evolcore 0.0.29-test.0 → 0.0.30

package/dist/trigger/script-sandbox.js

@@ -0,0 +1,458 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { spawn } from 'node:child_process';
+import { resolveCodexCliPath } from '../agents/baseagent.js';
+import { ensureSessionRuntimeDir } from '../cli/task-context.js';
+import { resolveBubblewrapPath } from '../core/permission/sandbox-runtime.js';
+import { classifyProtectedPath, getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../core/permission/protected-paths.js';
+import { resolveRoot } from '../paths.js';
+import { buildCliLaunchCommand, killProcess, resolveCommandPath } from '../utils/cross-platform.js';
+import { TRIGGER_LOCAL_FILE_LIMIT } from './local-files.js';
+const SAFE_ENVIRONMENT_KEYS = [
+    'ComSpec', 'COMSPEC', 'LANG', 'LC_ALL', 'OS', 'PATH', 'PATHEXT',
+    'ProgramData', 'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432',
+    'SystemDrive', 'SystemRoot', 'WINDIR',
+];
+const SYSTEM_READ_ROOTS = ['/usr/bin', '/usr/lib', '/usr/lib64', '/usr/local/bin', '/usr/local/lib', '/usr/share/locale', '/usr/share/zoneinfo', '/bin', '/sbin', '/lib', '/lib64'];
+const SYSTEM_READ_FILES = ['/etc/ld.so.cache', '/etc/localtime', '/etc/passwd', '/etc/group'];
+const CONTROL_DIRECTORY_NAMES = ['agents', 'AIDs', 'aids', 'data', 'CA', '.snapshots', 'logs', 'backups'];
+const WINDOWS_SANDBOX_SETUP_VERSION = 5;
+const WINDOWS_SANDBOX_ENV_EXCLUDES = [
+    'CODEX_HOME',
+    'EVOLCORE_DELEGATION_TOKEN',
+    'EVOLCORE_CODEX_SESSION_TOKEN',
+    'EVOLCORE_TASK_RUNTIME_CONTEXT',
+    'EVOLCORE_INSTANCE_SOCKET',
+    'EVOLCORE_DAEMON_SOCKET',
+    'EVOLCORE_IPC_SOCKET',
+    'OPENAI_API_KEY',
+    'CODEX_API_KEY',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'GEMINI_API_KEY',
+    'GOOGLE_API_KEY',
+    'ECAGENT_API_KEY',
+];
+export function buildTriggerScriptLaunch(input) {
+    const authorization = input.executionAuthorization;
+    if (!authorization?.allowed || !authorization.scope)
+        throw new Error('Trigger execution authorization is missing');
+    const runtime = resolveRuntime(input.trigger.execution.script?.runtime || '');
+    if (authorization.scope === 'daemon') {
+        const launch = buildCliLaunchCommand(runtime, [input.scriptPath, ...input.scriptArgs]);
+        return { ...launch, cwd: input.projectPath, env: process.env };
+    }
+    if (!authorization.permissionMode || authorization.permissionMode === 'fullaccess') {
+        throw new Error('scoped Trigger execution requires an effective non-fullaccess permission mode');
+    }
+    if (process.platform !== 'linux' && process.platform !== 'win32') {
+        throw new Error('scoped Trigger script isolation is unavailable on this host');
+    }
+    if (process.platform === 'win32' && path.extname(runtime).toLowerCase() !== '.exe') {
+        throw new Error('scoped Windows Trigger scripts require a native executable runtime');
+    }
+    const projectPath = resolveRealDirectory(input.projectPath, 'Trigger project path');
+    const triggerDir = resolveRealDirectory(input.triggerDir, 'Trigger directory');
+    const root = resolveRealDirectory(resolveRoot(), 'EvolCore root');
+    const projectClass = classifyProtectedPath(projectPath, { root, selfAid: input.trigger.agentAid });
+    if (projectClass !== 'ordinary')
+        throw new Error(`scoped Trigger project path is protected: ${projectPath}`);
+    if ((isSameOrDescendant(root, projectPath) && !samePath(projectPath, root))
+        || isSameOrDescendant(os.homedir(), projectPath)) {
+        throw new Error('scoped Trigger project must not contain the EvolCore root or the host home directory');
+    }
+    const runtimeDir = path.dirname(runtime);
+    if (classifyProtectedPath(runtime, { root, selfAid: input.trigger.agentAid }) !== 'ordinary'
+        || isSameOrDescendant(root, runtimeDir) && !isSameOrDescendant(runtimeDir, root)
+        || samePath(runtimeDir, path.parse(runtimeDir).root)) {
