evolcore 0.0.31 → 0.0.33

package/dist/core/skill/switch-resolver.js

@@ -2,6 +2,58 @@ import fs from 'fs';
 import path from 'path';
 import { getPackageRoot } from '../../paths.js';
 import { resolveRoot } from '../../paths.js';
+/**
+ * 覆盖链求值：给定技能名与三级开关，判定最终是否启用、由谁决定。
+ *
+ * `resolveSkills`（只要启用集合）与 `resolveAllSkillStates`（要全量+归因）
+ * 共用这一份实现，避免两条路径对同一条覆盖链给出不同答案。
+ */
+function evaluateSkillSwitch(name, sets) {
+    const b = getSwitch(sets.builtin, name);
+    const hasBuiltinLock = b.locked === true;
+    if (hasBuiltinLock) {
+        return { enabled: b.enabled === true, decidedBy: 'builtin(locked)', locked: true, overridable: false };
+    }
+    if (name in sets.agent) {
+        return { enabled: getSwitch(sets.agent, name).enabled === true, decidedBy: 'agent', locked: false, overridable: true };
+    }
+    if (name in sets.local) {
+        return { enabled: getSwitch(sets.local, name).enabled === true, decidedBy: 'local', locked: false, overridable: true };
+    }
+    if (name in sets.builtin) {
+        return { enabled: b.enabled === true, decidedBy: 'builtin', locked: false, overridable: true };
+    }
+    // 三级都没有显式开关 → 缺省禁用（装完必须显式启用）
+    return { enabled: false, decidedBy: 'default(缺省禁用)', locked: false, overridable: true };
+}
+/** 读取三级开关文件 */
+function readSkillSwitchSets(paths) {
+    return {
+        builtin: readSwitchesFile(path.join(paths.builtin, '.switches.json')),
+        local: readSwitchesFile(path.join(paths.local, '.switches.json')),
+        agent: readSwitchesFile(path.join(paths.agent, '.switches.json')),
+    };
+}
+/**
+ * 全量解析：返回所有已安装技能（含未启用），带开关归因。
+ *
+ * 与 `resolveSkills` 的区别是保留禁用技能——斜杠菜单和 `ec skill list`
+ * 需要展示"装了但没开"的技能，否则用户看不出为什么某个技能没生效。
+ */
+export function resolveAllSkillStates(agentDir, override) {
+    const paths = getSkillPaths(agentDir, override);
+    const builtinNames = scanSkillNames(paths.builtin);
+    const localNames = scanSkillNames(paths.local);
+    const sets = readSkillSwitchSets(paths);
+    const out = [];
+    for (const name of new Set([...builtinNames, ...localNames])) {
+        // 本机有 SKILL.md 即算本机技能（本机覆盖内置）
+        const source = localNames.has(name) ? 'local' : 'builtin';
+        const skillDir = path.join(source === 'local' ? paths.local : paths.builtin, name);
+        out.push({ name, source, skillDir, ...evaluateSkillSwitch(name, sets) });
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
 function getSkillPaths(agentDir, override) {
     return {
         builtin: override?.builtin ?? path.join(getPackageRoot(), 'kits', 'skills'),
@@ -73,41 +125,15 @@ export function resolveSkills(agentDir, override) {
     const localNames = scanSkillNames(paths.local);
     const allNames = new Set([...builtinNames, ...localNames]);
     // ② 读取三级汇总开关文件
-    const builtinSwitches = readSwitchesFile(path.join(paths.builtin, '.switches.json'));
-    const localSwitches = readSwitchesFile(path.join(paths.local, '.switches.json'));
-    const agentSwitches = readSwitchesFile(path.join(paths.agent, '.switches.json'));
+    const sets = readSkillSwitchSets(paths);
     const results = [];
     for (const name of allNames) {
         // ③ 判断来源：本机有 SKILL.md → local，否则 builtin
         const source = localNames.has(name) ? 'local' : 'builtin';
         const skillRoot = source === 'local' ? paths.local : paths.builtin;
         const skillDir = path.join(skillRoot, name);
-        // ④ 覆盖链求值（design §4.1）
-        const builtinSwitch = getSwitch(builtinSwitches, name);
-        // 内置 locked 时，直接由内置 enabled 决定
-        if (builtinSwitch.locked) {
-            if (builtinSwitch.enabled) {
-                results.push({ name, source, enabled: true, skillDir });
-            }
-            continue;
-        }
-        // 否则从 Agent 级往下找第一个存在的开关
-        const agentSwitch = getSwitch(agentSwitches, name);
-        if (name in agentSwitches) {
-            if (agentSwitch.enabled) {
-                results.push({ name, source, enabled: true, skillDir });
-            }
-            continue;
-        }
-        const localSwitch = getSwitch(localSwitches, name);
-        if (name in localSwitches) {
-            if (localSwitch.enabled) {
-                results.push({ name, source, enabled: true, skillDir });
-            }
-            continue;
-        }
-        // 三级都没有显式开关 → 用缺省（enabled:false，装完必须显式启用）
-        if (builtinSwitch.enabled) {
+        // ④ 覆盖链求值（与 resolveAllSkillStates 共用）
+        if (evaluateSkillSwitch(name, sets).enabled) {
             results.push({ name, source, enabled: true, skillDir });
         }
     }

