evolcore 0.0.32 → 0.0.34

package/dist/agents/ecagent-runner.js

@@ -1,4 +1,4 @@
-import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable, TRANSPORT_EFFORTS, resolveCatalogModel, } from '../core/model/model-catalog.js';
+import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable, } from '../core/model/model-catalog.js';
 // Ecagent/OpenAI API 不认识 Claude Code SDK 的窗口后缀，必须传入基础模型 ID。
 import { stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 import fs from 'fs';
@@ -18,6 +18,7 @@ import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { resolveEcagentConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { appendRequestPath } from './request-identity.js';
+import { resolveModelSpec } from '../stats/billing.js';
 import { getManagedTaskTempDir } from '../cli/task-context.js';
 import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
 const PROVIDER_ID = 'evolcore-gateway';
@@ -436,18 +437,23 @@ async function consumeOpenAiStream(output, body, model) {
     throw new Error('[network] Gateway stream ended without a terminal event');
 }
 function createModel(id, baseUrl) {
-    const isClaude = id.toLowerCase().startsWith('claude-');
+    const modelId = stripContextWindowSuffix(id);
+    const isClaude = modelId.toLowerCase().startsWith('claude-');
+    const fallback = isClaude
+        ? { context_window: 200_000, max_output_tokens: 8_192 }
+        : { context_window: 128_000, max_output_tokens: 16_384 };
+    const spec = resolveModelSpec(resolveRoot(), id, undefined, fallback);
     return {
-        id,
-        name: id,
+        id: modelId,
+        name: modelId,
         api: 'openai-completions',
         provider: PROVIDER_ID,
         baseUrl,
         reasoning: true,
         input: ['text', 'image'],
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: isClaude ? 200_000 : 128_000,
-        maxTokens: isClaude ? 8_192 : 16_384,
+        contextWindow: spec.context_window,
+        maxTokens: spec.max_output_tokens,
         compat: {
             maxTokensField: 'max_tokens',
             supportsUsageInStreaming: true,
@@ -464,7 +470,11 @@ function isWithin(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
+/** 路径是否落在任一显式声明的根之下（含根本身）。 */
+function isWithinAny(candidate, roots) {
+    return roots.some(root => isWithin(path.resolve(root), candidate));
+}
+export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false, personalMdPath, sessionGrants) {
     const root = fs.realpathSync(projectPath);
     const resolved = path.resolve(root, candidate || '.');
     const allowedBootstrapFile = bootstrapAgentMdPath
@@ -472,7 +482,15 @@ export function resolveEcagentToolPath(projectPath, candidate, forWrite = false,
         : undefined;
     const allowedPersonalFile = personalMdPath ? path.resolve(personalMdPath) : undefined;
     const isManagedIdentityFile = resolved === allowedBootstrapFile || resolved === allowedPersonalFile;
-    if (!fullaccess && !isWithin(root, resolved) && !isManagedIdentityFile) {
+    // 系统会话：模块声明的可读根整体放行，可写文件逐个精确匹配（不含目录）。
+    // 声明之外、项目之外的路径仍然拒绝。声明里的路径可能在多个根之间借符号链接互串，
+    // 所以放行前统一按真实路径复核，确认真实位置仍落在同一个被授予的边界内。
+    // 写只看可写文件（逐个精确匹配），绝不由可读根推导；读只看可读根。
+    const sessionWrites = forWrite && (sessionGrants?.writeFiles ?? [])
+        .some(file => path.resolve(file) === resolved);
+    const sessionReads = !forWrite && isWithinAny(resolved, sessionGrants?.readRoots ?? []);
+    const isSessionTarget = sessionReads || sessionWrites;
+    if (!fullaccess && !isWithin(root, resolved) && !isManagedIdentityFile && !isSessionTarget) {
         throw new Error(`Path is outside the project: ${candidate}`);
     }
     if (isManagedIdentityFile) {
@@ -494,7 +512,34 @@ export function resolveEcagentToolPath(projectPath, candidate, forWrite = false,
     while (!fs.existsSync(cursor) && cursor !== path.dirname(cursor))
         cursor = path.dirname(cursor);
     const canonical = fs.realpathSync(cursor);
-    if (!fullaccess && !isWithin(root, canonical))
+    if (fullaccess)
+        return resolved;
+    // 系统会话的写入目标与判定层一致：必须是普通文件，链接一律拒绝。
+    // 链接会让 resolved 与真实位置分离，放行等于把洞开到声明之外。
+    if (sessionWrites && fs.existsSync(resolved) && fs.lstatSync(resolved).isSymbolicLink()) {
+        throw new Error(`Refusing to write through a symbolic link: ${candidate}`);
+    }
+    // 可写文件尚未创建时，以父目录的真实路径为准；已存在时以文件自身的真实路径为准。
+    const canonicalSelf = fs.existsSync(resolved) ? fs.realpathSync(resolved) : canonical;
+    if (isSessionTarget) {
+        const grantedRoots = [
+            ...(sessionReads ? sessionGrants?.readRoots ?? [] : []),
+            ...(sessionWrites ? (sessionGrants?.writeFiles ?? []).filter(file => path.resolve(file) === resolved) : []),
+        ];
+        const canonicalRoots = grantedRoots.flatMap(granted => {
+            const inside = fs.existsSync(granted) ? [fs.realpathSync(granted)] : [];
+            // 根自身可能尚未创建，或者位于尚未创建的上层目录中；先归到存在的祖先再比。
