evolcore 0.0.33 → 0.0.34

package/dist/agents/ecagent-runner.js

@@ -18,6 +18,7 @@ import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { resolveEcagentConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { appendRequestPath } from './request-identity.js';
+import { resolveModelSpec } from '../stats/billing.js';
 import { getManagedTaskTempDir } from '../cli/task-context.js';
 import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
 const PROVIDER_ID = 'evolcore-gateway';
@@ -436,18 +437,23 @@ async function consumeOpenAiStream(output, body, model) {
     throw new Error('[network] Gateway stream ended without a terminal event');
 }
 function createModel(id, baseUrl) {
-    const isClaude = id.toLowerCase().startsWith('claude-');
+    const modelId = stripContextWindowSuffix(id);
+    const isClaude = modelId.toLowerCase().startsWith('claude-');
+    const fallback = isClaude
+        ? { context_window: 200_000, max_output_tokens: 8_192 }
+        : { context_window: 128_000, max_output_tokens: 16_384 };
+    const spec = resolveModelSpec(resolveRoot(), id, undefined, fallback);
     return {
-        id,
-        name: id,
+        id: modelId,
+        name: modelId,
         api: 'openai-completions',
         provider: PROVIDER_ID,
         baseUrl,
         reasoning: true,
         input: ['text', 'image'],
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: isClaude ? 200_000 : 128_000,
-        maxTokens: isClaude ? 8_192 : 16_384,
+        contextWindow: spec.context_window,
+        maxTokens: spec.max_output_tokens,
         compat: {
             maxTokensField: 'max_tokens',
             supportsUsageInStreaming: true,
@@ -464,7 +470,11 @@ function isWithin(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
+/** 路径是否落在任一显式声明的根之下（含根本身）。 */
+function isWithinAny(candidate, roots) {
+    return roots.some(root => isWithin(path.resolve(root), candidate));
+}
+export function resolveEcagentToolPath(projectPath, candidate, forWrite = false, bootstrapAgentMdPath, fullaccess = false, personalMdPath, sessionGrants) {
     const root = fs.realpathSync(projectPath);
     const resolved = path.resolve(root, candidate || '.');
     const allowedBootstrapFile = bootstrapAgentMdPath
@@ -472,7 +482,15 @@ export function resolveEcagentToolPath(projectPath, candidate, forWrite = false,
         : undefined;
     const allowedPersonalFile = personalMdPath ? path.resolve(personalMdPath) : undefined;
     const isManagedIdentityFile = resolved === allowedBootstrapFile || resolved === allowedPersonalFile;
-    if (!fullaccess && !isWithin(root, resolved) && !isManagedIdentityFile) {
+    // 系统会话：模块声明的可读根整体放行，可写文件逐个精确匹配（不含目录）。
+    // 声明之外、项目之外的路径仍然拒绝。声明里的路径可能在多个根之间借符号链接互串，
+    // 所以放行前统一按真实路径复核，确认真实位置仍落在同一个被授予的边界内。
+    // 写只看可写文件（逐个精确匹配），绝不由可读根推导；读只看可读根。
+    const sessionWrites = forWrite && (sessionGrants?.writeFiles ?? [])
+        .some(file => path.resolve(file) === resolved);
+    const sessionReads = !forWrite && isWithinAny(resolved, sessionGrants?.readRoots ?? []);
+    const isSessionTarget = sessionReads || sessionWrites;
+    if (!fullaccess && !isWithin(root, resolved) && !isManagedIdentityFile && !isSessionTarget) {
         throw new Error(`Path is outside the project: ${candidate}`);
     }
     if (isManagedIdentityFile) {
@@ -494,7 +512,34 @@ export function resolveEcagentToolPath(projectPath, candidate, forWrite = false,
     while (!fs.existsSync(cursor) && cursor !== path.dirname(cursor))
         cursor = path.dirname(cursor);
     const canonical = fs.realpathSync(cursor);
-    if (!fullaccess && !isWithin(root, canonical))
+    if (fullaccess)
+        return resolved;
+    // 系统会话的写入目标与判定层一致：必须是普通文件，链接一律拒绝。
+    // 链接会让 resolved 与真实位置分离，放行等于把洞开到声明之外。
+    if (sessionWrites && fs.existsSync(resolved) && fs.lstatSync(resolved).isSymbolicLink()) {
+        throw new Error(`Refusing to write through a symbolic link: ${candidate}`);
+    }
+    // 可写文件尚未创建时，以父目录的真实路径为准；已存在时以文件自身的真实路径为准。
+    const canonicalSelf = fs.existsSync(resolved) ? fs.realpathSync(resolved) : canonical;
+    if (isSessionTarget) {
+        const grantedRoots = [
+            ...(sessionReads ? sessionGrants?.readRoots ?? [] : []),