+        throw new Error('scoped Trigger runtime path is protected or too broad');
+    }
+    const scriptBytes = readScriptSnapshot(input.scriptPath, triggerDir);
+    const windowsBackend = process.platform === 'win32' ? resolveWindowsBackend() : undefined;
+    if (windowsBackend && (isSameOrDescendant(windowsBackend.home, projectPath)
+        || isSameOrDescendant(projectPath, windowsBackend.home)
+        || isSameOrDescendant(windowsBackend.home, runtimeDir)
+        || isSameOrDescendant(runtimeDir, windowsBackend.home))) {
+        throw new Error('scoped Trigger project and runtime must not expose the Codex control home');
+    }
+    const bubblewrap = process.platform === 'linux' ? resolveBubblewrapPath() : undefined;
+    if (process.platform === 'linux' && !bubblewrap) {
+        throw new Error('bubblewrap is required for scoped Trigger script isolation');
+    }
+    const runtimeRoot = ensureSessionRuntimeDir(`trigger:${input.trigger.agentAid}:${input.trigger.id}`);
+    if (!runtimeRoot)
+        throw new Error('scoped Trigger runtime directory is unavailable');
+    assertRealDirectory(runtimeRoot, 'scoped Trigger runtime root');
+    if (isSameOrDescendant(path.dirname(runtimeRoot), projectPath)) {
+        throw new Error('scoped Trigger project must not contain the shared temporary directory');
+    }
+    const runDir = fs.mkdtempSync(path.join(runtimeRoot, 'run-'));
+    const cleanup = () => {
+        if (!isSameOrDescendant(runDir, runtimeRoot) || samePath(runDir, runtimeRoot))
+            return;
+        try {
+            assertRealDirectory(runDir, 'scoped Trigger run directory');
+            fs.rmSync(runDir, { recursive: true, force: true });
+        }
+        catch { }
+    };
+    try {
+        const workDir = path.join(runDir, 'work');
+        const snapshotDir = path.join(runDir, 'script');
+        fs.mkdirSync(workDir, { mode: 0o700 });
+        fs.mkdirSync(snapshotDir, { mode: 0o700 });
+        const scriptPath = path.join(snapshotDir, path.basename(input.scriptPath));
+        fs.writeFileSync(scriptPath, scriptBytes, { flag: 'wx', mode: 0o400 });
+        preserveNodeModuleType(runtime, input.scriptPath, snapshotDir);
+        const env = buildSandboxEnvironment(workDir);
+        const blockedPaths = protectedScriptPaths(root, input.trigger.agentAid);
+        const scriptArgs = [scriptPath, ...input.scriptArgs];
+        if (windowsBackend) {
+            const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+            const readRoots = [
+                path.join(systemRoot, 'System32'),
+                path.join(systemRoot, 'WinSxS'),
+                runtime,
+                runtimeDir,
+                process.execPath,
+                path.dirname(process.execPath),
+                snapshotDir,
+            ].filter(value => fs.existsSync(value));
+            const entries = [
+                { path: { type: 'special', value: { kind: 'root' } }, access: 'deny' },
+                ...readRoots.map(value => filesystemEntry(value, 'read')),
+                filesystemEntry(projectPath, authorization.permissionMode === 'readonly' ? 'read' : 'write'),
+                filesystemEntry(workDir, 'write'),
+                ...blockedPaths.map(value => filesystemEntry(value, 'deny')),
+            ];
+            const sandboxState = JSON.stringify({
+                permissionProfile: {
+                    type: 'managed',
+                    file_system: { type: 'restricted', entries },
+                    network: 'restricted',
+                },
+                sandboxCwd: pathToFileURL(projectPath).href,
+            });
+            if (sandboxState.length > 20_000)
+                throw new Error('scoped Windows Trigger filesystem policy exceeds the command-line budget');
+            const shellEnvironmentPolicy = `shell_environment_policy={inherit="all",exclude=${JSON.stringify(WINDOWS_SANDBOX_ENV_EXCLUDES)},include_only=[],set={}}`;