+            let ancestor = granted;
+            while (!fs.existsSync(ancestor) && ancestor !== path.dirname(ancestor))
+                ancestor = path.dirname(ancestor);
+            return [...inside, fs.realpathSync(ancestor)];
+        });
+        if (!canonicalRoots.some(granted => isWithin(granted, canonical) && isWithin(granted, canonicalSelf))) {
+            throw new Error(`Path resolves outside its declared grant: ${candidate}`);
+        }
+        return resolved;
+    }
+    if (!isWithin(root, canonical))
         throw new Error(`Path resolves outside the project: ${candidate}`);
     return resolved;
 }
@@ -547,7 +592,7 @@ async function walkFiles(root, signal) {
 function textResult(text, details = {}) {
     return { content: [{ type: 'text', text: truncate(text) }], details };
 }
-function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
+function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false, personalMdPath, sessionGrants) {
     const read = {
         name: 'Read', label: 'Read', description: 'Read a UTF-8 text file from the project.',
         parameters: Type.Object({
@@ -556,7 +601,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             limit: Type.Optional(Type.Number({ minimum: 1 })),
         }),
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             const stat = await fs.promises.stat(file);
             if (stat.size > MAX_READ_BYTES)
                 throw new Error(`File exceeds ${MAX_READ_BYTES} byte read limit`);
@@ -573,7 +618,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
         name: 'Glob', label: 'Glob', description: 'Find project files matching a glob pattern.',
         parameters: Type.Object({ pattern: Type.String(), path: Type.Optional(Type.String()) }),
         async execute(_id, params, signal) {
-            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess);
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess, undefined, sessionGrants);
             const matcher = globRegex(params.pattern.replaceAll('\\', '/'));
             const files = (await walkFiles(root, signal))
                 .map(file => path.relative(root, file).replaceAll(path.sep, '/'))
@@ -589,7 +634,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             case_insensitive: Type.Optional(Type.Boolean()), literal: Type.Optional(Type.Boolean()),
         }),
         async execute(_id, params, signal) {
-            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess);
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess, undefined, sessionGrants);
             const files = (await fs.promises.stat(root)).isFile() ? [root] : await walkFiles(root, signal);
             const fileMatcher = params.glob ? globRegex(params.glob.replaceAll('\\', '/')) : undefined;
             const flags = params.case_insensitive ? 'i' : '';
@@ -622,7 +667,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
         name: 'Write', label: 'Write', description: 'Create or completely overwrite a project file.',
         parameters: Type.Object({ file_path: Type.String(), content: Type.String() }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             await fs.promises.mkdir(path.dirname(file), { recursive: true });
             await fs.promises.writeFile(file, params.content, { encoding: 'utf8', signal });
             return textResult(`Wrote ${Buffer.byteLength(params.content)} bytes to ${path.relative(projectPath, file)}`, { file });
@@ -635,7 +680,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             replace_all: Type.Optional(Type.Boolean()),
         }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             const value = await fs.promises.readFile(file, { encoding: 'utf8', signal });
             if (!params.old_string)
                 throw new Error('old_string must not be empty');
@@ -724,7 +769,7 @@ export class EcagentRunner {
                 configuredHeaders: config.headers,
             }),
         };
-        this.model = stripContextWindowSuffix(config.model);
+        this.model = config.model;
         this.effort = config.effort;
         this.agentAid = runtime?.agentAid;
         this.onSessionIdUpdate = callbacks?.onSessionIdUpdate;
@@ -734,8 +779,8 @@ export class EcagentRunner {
             throw new Error('ecagent requires an EvolCore Agent AID');
         return agentSessionsDir(this.agentAid);
     }
-    setModel(model) { this.model = stripContextWindowSuffix(model); }
-    getModel() { return this.model; }
+    setModel(model) { this.model = model; }
+    getModel() { return stripContextWindowSuffix(this.model); }
     resolveModelId(model) { return model; }
     setEffort(effort) { this.effort = effort; }
     getEffort() { return this.effort; }
@@ -762,15 +807,7 @@ export class EcagentRunner {
         return catalog.models.map(m => m.id);
