；解析不出单条字面命令（含 ; && | $() 等）一律拦
+ *   - Read / Glob / Grep 等只读工具不在这里管
+ *
+ * 作为 policyHook 由 response-engine 在整理会话里挂上，三个 runner 共用。
+ */
+import { parseCodexToolCommand } from '../permission/ec-command-parser.js';
+const BLOCKED_TOOLS = new Set([
+    'Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'FileChange',
+    'Agent', 'Task', 'PowerShell',
+]);
+const ALLOWED_MEMORY_SUBCOMMANDS = new Set(['create', 'update', 'archive', 'feedback']);
+export const MEMORY_SESSION_DENY_MESSAGE = '整理会话不允许执行此命令';
+export function memorySessionPolicyHook(toolName, toolInput) {
+    if (BLOCKED_TOOLS.has(toolName)) {
+        return {
+            block: true,
+            policyCode: 'memory_session_tool_forbidden',
+            reason: `${MEMORY_SESSION_DENY_MESSAGE}：整理会话不能使用 ${toolName}，写记忆只能用 \`ec memory create|update|archive\`，反馈用 \`ec memory feedback\``,
+        };
+    }
+    if (toolName !== 'Bash')
+        return undefined;
+    const parsed = parseCodexToolCommand(toolInput);
+    const argv = parsed.ok ? parsed.argv : undefined;
+    if (argv && argv[0] === 'ec' && argv[1] === 'memory' && ALLOWED_MEMORY_SUBCOMMANDS.has(argv[2] ?? '')) {
+        return undefined;
+    }
+    return {
+        block: true,
+        policyCode: 'memory_session_command_forbidden',
+        reason: `${MEMORY_SESSION_DENY_MESSAGE}：Bash 只允许单条 \`ec memory create|update|archive|feedback\`` +
+            '（不能拼接其他命令；正文含特殊字符时用单引号包住）。读文件请用 Read / Glob / Grep。',
+    };
+}

package/dist/core/memory/memory-signature.js

@@ -0,0 +1,257 @@
+/**
+ * memory-signature.ts — 记忆文件签名与验签
+ *
+ * **不重用 agent.md 的签名链路。** `signAgentMd` / `verifyAgentMd` 会走
+ * agent-md-schema 的校验（强制 frontmatter 有 aid/name/type/version、payload ≤ 4096B），
+ * 套在记忆文件上必然失败——而且 `signAgentMd` 签名时**不做校验**，
+ * 签出来的文件自己验不回来，属于静默产废品。
+ *
+ * 这里改用 fastaun 的底层字节级接口：
+ *   - `AID.sign(payload)`   → `{ signature: base64 }`，纯字节签名，无大小上限
+ *   - `AID.verify(payload, sig)` → `{ valid: boolean }`，纯字节验签
+ *
+ * 签名块格式沿用 AUN 既有的 `<!-- AUN-SIGNATURE ... -->`，便于工具链复用。
+ * 但拼装 / 解析 / 证书绑定校验三个工具函数在 fastaun 里**没有导出**
+ * （包 exports 只映射了 "."），所以在本模块内镜像实现。
+ *
+ * 签名身份：记忆所属 agent 自身的 AID 证书私钥。
+ * 验签：只加载本地证书，无需网络。
+ */
+import { X509Certificate, createHash } from 'node:crypto';
+import { getAidStore, loadAid, SLOT } from '../../aun/aid/store.js';
+import { aunPath } from '../../paths.js';
+/**
+ * 记忆文件大小上限（字节）。超过即拒绝签名。
+ *
+ * 定这个限制的理由不是技术限制（`AID.sign` 本身无上限，实测 200KB 通过），
+ * 而是记忆本身的性质：一条记忆应是**一句话能说清的结论**，不是文档。
+ * 超过 10KB 通常意味着应该拆成多条，或者根本不该进记忆系统。
+ */
+export const MAX_MEMORY_BYTES = 10 * 1024;
+// ── 镜像自 fastaun/dist/cert-utils.js ─────────────────────────────────────
+const SIGNATURE_MARKER = '<!-- AUN-SIGNATURE';
+const SIGNATURE_RE = /^<!-- AUN-SIGNATURE(?:\r\n|\n|\r)(?<body>[\s\S]*?)(?:\r\n|\n|\r)-->\s*$/;
+const FINGERPRINT_HEX_RE = /^[0-9a-f]+$/;
+const REQUIRED_FIELDS = ['cert_fingerprint', 'timestamp', 'signature'];
+const ALLOWED_FIELDS = [...REQUIRED_FIELDS, 'public_key_fingerprint'];
+/** 严格 base64 校验（长度是 4 的倍数、字符集合法、可往返）。 */
+function isStrictBase64(value) {
+    const text = String(value ?? '');
+    if (!text || text.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(text))
+        return false;
+    return Buffer.from(text, 'base64').toString('base64') === text;
+}
+/** 归一化指纹，去掉 `sha256:` 前缀和冒号分隔，返回小写 hex。 */
+function normalizeFingerprintHex(value) {
+    let text = String(value ?? '').trim().toLowerCase();
+    if (text.startsWith('sha256:'))
+        text = text.slice('sha256:'.length);
+    text = text.replace(/:/g, '');
+    if (![16, 64].includes(text.length) || !FINGERPRINT_HEX_RE.test(text))
+        return '';
+    return text;
+}
+/** 证书指纹比对（`sha256:<hex>`）。 */
+function certMatchesFingerprint(certPem, fingerprint) {
+    const expected = normalizeFingerprintHex(fingerprint);
+    if (!expected)
+        return false;
+    const derHex = new X509Certificate(certPem).fingerprint256.replace(/:/g, '').toLowerCase();
+    if (expected.length === 16)
+        return derHex.slice(0, 16) === expected;
+    return derHex === expected;
+}
+/** 公钥指纹（SPKI DER 的 SHA-256）。 */
+function publicKeyFingerprint(certPem) {