+            const sandboxArgs = [
+                'sandbox', '--sandbox-state-json', sandboxState, '--sandbox-state-disable-network',
+                '-c', 'windows.sandbox="elevated"',
+                '-c', shellEnvironmentPolicy,
+            ];
+            const launch = {
+                command: windowsBackend.command,
+                args: [...sandboxArgs, '--', runtime, ...scriptArgs],
+                cwd: projectPath,
+                env: { ...env, CODEX_HOME: windowsBackend.home },
+                cleanup,
+            };
+            launch.prepare = signal => verifyWindowsReadIsolation(launch, sandboxArgs, runDir, workDir, signal);
+            return launch;
+        }
+        const args = [
+            '--die-with-parent', '--new-session', '--unshare-all', '--cap-drop', 'ALL',
+            '--tmpfs', '/', '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp',
+        ];
+        const readRoots = [...SYSTEM_READ_ROOTS, ...SYSTEM_READ_FILES, runtimeDir]
+            .filter(value => fs.existsSync(value));
+        const visibleRoots = [...readRoots, projectPath];
+        const directoryMountpoints = new Set();
+        for (const value of [...visibleRoots, ...blockedPaths, runDir, workDir].filter(value => fs.existsSync(value))) {
+            const stat = fs.lstatSync(value);
+            let current = stat.isDirectory() ? path.resolve(value) : path.dirname(path.resolve(value));
+            while (current !== path.parse(current).root) {
+                directoryMountpoints.add(current);
+                current = path.dirname(current);
+            }
+        }
+        for (const value of [...directoryMountpoints].sort((left, right) => left.length - right.length)) {
+            args.push('--dir', value);
+        }
+        for (const value of new Set(readRoots))
+            args.push('--ro-bind', value, value);
+        args.push(authorization.permissionMode === 'readonly' ? '--ro-bind' : '--bind', projectPath, projectPath);
+        for (const value of blockedPaths) {
+            if (!visibleRoots.some(directory => isSameOrDescendant(value, directory)) || !fs.existsSync(value))
+                continue;
+            const stat = fs.lstatSync(value);
+            if (stat.isDirectory())
+                args.push('--tmpfs', value, '--remount-ro', value);
+            else
+                args.push('--ro-bind', '/dev/null', value);
+        }
+        args.push('--ro-bind', runDir, runDir, '--bind', workDir, workDir, '--remount-ro', '/');
+        args.push('--chdir', projectPath, '--', runtime, ...scriptArgs);
+        return { command: bubblewrap, args, cwd: projectPath, env, cleanup };
+    }
+    catch (error) {
+        cleanup();
+        throw error;
+    }
+}
+function resolveRuntime(value) {
+    const runtime = value.trim();
+    if (!runtime || /[\0\r\n]/.test(runtime))
+        throw new Error('script.runtime is invalid');
+    const executable = runtime === 'node' ? process.execPath
+        : path.isAbsolute(runtime) ? runtime : resolveCommandPath(runtime);
+    if (!executable || !fs.statSync(executable).isFile())
+        throw new Error(`script runtime is unavailable: ${runtime}`);
+    return fs.realpathSync.native(executable);
+}
+function resolveWindowsBackend() {
+    const codexPath = resolveCodexCliPath();
+    if (!codexPath)
+        throw new Error('Codex CLI is required for scoped Windows Trigger script isolation');
+    let command = codexPath;
+    if (path.extname(command).toLowerCase() !== '.exe') {
+        const packageFile = path.join(path.dirname(codexPath), 'node_modules', '@openai', 'codex', 'package.json');
+        const platformName = `@openai/codex-win32-${process.arch}`;
+        const platformFile = createRequire(packageFile).resolve(`${platformName}/package.json`);
+        const target = process.arch === 'arm64' ? 'aarch64-pc-windows-msvc' : 'x86_64-pc-windows-msvc';