     }
     async getAvailableEfforts(model) {
-        const catalog = await this.getModelCatalog();
-        const efforts = catalogEfforts(catalog, model, 'ecagent');
-        if (efforts.length > 0)
-            return efforts;
-        // The embedded transport advertises reasoning support for every model it
-        // constructs. Older gateways may omit reasoningLevels from /models; keep
-        // menu.options aligned with the actual runner capability in that case.
-        const entry = catalog.models.find(item => item.id === resolveCatalogModel(catalog, model));
-        return entry && entry.reasoningLevels === undefined ? [...TRANSPORT_EFFORTS.ecagent] : efforts;
+        return catalogEfforts(await this.getModelCatalog(), model, 'ecagent');
     }
     registerStream(key, stream) { this.activeStreams.set(key, stream); }
     cleanupStream(key) {
@@ -893,7 +930,7 @@ export class EcagentRunner {
                 models,
                 model,
                 thinkingLevel: normalizeThinkingLevel(effort),
-                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess, request.modelOverride?.personalMdPath),
+                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess, request.modelOverride?.personalMdPath, this.permissionContexts.get(request.sessionId)?.systemSessionGrants),
                 systemPrompt: [DEFAULT_SYSTEM_PROMPT, request.systemPromptAppend].filter(Boolean).join('\n\n'),
                 streamOptions: {
                     timeoutMs: this.config.timeoutMs,
@@ -917,7 +954,7 @@ export class EcagentRunner {
                     if (pauseResult === 'cancelled')
                         return { block: true, reason: '工具调用已取消' };
                 }
-                const decision = await this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input);
+                const decision = await this.authorizeTool(request.sessionId, request.projectPath, permissionMode, event.toolName, event.input, stats.numTurns + 1);
                 return lifecycle.cancelled || signal?.aborted ? { block: true, reason: '工具调用已取消' } : decision;
             });
             const unsubscribe = harness.subscribe(event => this.mapHarnessEvent(queue, event, stats, model, effort));
@@ -1175,7 +1212,7 @@ export class EcagentRunner {
             model: model.id, effort,
         };
     }
-    async authorizeTool(sessionId, projectPath, mode, toolName, input) {
+    async authorizeTool(sessionId, projectPath, mode, toolName, input, turn) {
         const permissionContext = this.permissionContexts.get(sessionId);
         if (mode === 'fullaccess') {
             return hasTrustedFullAccessContext(permissionContext)
@@ -1220,7 +1257,15 @@ export class EcagentRunner {
                 logger.warn(`[EcagentRunner] failed to record blocked operation: session=${sessionId} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
         };
-        const policy = permissionContext?.policyHook?.(toolName, input);
+        // 系统会话：模块判定即最终结论，不进入 preflight / permissionMode 分支
+        if (permissionContext?.systemSessionCheck) {
+            const decision = permissionContext.systemSessionCheck(toolName, input);
+            if (decision.allow)
+                return {};
+            await recordBlockedOperation(decision.code);
+            return { block: true, reason: decision.reason };
+        }
+        const policy = permissionContext?.policyHook?.(toolName, input, { turn });
         if (policy?.block) {
             await recordBlockedOperation(policy.policyCode ?? 'session_policy_hook');
             return { block: true, reason: policy.reason || '当前会话策略拒绝此工具调用' };
@@ -1247,7 +1292,7 @@ export class EcagentRunner {
         const checkedInput = preflight.input;
         if (mode === 'readonly') {
             const decision = checkReadonly(toolName, checkedInput, projectPath, {
-                sessionId, managedTempDir: permissionContext?.managedTempDir, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
+                sessionId, managedTempDir: permissionContext?.managedTempDir, grantedReadRoots: permissionContext?.grantedReadRoots, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
                 allowReadonlySourceDiagnostics: permissionContext?.allowReadonlySourceDiagnostics === true,
             });
             if (decision.behavior === 'deny') {
@@ -1359,7 +1404,7 @@ export class EcagentRunner {
                 ? cached
                 : await this.openExistingRuntime(agentSessionId, cwd);
             this.onCompactStart?.(sessionId);
-            const compactModel = stripContextWindowSuffix(modelOverride?.model || this.model);
+            const compactModel = modelOverride?.model || this.model;
             const compactEffort = modelOverride?.effortMode === 'model_default'
                 ? undefined
                 : modelOverride?.effort ?? this.effort;