package/dist/core/task/task-recovery-service.js

@@ -133,6 +133,8 @@ export class TaskRecoveryService {
                 agentSessionId: session.agentSessionId, baseagent: session.baseagent,
                 automatic: request.automatic === true,
                 origin,
+                approvalInteractionPolicy: context?.approvalInteractionPolicy
+                    ?? (request.automatic ? 'deny' : 'interactive'),
             };
             const replyContext = replyContextFromSession(session);
             const message = {

package/dist/core/task/task-resume-operation.js

@@ -1,5 +1,16 @@
 /** IPC has authenticated the transport; this enforces the Agent/task boundary. */
 export async function executeTaskResume(request, deps) {
+    if (request.argv) {
+        const argv = request.argv;
+        if (argv[0] !== 'task' || argv[1] !== 'resume' || !argv[2]?.trim() || argv[2].startsWith('-')
+            || !(argv.length === 3 || (argv.length === 5 && argv[3] === '--format' && argv[4] === 'json'))) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: 'Invalid task resume argv' };
+        }
+        request = { ...request, targetSessionId: argv[2].trim() };
+    }
+    else if (request.sessionId) {
+        return { ok: false, code: 'INVALID_REQUEST', error: 'Managed task resume requires argv' };
+    }
     const authorization = request.sessionId
         ? await deps.authorizeManaged({
             sessionId: request.sessionId,

