evolcore 0.0.31 → 0.0.32

package/dist/core/message/message-queue.js

@@ -21,6 +21,20 @@ export class MessageQueue {
     interruptBarriers = new Map();
     interruptFailures = new Map();
     activeTerminalReasons = new Map();
+    /**
+     * 允许「未提交输入」回队的 key（仅新消息到达触发的中断）。
+     * 与 activeTerminalReasons 分开：后者还承载 stop/timeout/priority 抢占等
+     * 语义，那些场景绝不能复活旧输入。
+     */
+    requeueableInterrupts = new Set();
+    /**
+     * queueKey → 触发本次 new_message 中断的消息。
+     *
+     * 回队前用它把「打断消息」从 pending 中排除：只有当队列里没有其它等待项时
+     * 才回队。否则重放旧输入会插到那些等待项（如被 defer 的群聊消息）前面，
+     * 打乱既有调度顺序。
+     */
+    interruptingMessages = new Map();
     eventBus;
     recentMessageIds = new Set();
     DEDUP_WINDOW = 60_000; // 1 分钟窗口
@@ -108,6 +122,19 @@ export class MessageQueue {
                 }
             }
         });
+        subscribe.call(eventBus, 'input_accepted', event => {
+            if (!('inputId' in event) || !event.inputId)
+                return;
+            const inputEvent = event;
+            // inputId 格式为 sessionId 或 sessionId:xxx，取第一段匹配
+            const sessionId = inputEvent.inputId.split(':')[0];
+            for (const [queueKey, state] of this.activeStates) {
+                if (this.matchesSession(queueKey, sessionId)) {
+                    state.inputSubmitted = true;
+                    logger.debug(`[MessageQueue] input_accepted for ${queueKey}, taskId=${state.taskId}, generation=${state.generation}`);
+                }
+            }
+        });
         subscribe.call(eventBus, 'task:completed', event => {
             if ('sessionId' in event && event.sessionId)
                 this.markActiveTerminal(event.sessionId, 'completed');
@@ -124,6 +151,37 @@ export class MessageQueue {
                 this.activeTerminalReasons.set(queueKey, reason);
         }
     }
+    /**
+     * 显式允许/禁止该 key 的 active 批次在中断后回队。
+     *
+     * 只有「新消息到达触发的中断」才置 true：那种场景下旧输入尚未提交给模型，
+     * 用户也确实期望两条一起被看到。stop / 优先级抢占 / 超时等一律不允许复活。
+     */
+    markRequeueable(queueKey, requeueable) {
+        if (requeueable)
+            this.requeueableInterrupts.add(queueKey);
+        else
+            this.requeueableInterrupts.delete(queueKey);
+    }
+    /**
+     * 标记 active 批次的输入已真正提交给模型（runner 发出 input_accepted 后调用）。
+     *
+     * 这是 pre-submit 回队的关键判据：只有「未提交」的 active 才能在 new_message
+     * 中断后安全放回队列；已提交的批次若回队，会在 provider session 里产生重复用户轮次。
+     */
+    markInputSubmitted(sessionId, taskId) {
+        for (const [queueKey, state] of this.activeStates) {
+            if (!this.matchesSession(queueKey, sessionId))
+                continue;
+            // 同一 session 可能有多个 queueKey（不同 agent/project），taskId 用来精确定位。
+            if (taskId !== undefined && state.taskId !== undefined && state.taskId !== taskId)
+                continue;
+            state.inputSubmitted = true;
+            state.submittedMessageIds = Array.from(state.messageIds);
+            logger.debug(`[Queue] input submitted: key=${queueKey} task=${taskId ?? '<none>'} ids=${state.submittedMessageIds.join(',')}`);
+            return;
+        }
+    }
     /**
      * 注册一次性消息拦截器：下一条来自 sessionKey 的消息不入队、不触发 interrupt，
      * 直接传给 handler。用于 AskUserQuestion 的"手动输入"场景。
@@ -1082,7 +1140,12 @@ export class MessageQueue {
                     activeState?.peerId === message.peerId &&
                     !this.hasOtherPeerQueued(queueKey, message.peerId);
                 if (interruptSingle || interruptGroupSamePeer) {
-                    logger.debug(`[Queue] ${queueKey} is processing, triggering interrupt (samePeer=${interruptGroupSamePeer})`);
+                    const inputSubmitted = activeState?.inputSubmitted ?? false;
+                    logger.info(`[Queue] new_message interrupt: key=${queueKey} samePeer=${interruptGroupSamePeer} taskId=${activeState?.taskId ?? '<none>'} generation=${activeState?.generation ?? '<none>'} inputSubmitted=${inputSubmitted} activeMsg=${Array.from(activeState?.messageIds ?? []).join(',')}`);
+                    // 新消息到达才允许 pre-submit 回队：旧输入尚未提交给模型，
+                    // 且用户期望它与刚到的消息一起被看到。
+                    this.markRequeueable(queueKey, true);
+                    this.interruptingMessages.set(queueKey, message);
                     this.eventBus?.publish({
                         type: 'task:interrupted',
                         sessionId: sessionKey,
@@ -1218,7 +1281,7 @@ export class MessageQueue {
             this.activeBatches.set(queueKey, activeItem);
             this.processingStartTime.set(queueKey, Date.now());
             this.persistQueuesImmediate();
-            logger.info(`[Queue] processing batch: key=${queueKey} items=${rawItems.length} pending=${queue.length} rawPending=${this.queueRawMessageCount(queue)} batchRole=${merged.message.batchRole ?? '<mixed>'} peer=${activeState.peerId ?? '<multi>'} msg=${merged.message.messageId ?? '<none>'}`);
