evolcore 0.0.3 → 0.0.4

package/dist/config/config-manager.js

@@ -12,19 +12,22 @@
  */
 import fs from 'fs';
 import path from 'path';
+import crypto from 'crypto';
 import { resolvePaths, agentConfig as agentConfigPath, agentContactConfig, agentRelationConfig, agentDir, agentRelationsDir, agentRolesIndex, agentRoleConfig, } from '../paths.js';
 import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { isExplicitGroupId } from '../aun/group-identity.js';
 import { parseContactAlias } from './contact-alias.js';
-import { loadSchema, currentVersion, isSchemaName, } from './schema-registry.js';
+import { loadSchema, listSchemaVersions, currentVersion, isSchemaName, } from './schema-registry.js';
 import { mergeLayers, expandVars, buildEnvResolver } from './merge.js';
 import { normalizeAgentLifecycle } from './lifecycle.js';
 import { isBehaviorConfigFieldPath } from './config-field-policy.js';
 import { clearRoleStoreCache, isRoleName } from './role-store.js';
 import { writeRoleDefinition, writeRoleRegistry } from './role-service.js';
+import { mutateContactBookTransactionSync } from './contact-book-store.js';
 import { DAEMON_SCHEMA_NAME } from '../product.js';
+import { validateAccessPolicyDomain } from './access-policy-domain.js';
 export var ConfigTarget;
 (function (ConfigTarget) {
     ConfigTarget["Process"] = "process";
@@ -36,6 +39,8 @@ export var ConfigTarget;
     ConfigTarget["Role"] = "role";
 })(ConfigTarget || (ConfigTarget = {}));
 const configWriteListeners = new Set();
+const CONFIG_MUTATION_LOCK_WAIT_MS = 5_000;
+const CONFIG_MUTATION_LOCK_RETRY_MS = 20;
 /** Observe successful in-process config writes after cache invalidation. */
 export function onConfigWrite(listener) {
     configWriteListeners.add(listener);
@@ -224,10 +229,13 @@ export function assertContactBookV2Ready() {
     if (!fs.existsSync(agentsRoot))
         return;
     const issues = [];
-    const agentSchema = loadSchema('agent-config', 6);
-    const contactSchema = loadSchema('contact-book', 2);
-    const relationSchema = loadSchema('relation-config', 5);
-    const inspect = (file, schema) => {
+    const supportedSchemas = (name, minimumVersion) => (listSchemaVersions(name)
+        .filter(version => version >= minimumVersion)
+        .map(version => loadSchema(name, version)));
+    const agentSchemas = supportedSchemas('agent-config', 6);
+    const contactSchemas = supportedSchemas('contact-book', 2);
+    const relationSchemas = supportedSchemas('relation-config', 5);
+    const inspect = (file, schemas) => {
         let value;
         try {
             value = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -236,8 +244,9 @@ export function assertContactBookV2Ready() {
             issues.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
             return;
         }
-        if (!schema.validate(value)) {
-            const detail = (schema.validate.errors ?? [])
+        const candidates = Array.isArray(schemas) ? schemas : [schemas];
+        if (!candidates.some(schema => schema.validate(value))) {
+            const detail = (candidates.at(-1)?.validate.errors ?? [])
                 .map(error => `${error.instancePath || '/'} ${error.message}`)
                 .join('; ');
             issues.push({ file, detail });
@@ -263,14 +272,14 @@ export function assertContactBookV2Ready() {
         const agentFile = path.join(dir, 'config.json');
         if (!fs.existsSync(agentFile))
             continue;
-        inspect(agentFile, agentSchema);
+        inspect(agentFile, agentSchemas);
         const contactFile = path.join(dir, 'contact.json');
         if (fs.existsSync(contactFile)) {
-            inspect(contactFile, contactSchema);
+            inspect(contactFile, contactSchemas);
             inspectContactBookDomain(contactFile, agentFile, issues);
         }
         for (const relationFile of walkRelationConfigs(path.join(dir, 'relations'))) {
-            inspect(relationFile, relationSchema);
+            inspect(relationFile, relationSchemas);
         }
     }
     const correctionReceipt = path.join(root, 'data', 'contact-book-v2-relation-role-authority.json');
@@ -394,7 +403,7 @@ function findRelationRoleRemovedByExperimentalMigration(root) {
                 catch {
                     continue;
                 }
-                if (currentValue?.$schema_version === 5) {
+                if (typeof currentValue?.$schema_version === 'number' && currentValue.$schema_version >= 5) {
                     return currentFile;
                 }
             }
@@ -621,7 +630,12 @@ export function write(target, value, sel, opts = {}) {
         finishConfigWrite(target, sel, file);
         return;
     }
-    const schema = loadSchema(TARGET_SCHEMA[target]);
+    const requestedVersion = value && typeof value === 'object'
+        ? Number(value.$schema_version)
+        : NaN;
+    const schema = target === ConfigTarget.Contact && requestedVersion === 2
+        ? loadSchema('contact-book', 2)
+        : loadSchema(TARGET_SCHEMA[target]);
     const withVer = ensureSchemaVersion(value, schema.version);
     const migrated = withVer;
     // Agent config 写入规范化（aid 校验、projects 字段清理）
@@ -635,15 +649,166 @@ export function write(target, value, sel, opts = {}) {
         validateOrThrow(schema, normalized, target);
         // 1b. responseModeParams 桶内容校验：主 schema 把 responseModeParams 当黑箱，
         //     此处使用“模式桶 schema”逐桶校验内容（桶键 = 已登记的响应模式 id）。
-        if (target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