package/dist/core/thread/command-parser.js

@@ -0,0 +1,125 @@
+import { isValidAid } from '../../aun/aid/validation.js';
+import { normalizeThreadPeer } from './thread-service.js';
+const STATUSES = new Set(['pending', 'in_progress', 'completed', 'archived']);
+const COMMON_OPTIONS = ['--self', '--format', '--json'];
+const VALUE_OPTIONS = new Set(['--self', '--agent', '--format', '--name', '--label', '--status', '--sort', '--page', '--limit', '--before', '--after', '--if-rev']);
+const OPTIONS = {
+    peers: [], list: ['--status', '--label', '--unlabeled', '--sort', '--page', '--limit'],
+    show: [], history: ['--limit', '--before', '--after'],
+    create: ['--name', '--label', '--status', '--group'], rename: [], label: ['--clear'], status: [],
+    delete: [], 'rebuild-index': ['--check', '--agent'], 'check-index': ['--agent'],
+    'summary-show': [], 'summary-set': ['--name', '--if-rev'], 'summary-log': [], 'summary-clear': [],
+};
+export function resolveThreadCommandArgv(argv) {
+    if (argv[0] !== 'thread' || argv.some(value => typeof value !== 'string' || value.includes('\0')))
+        throw new Error('Invalid thread argv');
+    const command = argv[1] === 'summary' ? `summary-${argv[2]}` : argv[1];
+    if (!Object.hasOwn(OPTIONS, command))
+        throw new Error('Unknown thread command');
+    const allowed = new Set([...COMMON_OPTIONS, ...OPTIONS[command]]);
+    const options = new Map();
+    const positional = [];
+    for (let index = command.startsWith('summary-') ? 3 : 2; index < argv.length; index++) {
+        const value = argv[index];
+        if (!value.startsWith('--')) {
+            positional.push(value);
+            continue;
+        }
+        if (!allowed.has(value) || options.has(value))
+            throw new Error(`Invalid or duplicate option: ${value}`);
+        if (!VALUE_OPTIONS.has(value)) {
+            options.set(value, true);
+            continue;
+        }
+        const argument = argv[++index];
+        if (argument === undefined || argument.startsWith('--'))
+            throw new Error(`Missing value: ${value}`);
+        options.set(value, argument);
+    }
+    const text = (flag) => options.get(flag);
+    const number = (flag, minimum = 0) => {
+        if (!options.has(flag))
+            return undefined;
+        const value = Number(text(flag));
+        if (!Number.isSafeInteger(value) || value < minimum)
+            throw new Error(`Invalid number: ${flag}`);
+        return value;
+    };
+    const selfAidValue = text('--self');
+    const agentAidValue = text('--agent');
+    const selfAid = (agentAidValue ?? selfAidValue)?.replace(/^@/, '');
+    if (selfAidValue !== undefined && agentAidValue !== undefined
+        && selfAidValue.replace(/^@/, '') !== agentAidValue.replace(/^@/, '')) {
+        throw new Error('--self and --agent must target the same Agent');
+    }
+    if (selfAid !== undefined && !isValidAid(selfAid))
+        throw new Error('Invalid self AID');
+    if (text('--format') !== undefined && text('--format') !== 'json')
+        throw new Error('Only JSON format is supported');
+    const status = text('--status') ?? (command === 'status' ? positional[1] : undefined);
+    if (status !== undefined && !STATUSES.has(status))