+            logger.info(`[Queue] processing batch: key=${queueKey} items=${rawItems.length} pending=${queue.length} rawPending=${this.queueRawMessageCount(queue)} batchRole=${merged.message.batchRole ?? '<mixed>'} peer=${activeState.peerId ?? '<multi>'} msg=${merged.message.messageId ?? '<none>'} sourceIds=${Array.from(activeMessageIds).join(',')}`);
             try {
                 await this.handler(merged.message);
                 logger.debug(`[Queue] Message processed successfully`);
@@ -1230,10 +1293,17 @@ export class MessageQueue {
             }
             finally {
                 if (!this.shuttingDown) {
+                    const terminalReason = this.activeTerminalReasons.get(queueKey);
+                    const disposition = this.disposeInterruptedBatch(queueKey, activeState, rawParts, merged.message.causation);
+                    if (disposition !== 'none') {
+                        logger.info(`[Queue] batch disposition: key=${queueKey} reason=${terminalReason ?? '<completed>'} disposition=${disposition}`);
+                    }
                     this.activeBatches.delete(queueKey);
                     this.processingStartTime.delete(queueKey);
                     this.activeStates.delete(queueKey);
                     this.activeTerminalReasons.delete(queueKey);
+                    this.requeueableInterrupts.delete(queueKey);
+                    this.interruptingMessages.delete(queueKey);
                     this.persistQueuesImmediate();
                 }
             }
@@ -1244,6 +1314,63 @@ export class MessageQueue {
             }
         }
     }
+    /**
+     * 决定被中断的 active 批次的下落。
+     *
+     * 只有同时满足两个条件才回队：
+     *  1) 该 key 被显式标记为「新消息到达」（markRequeueable），而不是 stop/超时/优先级抢占；
+     *  2) 该批次的输入尚未提交给模型（未收到 input_accepted / 未产出输出）。
+     *
+     * 已提交的批次若回队，会在 provider session 里产生重复用户轮次；
+     * stop/timeout/recalled 是用户或系统的明确意图，绝不复活；
+     * daemon_restart 由启动恢复流程处理，这里不重复入队。
+     *
+     * 回队到物理队首并保留原始 messageId/receivedAt，下一次 dequeueGreedy 会把它
+     * 与期间到达的 pending 消息一起合并，等价于「未提交的旧输入 + 新输入」同批提交。
+     */
+    disposeInterruptedBatch(queueKey, activeState, rawParts, causation) {
+        if (!this.requeueableInterrupts.has(queueKey))
+            return 'none';
+        if (!this.interruptCallback
+            || this.activeTerminalReasons.get(queueKey) !== 'new_message')
+            return 'none';
+        if (rawParts.length === 0)
+            return 'none';
+        // 已提交：不能重放，交由 provider/session 侧的既有用户轮次保证上下文完整。
+        if (activeState.inputSubmitted)
+            return 'input_already_submitted';
+        const queue = this.queues.get(queueKey);
+        if (!queue) {
+            logger.warn(`[Queue] pre-submit requeue skipped: queue gone key=${queueKey}`);
+            return 'none';
+        }
+        const requeued = rawParts.map(part => this.itemFromPart(part));
+        // 只有当队列里除打断消息外没有其它等待项时才回队。
+        // 若已有其它 pending（例如被 defer 的群聊消息），说明旧输入本可在当前轮
+        // 处理完毕，回队会插入一个与它们无关的额外轮次并打乱既有调度顺序；
+        // 那种情况下保持原有中断行为。
+        const interrupting = this.interruptingMessages.get(queueKey);
+        const pendingWithoutInterrupt = interrupting
+            ? queue.filter(item => item.message.messageId !== interrupting.messageId)
+            : queue;
+        if (pendingWithoutInterrupt.length > 0) {
+            logger.info(`[Queue] pre-submit requeue skipped: key=${queueKey} other pending=${pendingWithoutInterrupt.length}`);
+            return 'none';
+        }
+        queue.unshift(...requeued);
+        // 按物理顺序重建逻辑队列，避免把旧输入追加到新消息之后，导致 FIFO
+        // 在下一次 reorderPhysical 时颠倒回队消息与打断消息的顺序。
+        // 与 enqueue 路径保持同一条件，避免把 owner-inject/interrupt 消息写进逻辑队列。
+        this.logicalQueue.clear(queueKey);
+        for (const item of queue) {
+            if (item.message.source !== 'owner-inject' && item.message.attentionPolicy !== 'interrupt') {
+                this.logicalQueue.enqueue(queueKey, item.message);
+            }
+        }
+        logger.info(`[Queue] requeued pre-submit batch: key=${queueKey} ids=${requeued
+            .flatMap(item => this.messageIdsFor(item)).join(',')} causation=${causation?.traceId ?? '<none>'}`);
+        return 'requeued_pre_submit';
+    }
     /**
      * 贪心弹出队首可合并消息。
      * 群聊入队携带 role，此时取出当前所有群聊 pending 并按时间线合并；
@@ -1337,7 +1464,8 @@ export class MessageQueue {
             && a.channelKey === b.channelKey
             && a.channelType === b.channelType
             && a.chatType === b.chatType
-            && a.peerKey === b.peerKey;
+            && a.peerKey === b.peerKey
+            && a.approvalInteractionPolicy === b.approvalInteractionPolicy;
     }
     firstTimestamp(item) {
         const parts = this.partsOf(item);