+        command = path.join(path.dirname(platformFile), 'vendor', target, 'bin', 'codex.exe');
+    }
+    if (!fs.statSync(command).isFile())
+        throw new Error('native Codex executable is unavailable');
+    const home = resolveRealDirectory(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'Codex control home');
+    let marker;
+    try {
+        marker = JSON.parse(fs.readFileSync(path.join(home, '.sandbox', 'setup_marker.json'), 'utf8'));
+    }
+    catch { }
+    let users;
+    try {
+        users = JSON.parse(fs.readFileSync(path.join(home, '.sandbox-secrets', 'sandbox_users.json'), 'utf8'));
+    }
+    catch { }
+    if (!marker || marker.version !== WINDOWS_SANDBOX_SETUP_VERSION || marker.allow_local_binding !== false
+        || !Array.isArray(marker.proxy_ports) || marker.proxy_ports.length !== 0
+        || !users || users.version !== WINDOWS_SANDBOX_SETUP_VERSION
+        || users.offline?.username !== 'CodexSandboxOffline' || typeof users.offline?.password !== 'string' || !users.offline.password
+        || users.online?.username !== 'CodexSandboxOnline' || typeof users.online?.password !== 'string' || !users.online.password
+        || !fs.existsSync(path.join(home, '.sandbox-bin'))
+        || !fs.readdirSync(path.join(home, '.sandbox-bin')).some(name => /^codex-command-runner-.+\.exe$/.test(name))) {
+        throw new Error('Windows restricted-read sandbox must be prepared in the host terminal; automatic elevation and host fallback are disabled');
+    }
+    return { command: fs.realpathSync.native(command), home };
+}
+function resolveRealDirectory(value, label) {
+    if (!path.isAbsolute(value))
+        throw new Error(`${label} must be absolute`);
+    assertRealDirectory(path.resolve(value), label);
+    return fs.realpathSync.native(value);
+}
+function assertRealDirectory(value, label) {
+    const stat = fs.lstatSync(value);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || !samePath(fs.realpathSync.native(value), path.resolve(value))) {
+        throw new Error(`${label} must be a real directory without symlinks or junctions`);
+    }
+}
+function samePath(left, right) {
+    return isSameOrDescendant(left, right) && isSameOrDescendant(right, left);
+}
+function readScriptSnapshot(value, triggerDir) {
+    const scriptPath = path.resolve(value);
+    const validate = () => {
+        if (!isSameOrDescendant(scriptPath, triggerDir))
+            throw new Error('Trigger script must stay inside its directory');
+        let current = path.dirname(scriptPath);
+        while (true) {
+            assertRealDirectory(current, 'Trigger script parent');
+            if (samePath(current, triggerDir))
+                break;
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw new Error('Trigger script directory is invalid');
+            current = parent;
+        }
+        const stat = fs.lstatSync(scriptPath);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > TRIGGER_LOCAL_FILE_LIMIT) {
+            throw new Error('Trigger script must be a regular unlinked file under 4 MiB');
+        }
+        return stat;
+    };
+    const expected = validate();
+    const descriptor = fs.openSync(scriptPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fs.fstatSync(descriptor);
+        if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== expected.dev || opened.ino !== expected.ino
+            || opened.size !== expected.size || opened.size > TRIGGER_LOCAL_FILE_LIMIT) {
+            throw new Error('Trigger script changed during validation');
+        }
+        const bytes = Buffer.alloc(opened.size + 1);
+        let length = 0;
+        while (length < bytes.length) {
+            const count = fs.readSync(descriptor, bytes, length, bytes.length - length, length);
+            if (!count)
+                break;
+            length += count;
+        }
+        const after = fs.fstatSync(descriptor);