+        throw new Error('Invalid topic status');
+    const sort = text('--sort');
+    if (sort !== undefined && sort !== 'recent' && sort !== 'created')
+        throw new Error('Invalid sort order');
+    const maximum = ['peers', 'rebuild-index', 'check-index'].includes(command) ? 0
+        : ['rename', 'status', 'label'].includes(command) ? 2 : command === 'summary-set' ? Infinity : 1;
+    const minimum = maximum === 0 ? 0 : ['rename', 'status', 'summary-set'].includes(command) ? 2 : 1;
+    if (positional.length < minimum || positional.length > maximum)
+        throw new Error('Invalid thread arguments');
+    const op = (command === 'peers' ? 'list-peers' : command);
+    const request = { type: 'thread.op', op, selfAid };
+    if (command === 'list' || command === 'create') {
+        request.peer = normalizeThreadPeer(positional[0]);
+        if (!request.peer)
+            throw new Error('Invalid peer');
+    }
+    else if (maximum !== 0) {
+        request.ref = positional[0];
+        if (request.ref !== 'current') {
+            const pieces = positional[0].split('/');
+            if (pieces.length > 2 || !pieces[0] || pieces[1] === '')
+                throw new Error('Invalid thread reference');
+            request.peer = normalizeThreadPeer(pieces[0]);
+            request.threadId = pieces[1];
+            if (!request.peer || request.threadId && !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(request.threadId))
+                throw new Error('Invalid thread reference');
+        }
+    }
+    if (command === 'list')
+        Object.assign(request, {
+            status, label: text('--label'), unlabeled: options.has('--unlabeled'), sort,
+            page: number('--page', 1), limit: number('--limit', 1),
+        });
+    if (command === 'history')
+        Object.assign(request, { limit: number('--limit', 1), before: number('--before'), after: number('--after') });
+    if (command === 'create') {
+        if (!text('--name')?.trim())
+            throw new Error('Topic name is required');
+        Object.assign(request, { name: text('--name'), label: text('--label'), topicStatus: status, peerKind: options.has('--group') ? 'group' : 'private' });
+    }
+    if (command === 'rename') {
+        if (!positional[1].trim())
+            throw new Error('Topic name is required');
+        request.name = positional[1];
+    }
+    if (command === 'label') {
+        if (options.has('--clear') ? positional.length !== 1 : positional.length !== 2)
+            throw new Error('Specify a label or --clear');
+        request.label = options.has('--clear') ? null : positional[1];
+    }
+    if (command === 'status')
+        request.topicStatus = status;
+    if (command === 'rebuild-index')
+        request.dryRun = options.has('--check');
+    if (command === 'summary-set') {
+        if (!text('--name')?.trim())
+            throw new Error('Summary requires --name; use - to keep the current name');
+        request.name = text('--name');
+        request.content = positional.slice(1).join(' ');
+        if (!request.content.trim())
+            throw new Error('Summary content is required');
+        request.ifRev = number('--if-rev');
+    }
+    return request;
+}