package/dist/core/message/response-engine.js

@@ -1893,6 +1893,20 @@ export class ResponseEngine {
             peerKey: formatPeerKey(channelType, chatType === 'group' ? conversationId : actorId),
         };
     }
+    resolveTaskApprovalInteractionPolicy(message) {
+        if (message.taskRecovery) {
+            const policy = message.taskRecovery.approvalInteractionPolicy;
+            if (policy === 'interactive' || policy === 'deny')
+                return policy;
+            return message.taskRecovery.automatic ? 'deny' : 'interactive';
+        }
+        if (message.source === 'handoff' && message.handoffDelivery?.direction === 'origin') {
+            return message.handoffDelivery.originAuthorization?.approvalInteractionPolicy === 'interactive'
+                ? 'interactive'
+                : 'deny';
+        }
+        return message.source === 'trigger' ? 'deny' : 'interactive';
+    }
     resolveHandoffOriginExecutionIdentity(message, selfAid) {
         const authorization = message.handoffDelivery?.originAuthorization;
         if (message.source !== 'handoff'
@@ -2701,6 +2715,7 @@ export class ResponseEngine {
         const triggerExecutionIdentity = this.resolveTriggerExecutionIdentity(message, selfAid);
         const authorizationIdentity = triggerExecutionIdentity
             ?? this.resolveHandoffOriginExecutionIdentity(message, selfAid);
+        const approvalInteractionPolicy = this.resolveTaskApprovalInteractionPolicy(message);
         const configChannelType = authorizationIdentity?.channelType ?? currentChannelType;
         const configChatType = authorizationIdentity
             ? (message.triggerMeta?.originChatType ?? message.handoffDelivery?.originAuthorization?.chatType ?? 'private')
@@ -3122,6 +3137,7 @@ export class ResponseEngine {
                 : undefined;
             turnLease = await this.turnCoordinator.begin(session, taskId, inputId, configActorId ? {
                 peerId: configActorId,
+                approvalInteractionPolicy,
                 encrypted: message.encrypted ?? message.replyContext?.metadata?.encrypted,
                 baseagent: session.baseagent,
                 agentSessionId: session.agentSessionId,
@@ -3439,7 +3455,7 @@ export class ResponseEngine {
                 peerKey: authPeerKey,
                 causation: taskCausation,
                 approvalRouting,
-                approvalInteractionPolicy: authorizationIdentity ? 'deny' : 'interactive',
+                approvalInteractionPolicy,
                 permissionMode: effectivePermissionMode,
                 recordExecutionAnomaly,
                 pauseController: taskPauseController,
@@ -4253,6 +4269,7 @@ export class ResponseEngine {
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
+                    projectPath: path.resolve(session.projectPath),
                     messageId: message.messageId,
                     baseagent: normalizedBaseagent.canonical,
                     channel: configChannelType,
@@ -4300,7 +4317,9 @@ export class ResponseEngine {
                         selfAid,
                         peerKey,
                         issuedRole: peerRole,
+                        executionSource: fullAccessAuthorization?.source ?? (message.source === 'trigger' ? 'trigger' : 'user'),
                         permissionMode: effectivePermissionMode,
+                        approvalInteractionPolicy,
                         ...(sessionRuntimeDir ? { sessionRuntimeDir } : {}),
                         ...(fullAccessAuthorization ? { executionIdentity: fullAccessAuthorization } : {}),
                     });
@@ -5932,14 +5951,23 @@ export class ResponseEngine {
                 if (event.type === 'input_accepted') {
                     inputAccepted = !turnLease || event.inputId === turnLease.inputId;
                     logger.debug(`[ResponseEngine] Input accepted: session=${session.id} input=${event.inputId}`);
+                    // 通知队列：本批次输入已真正提交给模型，此后不可回队重放。
+                    this.messageQueue?.markInputSubmitted?.(session.id, turnLease?.taskId);
                     continue;
                 }
                 if (event.type === 'text') {
-                    if (event.text.trim())
+                    const hasText = !!event.text.trim();
+                    // 模型已产出文本 ⇒ 输入必然已被消费。覆盖不发 input_accepted 的 runner
+                    // （codex/ecagent/gemini），避免它们在 pre-submit 回队时重复用户轮次。
+                    if (hasText)
+                        this.messageQueue?.markInputSubmitted?.(session.id, turnLease?.taskId);
+                    if (hasText)
                         textCount++;
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                 }
                 else if (event.type === 'tool_use') {
+                    // 产生工具调用同样证明输入已被消费，且此时重放会重复发起副作用。
+                    this.messageQueue?.markInputSubmitted?.(session.id, turnLease?.taskId);
                     toolUseCount++;
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                     if (event.callId) {

