evolcore 0.0.31 → 0.0.33

package/dist/trigger/ipc-service.js

@@ -1,10 +1,8 @@
-import fs from 'fs';
-import path from 'path';
 import { getEventCatalog } from '../core/event-catalog.js';
 import { authorizeOperation, canApprovePersistentFullAccessTrigger, isCrossAgentTriggerOperationAllowed, } from '../core/auth/auth-gateway.js';
 import { auditFullAccessEvent } from '../core/auth/authorization-audit.js';
 import { assertTriggerLocalFileAuthority, daemonPrivilegedTriggerReason, } from './authorization.js';
-import { decodeTriggerScriptFile, resolveTriggerLocalPath } from './local-files.js';
+import { decodeTriggerScriptFile } from './local-files.js';
 import { applyTriggerPatch } from './patch.js';
 import { definitionRevision, normalizeTriggerDefinition, splitScriptCommand } from './validation.js';
 export function createTriggerBaseagentResolver({ daemonTriggerOwnerAid, getAgentName, getDaemonAgentName, agentMap, }) {
@@ -51,6 +49,9 @@ export function materializeTriggerCreateBaseagent(input, agentAid, dependencies)
 }
 export function createTriggerIpcExecutor(dependencies) {
     return async (cmd) => {
+        let approvedActor;
+        let approvedAgentAid;
+        let approvedOperation;
         const schedulerFor = (agentAid) => {
             const scheduler = dependencies.getScheduler(agentAid);
             if (!scheduler)
@@ -102,7 +103,10 @@ export function createTriggerIpcExecutor(dependencies) {
             return { ...definition, authorizedBy };
         };
         const authorizeTrigger = async (agentAid, operation, triggerId, contextOnly = false) => {
-            const actor = await dependencies.authenticateActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.delegationCommandHash, cmd.controlToken, contextOnly);
+            if (approvedActor && (agentAid !== approvedAgentAid || operation !== approvedOperation)) {
+                throw new Error('Trigger operation does not match its approved argv');
+            }
+            const actor = approvedActor ?? await dependencies.authenticateActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.delegationCommandHash, cmd.controlToken, contextOnly);
             if (actor.permissionMode === 'readonly' && !actor.fullAccess
                 && !['trigger.list', 'trigger.show', 'trigger.history', 'trigger.eventCatalog'].includes(operation)) {
                 throw new Error('readonly tasks cannot modify or run Triggers');
@@ -160,38 +164,48 @@ export function createTriggerIpcExecutor(dependencies) {
             }
             return actor;
         };
-        switch (cmd.type) {
-            case 'trigger.authorizeLocalFiles': {
-                if (cmd.operation !== 'trigger.create' && cmd.operation !== 'trigger.update') {
-                    throw new Error('local file authorization only supports Trigger create/update');
-                }
-                const agentAid = requireAgent(cmd.agentAid);
-                if (cmd.operation === 'trigger.update' && (typeof cmd.triggerId !== 'string' || !cmd.triggerId)) {
-                    throw new Error('missing triggerId');
-                }
-                if (typeof cmd.actorSessionId !== 'string' || !cmd.actorSessionId) {
-                    throw new Error('local Trigger file authorization requires a managed task');
-                }
-                const actor = await authorizeTrigger(agentAid, cmd.operation, cmd.triggerId, true);
-                assertTriggerLocalFileAuthority(actor);
-                if (actor.fullAccess)
-                    return { ok: true, fullAccess: true };
-                const session = await dependencies.getSessionById(cmd.actorSessionId);