package/dist/core/thread/index.js

@@ -0,0 +1 @@
+export { ThreadService, ThreadServiceError, normalizeThreadPeer } from './thread-service.js';

package/dist/core/thread/ipc-operation.js

@@ -0,0 +1,95 @@
+import { trustedExecutionIdentityInput } from '../auth/agent-delegation.js';
+import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
+import { isManagementRole } from '../../config/builtin-roles.js';
+import { parsePeerKey } from '../relation/peer-identity.js';
+import { resolveThreadCommandArgv } from './command-parser.js';
+import { executeThreadOperation } from './thread-operation.js';
+import { ThreadService } from './thread-service.js';
+export function createThreadOperationExecutor(dependencies) {
+    const threadService = new ThreadService(dependencies.sessionManager);
+    return async (incoming) => {
+        try {
+            if (!Array.isArray(incoming.argv))
+                return { ok: false, code: 'INVALID_REQUEST', error: 'Thread operations require argv' };
+            const request = resolveThreadCommandArgv(incoming.argv);
+            const token = typeof incoming.delegationToken === 'string' ? incoming.delegationToken.trim() : '';
+            let currentPeer;
+            let relationOnly = false;
+            if (token) {
+                if (!incoming.sessionId)
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Caller sessionId is required' };
+                const delegation = dependencies.agentDelegationRegistry.validate(token, incoming.sessionId, incoming.delegationCommandHash);
+                if (!delegation.ok)
+                    return { ok: false, code: delegation.code, error: delegation.reason };
+                const session = await dependencies.sessionManager.getSessionById(incoming.sessionId);
+                if (!session || session.selfAID !== delegation.grant.selfAid)
+                    return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation does not match the caller session' };
+                if (request.selfAid && request.selfAid !== delegation.grant.selfAid)
+                    return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent can be targeted' };
+                request.selfAid = delegation.grant.selfAid;
+                const peer = parsePeerKey(delegation.grant.peerKey);
+                currentPeer = peer.channelId;
+                const subject = buildAuthSubject({
+                    selfAid: request.selfAid, actorId: delegation.grant.actorId,
+                    channel: delegation.grant.channel, channelType: delegation.grant.channelType,
+                    channelId: currentPeer, conversationId: currentPeer, chatType: delegation.grant.chatType,
+                    permissionMode: delegation.grant.permissionMode, processOwners: dependencies.getProcessOwners(),
+                    ...trustedExecutionIdentityInput(delegation.grant),
+                });
+                relationOnly = subject.dataScope === 'relation';
+                const readOnly = ['list', 'list-peers', 'show', 'history', 'check-index', 'summary-show', 'summary-log'].includes(request.op);
+                const management = isManagementRole(subject.role) || subject.processRole === 'fullaccess-run';
+                if (delegation.grant.chatType === 'group' && !management) {
+                    return { ok: false, code: 'NOT_ALLOWED', error: 'Group thread operations require an administrator role' };
+                }
+                if (!readOnly && (!management || subject.permissionMode === 'readonly'))
+                    return { ok: false, code: 'NOT_ALLOWED', error: 'Thread changes require a writable administrator task' };
+                const globalOperation = ['list-peers', 'check-index', 'rebuild-index'].includes(request.op);
+                const decision = authorizeOperation({
+                    source: 'agent-tool', subject,
+                    intent: { operation: `ec.thread.${request.op}`, scope: globalOperation && !(relationOnly && request.op === 'list-peers') ? 'agent' : 'relation', source: 'agent-tool', args: { self: request.selfAid, peer: request.peer ?? currentPeer, peerKey: delegation.grant.peerKey } },
+                    auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
+                });
+                if (!decision.allow)
+                    return { ok: false, code: decision.code, error: decision.reason };
+                if (relationOnly && globalOperation && request.op !== 'list-peers')
+                    return { ok: false, code: 'SCOPE_MISMATCH', error: 'Index management requires Agent scope' };
+                if (request.ref === 'current') {
+                    const indexed = threadService.resolveCurrentThread(request.selfAid, session.id);
+                    request.peer = indexed?.peer ?? currentPeer;
+                    request.threadId = indexed?.threadId ?? session.threadId ?? undefined;
+                    request.sessionId = session.id;
+                }
+            }
+            else {
+                if (incoming.sessionId || incoming.delegationToken || incoming.localControl !== true)
+                    return { ok: false, code: 'INVALID_CONTROL_TOKEN', error: 'Valid local control token is required' };
+                if (!request.selfAid)
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'Host commands require --self' };
+                if (request.ref === 'current')
+                    return { ok: false, code: 'INVALID_REQUEST', error: 'current requires a managed caller session' };
+            }
+            if (relationOnly && request.peer && request.peer !== currentPeer)
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current relation can be targeted' };
+            if (request.op.startsWith('summary-') && !request.sessionId) {
+                const target = request.threadId
+                    ? await threadService.showThread({ selfAid: request.selfAid, peer: request.peer, threadId: request.threadId })
+                    : await threadService.showMainSession(request.selfAid, request.peer);
+                if (!target)
+                    return { ok: false, code: 'NOT_FOUND', error: 'Target session not found' };
+                request.sessionId = target.sessionId;
+            }
+            if (request.sessionId && !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(request.sessionId))
+                return { ok: false, code: 'INVALID_REQUEST', error: 'Invalid target sessionId' };
+            const response = await executeThreadOperation(request, threadService, dependencies.sendSystemMsg);
+            if (response.ok && request.op === 'delete' && request.threadId)
+                dependencies.onDeleted?.(request.selfAid, request.threadId);
+            if (response.ok && relationOnly && request.op === 'list-peers')
+                response.result = { peers: response.result.peers.filter(entry => entry.peer === currentPeer) };
+            return response;
+        }
+        catch (error) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: error instanceof Error ? error.message : String(error) };
+        }
+    };
+}