package/dist/agents/runner-types.js

@@ -136,10 +136,9 @@ export function isOneMillionContextModel(model) {
     return ONE_M_CONTEXT_MODEL_PREFIXES.some(prefix => base === prefix || base.startsWith(`${prefix}-`));
 }
 /**
- * EvolCore's conservative local context-window catalog: 1M models = 1,000,000;
- * every other model falls back to 200,000 until provider metadata is available.
- * This is an operational guardrail, not a claim about an upstream provider's
- * advertised capacity.
+ * Hardcoded context-window fallback for models missing from the parameter table:
+ * known 1M models use 1,000,000; every other model falls back to 200,000.
+ * This is an operational guardrail, not a claim about advertised capacity.
  */
 export function realContextWindowForModel(model) {
     return isOneMillionContextModel(model) ? 1000000 : 200000;
@@ -159,8 +158,8 @@ export function autoCompactWindowForModel(_model) {
  * at the right point for small-context models (200k/128k), where EvolCore's
  * fixed 650k threshold would never trigger.
  */
-export function sdkAutoCompactWindowForModel(model) {
-    const contextWindow = realContextWindowForModel(model);
+export function sdkAutoCompactWindowForModel(model, resolvedContextWindow) {
+    const contextWindow = resolvedContextWindow ?? realContextWindowForModel(model);
     const reserve = Math.min(10_000, Math.floor(contextWindow * 0.05));
     return Math.min(650_000, Math.max(1, contextWindow - reserve));
 }

package/dist/aun/aid/identity.js

@@ -224,7 +224,7 @@ export async function aidCreate(aid, opts) {
     // 新注册流程：AIDStore.register → downloadCaRoot → load → authenticate
     const store = await getAidStore({ slotId: SLOT.cli, aunPath });
     try {
-        const regResult = await store.register(aid);
+        const regResult = await store.register(aid, { type: 'agent' });
         if (!regResult.ok) {
             const e = new Error(regResult.error.message);
             e.code = regResult.error.code;