+        if (target === ConfigTarget.Defaults || target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
             validateResponseModeParams(normalized?.responseModeParams, target);
         }
+        if (target === ConfigTarget.Agent) {
+            const selfAid = sel?.self || String(normalized?.aid || '').trim();
+            const issue = validateAccessPolicyDomain(selfAid, normalized);
+            if (issue)
+                throw new ConfigError(issue.code, issue.message);
+        }
+    }
+    // Owner 是实际联系人。将 Agent 配置和缺失的 Owner 联系人写入同一可恢复事务，
+    // 避免渠道身份绑定承担联系人创建职责。
+    const ownerIds = target === ConfigTarget.Agent && Array.isArray(normalized.owners)
+        ? [...new Set(normalized.owners
+                .map((value) => String(value || '').trim())
+                .filter((value) => isValidAid(value)))]
+        : [];
+    if (target === ConfigTarget.Agent && sel?.self && ownerIds.length > 0) {
+        const before = readTextOrNull(file);
+        const after = `${JSON.stringify(normalized, null, 2)}\n`;
+        mutateContactBookTransactionSync({
+            selfAid: sel.self,
+            actor: 'agent-owner-sync',
+            mutation: { type: 'ensure-contacts', primaryIds: ownerIds },
+        }, [{ file, before, after }]);
+        finishConfigWrite(target, sel, file);
+        return;
     }
     // 2. 写入文件
     fs.mkdirSync(path.dirname(file), { recursive: true });
     atomicWriteJson(file, normalized);
     finishConfigWrite(target, sel, file);
 }
+/**
+ * Mutate one configuration document while holding a file-scoped, cross-process lock.
+ *
+ * Callers must keep the callback synchronous. This is the safe primitive for
+ * read-modify-write paths; direct `read()` followed by `write()` cannot protect
+ * unrelated fields from another process writing the same config document.
+ */
+export function mutateConfig(target, sel, mutate) {
+    if (target === ConfigTarget.RoleRegistry || target === ConfigTarget.Role || target === ConfigTarget.Contact) {
+        throw new ConfigError('MUTATION_UNSUPPORTED', `mutateConfig does not support ${target}`);
+    }
+    const file = targetPath(target, sel);
+    const release = acquireConfigMutationLock(file);
+    try {
+        const current = read(target, sel, { cache: false });
+        const next = current ? cloneConfigValue(current) : configSkeleton(target, sel);
+        const before = stableConfigValue(current ?? next);
+        const value = mutate(next);
+        const changed = before !== stableConfigValue(next);
+        if (changed)
+            write(target, next, sel);
+        return { value, changed };
+    }
+    finally {
+        release();
+    }
+}
+function cloneConfigValue(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function stableConfigValue(value) {
+    return JSON.stringify(sortConfigValue(value));
+}
+function sortConfigValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortConfigValue);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, nested]) => [key, sortConfigValue(nested)]));
+}
+function acquireConfigMutationLock(file) {
+    const lockDir = `${file}.mutation.lock`;
+    const ownerFile = path.join(lockDir, 'owner.json');
+    const token = crypto.randomBytes(16).toString('hex');
+    const candidate = `${lockDir}.candidate-${process.pid}-${token}`;
+    const candidateOwner = path.join(candidate, 'owner.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.mkdirSync(candidate);
+    fs.writeFileSync(candidateOwner, `${JSON.stringify({ pid: process.pid, token })}\n`, { mode: 0o600 });
+    let acquired = false;
+    const deadline = Date.now() + CONFIG_MUTATION_LOCK_WAIT_MS;
+    try {
+        while (true) {
+            try {
+                fs.renameSync(candidate, lockDir);
+                acquired = true;
+                return () => releaseConfigMutationLock(lockDir, ownerFile, token);
+            }
+            catch (error) {
+                if (error?.code !== 'EEXIST' && error?.code !== 'ENOTEMPTY')
+                    throw error;
+                if (reclaimStaleConfigMutationLock(lockDir, ownerFile))
+                    continue;
+                if (Date.now() >= deadline) {
+                    throw new ConfigError('LOCK_TIMEOUT', `Timed out waiting for config mutation lock: ${file}`);
+                }
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, CONFIG_MUTATION_LOCK_RETRY_MS);
+            }
+        }
+    }
+    finally {
+        if (!acquired)
+            fs.rmSync(candidate, { recursive: true, force: true });
+    }
+}
+function reclaimStaleConfigMutationLock(lockDir, ownerFile) {
+    let raw;
+    let pid;
+    try {
+        raw = fs.readFileSync(ownerFile, 'utf8');
+        pid = Number(JSON.parse(raw).pid);
+    }
+    catch {
+        return false;
+    }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        if (error?.code !== 'ESRCH')
+            return false;
+        const reclaimed = `${lockDir}.reclaimed-${crypto.createHash('sha256').update(raw).digest('hex').slice(0, 16)}`;
+        try {
+            fs.renameSync(lockDir, reclaimed);
+            fs.rmSync(reclaimed, { recursive: true, force: true });
+            return true;
+        }
+        catch (renameError) {
+            return renameError?.code === 'ENOENT';
+        }
+    }
+}
+function releaseConfigMutationLock(lockDir, ownerFile, token) {
+    try {
+        const owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8'));
+        if (owner.token === token)
+            fs.rmSync(lockDir, { recursive: true, force: true });
+    }
+    catch {
+        // A replaced lock is not ours to release.