package/dist/core/thread/thread-context-storage.js

@@ -0,0 +1,131 @@
+import fs from 'fs';
+import path from 'path';
+import { agentThreadInboxDir, agentThreadInboxPath, agentSessionsDir } from '../../paths.js';
+import { appendJsonl, readAllJsonlLines } from '../session/session-fs-store.js';
+import { logger } from '../../utils/logger.js';
+/**
+ * Thread Context 收件箱（thread-inbox）。
+ *
+ * 跨话题发送成功后，发送方把「我从哪个话题跨到哪个话题发了什么」写进自己的
+ * inbox；目标会话下次被唤醒时读取一次、注入渲染、然后物理删除整个文件。
+ *
+ * 设计要点：
+ * - 无「已消费」标记 —— 注入即删除，文件为空即删除文件
+ * - 一个目标会话一个文件，多条记录追加（支持多方并发）
+ * - 读取时跳过损坏行，不因单行损坏丢失全部提醒
+ */
+export class ThreadContextStorage {
+    /** 追加一条 inbox 记录。 */
+    append(aid, entry) {
+        const filePath = agentThreadInboxPath(aid, entry.targetSessionId);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        appendJsonl(filePath, entry);
+    }
+    /** 读取某目标会话的全部 inbox 记录。文件不存在或损坏时返回空数组。 */
+    readAll(aid, targetSessionId) {
+        const filePath = agentThreadInboxPath(aid, targetSessionId);
+        if (!fs.existsSync(filePath))
+            return [];
+        // readAllJsonlLines 内部已跳过损坏行
+        return readAllJsonlLines(filePath).filter(entry => entry && typeof entry.messageId === 'string' && typeof entry.targetSessionId === 'string');
+    }
+    /**
+     * 删除 inbox 文件。注入完成后调用 —— 这是「注入一次」语义的落点。
+     * 文件不存在时静默返回。
+     */
+    deleteFile(aid, targetSessionId) {
+        const filePath = agentThreadInboxPath(aid, targetSessionId);
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT') {
+                logger.warn(`[ThreadContext] 删除 inbox 失败: ${filePath}: ${e.message}`);
+            }
+        }
+    }
+    /** inbox 目录是否为空（无任何待注入记录）。 */
+    isEmpty(aid) {
+        const dir = agentThreadInboxDir(aid);
+        try {
+            const files = fs.readdirSync(dir).filter(f => f.endsWith('.jsonl'));
+            for (const file of files) {
+                if (readAllJsonlLines(path.join(dir, file)).length > 0)
+                    return false;
+            }
+            return true;
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return true;
+            throw e;
+        }
+    }
+    /**
+     * 空洞检测：来源话题在 (afterTimestamp, now] 区间内有多少条真实对话消息。
+     *
+     * 只统计对话消息（in/out），跳过协议/系统消息。检测失败时返回保守值
+     * （hasNewMessages=false + error），不因检测异常打断消息处理主流程。
+     */
+    detectGap(aid, originSessionId, afterTimestamp) {
+        try {
+            const sessionsDir = agentSessionsDir(aid);
+            const chatDir = this.findChatDirForSession(sessionsDir, originSessionId);
+            if (!chatDir)
+                return { hasNewMessages: false, count: 0 };
+            const logPath = path.join(chatDir, 'messages.jsonl');
+            if (!fs.existsSync(logPath))
+                return { hasNewMessages: false, count: 0 };
+            const now = Date.now();
+            const hits = readAllJsonlLines(logPath).filter((m) => {
+                const ts = typeof m?.ts === 'number' ? m.ts : undefined;
+                if (ts === undefined || ts <= afterTimestamp || ts > now)
+                    return false;
+                // 只算真实对话消息
+                return m.dir === 'in' || m.dir === 'out';
+            });
+            if (hits.length === 0)
+                return { hasNewMessages: false, count: 0 };
+            const stamps = hits.map((m) => m.ts).sort((a, b) => a - b);
+            return {
+                hasNewMessages: true,
+                count: hits.length,
+                firstTimestamp: stamps[0],
+                lastTimestamp: stamps[stamps.length - 1],
+            };
+        }
+        catch (e) {
+            logger.warn(`[ThreadContext] 空洞检测失败: session=${originSessionId}: ${e.message}`);
+            return { hasNewMessages: false, count: 0, error: '无法检测' };
+        }
+    }
+    /**
+     * 按会话 ID 定位 chatDir。sessionId 形如 meta_xxx，其所在 chatDir 由
+     * sessions/<channelKey>/ 布局决定，需要扫描定位（与 SessionManager 同策略）。
+     */
+    findChatDirForSession(sessionsDir, sessionId) {
+        let roots;
+        try {
+            roots = fs.readdirSync(sessionsDir);
+        }
+        catch {
+            return undefined;
+        }
+        for (const root of roots) {
+            const rootPath = path.join(sessionsDir, root);
+            // 顶层：sessions/<channelKey>/<sessionId>.jsonl
+            try {
+                if (fs.statSync(path.join(rootPath, `${sessionId}.jsonl`)).isFile())
+                    return rootPath;
+            }
+            catch { /* 继续找 */ }
+            // 话题：sessions/<channelKey>/_threads/<sessionId>.jsonl
+            try {
+                if (fs.statSync(path.join(rootPath, '_threads', `${sessionId}.jsonl`)).isFile())
+                    return rootPath;
+            }
+            catch { /* 继续找 */ }
+        }
+        return undefined;
+    }
+}