package/dist/core/permission/sandbox-runtime.js

@@ -563,6 +563,14 @@ function appendLClassReadOnlyBinds(args, root, options = {}) {
         args.push('--ro-bind', target.path, target.path);
     }
 }
+function appendLClassMasks(args, root, options = {}) {
+    for (const target of getExistingLClassReadOnlyTargets(root, options)) {
+        if (target.kind === 'directory')
+            pushMaskedDirectory(args, target.path);
+        else
+            pushMaskedFile(args, target.path);
+    }
+}
 export function ensureCodexManagedMountpoint(systemConfigDirectory = '/etc/codex', effectiveUid = typeof process.getuid === 'function' ? process.getuid() : undefined) {
     let systemConfigStat;
     try {
@@ -691,7 +699,12 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
                 pushMaskedFile(args, resolved);
         }
     }
-    appendLClassReadOnlyBinds(args, root, options);
+    if (options.denyLClassRead) {
+        appendLClassMasks(args, root, options);
+    }
+    else {
+        appendLClassReadOnlyBinds(args, root, options);
+    }
     appendHClassMasks(args, root, true, options);
     if (options.exposeDaemonIpc !== false)
         appendDaemonIpcSocket(args, root);

package/dist/core/task/task-recovery-service.js

@@ -133,6 +133,8 @@ export class TaskRecoveryService {
                 agentSessionId: session.agentSessionId, baseagent: session.baseagent,
                 automatic: request.automatic === true,
                 origin,
+                approvalInteractionPolicy: context?.approvalInteractionPolicy
+                    ?? (request.automatic ? 'deny' : 'interactive'),
             };
             const replyContext = replyContextFromSession(session);
             const message = {

package/dist/core/task/task-resume-operation.js

@@ -1,5 +1,16 @@
 /** IPC has authenticated the transport; this enforces the Agent/task boundary. */
 export async function executeTaskResume(request, deps) {
+    if (request.argv) {
+        const argv = request.argv;
+        if (argv[0] !== 'task' || argv[1] !== 'resume' || !argv[2]?.trim() || argv[2].startsWith('-')
+            || !(argv.length === 3 || (argv.length === 5 && argv[3] === '--format' && argv[4] === 'json'))) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: 'Invalid task resume argv' };
+        }
+        request = { ...request, targetSessionId: argv[2].trim() };
+    }
+    else if (request.sessionId) {
+        return { ok: false, code: 'INVALID_REQUEST', error: 'Managed task resume requires argv' };
+    }
     const authorization = request.sessionId
         ? await deps.authorizeManaged({
             sessionId: request.sessionId,