+            ...(sessionWrites ? (sessionGrants?.writeFiles ?? []).filter(file => path.resolve(file) === resolved) : []),
+        ];
+        const canonicalRoots = grantedRoots.flatMap(granted => {
+            const inside = fs.existsSync(granted) ? [fs.realpathSync(granted)] : [];
+            // 根自身可能尚未创建，或者位于尚未创建的上层目录中；先归到存在的祖先再比。
+            let ancestor = granted;
+            while (!fs.existsSync(ancestor) && ancestor !== path.dirname(ancestor))
+                ancestor = path.dirname(ancestor);
+            return [...inside, fs.realpathSync(ancestor)];
+        });
+        if (!canonicalRoots.some(granted => isWithin(granted, canonical) && isWithin(granted, canonicalSelf))) {
+            throw new Error(`Path resolves outside its declared grant: ${candidate}`);
+        }
+        return resolved;
+    }
+    if (!isWithin(root, canonical))
         throw new Error(`Path resolves outside the project: ${candidate}`);
     return resolved;
 }
@@ -547,7 +592,7 @@ async function walkFiles(root, signal) {
 function textResult(text, details = {}) {
     return { content: [{ type: 'text', text: truncate(text) }], details };
 }
-function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false, personalMdPath) {
+function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullaccess = false, personalMdPath, sessionGrants) {
     const read = {
         name: 'Read', label: 'Read', description: 'Read a UTF-8 text file from the project.',
         parameters: Type.Object({
@@ -556,7 +601,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             limit: Type.Optional(Type.Number({ minimum: 1 })),
         }),
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             const stat = await fs.promises.stat(file);
             if (stat.size > MAX_READ_BYTES)
                 throw new Error(`File exceeds ${MAX_READ_BYTES} byte read limit`);
@@ -573,7 +618,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
         name: 'Glob', label: 'Glob', description: 'Find project files matching a glob pattern.',
         parameters: Type.Object({ pattern: Type.String(), path: Type.Optional(Type.String()) }),
         async execute(_id, params, signal) {
-            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess);
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess, undefined, sessionGrants);
             const matcher = globRegex(params.pattern.replaceAll('\\', '/'));
             const files = (await walkFiles(root, signal))
                 .map(file => path.relative(root, file).replaceAll(path.sep, '/'))
@@ -589,7 +634,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             case_insensitive: Type.Optional(Type.Boolean()), literal: Type.Optional(Type.Boolean()),
         }),
         async execute(_id, params, signal) {
-            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess);
+            const root = resolveEcagentToolPath(projectPath, params.path ?? '.', false, undefined, fullaccess, undefined, sessionGrants);
             const files = (await fs.promises.stat(root)).isFile() ? [root] : await walkFiles(root, signal);
             const fileMatcher = params.glob ? globRegex(params.glob.replaceAll('\\', '/')) : undefined;
             const flags = params.case_insensitive ? 'i' : '';
@@ -622,7 +667,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
         name: 'Write', label: 'Write', description: 'Create or completely overwrite a project file.',
         parameters: Type.Object({ file_path: Type.String(), content: Type.String() }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             await fs.promises.mkdir(path.dirname(file), { recursive: true });
             await fs.promises.writeFile(file, params.content, { encoding: 'utf8', signal });
             return textResult(`Wrote ${Buffer.byteLength(params.content)} bytes to ${path.relative(projectPath, file)}`, { file });
@@ -635,7 +680,7 @@ function createTools(env, projectPath, runtimeEnv, bootstrapAgentMdPath, fullacc
             replace_all: Type.Optional(Type.Boolean()),
         }), executionMode: 'sequential',
         async execute(_id, params, signal) {