+        const current = validate();
+        if (length !== opened.size || after.size !== opened.size || after.nlink !== 1
+            || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs
+            || current.dev !== opened.dev || current.ino !== opened.ino
+            || current.mtimeMs !== opened.mtimeMs || current.ctimeMs !== opened.ctimeMs) {
+            throw new Error('Trigger script changed during snapshotting');
+        }
+        return bytes.subarray(0, length);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function preserveNodeModuleType(runtime, scriptPath, snapshotDir) {
+    if (!/^node(?:\.exe)?$/i.test(path.basename(runtime)) || path.extname(scriptPath) !== '.js')
+        return;
+    let current = path.dirname(scriptPath);
+    while (true) {
+        const packageFile = path.join(current, 'package.json');
+        if (fs.existsSync(packageFile)) {
+            const stat = fs.lstatSync(packageFile);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > TRIGGER_LOCAL_FILE_LIMIT) {
+                throw new Error('script package metadata must be a regular unlinked file under 4 MiB');
+            }
+            const metadata = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+            if (metadata.type === 'module' || metadata.type === 'commonjs') {
+                fs.writeFileSync(path.join(snapshotDir, 'package.json'), JSON.stringify({ type: metadata.type }), { flag: 'wx', mode: 0o400 });
+            }
+            return;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return;
+        current = parent;
+    }
+}
+function buildSandboxEnvironment(workDir) {
+    const env = {};
+    for (const key of SAFE_ENVIRONMENT_KEYS) {
+        const value = process.env[key];
+        if (typeof value === 'string' && value.length > 0)
+            env[key] = value;
+    }
+    const homeDir = process.platform === 'win32' ? path.join(workDir, 'home') : workDir;
+    if (homeDir !== workDir)
+        fs.mkdirSync(homeDir, { mode: 0o700 });
+    return {
+        ...env, HOME: homeDir, USERPROFILE: homeDir,
+        APPDATA: path.join(workDir, 'appdata'), LOCALAPPDATA: path.join(workDir, 'localappdata'),
+        TMPDIR: workDir, TEMP: workDir, TMP: workDir, EVOLCORE_TRIGGER_SANDBOX: '1',
+    };
+}
+function protectedScriptPaths(root, selfAid) {
+    const directoryRoots = CONTROL_DIRECTORY_NAMES.map(name => path.join(root, name));
+    const targets = [
+        ...directoryRoots,
+        ...getExistingHClassMaskTargets(root, { selfAid }).map(target => target.path),
+        ...getExistingLClassReadOnlyTargets(root, { selfAid }).map(target => target.path),
+        path.join(root, 'daemon.json'), path.join(root, '.env'), path.join(root, '.device_id'),
+        path.join(root, '.lock'), path.join(root, 'daemon.pid'),
+    ];
+    return [...new Set(targets)].filter(candidate => (directoryRoots.includes(candidate) || !directoryRoots.some(directory => isSameOrDescendant(candidate, directory))));
+}
+function filesystemEntry(value, access) {
+    return { path: { type: 'path', path: path.resolve(value) }, access };
+}
+async function verifyWindowsReadIsolation(launch, sandboxArgs, runDir, workDir, signal) {
+    signal?.throwIfAborted();
+    const canary = path.join(runDir, 'read-isolation-canary');
+    const writableProbe = path.join(workDir, 'write-isolation-probe');
+    fs.writeFileSync(canary, 'evolcore-read-isolation-canary', { flag: 'wx' });
+    const readProbe = [
+        'const fs = require("node:fs");',
+        'if (fs.readFileSync(process.argv[1], "utf8") !== "evolcore-read-isolation-canary") process.exit(91);',
+        'process.stdout.write("evolcore-trigger-sandbox-ready");',
+    ].join('\n');
+    const probe = [
+        'const fs = require("node:fs");',
+        'let denied = false;',
+        'try { fs.readFileSync(process.argv[1]); } catch (error) {',
+        'if (error.code === "EACCES" || error.code === "EPERM") denied = true; else throw error;',