package/dist/aun/group/operations.js

@@ -117,7 +117,6 @@ async function tryDaemonGroupSend(args, payload, runtimeContext, file) {
         mentions: args.mentions,
         encrypt: args.encrypt,
         thread,
-        returnPolicy: args.returnPolicy,
         originSessionId: runtimeContext.sessionId,
         originMessageId: runtimeContext.messageId,
         delegationToken: readDelegationCredential(),

package/dist/aun/msg/history.js

@@ -171,6 +171,7 @@ function readHistoryScopes(input) {
         .filter(({ entry, sessionIds }) => sessionIds === undefined
         || (typeof entry.sessionId === 'string' && sessionIds.has(entry.sessionId)))
         .filter(({ entry }) => input.direction === 'all' || entry.dir === input.direction)
+        .filter(({ entry }) => input.args.threadId === undefined || entry.threadId === input.args.threadId)
         .filter(({ entry }) => input.args.after === undefined || entry.ts > input.args.after)
         .filter(({ entry }) => input.args.before === undefined || entry.ts < input.args.before)
         .sort((left, right) => left.entry.ts - right.entry.ts || left.scope - right.scope)

package/dist/aun/msg/p2p.js

@@ -134,7 +134,6 @@ async function tryDaemonMsgSend(args, payload, runtimeContext, file) {
         ...(payload ? { payload } : { file }),
         encrypt: args.encrypt,
         thread,
-        returnPolicy: args.returnPolicy,
         handoffContext: args.handoffContext,
         originSessionId: runtimeContext.sessionId,
         originMessageId: runtimeContext.messageId,

package/dist/aun/outbox.js

@@ -64,6 +64,24 @@ function isExpired(entry) {
         return false;
     return Date.now() - entry.ts > entry.ttl;
 }
+/**
+ * A process-scoped entry whose enqueuing process is gone. Replaying it would
+ * deliver stale live feedback — typically the "restarting, back in ~5s" notice
+ * that a successful restart has already superseded with its own confirmation.
+ *
+ * A stale entry is not `isExpired()`: it needs `drainOnce` to retire it with a
+ * reason of its own, otherwise the send log would report a semantic drop as a
+ * timeout.
+ */
+export function isStaleProcessScoped(entry) {
+    if (!entry.processScoped)
+        return false;
+    // A record without a pid cannot prove same-process ownership. Treat it as
+    // replayable so the ordinary route/expiry rules stay in charge.
+    if (typeof entry.enqueuedByPid !== 'number')
+        return false;
+    return entry.enqueuedByPid !== process.pid;
+}
 export function isDeliveryForChannel(value, channelId) {
     return isDeliveryTargetForChannel(value, channelId);
 }
@@ -129,6 +147,7 @@ export function enqueue(aid, opts) {
         delivery,
         dedupeKey: opts.dedupeKey,
         critical: opts.critical,
+        ...(opts.processScoped ? { processScoped: true, enqueuedByPid: process.pid } : {}),
         type: opts.type,
         contentKind: opts.contentKind,
         payload: opts.payload,
@@ -273,6 +292,19 @@ function markExpired(entry) {
         code: entry.lastErrorCode,
     };
 }
+/**
+ * Drop a process-scoped entry left behind by a previous process. The terminal
+ * record is retained so the send log still shows why it never went out.
+ */
+function markSupersededProcessScoped(entry) {
+    entry.lastError = 'process-scoped delivery superseded by a new daemon process';
+    entry.lastErrorCode = 'OUTBOX_PROCESS_SUPERSEDED';
+    entry.terminal = {
+        at: Date.now(),
+        error: entry.lastError,
+        code: entry.lastErrorCode,
+    };
+}
 /** Mark a durable entry terminal while keeping its reason for diagnostics. */
 export function markTerminal(aid, id, failure, submitted, queue = submitted ? entryQueue(submitted) : 'default') {
     const entries = readEntries(aid, queue);
@@ -336,6 +368,7 @@ async function drainOnce(aid, sender, queue) {
     let expired = 0;
     let failed = 0;
     let permanent = 0;
+    let superseded = 0;
     const remaining = [];
     for (const entry of entries) {
         // Cancellation or another sender may have changed an
@@ -350,6 +383,16 @@ async function drainOnce(aid, sender, queue) {
             }
             Object.assign(entry, currentEntry);
         }
+        if (isStaleProcessScoped(entry)) {
+            // Deliberately not counted as `expired`: this is a semantic drop, not a
+            // timeout, and the drained-line diagnostic should not conflate them.
+            // The terminal record also retires the entry from `hasPending()`, so a
+            // later drain does not rediscover it.
+            superseded++;
+            markSupersededProcessScoped(entry);
+            remaining.push(entry);
+            continue;
+        }
         if (isExpired(entry)) {
             expired++;
             markExpired(entry);
@@ -457,7 +500,13 @@ async function drainOnce(aid, sender, queue) {
             }];
     });
     writeEntries(aid, retained, queue);
-    return { sent, expired, failed, ...(permanent > 0 ? { permanent } : {}) };
+    return {
+        sent,
+        expired,
+        failed,
+        ...(permanent > 0 ? { permanent } : {}),
+        ...(superseded > 0 ? { superseded } : {}),
+    };
 }
 export async function drain(aid, sender, queue = 'default') {
     const drainKey = `${queue}:${aid}`;