+    }
+}
+function readTextOrNull(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
 function finishConfigWrite(target, sel, file) {
     if (fileCacheAvailable())
         fileCache.invalidate(file);
@@ -688,10 +853,9 @@ function validateOrThrow(schema, value, target) {
 function validateProcessOnlyFields(target, value) {
     if (target === ConfigTarget.Process || !value || typeof value !== 'object')
         return [];
-    const debug = value.debug;
-    if (!debug || typeof debug !== 'object' || !Object.prototype.hasOwnProperty.call(debug, 'eckSnapshots'))
+    if (!Object.prototype.hasOwnProperty.call(value, 'debug'))
         return [];
-    return ['/debug/eckSnapshots is only allowed in process config'];
+    return ['/debug is only allowed in process config'];
 }
 /**
  * responseModeParams 桶专项校验。
@@ -736,7 +900,12 @@ function validateResponseModeParams(params, target) {
  * 供 config-store.validateAgentConfig 等只校验不落盘的场景使用。
  */
 export function validateConfig(target, value) {
-    const schema = loadSchema(TARGET_SCHEMA[target]);
+    const requestedVersion = value && typeof value === 'object'
+        ? Number(value.$schema_version)
+        : NaN;
+    const schema = target === ConfigTarget.Contact && requestedVersion === 2
+        ? loadSchema('contact-book', 2)
+        : loadSchema(TARGET_SCHEMA[target]);
     const withVer = ensureSchemaVersion(value, schema.version);
     const ok = schema.validate(withVer);
     const errors = validateProcessOnlyFields(target, withVer);
@@ -772,6 +941,11 @@ export function ensureFile(target, sel) {
     const file = targetPath(target, sel);
     if (fs.existsSync(file))
         return;
+    const skeleton = configSkeleton(target, sel);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    atomicWriteJson(file, skeleton);
+}
+function configSkeleton(target, sel) {
     const schema = loadSchema(TARGET_SCHEMA[target]);
     const skeleton = { $schema_version: schema.version };
     const props = schema.raw.properties || {};
@@ -791,8 +965,7 @@ export function ensureFile(target, sel) {
         else if (spec?.type === 'object')
             skeleton[key] = {};
     }
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    atomicWriteJson(file, skeleton);
+    return skeleton;
 }
 // ── schema 版本迁移 ───────────────────────────────────────────────────────
 //
@@ -823,9 +996,11 @@ export function resolveAgentConfig(sel, opts = {}) {
 function stripStaticOwnerField(config) {
     if (!config)
         return config;
-    if (!Object.prototype.hasOwnProperty.call(config, 'owners') && !Object.prototype.hasOwnProperty.call(config, 'admins'))
+    if (!Object.prototype.hasOwnProperty.call(config, 'owners')
+        && !Object.prototype.hasOwnProperty.call(config, 'admins')
+        && !Object.prototype.hasOwnProperty.call(config, 'access'))
         return config;
-    const { owners: _owners, admins: _admins, ...rest } = config;
+    const { owners: _owners, admins: _admins, access: _access, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -853,7 +1028,6 @@ export function resolveEffective(sel, opts = {}) {
         models: config.models,
         projects: config.projects,
         capabilities: config.capabilities,
-        debug: config.debug,
         observable: config.observable,
         extra_backup: config.extra_backup,
         // Runtime configuration parameters
@@ -868,6 +1042,7 @@ export function resolveEffective(sel, opts = {}) {
         debounce: config.debounce,
         show_activities: config.show_activities,
         session_renew: config.session_renew,
+        groupRules: config.groupRules,
         render: config.render,
         sessionManifests: config.sessionManifests,
         enable_rich_content: config.enable_rich_content,
@@ -895,6 +1070,7 @@ const EFFECTIVE_BEHAVIOR_FIELDS = [
     'debounce',
     'show_activities',
     'session_renew',
+    'groupRules',
     'render',
     'sessionManifests',
     'enable_rich_content',

package/dist/config/config-operation-service.js

@@ -1,4 +1,4 @@
-import { ConfigError, ConfigTarget, ensureFile, listFields, read, resolveEffectiveFieldWithSource, resolveEffectiveWithSources, validateConfigFile, write, } from './config-manager.js';