package/dist/index.js

@@ -640,11 +640,11 @@ async function main() {
         getAgentRuntimeError: () => agentRuntimeError,
         daemonAid: daemonCfg.aid,
         getControlAidState: () => controlChannel?.getAidState(),
-    }), async (cmd, sessionId, delegationToken, delegationCommandHash) => {
+    }), async (argv, sessionId, delegationToken, delegationCommandHash) => {
         const delegation = agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
-        return cmdHandler.handleCtl(cmd, sessionId, delegation.grant);
+        return cmdHandler.handleManagedCliOperation(argv, sessionId, delegation.grant);
     });
     ipcServer.setDaemonRuntimeEpoch(agentDelegationRegistry.getRuntimeEpoch());
     const { reloadHooks, reloadCoordinator } = createAgentReloadRuntime({

package/dist/ipc.js

@@ -21,6 +21,7 @@ import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 import { remoteAccessService } from './core/auth/remote-access-store.js';
 import { setModelCatalogDaemonOwner } from './core/model/model-catalog.js';
 import { RUNTIME_ENVIRONMENT_NAMES, setRuntimeEnvironmentOverride } from './config/runtime-env.js';
+import { MAIN_CLI_BIN } from './product.js';
 const isWindows = process.platform === 'win32';
 const isNamedPipe = (p) => isWindows && p.toLowerCase().startsWith('\\\\.\\pipe\\');
 const CPU_SAMPLE_INTERVAL_MS = 1000;
@@ -75,6 +76,16 @@ const LOCAL_CONTROL_COMMANDS = new Set([
     'remote-auth.redeem',
     'remote-auth.validate',
 ]);
+const MEMORY_COMMAND_ENDPOINTS = new Set([
+    'memory.note', 'memory.note.update', 'memory.note.drop', 'memory.note.list',
+    'memory.create', 'memory.update', 'memory.archive', 'memory.demote', 'memory.consolidate', 'memory.feedback',
+]);
+const DELEGATED_ARGV_ENDPOINTS = new Set([
+    'agent.op', 'config.op', 'contact.op', 'aid.op', 'group.op', 'msg.op', 'fs.op',
+    'ctl', 'diag', 'menu-client.request', 'task.resume', 'queue.op', 'storage.auth', 'storage.upload',
+    'trigger.op', 'local-command-context', 'evolagent.bootstrapComplete', ...MEMORY_COMMAND_ENDPOINTS,
+    'handoff-return', 'handoff-recover-return', 'handoff-status', 'handoff-list', 'handoff-trace',
+]);
 let ipcQuerySequence = 0;
 function ipcLogToken(value, fallback = 'unknown') {
     const token = String(value ?? '').replace(/[^A-Za-z0-9_.:-]/g, '_').slice(0, 128);
@@ -925,6 +936,75 @@ export class IpcServer {
                 error: 'The task delegation token belongs to a previous daemon runtime; start a new task authorization and do not retry this command in the current task',
             };
         }
+        if (typeof cmd.delegationToken === 'string'
+            && (DELEGATED_ARGV_ENDPOINTS.has(cmd.type) || (cmd.type === 'aun-msg-send' && cmd.argv !== undefined))) {
+            if (!Array.isArray(cmd.argv) || cmd.argv.some(value => typeof value !== 'string')) {
+                return { ok: false, code: 'INVALID_REQUEST', error: 'Invalid command argv' };
+            }
+            const expectedHash = hashDelegatedCommandArgv([
+                MAIN_CLI_BIN,
+                ...(cmd.type === 'menu-client.request' ? ['menu-client'] : []),
+                ...cmd.argv,
+            ]);
+            if (!expectedHash || cmd.delegationCommandHash !== expectedHash) {
+                return { ok: false, code: 'INVALID_DELEGATION', error: 'Command hash does not match the submitted argv' };
+            }
+        }
+        if (cmd.argv !== undefined && ['handoff-status', 'handoff-list', 'handoff-trace'].includes(cmd.type)) {
+            try {
+                const { parseList, parseTrace } = await import('./cli/handoff-command.js');
+                if (!Array.isArray(cmd.argv) || cmd.argv[0] !== 'handoff' || `handoff-${cmd.argv[1]}` !== cmd.type) {
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Handoff endpoint does not match argv' };
+                }
+                if (cmd.type === 'handoff-list') {
+                    const parsed = parseList(cmd.argv.slice(2));
+                    cmd = { ...cmd, agent: parsed.agent, state: parsed.state, filterSessionId: parsed.sessionId, limit: parsed.limit };
+                }
+                else {
+                    const parsed = parseTrace(cmd.argv.slice(2));
+                    if (cmd.type === 'handoff-status' && cmd.argv.length !== 3)
+                        throw new Error('Invalid handoff status arguments');
+                    cmd = { ...cmd, agent: parsed.agent, handoffId: parsed.handoffId, limit: parsed.limit };
+                }
+            }
+            catch (error) {
+                return { ok: false, code: 'INVALID_ARGUMENT', error: error instanceof Error ? error.message : String(error) };
+            }
+        }
+        if (MEMORY_COMMAND_ENDPOINTS.has(cmd.type)) {
+            if (typeof cmd.sessionId !== 'string' || !cmd.sessionId)