-                if (!session)
-                    throw new Error('Trigger actor session is unavailable');
-                if (typeof cmd.cwd !== 'string' || !path.isAbsolute(cmd.cwd))
-                    throw new Error('missing absolute command cwd');
-                const fileScope = {
-                    selfAid: agentAid,
-                    projectPath: fs.realpathSync.native(path.resolve(session.projectPath)),
-                    sessionRuntimeDir: actor.sessionRuntimeDir,
-                    cwd: cmd.cwd,
-                };
-                fileScope.cwd = resolveTriggerLocalPath(cmd.cwd, fileScope);
-                if (!fs.statSync(fileScope.cwd).isDirectory())
-                    throw new Error('command cwd must be a directory');
-                return { ok: true, fullAccess: false, fileScope };
+        if (cmd.type === 'trigger.op') {
+            if (!Array.isArray(cmd.argv) || cmd.argv.some((value) => typeof value !== 'string')
+                || typeof cmd.actorSessionId !== 'string' || !cmd.actorSessionId) {
+                throw new Error('Managed Trigger requires argv and actorSessionId');
+            }
+            const session = await dependencies.getSessionById(cmd.actorSessionId);
+            if (!session?.selfAID)
+                throw new Error('Trigger actor session is unavailable');
+            const { resolveTriggerCommandArgv, buildTriggerCreateRequest, buildTriggerUpdateRequest } = await import('../cli/trigger-command.js');
+            const argv = cmd.argv;
+            const command = resolveTriggerCommandArgv(argv, session.selfAID);
+            cmd = { ...command, actorSessionId: cmd.actorSessionId, delegationToken: cmd.delegationToken,
+                delegationCommandHash: cmd.delegationCommandHash };
+            approvedAgentAid = requireAgent(command.agentAid);
+            approvedOperation = command.type;
+            approvedActor = await authorizeTrigger(approvedAgentAid, approvedOperation, command.triggerId);
+            const args = argv.slice(2);
+            const usesFiles = args.some(value => ['--file', '--prompt-file', '--script-path', '--script-file']
+                .some(flag => value === flag || value.startsWith(`${flag}=`)));
+            if (usesFiles)
+                assertTriggerLocalFileAuthority(approvedActor);
+            const fileScope = approvedActor.fullAccess ? undefined : {
+                selfAid: approvedAgentAid, projectPath: session.projectPath,
+                sessionRuntimeDir: approvedActor.sessionRuntimeDir, cwd: session.projectPath,
+            };
+            if (command.type === 'trigger.create') {
+                const parsed = await buildTriggerCreateRequest(args, fileScope, approvedAgentAid);
+                if (parsed.definition?.agentAid !== approvedAgentAid)
+                    throw new Error('Imported Trigger does not match the authorized Agent');
+                cmd = { ...cmd, ...parsed };
+            }
+            else if (command.type === 'trigger.update') {
+                cmd = { ...cmd, ...await buildTriggerUpdateRequest(args, fileScope, approvedAgentAid) };
+            }
+            else if (usesFiles) {
+                throw new Error('File inputs are only valid for Trigger create/update');
             }
+        }
+        else if (cmd.actorSessionId) {
+            throw new Error('Managed callers must use trigger.op with approved argv');
+        }
+        switch (cmd.type) {
             case 'trigger.list': {
                 const agentAid = requireAgent(cmd.agentAid);
                 const actor = await authorizeTrigger(agentAid, 'trigger.list');