+        '}',
+        'if (!denied) { process.stderr.write("read isolation is not enforced"); process.exit(90); }',
+        'fs.writeFileSync(process.argv[2], "allowed");',
+        'process.stdout.write("evolcore-trigger-sandbox-ready");',
+    ].join('\n');
+    try {
+        const readArgs = [...sandboxArgs];
+        const stateIndex = readArgs.indexOf('--sandbox-state-json') + 1;
+        const readState = JSON.parse(readArgs[stateIndex]);
+        readState.permissionProfile.file_system.entries.push(filesystemEntry(canary, 'read'));
+        readArgs[stateIndex] = JSON.stringify(readState);
+        if (readArgs[stateIndex].length > 20_000)
+            throw new Error('filesystem probe policy exceeds the command-line budget');
+        await runWindowsIsolationProbe(launch, readArgs, readProbe, [canary], signal);
+        await runWindowsIsolationProbe(launch, sandboxArgs, probe, [canary, writableProbe], signal);
+    }
+    catch (error) {
+        throw new Error(`Windows sandbox cannot prove scoped read isolation; Trigger script execution is refused: ${error?.message || String(error)}`, { cause: error });
+    }
+    finally {
+        try {
+            fs.unlinkSync(canary);
+        }
+        catch { }
+        try {
+            fs.unlinkSync(writableProbe);
+        }
+        catch { }
+    }
+}
+function runWindowsIsolationProbe(launch, sandboxArgs, probe, probeArgs, signal) {
+    signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const child = spawn(launch.command, [...sandboxArgs, '--', process.execPath, '-e', probe, ...probeArgs], {
+            cwd: launch.cwd, env: launch.env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+        });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        let terminationError;
+        const terminate = (error) => {
+            if (settled || terminationError)
+                return;
+            terminationError = error;
+            if (!child.pid || !killProcess(child.pid, true)) {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { }
+            }
+        };
+        const abortHandler = () => terminate(new Error('isolation verification was aborted'));
+        const timer = setTimeout(() => terminate(new Error('isolation verification timed out')), 15_000);
+        timer.unref();
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', abortHandler);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        child.stdout.on('data', bytes => { stdout = (stdout + bytes.toString()).slice(0, 2048); });
+        child.stderr.on('data', bytes => { stderr = (stderr + bytes.toString()).slice(0, 2048); });
+        child.once('error', error => finish(terminationError ?? error));
+        child.once('close', code => {
+            if (terminationError)
+                finish(terminationError);
+            else if (code === 0 && stdout === 'evolcore-trigger-sandbox-ready')
+                finish();
+            else
+                finish(new Error(stderr.trim() || `isolation verification exited with code ${code}`));
+        });
+        if (signal?.aborted)
+            abortHandler();
+        else
+            signal?.addEventListener('abort', abortHandler, { once: true });
+    });
+}

package/dist/trigger/system-definitions.js

@@ -0,0 +1,188 @@
+import fs from 'fs';
+import path from 'path';
+import { getPackageRoot } from '../paths.js';
+import { TASK_RECOVERY_PROMPT } from '../core/task/task-recovery-service.js';
+import { atomicWriteJson } from '../core/session/session-fs-store.js';
+import { normalizeTriggerDefinition } from './validation.js';
+export function seedUpgradeCheckTrigger(manager, owner) {
+    const now = Date.now();
+    const scriptName = 'upgrade-check.cjs';
+    const definition = normalizeTriggerDefinition({
+        $schema_version: 3.1,
+        id: '__upgrade-check',
+        agentAid: owner.aid,
+        enabled: true,
+        name: '__upgrade-check',