+                return { ok: false, code: 'INVALID_REQUEST', error: 'missing sessionId' };
+            if (cmd.debug === true) {
+                if (cmd.delegationToken || !this.hasValidControlToken(cmd.controlToken)) {
+                    return { ok: false, code: 'INVALID_CONTROL_TOKEN', error: 'Memory debug requires a local control token, not task delegation' };
+                }
+            }
+            else {
+                if (!this.taskRuntimeContextAuthorizer)
+                    return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Memory authorization is not configured' };
+                if (!Array.isArray(cmd.argv) || cmd.argv.some((value) => typeof value !== 'string') || cmd.argv.includes('--debug')) {
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Managed memory requires argv without --debug' };
+                }
+                const authorization = this.taskRuntimeContextAuthorizer({
+                    sessionId: cmd.sessionId, delegationToken: cmd.delegationToken,
+                    delegationCommandHash: cmd.delegationCommandHash, consumeApproval: true,
+                });
+                if (!authorization.ok)
+                    return authorization;
+            }
+            if (cmd.argv !== undefined) {
+                try {
+                    const { resolveMemoryCommandArgv } = await import('./cli/memory-command.js');
+                    const operation = resolveMemoryCommandArgv(cmd.argv);
+                    if (operation.type !== cmd.type)
+                        return { ok: false, code: 'INVALID_REQUEST', error: 'Memory endpoint does not match argv' };
+                    cmd = { ...operation, sessionId: cmd.sessionId, debug: cmd.debug === true };
+                }
+                catch (error) {
+                    return { ok: false, code: 'INVALID_ARGUMENT', error: error instanceof Error ? error.message : String(error) };
+                }
+            }
+        }
         switch (cmd.type) {
             case 'diag':
                 return this.diagExecutor ? this.diagExecutor(cmd) : { ok: false, code: 'NOT_CONFIGURED', message: '诊断入口未配置' };
@@ -1168,6 +1248,7 @@ export class IpcServer {
                     sessionId: cmd.sessionId,
                     delegationToken: typeof cmd.delegationToken === 'string' ? cmd.delegationToken : undefined,
                     delegationCommandHash: typeof cmd.delegationCommandHash === 'string' ? cmd.delegationCommandHash : undefined,
+                    argv: Array.isArray(cmd.argv) ? cmd.argv : undefined,
                 });
             }
             case 'status.auth': {
@@ -1191,6 +1272,7 @@ export class IpcServer {
                     return { ok: false, code: 'INVALID_REQUEST', error: 'invalid storage operation' };
                 }
                 return await this.storageAuthorizationExecutor({
+                    argv: cmd.argv,
                     sessionId: cmd.sessionId,
                     aid: cmd.aid,
                     operation: cmd.operation,
@@ -1208,6 +1290,7 @@ export class IpcServer {
                     return { ok: false, code: 'INVALID_REQUEST', error: 'missing sessionId, aid, localFile, or remotePath' };
                 }
                 return await this.storageUploadExecutor({
+                    argv: cmd.argv,
                     sessionId: cmd.sessionId,
                     aid: cmd.aid,
                     localFile: cmd.localFile,
@@ -1235,9 +1318,10 @@ export class IpcServer {
                 }
             }
             case 'task.resume': {
-                const allowed = new Set(['type', 'targetSessionId', 'sessionId', 'delegationToken',
+                const allowed = new Set(['type', 'argv', 'targetSessionId', 'sessionId', 'delegationToken',
                     'delegationCommandHash', 'controlToken', 'daemonRuntimeEpoch', 'requestId', 'id']);
                 if (Object.keys(cmd).some(key => !allowed.has(key))
+                    || (cmd.argv !== undefined && (!Array.isArray(cmd.argv) || cmd.argv.some((value) => typeof value !== 'string')))
                     || typeof cmd.targetSessionId !== 'string' || !cmd.targetSessionId.trim()
                     || (cmd.sessionId !== undefined && (typeof cmd.sessionId !== 'string' || !cmd.sessionId.trim()))) {
                     return { ok: false, code: 'INVALID_REQUEST', error: 'task.resume accepts only a target session and caller credentials' };
@@ -1250,6 +1334,7 @@ export class IpcServer {
                 try {
                     return await this.taskResumeExecutor({
                         targetSessionId: cmd.targetSessionId,
+                        argv: Array.isArray(cmd.argv) ? cmd.argv : undefined,
                         sessionId: cmd.sessionId,