package/dist/trigger/parser.js

@@ -11,7 +11,7 @@ const TRIGGER_UPDATE_FLAGS = new Set([
 ]);
 const TRIGGER_CREATE_FLAGS = new Set([
     'once', 'delay', 'at', 'cron', 'every', 'event', 'event-filter', 'tz',
-    'exec', 'prompt', 'name', 'agent',
+    'exec', 'prompt', 'name', 'agent', 'label',
     'script-path', 'script-runtime', 'script-args', 'script-timeout', 'execution-timeout',
     'feedback', 'target-channel', 'target-channel-id', 'target-chat-type', 'target-session', 'target-thread-id',
     'trigger-thread', 'baseagent',
@@ -68,6 +68,60 @@ export function parseDuration(s) {
     const multiplier = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : unit === 'm' ? 60_000 : 1_000;
     return amount * multiplier;
 }
+/**
+ * T10: 从原始 args 里提取 `--label key=value`（支持多次出现，值内可用逗号分隔多对）。
+ * 约定：labels 若存在则必须含 `kind`（渲染模板路由 key）。
+ */
+export function extractLabels(args) {
+    const tokens = [];
+    if (Array.isArray(args)) {
+        for (let i = 0; i < args.length; i++) {
+            const a = args[i];
+            if (a === '--label') {
+                const next = args[i + 1];
+                if (next === undefined || next.startsWith('--'))
+                    return { error: '--label 不能为空（格式：--label key=value）' };
+                tokens.push(next);
+                i += 1;
+            }
+            else if (a.startsWith('--label=')) {
+                tokens.push(a.slice('--label='.length));
+            }
+        }
+    }
+    else {
+        const re = /--label(?:=(\S+)|(?:\s+(?!--)(\S+)))?/g;
+        let m;
+        while ((m = re.exec(args)) !== null) {
+            const v = m[1] ?? m[2];
+            if (v === undefined)
+                return { error: '--label 不能为空（格式：--label key=value）' };
+            tokens.push(v.replace(/^["']|["']$/g, ''));
+        }
+    }
+    if (tokens.length === 0)
+        return { labels: {} };
+    const labels = {};
+    for (const token of tokens) {
+        for (const pair of token.split(',')) {
+            const trimmed = pair.trim();
+            if (!trimmed)
+                continue;
+            const eq = trimmed.indexOf('=');
+            if (eq <= 0)
+                return { error: `--label 格式无效: "${trimmed}"（应为 key=value）` };
+            const key = trimmed.slice(0, eq).trim();
+            const value = trimmed.slice(eq + 1);
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+                return { error: `--label key 名无效: "${key}"（只允许字母、数字、下划线，且不以数字开头）` };
+            }
+            labels[key] = value;
+        }
+    }
+    if (!('kind' in labels))
+        return { error: '--label 必须包含 kind（如 --label kind=default）' };
+    return { labels };
+}
 export function parseIsoDate(s) {
     const d = new Date(s);
     return isNaN(d.getTime()) ? null : d.getTime();
@@ -496,6 +550,9 @@ export function parseTriggerSet(args) {
     if (!parsed.ok)
         return { ok: false, error: withPromptFileHint(parsed.error, args) };
     const value = parsed.value;
+    const labelsResult = extractLabels(args);
+    if ('error' in labelsResult)
+        return { ok: false, error: labelsResult.error };
     return {
         ok: true,
         value: {
@@ -525,6 +582,7 @@ export function parseTriggerSet(args) {
             model: value.model,
             effort: value.effort,
             permissionMode: value.permissionMode,
+            ...(Object.keys(labelsResult.labels).length > 0 ? { labels: labelsResult.labels } : {}),
         },
     };
 }
@@ -538,6 +596,9 @@ export function parseTriggerSetArgv(args, opts = {}) {
     if (!parsed.ok)
         return { ok: false, error: withPromptFileHint(parsed.error, args, opts) };
     const value = parsed.value;
+    const labelsResult = extractLabels(args);
+    if ('error' in labelsResult)
+        return { ok: false, error: labelsResult.error };
     return {
         ok: true,
         value: {
@@ -567,6 +628,7 @@ export function parseTriggerSetArgv(args, opts = {}) {
             model: value.model,
             effort: value.effort,
             permissionMode: value.permissionMode,
+            ...(Object.keys(labelsResult.labels).length > 0 ? { labels: labelsResult.labels } : {}),
         },
     };
 }