+    const cert = new X509Certificate(certPem);
+    const spkiDer = cert.publicKey.export({ type: 'spki', format: 'der' });
+    return `sha256:${createHash('sha256').update(spkiDer).digest('hex')}`;
+}
+/** 构造签名块。`public_key_fingerprint` 可选，省略即可。 */
+export function buildSignatureBlock(certFingerprint, timestamp, signatureB64, publicKeyFp = '') {
+    const lines = ['<!-- AUN-SIGNATURE', `cert_fingerprint: ${certFingerprint}`];
+    if (publicKeyFp)
+        lines.push(`public_key_fingerprint: ${publicKeyFp}`);
+    lines.push(`timestamp: ${Math.trunc(timestamp)}`, `signature: ${signatureB64}`, '-->');
+    return lines.join('\n');
+}
+/**
+ * 解析文件尾部的签名块。
+ * `payload` 是**原始字节子串**（`content.slice(0, idx)`），验签必须用它而不是原 content。
+ */
+export function parseSignatureBlock(content) {
+    const idx = content.lastIndexOf(SIGNATURE_MARKER);
+    if (idx < 0)
+        return { payload: content, fields: null };
+    if (content.indexOf(SIGNATURE_MARKER) !== idx) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'must contain exactly one signature block' };
+    }
+    if (idx > 0 && content[idx - 1] !== '\n' && content[idx - 1] !== '\r') {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'signature block must start on a new line' };
+    }
+    const tail = content.slice(idx);
+    const match = tail.match(SIGNATURE_RE);
+    if (!match)
+        return { payload: content.slice(0, idx), fields: null, parseError: 'malformed signature block' };
+    const fields = {};
+    for (const rawLine of (match.groups?.body ?? '').split(/\r\n|\n|\r/)) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        const colon = line.indexOf(':');
+        if (colon < 0)
+            return { payload: content.slice(0, idx), fields: null, parseError: `malformed signature field: ${line}` };
+        const key = line.slice(0, colon).trim().toLowerCase();
+        if (Object.prototype.hasOwnProperty.call(fields, key)) {
+            return { payload: content.slice(0, idx), fields: null, parseError: `duplicate signature field: ${key}` };
+        }
+        fields[key] = line.slice(colon + 1).trim();
+    }
+    for (const req of REQUIRED_FIELDS) {
+        if (!fields[req])
+            return { payload: content.slice(0, idx), fields: null, parseError: `signature block missing ${req}` };
+    }
+    if (Object.keys(fields).some(k => !ALLOWED_FIELDS.includes(k))) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'signature block contains unknown fields' };
+    }
+    if (!/^sha256:[0-9a-f]{64}$/i.test(fields.cert_fingerprint)) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid cert_fingerprint' };
+    }
+    if (fields.public_key_fingerprint && !/^sha256:[0-9a-f]{64}$/i.test(fields.public_key_fingerprint)) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid public_key_fingerprint' };
+    }
+    if (!/^\d+$/.test(fields.timestamp)) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid timestamp' };
+    }
+    if (!isStrictBase64(fields.signature)) {
+        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid signature base64' };
+    }
+    return { payload: content.slice(0, idx), fields: fields };
+}
+// ── 证书 ↔ AID 绑定校验（镜像 fastaun/dist/agent-md-schema.js:102） ────────
+/** 取证书 Subject 的 CN。 */
+function certCommonName(certPem, issuer = false) {
+    const cert = new X509Certificate(certPem);
+    const target = issuer ? cert.issuer : cert.subject;
+    for (const line of target.split('\n')) {
+        const m = line.match(/^CN=(.*)$/);
+        if (m)
+            return m[1].trim();
+    }
+    return '';
+}
+/**
+ * 校验证书本身与 AID 的绑定。
+ *
+ * `requireCurrentValidity` 默认 **false** —— 记忆文件是历史记录，证书到期后
+ * 旧记忆不该集体失效。要做时效策略，由调用方比对 `timestamp`。
+ */
+export function validateMemoryCertificate(certPem, expectedAid, timestamp, opts = {}) {
+    let cert;
+    try {
+        cert = new X509Certificate(certPem);
+    }
+    catch (e) {
+        return { ok: false, reason: `certificate unreadable: ${e?.message ?? e}` };
+    }
+    if (cert.publicKey.asymmetricKeyType !== 'ec'