+        description: 'System trigger: check EvolCore upgrades after install or upgrade.',
+        createdAt: now,
+        updatedAt: now,
+        origin: {
+            channelKey: 'daemon',
+            channelType: 'daemon',
+            channelId: owner.originPeerId || owner.aid,
+            session: 'main',
+            peerId: owner.originPeerId || owner.aid,
+            sessionKey: `daemon#${owner.originPeerId || owner.aid}#__system__`,
+        },
+        source: {
+            type: 'cron',
+            expression: '59 3 * * *',
+            timezone: 'Asia/Shanghai',
+        },
+        execution: {
+            type: 'script',
+            script: {
+                path: scriptName,
+                runtime: 'node',
+                timeoutMs: 60_000,
+            },
+            permissionMode: 'bypass',
+            onError: 'fail',
+            noopSentinel: '[[NOOP]]',
+        },
+        feedback: {
+            strategy: 'silent',
+        },
+        reliability: {
+            concurrency: 'forbid',
+            missedPolicy: 'run_once',
+            retry: {
+                maxAttempts: 0,
+                backoffMs: 30_000,
+            },
+        },
+    });
+    const dir = manager.triggerDir(definition.id);
+    fs.mkdirSync(dir, { recursive: true });
+    const scriptPath = path.join(dir, scriptName);
+    const packageRoot = getPackageRoot();
+    fs.writeFileSync(scriptPath, `#!/usr/bin/env node
+const { pathToFileURL } = require('node:url');
+const entry = ${JSON.stringify(path.join(packageRoot, 'dist', 'utils', 'package-version-info.js'))};
+async function main() {
+  const { refreshManagedPackageVersions } = await import(pathToFileURL(entry).href);
+  const results = await refreshManagedPackageVersions(undefined, { source: 'daily-check' });
+  const failed = results.some(result => result.status === 'unavailable');
+  process.stdout.write(JSON.stringify({
+    outcome: failed ? 'error' : 'success',
+    text: results.map(result => result.packageName + ': ' + result.status).join('; '),
+    files: [],
+  }));
+}
+main().catch(() => {
+  process.stdout.write(JSON.stringify({ outcome: 'error', text: 'Version information refresh failed', files: [] }));
+  process.exitCode = 1;
+});
+`);
+    fs.rmSync(path.join(dir, 'upgrade-check.sh'), { force: true });
+    fs.rmSync(path.join(dir, 'upgrade-check.js'), { force: true });
+    fs.chmodSync(scriptPath, 0o755);
+    atomicWriteJson(manager.definitionPath(definition.id), definition);
+    fs.rmSync(manager.activePath(definition.id), { force: true });
+}
+export function seedTaskRecoveryTrigger(manager, owner) {
+    const now = Date.now();
+    const definition = normalizeTriggerDefinition({
+        $schema_version: 3.1,
+        id: '__task-recovery',
+        agentAid: owner.aid,
+        enabled: true,
+        name: '__task-recovery',
+        description: 'System trigger: recover failed tasks for local Agents.',
+        createdAt: now,
+        updatedAt: now,
+        origin: {
+            channelKey: 'daemon',
+            channelType: 'daemon',
+            channelId: owner.originPeerId || owner.aid,
+            session: 'main',
+            peerId: owner.originPeerId || owner.aid,
+            sessionKey: `daemon#${owner.originPeerId || owner.aid}#__task-recovery__`,
+        },
+        source: {
+            type: 'event',
+            eventPattern: 'task:error',
+        },
+        execution: {
+            type: 'target_session',
+            prompt: TASK_RECOVERY_PROMPT,
+            onError: 'retry',
+            noopSentinel: '[[NOOP]]',
+        },
+        feedback: { strategy: 'event_session' },
+        reliability: {
+            concurrency: 'forbid',
+            missedPolicy: 'run_once',
+            retry: { maxAttempts: 2, backoffMs: 30_000 },
+        },
+    });
+    fs.mkdirSync(manager.triggerDir(definition.id), { recursive: true });