package/dist/trigger/script-sandbox.js

@@ -6,28 +6,16 @@ import { pathToFileURL } from 'node:url';
 import { spawn } from 'node:child_process';
 import { resolveCodexCliPath } from '../agents/baseagent.js';
 import { ensureSessionRuntimeDir } from '../cli/task-context.js';
-import { resolveBubblewrapPath } from '../core/permission/sandbox-runtime.js';
-import { classifyProtectedPath, getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../core/permission/protected-paths.js';
+import { buildBubblewrapCommand, buildHClassGuardCommand, resolveBubblewrapPath, } from '../core/permission/sandbox-runtime.js';
+import { resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+import { buildCodexProtectedFilesystemRules, classifyProtectedPath, getExistingRelationAttachmentDirs, isSameOrDescendant, } from '../core/permission/protected-paths.js';
 import { resolveRoot } from '../paths.js';
 import { buildCliLaunchCommand, killProcess, resolveCommandPath } from '../utils/cross-platform.js';
 import { TRIGGER_LOCAL_FILE_LIMIT } from './local-files.js';
-const SAFE_ENVIRONMENT_KEYS = [
-    'ComSpec', 'COMSPEC', 'LANG', 'LC_ALL', 'OS', 'PATH', 'PATHEXT',
-    'ProgramData', 'ProgramFiles', 'ProgramFiles(x86)', 'ProgramW6432',
-    'SystemDrive', 'SystemRoot', 'WINDIR',
-];
-const SYSTEM_READ_ROOTS = ['/usr/bin', '/usr/lib', '/usr/lib64', '/usr/local/bin', '/usr/local/lib', '/usr/share/locale', '/usr/share/zoneinfo', '/bin', '/sbin', '/lib', '/lib64'];
-const SYSTEM_READ_FILES = ['/etc/ld.so.cache', '/etc/localtime', '/etc/passwd', '/etc/group'];
-const CONTROL_DIRECTORY_NAMES = ['agents', 'AIDs', 'aids', 'data', 'CA', '.snapshots', 'logs', 'backups'];
 const WINDOWS_SANDBOX_SETUP_VERSION = 5;
-const WINDOWS_SANDBOX_ENV_EXCLUDES = [
+const SCRIPT_ENVIRONMENT_EXCLUDES = [
     'CODEX_HOME',
-    'EVOLCORE_DELEGATION_TOKEN',
-    'EVOLCORE_CODEX_SESSION_TOKEN',
-    'EVOLCORE_TASK_RUNTIME_CONTEXT',
-    'EVOLCORE_INSTANCE_SOCKET',
-    'EVOLCORE_DAEMON_SOCKET',
-    'EVOLCORE_IPC_SOCKET',
     'OPENAI_API_KEY',
     'CODEX_API_KEY',
     'ANTHROPIC_API_KEY',
@@ -48,6 +36,8 @@ export function buildTriggerScriptLaunch(input) {
     if (!authorization.permissionMode || authorization.permissionMode === 'fullaccess') {
         throw new Error('scoped Trigger execution requires an effective non-fullaccess permission mode');
     }
+    const sandboxDecision = resolvePhaseOneExecutionSandbox(authorization.permissionMode, authorization.role);
+    const readonly = sandboxDecision.permissionMode === 'readonly';
     if (process.platform !== 'linux' && process.platform !== 'win32') {
         throw new Error('scoped Trigger script isolation is unavailable on this host');
     }
@@ -108,9 +98,12 @@ export function buildTriggerScriptLaunch(input) {
         fs.writeFileSync(scriptPath, scriptBytes, { flag: 'wx', mode: 0o400 });
         preserveNodeModuleType(runtime, input.scriptPath, snapshotDir);
         const env = buildSandboxEnvironment(workDir);
-        const blockedPaths = protectedScriptPaths(root, input.trigger.agentAid);
         const scriptArgs = [scriptPath, ...input.scriptArgs];
         if (windowsBackend) {
+            const filesystem = buildCodexProtectedFilesystemRules(root, {
+                selfAid: input.trigger.agentAid,
+                denyLClassRead: readonly,
+            });
             const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
             const readRoots = [
                 path.join(systemRoot, 'System32'),
@@ -122,25 +115,37 @@ export function buildTriggerScriptLaunch(input) {
                 snapshotDir,
             ].filter(value => fs.existsSync(value));
             const entries = [
-                { path: { type: 'special', value: { kind: 'root' } }, access: 'deny' },
+                { path: { type: 'special', value: { kind: 'root' } },
+                    access: sandboxDecision.state === 'off' ? 'write' : 'read' },