+        || cert.publicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+        return { ok: false, reason: 'signing certificate must use P-256' };
+    }
+    const notBefore = Math.trunc(new Date(cert.validFrom).getTime() / 1000);
+    const notAfter = Math.trunc(new Date(cert.validTo).getTime() / 1000);
+    const current = Math.trunc(opts.now ?? Date.now() / 1000);
+    if (![notBefore, notAfter, current, timestamp].every(Number.isFinite)) {
+        return { ok: false, reason: 'signing certificate is invalid' };
+    }
+    if ((opts.requireCurrentValidity ?? false) && (current < notBefore || current > notAfter)) {
+        return { ok: false, reason: 'signing certificate is expired or not yet valid' };
+    }
+    if (certCommonName(certPem).toLowerCase() !== expectedAid.trim().toLowerCase()) {
+        return { ok: false, reason: 'signing certificate subject does not match AID' };
+    }
+    if (timestamp < notBefore || timestamp > notAfter) {
+        return { ok: false, reason: 'signature timestamp is outside certificate validity' };
+    }
+    return { ok: true };
+}
+// ── 对外接口 ────────────────────────────────────────────────────────────────
+/**
+ * 对记忆文件内容签名。
+ * 失败时抛出错误，调用方负责处理（不静默丢弃）。
+ */
+export async function signMemoryFile(content, selfAid) {
+    const bytes = Buffer.byteLength(content, 'utf-8');
+    if (bytes > MAX_MEMORY_BYTES) {
+        throw new Error(`MEMORY_TOO_LARGE: 记忆文件 ${bytes} 字节，超过上限 ${MAX_MEMORY_BYTES} 字节（10KB）。` +
+            `一条记忆应当是一句话能说清的结论。内容确实这么多时，请拆成多条分别 create，` +
+            `或把细节留在归档的文件里、记忆只记结论。`);
+    }
+    const store = await getAidStore({ slotId: SLOT.daemon, aunPath: aunPath() });
+    try {
+        const aid = loadAid(store, selfAid);
+        // 保证 payload 以换行结尾，签名块独占一行（解析时的硬要求）
+        const payload = content.endsWith('\n') ? content : `${content}\n`;
+        const r = aid.sign(payload);
+        if (!r.ok) {
+            throw new Error(`sign 失败（${selfAid}）: ${r.error?.message ?? String(r.error)}`);
+        }
+        const block = buildSignatureBlock(aid.certFingerprint, Math.trunc(Date.now() / 1000), r.data.signature);
+        return { ok: true, signed: payload + block };
+    }
+    finally {
+        try {
+            store.close();
+        }
+        catch { /* ignore */ }
+    }
+}
+/**
+ * 验签记忆文件内容。
+ *
+ * 返回 `unsigned` 表示文件没有签名块；`invalid` 表示签名块损坏、指纹不符、
+ * 证书与 AID 不匹配、或字节验签失败。
+ *
+ * 只加载本地证书，无需网络。
+ */
+export async function verifyMemoryFile(content, selfAid) {
+    const parsed = parseSignatureBlock(content);
+    if (parsed.parseError)
+        return { status: 'invalid', reason: parsed.parseError };
+    if (!parsed.fields)
+        return { status: 'unsigned' };
+    const store = await getAidStore({ slotId: SLOT.daemon, aunPath: aunPath() });
+    try {
+        const aid = loadAid(store, selfAid);
+        // ① 证书指纹必须匹配本地证书
+        if (!certMatchesFingerprint(aid.certPem, parsed.fields.cert_fingerprint)) {
+            return { status: 'invalid', reason: 'certificate fingerprint mismatch' };
+        }
+        // ② 公钥指纹（若有）也必须匹配
+        if (parsed.fields.public_key_fingerprint
+            && parsed.fields.public_key_fingerprint.toLowerCase() !== publicKeyFingerprint(aid.certPem).toLowerCase()) {
+            return { status: 'invalid', reason: 'public key fingerprint mismatch' };
+        }
+        // ③ 证书 ↔ AID 绑定 + 签名时间落在证书有效期
+        const certCheck = validateMemoryCertificate(aid.certPem, selfAid, Number(parsed.fields.timestamp));
+        if (!certCheck.ok)
+            return { status: 'invalid', reason: certCheck.reason };
+        // ④ 字节验签（用解析出的原始 payload，不是原 content）
+        const v = aid.verify(parsed.payload, parsed.fields.signature);
+        if (!v.ok) {
+            return { status: 'invalid', reason: v.error?.message ?? String(v.error) };
+        }
+        if (!v.data.valid)
+            return { status: 'invalid', reason: 'signature verification failed' };
+        return { status: 'verified' };
+    }
+    catch (e) {
+        return { status: 'invalid', reason: e?.message ?? String(e) };
+    }
+    finally {
+        try {
+            store.close();
+        }
+        catch { /* ignore */ }
+    }
+}