-            const file = resolveEcagentToolPath(projectPath, params.file_path, false, bootstrapAgentMdPath, fullaccess, personalMdPath);
+            const file = resolveEcagentToolPath(projectPath, params.file_path, true, bootstrapAgentMdPath, fullaccess, personalMdPath, sessionGrants);
             const value = await fs.promises.readFile(file, { encoding: 'utf8', signal });
             if (!params.old_string)
                 throw new Error('old_string must not be empty');
@@ -724,7 +769,7 @@ export class EcagentRunner {
                 configuredHeaders: config.headers,
             }),
         };
-        this.model = stripContextWindowSuffix(config.model);
+        this.model = config.model;
         this.effort = config.effort;
         this.agentAid = runtime?.agentAid;
         this.onSessionIdUpdate = callbacks?.onSessionIdUpdate;
@@ -734,8 +779,8 @@ export class EcagentRunner {
             throw new Error('ecagent requires an EvolCore Agent AID');
         return agentSessionsDir(this.agentAid);
     }
-    setModel(model) { this.model = stripContextWindowSuffix(model); }
-    getModel() { return this.model; }
+    setModel(model) { this.model = model; }
+    getModel() { return stripContextWindowSuffix(this.model); }
     resolveModelId(model) { return model; }
     setEffort(effort) { this.effort = effort; }
     getEffort() { return this.effort; }
@@ -885,7 +930,7 @@ export class EcagentRunner {
                 models,
                 model,
                 thinkingLevel: normalizeThinkingLevel(effort),
-                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess, request.modelOverride?.personalMdPath),
+                tools: createTools(nodeEnv, request.projectPath, request.runtimeEnv, request.modelOverride?.bootstrapAgentMdPath, fullaccess, request.modelOverride?.personalMdPath, this.permissionContexts.get(request.sessionId)?.systemSessionGrants),
                 systemPrompt: [DEFAULT_SYSTEM_PROMPT, request.systemPromptAppend].filter(Boolean).join('\n\n'),
                 streamOptions: {
                     timeoutMs: this.config.timeoutMs,
@@ -1212,6 +1257,14 @@ export class EcagentRunner {
                 logger.warn(`[EcagentRunner] failed to record blocked operation: session=${sessionId} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
         };
+        // 系统会话：模块判定即最终结论，不进入 preflight / permissionMode 分支
+        if (permissionContext?.systemSessionCheck) {
+            const decision = permissionContext.systemSessionCheck(toolName, input);
+            if (decision.allow)
+                return {};
+            await recordBlockedOperation(decision.code);
+            return { block: true, reason: decision.reason };
+        }
         const policy = permissionContext?.policyHook?.(toolName, input, { turn });
         if (policy?.block) {
             await recordBlockedOperation(policy.policyCode ?? 'session_policy_hook');
@@ -1239,7 +1292,7 @@ export class EcagentRunner {
         const checkedInput = preflight.input;
         if (mode === 'readonly') {
             const decision = checkReadonly(toolName, checkedInput, projectPath, {
-                sessionId, managedTempDir: permissionContext?.managedTempDir, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
+                sessionId, managedTempDir: permissionContext?.managedTempDir, grantedReadRoots: permissionContext?.grantedReadRoots, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
                 allowReadonlySourceDiagnostics: permissionContext?.allowReadonlySourceDiagnostics === true,
             });
             if (decision.behavior === 'deny') {
@@ -1351,7 +1404,7 @@ export class EcagentRunner {
                 ? cached
                 : await this.openExistingRuntime(agentSessionId, cwd);
             this.onCompactStart?.(sessionId);
-            const compactModel = stripContextWindowSuffix(modelOverride?.model || this.model);
+            const compactModel = modelOverride?.model || this.model;
             const compactEffort = modelOverride?.effortMode === 'model_default'
                 ? undefined
                 : modelOverride?.effort ?? this.effort;