                 ...readRoots.map(value => filesystemEntry(value, 'read')),
-                filesystemEntry(projectPath, authorization.permissionMode === 'readonly' ? 'read' : 'write'),
+                filesystemEntry(projectPath, readonly ? 'read' : 'write'),
+                filesystemEntry(snapshotDir, 'read'),
                 filesystemEntry(workDir, 'write'),
-                ...blockedPaths.map(value => filesystemEntry(value, 'deny')),
+                filesystemEntry(windowsBackend.home, 'deny'),
+                ...Object.entries(filesystem).flatMap(([value, access]) => typeof access === 'number' ? [] : [{
+                        path: /[*?[\]]/.test(value)
+                            ? { type: 'glob_pattern', pattern: value }
+                            : { type: 'path', path: value },
+                        access,
+                    }]),
+                ...getExistingRelationAttachmentDirs(root, {
+                    selfAid: input.trigger.agentAid,
+                    onlyOtherAgents: true,
+                }).map(value => filesystemEntry(value, 'deny')),
             ];
             const sandboxState = JSON.stringify({
                 permissionProfile: {
                     type: 'managed',
-                    file_system: { type: 'restricted', entries },
-                    network: 'restricted',
+                    file_system: { type: 'restricted', entries, glob_scan_max_depth: filesystem.glob_scan_max_depth },
+                    network: 'enabled',
                 },
                 sandboxCwd: pathToFileURL(projectPath).href,
             });
             if (sandboxState.length > 20_000)
                 throw new Error('scoped Windows Trigger filesystem policy exceeds the command-line budget');
-            const shellEnvironmentPolicy = `shell_environment_policy={inherit="all",exclude=${JSON.stringify(WINDOWS_SANDBOX_ENV_EXCLUDES)},include_only=[],set={}}`;
+            const shellEnvironmentPolicy = `shell_environment_policy={inherit="all",exclude=${JSON.stringify(getScriptEnvironmentExcludes())},include_only=[],set={}}`;
             const sandboxArgs = [
-                'sandbox', '--sandbox-state-json', sandboxState, '--sandbox-state-disable-network',
+                'sandbox', '--sandbox-state-json', sandboxState,
                 '-c', 'windows.sandbox="elevated"',
                 '-c', shellEnvironmentPolicy,
             ];
@@ -154,40 +159,26 @@ export function buildTriggerScriptLaunch(input) {
             launch.prepare = signal => verifyWindowsReadIsolation(launch, sandboxArgs, runDir, workDir, signal);
             return launch;
         }
-        const args = [
-            '--die-with-parent', '--new-session', '--unshare-all', '--cap-drop', 'ALL',
-            '--tmpfs', '/', '--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp',
-        ];
-        const readRoots = [...SYSTEM_READ_ROOTS, ...SYSTEM_READ_FILES, runtimeDir]
-            .filter(value => fs.existsSync(value));
-        const visibleRoots = [...readRoots, projectPath];
-        const directoryMountpoints = new Set();
-        for (const value of [...visibleRoots, ...blockedPaths, runDir, workDir].filter(value => fs.existsSync(value))) {
-            const stat = fs.lstatSync(value);
-            let current = stat.isDirectory() ? path.resolve(value) : path.dirname(path.resolve(value));
-            while (current !== path.parse(current).root) {
-                directoryMountpoints.add(current);
-                current = path.dirname(current);
-            }
-        }
-        for (const value of [...directoryMountpoints].sort((left, right) => left.length - right.length)) {
-            args.push('--dir', value);
-        }
-        for (const value of new Set(readRoots))
-            args.push('--ro-bind', value, value);
-        args.push(authorization.permissionMode === 'readonly' ? '--ro-bind' : '--bind', projectPath, projectPath);