package/dist/channels/aun.js

@@ -557,6 +557,11 @@ function setIfDefined(target, key, value) {
     if (value !== undefined)
         target[key] = value;
 }
+function appendRawErrorText(text, raw) {
+    if (typeof raw !== 'string' || !raw.trim() || text.includes(raw))
+        return text;
+    return `${text}\n原因：${raw}`;
+}
 /**
  * 把 AUNChannel 投递的 opts 映射成渠道无关的 InboundMessage。
  *
@@ -4413,6 +4418,9 @@ export class AUNChannel {
         };
         if (evolCommand)
             base.ext = { evolCommand };
+        // Same diagnostic dictionary as text payloads (sessionId/agentSessionId/model).
+        if (context?.debug)
+            base.debug = { ...context.debug, sentAt: localTimestamp() };
         return withAunAttention(base);
     }
     async sendReliableStructured(channelId, payload, context, logText) {
@@ -4496,6 +4504,9 @@ export class AUNChannel {
             delivery,
             dedupeKey: operationId,
             critical: routedContext.metadata?.criticalDelivery === true,
+            // Live feedback about the running process (for example the pre-restart
+            // notice) must never be replayed by the process that replaces it.
+            processScoped: routedContext.metadata?.processScopedDelivery === true,
             type: 'text',
             text: finalText,
             context: routedContext,
@@ -4565,6 +4576,16 @@ export class AUNChannel {
         };
     }
     /** Daemon-side transport for `ec msg send` running inside an agent task. */
+    /**
+     * Agent 经 CLI 委托发送（ec msg send / ec group send）时占用本轮序号，
+     * 与回复路径共用 sentCount，保证同一轮内 seqInTurn 连续。
+     */
+    nextSeqInTurn(channelId, threadId) {
+        const turnKey = `${channelId}\0${threadId ?? ''}`;
+        const seqInTurn = (this.sentCount.get(turnKey) || 0) + 1;
+        this.sentCount.set(turnKey, seqInTurn);
+        return seqInTurn;
+    }
     async sendDaemonMsg(args) {
         if (!args.to) {
             return { ok: false, error: 'aun-msg-send requires a private target', code: 'UNSUPPORTED_TARGET' };
@@ -5271,6 +5292,9 @@ export class AUNChannel {
             delete payloadWithChatmode.thread_id;
         if (context?.threadId && !payloadWithChatmode.thread_id)
             payloadWithChatmode.thread_id = context.threadId;
+        // Same diagnostic dictionary as text payloads (sessionId/agentSessionId/model).
+        if (context?.debug)
+            payloadWithChatmode.debug = { ...context.debug, sentAt: localTimestamp() };
         const params = {
             context: { type: 'task', id: taskId },
             payload: this.limitThoughtPayload(payloadWithChatmode),
@@ -5847,8 +5871,12 @@ export class AUNChannel {
                 }
                 return { status: 'permanent', error: `unsupported outbox entry type: ${entry.type}`, code: 'UNSUPPORTED_OUTBOX_TYPE' };
             }, queue);
-            if (result.sent > 0 || result.expired > 0 || result.permanent) {
-                logger.info(`${this.logPrefix()} ${queue} outbox drained: sent=${result.sent} expired=${result.expired} failed=${result.failed} permanent=${result.permanent ?? 0}`);
+            if (result.sent > 0 || result.expired > 0 || result.permanent || result.superseded) {
+                const superseded = result.superseded ? ` superseded=${result.superseded}` : '';