+    atomicWriteJson(manager.definitionPath(definition.id), definition);
+    fs.rmSync(manager.activePath(definition.id), { force: true });
+}
+const SESSION_IDLE_CHECK_PROMPT = `本会话已闲置一段时间。请依据你的职责执行一次例行巡检：
+1. 判断群内是否存在成员有未完成的工作却停滞（如长时间无进展、被点名未回应、承诺后失联）。有，则向该成员催促一次并说明停滞事项，随后即止；无，则不做任何动作。大家都在正常工作或无待办时保持沉默。
+2. 巡检优先基于已有上下文判断，确需补充背景再查询历史，并遵守会话自身的发送规范。
+3. 判定无需任何对外动作时，本轮只输出 [[NOOP]]，不发送任何消息、不发布巡检结论。注意：最终对外输出必须是且仅是 [[NOOP]] 这一行——不要在输出它之前先发送任何说明文字或巡检判定，判定过程仅在内部完成。
+（本指令为通用模板，可按具体职责增删检查项。）`;
+export function seedSessionIdleCheckTrigger(manager, owner) {
+    const now = Date.now();
+    const definition = normalizeTriggerDefinition({
+        $schema_version: 3.1,
+        id: '__session-idle-check',
+        agentAid: owner.aid,
+        enabled: true,
+        name: '__session-idle-check',
+        description: 'System trigger: inspect configured idle group sessions.',
+        createdAt: now,
+        updatedAt: now,
+        origin: {
+            channelKey: 'daemon',
+            channelType: 'daemon',
+            channelId: owner.originPeerId || owner.aid,
+            session: 'main',
+            peerId: owner.originPeerId || owner.aid,
+            sessionKey: `daemon#${owner.originPeerId || owner.aid}#__session-idle-check__`,
+        },
+        source: {
+            type: 'event',
+            eventPattern: 'session:idle',
+            filter: { match: { chatType: 'group' } },
+        },
+        execution: {
+            type: 'target_session',
+            prompt: SESSION_IDLE_CHECK_PROMPT,
+            onError: 'retry',
+            noopSentinel: '[[NOOP]]',
+        },
+        feedback: { strategy: 'event_session' },
+        reliability: {
+            concurrency: 'forbid',
+            missedPolicy: 'run_once',
+            retry: { maxAttempts: 2, backoffMs: 30_000 },
+        },
+    });
+    fs.mkdirSync(manager.triggerDir(definition.id), { recursive: true });
+    atomicWriteJson(manager.definitionPath(definition.id), definition);
+    fs.rmSync(manager.activePath(definition.id), { force: true });
+}
+export function removeLegacyAgentUpgradeCheck(manager) {
+    let existing;
+    try {
+        existing = manager.get('__upgrade-check');
+    }
+    catch {
+        fs.rmSync(manager.triggerDir('__upgrade-check'), { recursive: true, force: true });
+        return;
+    }
+    if (!existing)
+        return;
+    const isLegacySystemOrigin = existing.origin?.channelKey === '__system__' || existing.origin?.channelKey === 'daemon';
+    const isUpgradeScript = existing.execution.type === 'script'
+        && (existing.execution.script?.path === 'upgrade-check.sh'
+            || existing.execution.script?.path === 'upgrade-check.js'
+            || existing.execution.script?.path === 'upgrade-check.cjs');
+    if (!isLegacySystemOrigin || !isUpgradeScript)
+        return;
+    fs.rmSync(manager.triggerDir('__upgrade-check'), { recursive: true, force: true });
+}

package/dist/trigger/validation.js

@@ -458,9 +458,6 @@ function normalizeExecution(value, _opts) {
         consolidationChatDir: optionalString(raw.consolidationChatDir),
         consolidationMemoryDir: optionalString(raw.consolidationMemoryDir),
     };
-    if (execution.type === 'script' && execution.permissionMode === 'fullaccess') {
-        throw new Error('script Trigger already executes as the daemon OS user and cannot declare execution.permissionMode=fullaccess');
-    }
     return execution;
 }
 const MEMORY_MODES = ['notes', 'generalize', 'promote', 'profile', 'forget'];

package/dist/utils/aid-bind.js

@@ -1,7 +1,7 @@
 import crypto from 'crypto';
 import { loadAgent, loadDaemonConfig, saveAgent, saveDaemonConfig } from '../config-store.js';
 import { resolveEffective } from '../config/config-manager.js';
-import { readEvolcoreVersion } from '../index.js';
+import { readInstalledEvolcoreVersion as readEvolcoreVersion } from './evolcore-version.js';
 export class BindService {
     opts;
     tasks = new Map();