+import { ConfigError, ConfigTarget, ensureFile, listFields, mutateConfig, read, resolveEffectiveFieldWithSource, resolveEffectiveWithSources, validateConfigFile, } from './config-manager.js';
 import { collectConfigFiles, diffVersions, listAllVersions, prune, readCurrent, restore, snapshot, isConfigSnapshotsEnabled, } from './snapshot.js';
 import { readBootLog } from './boot-log.js';
 import { currentVersion, fieldSchemaDefault, isSchemaName, listSchemaNames, listSchemaVersions, readRawSchema, schemaHistoryEntry, } from './schema-registry.js';
@@ -302,27 +302,26 @@ function executeSet(op, options) {
     if (!op.route)
         return { ok: false, code: 'UNKNOWN_FIELD', error: `Unknown config field: ${op.field}` };
     const selector = selectorFor(op, options);
-    const existing = read(op.route.target, selector) || {};
-    if (op.route.merge === 'list') {
-        const previous = getNested(existing, op.field);
-        const previousItems = Array.isArray(previous) ? previous : [];
-        const nextItems = Array.isArray(op.value) ? op.value : [op.value];
-        const merged = [...new Set([...previousItems, ...nextItems].map(value => typeof value === 'object' ? JSON.stringify(value) : value))]
-            .map(value => {
-            try {
-                return typeof value === 'string' && value.startsWith('{') ? JSON.parse(value) : value;
-            }
-            catch {
-                return value;
-            }
-        });
-        setNested(existing, op.field, merged);
-    }
-    else {
-        setNested(existing, op.field, op.value);
-    }
-    ensureFile(op.route.target, selector);
-    write(op.route.target, existing, selector);
+    mutateConfig(op.route.target, selector, existing => {
+        if (op.route.merge === 'list') {
+            const previous = getNested(existing, op.field);
+            const previousItems = Array.isArray(previous) ? previous : [];
+            const nextItems = Array.isArray(op.value) ? op.value : [op.value];
+            const merged = [...new Set([...previousItems, ...nextItems].map(value => typeof value === 'object' ? JSON.stringify(value) : value))]
+                .map(value => {
+                try {
+                    return typeof value === 'string' && value.startsWith('{') ? JSON.parse(value) : value;
+                }
+                catch {
+                    return value;
+                }
+            });
+            setNested(existing, op.field, merged);
+        }
+        else {
+            setNested(existing, op.field, op.value);
+        }
+    });
     return {
         ok: true,
         subcommand: 'set',
@@ -336,22 +335,20 @@ function executeUnset(op, options) {
     if (!op.route)
         return { ok: false, code: 'UNKNOWN_FIELD', error: `Unknown config field: ${op.field}` };
     const selector = selectorFor(op, options);
-    const existing = read(op.route.target, selector);
-    if (!existing) {
-        return { ok: true, subcommand: 'unset', field: op.field, removed: false, scope: op.configScope };
-    }
-    const parts = op.field.split('.');
-    let current = existing;
-    for (let i = 0; i < parts.length - 1; i++) {
-        if (current == null)
-            break;
-        current = current[parts[i]];
-    }
-    const leaf = parts[parts.length - 1];
-    const removed = !!current && typeof current === 'object' && Object.prototype.hasOwnProperty.call(current, leaf);
-    if (removed)
-        delete current[leaf];
-    write(op.route.target, existing, selector);
+    const { value: removed } = mutateConfig(op.route.target, selector, existing => {
+        const parts = op.field.split('.');
+        let current = existing;
+        for (let i = 0; i < parts.length - 1; i++) {
+            if (current == null)
+                break;
+            current = current[parts[i]];
+        }
+        const leaf = parts[parts.length - 1];
+        const exists = !!current && typeof current === 'object' && Object.prototype.hasOwnProperty.call(current, leaf);
+        if (exists)
+            delete current[leaf];
+        return exists;
+    });
     return { ok: true, subcommand: 'unset', field: op.field, removed, scope: op.configScope };
 }
 function selectorFor(command, options = {}) {