                         delegationToken: typeof cmd.delegationToken === 'string' ? cmd.delegationToken : undefined,
                         delegationCommandHash: typeof cmd.delegationCommandHash === 'string' ? cmd.delegationCommandHash : undefined,
@@ -1260,6 +1345,34 @@ export class IpcServer {
                     return { ok: false, code: 'TASK_RESUME_FAILED', error: error instanceof Error ? error.message : String(error) };
                 }
             }
+            case 'local-command-context': {
+                if (!Array.isArray(cmd.argv) || cmd.argv.some((value) => typeof value !== 'string')
+                    || !['skill', 'stats'].includes(cmd.argv[0]) || typeof cmd.sessionId !== 'string' || !cmd.sessionId
+                    || typeof cmd.delegationToken !== 'string' || !cmd.delegationToken) {
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Local command requires argv and task credentials' };
+                }
+                if (!this.taskRuntimeContextAuthorizer || !this.taskRuntimeContextProvider) {
+                    return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Command authorization is unavailable' };
+                }
+                const authorization = this.taskRuntimeContextAuthorizer({
+                    sessionId: cmd.sessionId, delegationToken: cmd.delegationToken,
+                    delegationCommandHash: cmd.delegationCommandHash, consumeApproval: true,
+                });
+                if (!authorization.ok)
+                    return authorization;
+                const context = this.taskRuntimeContextProvider({ sessionId: cmd.sessionId });
+                if (!context?.selfAid || !context.peerRole || context.peerRole === 'none') {
+                    return { ok: false, code: 'NOT_ALLOWED', error: 'Current task identity and role are unavailable' };
+                }
+                if (cmd.argv[0] === 'stats' && cmd.argv.some((value) => /^--(?:sql|rebuild)(?:=|$)/.test(value))) {
+                    return { ok: false, code: 'NOT_ALLOWED', error: 'Managed stats cannot use --sql or --rebuild' };
+                }
+                if (cmd.argv[0] === 'skill' && context.permissionMode === 'readonly'
+                    && ['create', 'install', 'remove', 'enable', 'disable'].includes(cmd.argv[1])) {
+                    return { ok: false, code: 'NOT_ALLOWED', error: 'Readonly tasks cannot modify skills' };
+                }
+                return { ok: true, context };
+            }
             case 'task-runtime-context': {
                 if (!this.taskRuntimeContextProvider)
                     return { ok: false, error: 'task runtime context not configured' };
@@ -1279,6 +1392,15 @@ export class IpcServer {
                 return { ok: true, context };
             }
             case 'aun-msg-send': {
+                if (cmd.argv !== undefined) {
+                    if (!this.aunMsgSender)
+                        return { ok: false, code: 'NOT_CONFIGURED', error: 'AUN sender is not configured' };
+                    return this.aunMsgSender({
+                        aid: '', to: '', scope: 'msg', argv: cmd.argv,
+                        originSessionId: cmd.originSessionId, originMessageId: cmd.originMessageId,
+                        delegationToken: cmd.delegationToken, delegationCommandHash: cmd.delegationCommandHash,
+                    });
+                }
                 if (cmd.handoffContext !== undefined && (typeof cmd.handoffContext !== 'string'
                     || !cmd.handoffContext.trim() || cmd.handoffContext.length > 64 * 1024 || cmd.scope === 'group')) {
                     return { ok: false, code: 'INVALID_HANDOFF_CONTEXT', error: 'Private handoff context must contain 1–65536 characters' };
@@ -1356,6 +1478,7 @@ export class IpcServer {
                     return { ok: false, code: 'HANDOFF_RETURN_CONTENT_REQUIRED', error: 'missing content' };
                 try {
                     return await this.handoffReturnExecutor({
+                        argv: cmd.argv,
                         sessionId: typeof cmd.sessionId === 'string' ? cmd.sessionId : undefined,
                         handoffId: typeof cmd.handoffId === 'string' ? cmd.handoffId : undefined,
                         content: cmd.content,
@@ -1378,6 +1501,7 @@ export class IpcServer {
                     return { ok: false, code: 'HANDOFF_RETURN_CONTENT_REQUIRED', error: 'missing content' };
                 try {
                     return await this.handoffRecoverReturnExecutor({
+                        argv: cmd.argv,
                         sessionId: cmd.sessionId,
                         handoffId: cmd.handoffId,
                         content: cmd.content,
@@ -1444,10 +1568,13 @@ export class IpcServer {
             case 'ctl': {
                 if (!this.commandExecutor)