+                logger.info(`${this.logPrefix()} ${queue} outbox drained: sent=${result.sent} expired=${result.expired} failed=${result.failed} permanent=${result.permanent ?? 0}${superseded}`);
+            }
+            if (result.superseded) {
+                logger.info(`${this.logPrefix()} ${queue} outbox: dropped ${result.superseded} process-scoped entr${result.superseded === 1 ? 'y' : 'ies'} left by a previous daemon process`);
             }
         };
         await drainQueue('default');
@@ -5962,6 +5990,9 @@ export class AUNChannel {
             statusPayload.chatmode = context.metadata.chatmode;
         if (context?.replyToMessageId)
             statusPayload.ref_message_id = context.replyToMessageId;
+        // Same diagnostic dictionary as text payloads (sessionId/agentSessionId/model).
+        if (context?.debug)
+            statusPayload.debug = { ...context.debug, sentAt: localTimestamp() };
         const notifyOptions = { ttlMs: 60_000 };
         if (delivery.chatType === 'group')
             notifyOptions.groupId = delivery.groupId;
@@ -6389,6 +6420,7 @@ export class AUNChannelPlugin {
                             text: payload.text,
                             severity: 'info',
                         };
+                        setIfDefined(noticePayload, 'raw', payload.raw);
                         setIfDefined(noticePayload, 'subtype', payload.subtype);
                         await channel.sendReliableStructured(channelId, noticePayload, replyCtx, payload.text);
                         return;
@@ -6398,10 +6430,14 @@ export class AUNChannelPlugin {
                             type: payload.recoverable === true ? 'notice' : 'error',
                             ...taskBase(),
                             subtype: payload.subtype,
-                            text: payload.text,
+                            text: payload.recoverable === true
+                                ? payload.text
+                                : appendRawErrorText(payload.text, payload.raw),
+                            ...(payload.raw !== undefined ? { raw: payload.raw } : {}),
+                            ...(payload.reason !== undefined ? { reason: payload.reason } : {}),
                             ...(payload.recoverable === true
                                 ? { severity: 'warn' }
-                                : { message: payload.text, user_message: payload.text, recoverable: false }),
+                                : { recoverable: false }),
                         };
                         await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
@@ -6410,11 +6446,11 @@ export class AUNChannelPlugin {
                         const errorPayload = {
                             type: 'error',
                             ...taskBase(),
-                            reason: payload.reason,
-                            text: payload.text,
-                            message: payload.text,
-                            user_message: payload.text,
+                            text: appendRawErrorText(payload.text, payload.raw),
                         };
+                        setIfDefined(errorPayload, 'subtype', payload.subtype);
+                        setIfDefined(errorPayload, 'reason', payload.reason);
+                        setIfDefined(errorPayload, 'raw', payload.raw);
                         await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
                     }