-        for (const value of blockedPaths) {
-            if (!visibleRoots.some(directory => isSameOrDescendant(value, directory)) || !fs.existsSync(value))
-                continue;
-            const stat = fs.lstatSync(value);
-            if (stat.isDirectory())
-                args.push('--tmpfs', value, '--remount-ro', value);
-            else
-                args.push('--ro-bind', '/dev/null', value);
-        }
-        args.push('--ro-bind', runDir, runDir, '--bind', workDir, workDir, '--remount-ro', '/');
-        args.push('--chdir', projectPath, '--', runtime, ...scriptArgs);
-        return { command: bubblewrap, args, cwd: projectPath, env, cleanup };
+        const launch = sandboxDecision.state === 'off'
+            ? buildHClassGuardCommand(runtime, scriptArgs, root, { selfAid: input.trigger.agentAid })
+            : buildBubblewrapCommand(runtime, scriptArgs, {
+                projectPath,
+                projectWritable: !readonly,
+                root,
+                selfAid: input.trigger.agentAid,
+                exposeDaemonIpc: false,
+                denyLClassRead: readonly,
+            });
+        if (!launch)
+            throw new Error('bubblewrap is required for scoped Trigger script isolation');
+        const separator = launch.args.indexOf('--');
+        if (separator < 0)
+            throw new Error('bubblewrap launch is missing its command separator');
+        const runMountArgs = ['--ro-bind', runDir, runDir, '--bind', workDir, workDir];
+        if (!launch.args.slice(0, separator).includes('--chdir'))
+            runMountArgs.push('--chdir', projectPath);
+        launch.args.splice(separator, 0, ...runMountArgs);
+        return { ...launch, cwd: projectPath, env, cleanup };
     }
     catch (error) {
         cleanup();
@@ -331,30 +322,20 @@ function preserveNodeModuleType(runtime, scriptPath, snapshotDir) {
 }
 function buildSandboxEnvironment(workDir) {
     const env = {};
-    for (const key of SAFE_ENVIRONMENT_KEYS) {
-        const value = process.env[key];
-        if (typeof value === 'string' && value.length > 0)
+    const excluded = new Set(getScriptEnvironmentExcludes().map(key => key.toUpperCase()));
+    for (const [key, value] of Object.entries(sanitizeShellExecutionEnvironment(process.env))) {
+        if (!excluded.has(key.toUpperCase())
+            && typeof value === 'string')
             env[key] = value;
     }
-    const homeDir = process.platform === 'win32' ? path.join(workDir, 'home') : workDir;
-    if (homeDir !== workDir)
-        fs.mkdirSync(homeDir, { mode: 0o700 });
     return {
-        ...env, HOME: homeDir, USERPROFILE: homeDir,
-        APPDATA: path.join(workDir, 'appdata'), LOCALAPPDATA: path.join(workDir, 'localappdata'),
+        ...env,
         TMPDIR: workDir, TEMP: workDir, TMP: workDir, EVOLCORE_TRIGGER_SANDBOX: '1',
     };
 }
-function protectedScriptPaths(root, selfAid) {
-    const directoryRoots = CONTROL_DIRECTORY_NAMES.map(name => path.join(root, name));
-    const targets = [
-        ...directoryRoots,
-        ...getExistingHClassMaskTargets(root, { selfAid }).map(target => target.path),
-        ...getExistingLClassReadOnlyTargets(root, { selfAid }).map(target => target.path),
-        path.join(root, 'daemon.json'), path.join(root, '.env'), path.join(root, '.device_id'),
-        path.join(root, '.lock'), path.join(root, 'daemon.pid'),
-    ];
-    return [...new Set(targets)].filter(candidate => (directoryRoots.includes(candidate) || !directoryRoots.some(directory => isSameOrDescendant(candidate, directory))));
+function getScriptEnvironmentExcludes() {
+    const dynamic = Object.keys(process.env).filter(key => key.toUpperCase().startsWith('EVOLCORE_'));
+    return [...new Set([...SCRIPT_ENVIRONMENT_EXCLUDES, ...dynamic])];
 }
 function filesystemEntry(value, access) {
     return { path: { type: 'path', path: path.resolve(value) }, access };