                     return { ok: false, error: 'ctl not configured' };
-                const { cmd: slashCmd, sessionId } = cmd;
-                if (!slashCmd || !sessionId)
-                    return { ok: false, error: 'missing cmd or sessionId' };
-                return await this.commandExecutor(slashCmd, sessionId, typeof cmd.delegationToken === 'string' ? cmd.delegationToken : undefined, typeof cmd.delegationCommandHash === 'string' ? cmd.delegationCommandHash : undefined);
+                const { sessionId, argv } = cmd;
+                if (!sessionId || !Array.isArray(argv))
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'missing argv or sessionId' };
+                if (argv.some(value => typeof value !== 'string')) {
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Invalid command argv' };
+                }
+                return await this.commandExecutor(argv, sessionId, typeof cmd.delegationToken === 'string' ? cmd.delegationToken : undefined, typeof cmd.delegationCommandHash === 'string' ? cmd.delegationCommandHash : undefined);
             }
             case 'memory.note': {
                 const { sessionId, slug, content, tags, speakers } = cmd;
@@ -1864,11 +1991,11 @@ export class IpcServer {
                 }
                 return await this.agentOperationExecutor(argv, sessionId, delegationToken, typeof cmd.delegationCommandHash === 'string' ? cmd.delegationCommandHash : undefined);
             }
+            case 'trigger.op':
             case 'trigger.list':
             case 'trigger.show':
             case 'trigger.history':
             case 'trigger.eventCatalog':
-            case 'trigger.authorizeLocalFiles':
             case 'trigger.create':
             case 'trigger.update':
             case 'trigger.setEnabled':
@@ -1917,6 +2044,17 @@ export class IpcServer {
                 const aid = cmd.aid;
                 if (!aid || typeof aid !== 'string')
                     return { ok: false, error: 'missing aid' };
+                if (cmd.argv !== undefined) {
+                    if (!Array.isArray(cmd.argv) || cmd.argv.some((value) => typeof value !== 'string')) {
+                        return { ok: false, code: 'INVALID_REQUEST', error: 'Invalid command argv' };
+                    }
+                    const argv = cmd.argv;
+                    const validFormat = argv.length === 3
+                        || (argv.length === 5 && argv[3] === '--format' && argv[4] === 'json');
+                    if (argv[0] !== 'agent' || argv[1] !== 'ready' || argv[2] !== aid || !validFormat) {
+                        return { ok: false, code: 'INVALID_REQUEST', error: 'agent ready endpoint does not match argv' };
+                    }
+                }
                 if (!this.bootstrapCompleteExecutor)
                     return { ok: false, error: 'bootstrap complete executor not configured' };
                 try {
@@ -2333,7 +2471,7 @@ export async function ipcQuery(socketPath, cmd, timeoutMs = 3000, options = {})
 function ipcQueryOnce(socketPath, cmd, timeoutMs = 3000) {
     let authenticatedCmd = cmd;
     if (!process.env.EVOLCORE_SESSION_ID
-        && requiresLocalControlToken(cmd)
+        && (requiresLocalControlToken(cmd) || (MEMORY_COMMAND_ENDPOINTS.has(cmd.type) && cmd.debug === true))
         && typeof cmd.controlToken !== 'string') {
         try {
             const controlToken = fs.readFileSync(resolvePaths().controlToken, 'utf8').trim();
@@ -2345,7 +2483,7 @@ function ipcQueryOnce(socketPath, cmd, timeoutMs = 3000) {
     const requestArgv = Array.isArray(authenticatedCmd.argv)
         && authenticatedCmd.argv.every((value) => typeof value === 'string')
         ? [
-            'ec',
+            MAIN_CLI_BIN,
             ...(authenticatedCmd.type === 'menu-client.request' ? ['menu-client'] : []),
             ...authenticatedCmd.argv,
         ]

package/dist/trigger/authorization.js

@@ -247,7 +247,7 @@ export function authorizeTriggerExecution(definition, dependencies) {
     }
     const permissionDecision = constrainRuntimePermissionMode({
         selfAid: definition.agentAid,
-        role,
+        role: typeof role === 'string' ? role : undefined,
         requestedValue: definition.execution.permissionMode,
     });
     if (definition.execution.permissionMode && permissionDecision.constrained) {
@@ -260,6 +260,7 @@ export function authorizeTriggerExecution(definition, dependencies) {
         allowed: true,
         scope: privilegedReason && hasDaemonTriggerAuthority(subject) ? 'daemon' : 'agent',
         permissionMode: permissionDecision.effectiveValue,
+        role: role ?? undefined,
     };
 }
 export async function authenticatedTriggerActor(dependencies, agentAid, actorSessionId, delegationToken, delegationCommandHash, controlToken, contextOnly = false) {