package/dist/agents/runner-types.js

@@ -136,10 +136,9 @@ export function isOneMillionContextModel(model) {
     return ONE_M_CONTEXT_MODEL_PREFIXES.some(prefix => base === prefix || base.startsWith(`${prefix}-`));
 }
 /**
- * EvolCore's conservative local context-window catalog: 1M models = 1,000,000;
- * every other model falls back to 200,000 until provider metadata is available.
- * This is an operational guardrail, not a claim about an upstream provider's
- * advertised capacity.
+ * Hardcoded context-window fallback for models missing from the parameter table:
+ * known 1M models use 1,000,000; every other model falls back to 200,000.
+ * This is an operational guardrail, not a claim about advertised capacity.
  */
 export function realContextWindowForModel(model) {
     return isOneMillionContextModel(model) ? 1000000 : 200000;
@@ -159,8 +158,8 @@ export function autoCompactWindowForModel(_model) {
  * at the right point for small-context models (200k/128k), where EvolCore's
  * fixed 650k threshold would never trigger.
  */
-export function sdkAutoCompactWindowForModel(model) {
-    const contextWindow = realContextWindowForModel(model);
+export function sdkAutoCompactWindowForModel(model, resolvedContextWindow) {
+    const contextWindow = resolvedContextWindow ?? realContextWindowForModel(model);
     const reserve = Math.min(10_000, Math.floor(contextWindow * 0.05));
     return Math.min(650_000, Math.max(1, contextWindow - reserve));
 }

package/dist/aun/aid/identity.js

@@ -224,7 +224,7 @@ export async function aidCreate(aid, opts) {
     // 新注册流程：AIDStore.register → downloadCaRoot → load → authenticate
     const store = await getAidStore({ slotId: SLOT.cli, aunPath });
     try {
-        const regResult = await store.register(aid);
+        const regResult = await store.register(aid, { type: 'agent' });
         if (!regResult.ok) {
             const e = new Error(regResult.error.message);
             e.code = regResult.error.code;

package/dist/channels/aun.js

@@ -557,6 +557,11 @@ function setIfDefined(target, key, value) {
     if (value !== undefined)
         target[key] = value;
 }
+function appendRawErrorText(text, raw) {
+    if (typeof raw !== 'string' || !raw.trim() || text.includes(raw))
+        return text;
+    return `${text}\n原因：${raw}`;
+}
 /**
  * 把 AUNChannel 投递的 opts 映射成渠道无关的 InboundMessage。
  *
@@ -6415,6 +6420,7 @@ export class AUNChannelPlugin {
                             text: payload.text,
                             severity: 'info',
                         };
+                        setIfDefined(noticePayload, 'raw', payload.raw);
                         setIfDefined(noticePayload, 'subtype', payload.subtype);
                         await channel.sendReliableStructured(channelId, noticePayload, replyCtx, payload.text);
                         return;
@@ -6424,10 +6430,14 @@ export class AUNChannelPlugin {
                             type: payload.recoverable === true ? 'notice' : 'error',
                             ...taskBase(),
                             subtype: payload.subtype,
-                            text: payload.text,
+                            text: payload.recoverable === true
+                                ? payload.text
+                                : appendRawErrorText(payload.text, payload.raw),
+                            ...(payload.raw !== undefined ? { raw: payload.raw } : {}),
+                            ...(payload.reason !== undefined ? { reason: payload.reason } : {}),
                             ...(payload.recoverable === true
                                 ? { severity: 'warn' }
-                                : { message: payload.text, user_message: payload.text, recoverable: false }),
+                                : { recoverable: false }),
                         };
                         await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
@@ -6436,11 +6446,11 @@ export class AUNChannelPlugin {
                         const errorPayload = {
                             type: 'error',
                             ...taskBase(),
-                            reason: payload.reason,
-                            text: payload.text,
-                            message: payload.text,
-                            user_message: payload.text,
+                            text: appendRawErrorText(payload.text, payload.raw),
                         };
+                        setIfDefined(errorPayload, 'subtype', payload.subtype);
+                        setIfDefined(errorPayload, 'reason', payload.reason);
+                        setIfDefined(errorPayload, 'raw', payload.raw);
                         await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
                     }