package/dist/trigger/validation.js

@@ -252,6 +252,20 @@ function normalizeV3Phase2(raw, opts) {
         reliability: normalizeReliability(raw.reliability),
         limits: normalizeLimits(raw.limits),
     };
+    // T10: labels 字典原样保留，只做类型校验（如果存在必须是 Record<string, string>）
+    const rawLabels = raw.labels;
+    if (rawLabels !== undefined && rawLabels !== null) {
+        if (typeof rawLabels !== 'object' || Array.isArray(rawLabels)) {
+            throw new Error('labels must be a plain object');
+        }
+        const labels = {};
+        for (const [k, v] of Object.entries(rawLabels)) {
+            if (typeof v !== 'string')
+                throw new Error(`labels.${k} must be a string`);
+            labels[k] = v;
+        }
+        definition.labels = labels;
+    }
     validateTriggerSemantics(definition);
     return definition;
 }

package/dist/utils/error-utils.js

@@ -466,7 +466,7 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
         }
     }
     // 回退到原有的错误消息匹配逻辑
-    const msg = error?.message || String(error);
+    const msg = resolveErrorMessage(error);
     const warnPrefix = includeEmoji ? '⚠️ ' : '';
     const errPrefix = includeEmoji ? '❌ ' : '';
     if (/invalid (?:jsonl )?session file/i.test(msg)) {
@@ -512,5 +512,26 @@ export function getErrorMessage(error, terminalReason, includeEmoji = true) {
     if (msg.includes('timeout')) {
         return `${warnPrefix}请求超时，请重试`;
     }
+    if (msg)
+        return `${errPrefix}暂无法判定错误原因：${msg}`;
     return `${errPrefix}处理消息时出错，请稍后重试`;
 }
+function resolveErrorMessage(error) {
+    if (typeof error === 'string')
+        return error.trim();
+    if (error === null || error === undefined)
+        return '';
+    if (typeof error === 'object') {
+        const message = 'message' in error ? String(error.message ?? '').trim() : '';
+        if (message)
+            return message;
+        const code = 'code' in error ? String(error.code ?? '').trim() : '';
+        if (code)
+            return code;
+        if ('message' in error)
+            return '';
+        const stringified = String(error).trim();
+        return stringified === '[object Object]' || stringified === 'Error' ? '' : stringified;
+    }
+    return String(error).trim();
+}

package/kits/docs/AUTHORING.md

@@ -111,7 +111,7 @@ ECK 的 manifest 机制决定了**不同位置的内容有不同的成本量级*
 
 写入 `rules/` 前自问：**这条信息如果不注入，agent 会在多少比例的对话里做错事？**
 
-- 每轮都需要（如"不得调用 `ec restart`"）→ 进 `rules/`
+- 每轮都需要（如"不得停止或重启承载当前会话的 EvolCore 实例"）→ 进 `rules/`
 - 偶发场景才需要（如"Menu 消息有哪些字段"）→ 留 `docs/`，靠 `INDEX.md` 触发词按需命中
 
 答不上来就别进 `rules/`。最常见的隐性浪费是把偶发查阅的内容塞进规则文件，之后每轮对话都在白烧 token。

package/kits/docs/channels/aun.md

@@ -42,6 +42,14 @@ AUN keystore seed 由 EvolCore 使用固定应用值管理，不再提供配置
 
 > Gateway 不在配置里手填：连接时从 AID 自动发现（见下）。Keystore 默认落在 `$EVOLCORE_HOME`。
 
+## SDK 同步边界
+
+`@agentunion/fastaun` 管理消息/群消息的 A/T/H 水位、ACK、Push/Tail/Forward、Gap Fill、多页同步、重连恢复和 Pull Gate。EvolCore 只消费公开消息/撤回/同步事件，负责业务路由、持久化和 `(namespace, message_id)` 应用幂等；`seq` 只用于顺序、诊断和日志。菜单、普通文本、volatile 消息和应用去重记录均不能用来推导或回写 SDK 游标。
+
+不得访问或 monkey patch SDK 私有成员，包括 `_seqTracker`、`_pullV2`、`_pullGroupV2`、`_publishAppEvent`、`_dispatcher`、`_identity`、`_auth`、`_tokenStore`、`_v2E2EE`。需要补同步、确认消息或调试时，应先检查 SDK 公开 API；缺少能力应向 SDK 增补公开契约，而不是在渠道适配层改写同步状态。显式查询使用公开 RPC/facade 与独立 slot，不得推进 daemon 消费游标。
+
+`fastaun 0.5.18` 公开 `sender_device_id`，但隐藏发送方 slot。EvolCore 的菜单 token 当前仅按设备绑定，不声称具备同设备多 slot 隔离。
+
 ## 特有机制
 