package/dist/channels/daemon.js

@@ -2,6 +2,7 @@ import { appendExpireEntry, recordNextLaunchCleanup, cleanupPreviousByKind, runE
 import { ExecutionTimeoutError } from '../utils/error-utils.js';
 import { normalizeExecutionMode } from '../trigger/validation.js';
 import { resolvePeerRoleDetail } from '../config/peer-role-resolver.js';
+import { assertSystemSessionLaunchable } from '../core/system-session/registry.js';
 const DEFAULT_WATCHDOG_MS = 11 * 60 * 1000;
 export class DaemonChannel {
     sessionManager;
@@ -253,6 +254,9 @@ export class DaemonChannel {
         // 记忆整理会话：把会话原型与整理模式写进 metadata，供渲染层选 manifest / 手册，
         // 供 ipc 侧校验写命令的 --scope。
         const { memoryMode, memoryScope, consolidationBatchDir, consolidationChatDir, consolidationMemoryDir } = trigger.execution;
+        // 系统会话：类型 / subtype / runner 校验不过直接拒绝（Gemini 不支持），不降级成普通会话
+        if (memoryMode)
+            assertSystemSessionLaunchable({ type: 'memory', subtype: memoryMode }, baseagent);
         // 反馈目标与触发方式（consolidation.ts 在 normalize 后补挂的字段）：
         // 收尾时据此投递反馈，并判断是否该反馈（定时触发不反馈）。
         const { feedbackOrigin, consolidationTriggeredBy } = trigger.execution;
@@ -260,7 +264,7 @@ export class DaemonChannel {
             channelKey: this.channelKey,
             peerId: `trigger:${trigger.id}`,
             peerName: trigger.name,
-            ...(memoryMode ? { sessionType: 'memory', memoryMode } : {}),
+            ...(memoryMode ? { systemSession: { type: 'memory', subtype: memoryMode }, sessionType: 'memory', memoryMode } : {}),
             ...(memoryScope ? { memoryScope } : {}),
             ...(consolidationBatchDir ? { consolidationBatchDir } : {}),
             ...(consolidationChatDir ? { consolidationChatDir } : {}),
@@ -570,8 +574,6 @@ export class DaemonChannel {
             peerId: `bg:${spec.kind}`,
             peerName: spec.kind,
             peerType: 'system',
-            bgKind: spec.kind,
-            bgInstanceId: spec.instanceId,
             ...(spec.metadata ?? {}),
         }, spec.kind, undefined, 'private', spec.baseagent, spec.agentAid, this.channelName, 'system');
         const promise = new Promise((resolve) => {
@@ -586,6 +588,7 @@ export class DaemonChannel {
                 terminated: false,
                 cleanupPolicy,
                 agentAid: spec.agentAid,
+                runtimeDir: spec.runtimeDir,
                 watchdogTimer: setTimeout(() => {
                     this.finishBgSession(runId, slot, 'error', 'bg-session watchdog timeout');
                 }, this.watchdogMs),

package/dist/cli/aun-commands.js

@@ -2173,7 +2173,8 @@ Options:
                         无值时默认 5m；Trigger 名：check-<目标threadId>-from-<来源threadId>-<唯一后缀>
                         取消/调整用返回的 trigger_id（trig_…），show/update/cancel 只认 id
   --trigger-prompt <text> 自定义复查 Trigger prompt 中的用户段（仅 --check-every）
-  --mention <aid>       发送时 @ 某个成员（可多次，或用逗号分隔多个 aid）
+  --mention <...>       发送时 @ 某个成员。写法固定为单引号包住、逗号分隔多个 aid
+                        （如 --mention 'alice.agentid.pub,bob.agentid.pub'），可多次传入
   --mention-all         发送时 @ 所有人
   --content-type <mime> 显式覆盖 MIME（仅 --file 模式）
   --as <type>           附件类型：image|video|voice|file（仅 --file 模式）
@@ -2187,7 +2188,7 @@ Options:
 格式示例（.example.invalid 是保留的虚构域，以下 AID 均不是真实地址）:
   ec group create sender.example.invalid "Dev Team" --visibility private
   ec group send sender.example.invalid 12345.example.invalid "hello team"
-  ec group send sender.example.invalid 12345.example.invalid "@member 看下 PR" --mention member.example.invalid
+  ec group send sender.example.invalid 12345.example.invalid '@member 看下 PR' --mention 'member.example.invalid'
   ec group send sender.example.invalid 12345.example.invalid --file ./arch.png
   ec group send sender.example.invalid g-12345.example.invalid "进度?" --thread thread-xxx --check-every 30m
   ec group rules sender.example.invalid 12345.example.invalid set ./rules.md

package/dist/cli/ctl-command.js

@@ -25,7 +25,9 @@ const CTL_HELP = `用法: ec ctl <command> [args...]
   ec ctl name "新会话名称"
   ec ctl send "任务已完成"
   ec ctl file report.md
-  ec ctl queue --full`;
+  ec ctl queue --full
+  ec ctl path list
+  ec ctl path grant "D:/shared/data" --access read`;
 export async function cmdCtl(args) {
     if (args.length === 0) {
         console.error(CTL_HELP);