 - **隐式创建**：aun 渠道由顶层 `aid` 派生，无独立配置实例；这是它与飞书等渠道最大的不同。

package/kits/docs/context-assembly.md

@@ -311,6 +311,7 @@ coding 场景（无 channel/无身份）下，`chatType`、`channel`、`selfAid`
 | 55 | commands | fragment | active 且 channel≠null | ✓ |
 | 60 | session | fragment | active | ✓ |
 | 70 | baseagent | fragment | active 且 baseAgent≠null | ✓ |
+| 80 | managed-runtime-notice | fragment | active | ✓ |
 
 Bootstrap 只加载引导与有渠道时的最小通信上下文 `[reply]`，不加载完整身份/关系/渠道能力、个人记忆或普通任务命令。
 `[reply]` 展示 selfAid、peerId、peerType、channel、chatType、chatMode；未知身份显示 unknown，回复方式只取运行时已解析的 chatMode，不从身份或私聊场景重新推断。命令经当前会话 delegated sender / daemon IPC 发送，遵守现有身份、目标、话题与加密约束。

package/kits/docs/evolcore/INDEX.md

@@ -14,14 +14,14 @@
 2. **不确定有没有命令**时，直接 `ec <猜测的子命令> --help` 试一下（如 `ec stats --help`）
 3. **已知场景需求**（如"要给对端发消息"）→ 看下方分类表 → 定位到对应命令集
 
-托管 Agent 任务禁止调用 `ec start`、`ec stop`、`ec restart` 或 `ec restart-monitor`。这些进程生命周期命令只能由宿主终端执行；源码改动后 Agent 只应完成构建并报告需要宿主重启。
+生命周期保护仅针对承载当前会话的 EvolCore 实例；其他实例按用户授权和目标端权限处理，不限管理通道。完整规则见 `$KITS_RULES/06-channel.md`。
 
 ## 服务运维类（本地，无需 AUN）
 
 | 命令 | 用途 | 触发词 |
 |------|------|--------|
 | `ec --version` / `-v` / `-V` | 查看版本号 | 版本 |
-| `ec restart` | 宿主终端重启服务（托管 Agent 禁止调用） | 重启 |
+| `ec restart` | 重启目标 daemon（承载当前托管会话的实例受生命周期保护） | 重启 |
 | `ec status` | 查看运行状态、进程、会话、渠道连接 | 状态/查看状态 |
 | `ec logs` | 查看日志（`--level` `--module` `--raw` `--no-color`） | 日志/查看日志 |
 | `ec diagnose` | 诊断启动环境 | 诊断/环境诊断 |
@@ -33,6 +33,7 @@ Windows 上 Codex 托管任务出现 `helper_sandbox_lock_failed`、`SetNamedSec
 | 命令集 | 用途 | 触发词 | 适用场景 | 文档 |
 |--------|------|--------|----------|------|
 | `ec msg` | 私聊收发消息 | 回复/发消息/拉取/撤回/查在线 | 有对端（peerId） | `msg.md` |
+| `ec thread` | 话题管理与话题链 | 话题/thread/跨会话/委托/话题链/ThreadOrigin/summary/删除话题 | 有对端（私聊或群聊） | `thread-chain.md` |
 | `ec group` | 群聊收发与群管理 | 群发/建群/本地群历史/邀请/踢人/退群/群成员/角色/封禁/屏蔽/成员状态/规则/@提及模式/协作 | 群聊（groupId） | `group.md`；完整协作流程见 `group-collaboration.md` |
 | `/invites` / `ec group invites` | 收到群邀请、Owner 卡片审核与恢复 | 入群邀请/接受邀请/拒绝邀请/审核卡片/待处理邀请 | 当前 Agent Owner 的 AUN 私聊 | `group.md` |
 | `ec group rules` | 群规则文件发布与上下文注入 | 群规则/工作流程/职责分工/rules.md/发布规则 | AUN 群聊（groupId） | `group-rules.md` |