evolcore 0.0.33 → 0.0.34

package/dist/core/command/command-handler.js

@@ -1,5 +1,6 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { loadedBaseagentIds } from '../../agents/baseagent-availability.js';
+import { grantSessionPath, listRuntimePathGrants, revokeSessionPath } from '../permission/session-path-grants.js';
 import { closeDiagnosticSession, diagnosticTokenHash, isDiagnosticSessionActive } from './diag-service.js';
 import { parseMenuClientArgs } from '../../cli/menu-client.js';
 import { ensureSessionRuntimeDir } from '../../cli/task-context.js';
@@ -20,6 +21,7 @@ import { agentmdGet } from '../../aun/aid/agentmd.js';
 import { parseDuration, parseTriggerSet, parseTriggerUpdate } from '../../trigger/parser.js';
 import { applyTriggerPatch, replaceEditableTriggerDefinition } from '../../trigger/patch.js';
 import { definitionRevision } from '../../trigger/validation.js';
+import { isDaemonEventSessionTrigger, matchTriggerEvent } from '../../trigger/event-source.js';
 import { tryParseChannelKey } from '../channel-loader.js';
 import { displaySessionTitle } from '../session/session-title.js';
 import { buildTranscriptTurns } from '../session/session-transcript.js';
@@ -45,7 +47,7 @@ import { handleSlashCommand } from './slash-handler.js';
 import { resolveChatMode } from '../message/peer-mode.js';
 import { execMenuAction as menuExecMenuAction, execMenuForEcweb as menuExecMenuForEcweb, execMenuForControl as menuExecMenuForControl, execMenuQuery as menuExecMenuQuery, execMenuUpdate as menuExecMenuUpdate, getMenuItems as menuGetMenuItems, getSubMenuItems as menuGetSubMenuItems, buildTopicForkSourcePayload, } from './menu-handler.js';
 import { getMenuCatalog, execMenuValueBatch, validateMenuValueBatchArgs } from './menu-catalog.js';
-import { resolveCurrentSessionLoopTarget } from '../session/session-idle-monitor.js';
+import { resolveCurrentSessionLoopTarget, sessionLoopError } from '../session/session-idle-monitor.js';
 export { isProcessLevelOwner } from './menu-handler.js';
 const CLI_EXEC_TIMEOUT_MS = 15_000;
 const CLI_EXEC_MAX_OUTPUT = 128 * 1024;
@@ -372,6 +374,45 @@ export class CommandHandler {
     getTriggerSchedulerForAgent(agentAid) {
         return this.triggerSchedulerResolver?.(agentAid) ?? (this.triggerSchedulerFallbackAid === agentAid ? this.triggerSchedulerFallback : undefined);
     }
+    assertSessionLoopTrigger(session) {
+        const daemonAid = this.getDaemonTriggerOwnerAid();
+        const schedulers = new Set([
+            this.getTriggerSchedulerForAgent(session.selfAID ?? ''),
+            daemonAid ? this.getTriggerSchedulerForAgent(daemonAid) : undefined,
+        ]);
+        const triggers = [...schedulers].flatMap(scheduler => scheduler?.list({ all: true }) ?? [])
+            .filter(definition => definition.id === '__session-idle-check'
+            || (definition.source.type === 'event' && definition.source.eventPattern === 'session:idle'));
+        if (triggers.length === 0) {
+            throw sessionLoopError('LOOP_TRIGGER_NOT_FOUND', '未找到 session:idle Trigger，无法开启 loop');
+        }
+        const enabled = triggers.filter(definition => definition.enabled);
+        if (enabled.length === 0) {
+            throw sessionLoopError('LOOP_TRIGGER_DISABLED', 'session:idle Trigger 未开启，无法开启 loop');
+        }
+        const event = {
+            type: 'session:idle',
+            sessionId: session.id,
+            agentAid: session.selfAID,
+            channel: session.channelType || session.channel,
+            channelName: session.channel,
+            channelId: session.channelId,
+            chatType: session.chatType,
+            ...(session.threadId ? { threadId: session.threadId } : {}),
+            peerId: session.metadata?.peerId || session.channelId,
+        };
+        const valid = enabled.some(definition => definition.source.type === 'event'
+            && definition.source.eventPattern === 'session:idle'
+            && definition.execution.type === 'target_session'
+            && !!definition.execution.prompt?.trim()
+            && definition.feedback.strategy === 'event_session'
+            && (definition.agentAid === session.selfAID || isDaemonEventSessionTrigger(definition))
+            && matchTriggerEvent(definition.source, event).matched);
+        if (!valid) {
+            throw sessionLoopError('LOOP_TRIGGER_INVALID', 'session:idle Trigger 配置不符合要求：事件过滤条件须允许接收当前会话的闲置事件，'
+                + '并使用 target_session 执行、event_session 动态路由，且提示词非空');
+        }
+    }
     triggerSourceFromSchedule(scheduleType, scheduleValue) {
         if (scheduleType === 'once')
             return { type: 'once' };
@@ -463,6 +504,7 @@ export class CommandHandler {
             createdAt: definition.createdAt,
             updatedAt: definition.updatedAt,
             status: definition.enabled ? 'active' : 'disabled',
+            ...(definition.description ? { description: definition.description } : {}),
             limits: definition.limits,
             limitState: schedulerDetails?.limitState,
             subscription: schedulerDetails?.subscription,
@@ -715,6 +757,7 @@ export class CommandHandler {
             agentAid: schedulerAid,
             enabled: true,
             name,
+            ...(parsed.description ? { description: parsed.description } : {}),
             createdAt: now,
             updatedAt: now,
             ...(authorizedBy ? { authorizedBy } : {}),
@@ -1822,6 +1865,7 @@ export class CommandHandler {
     // ── Agent Ctl ──
     static CTL_COMMANDS = [
         '/status', '/pwd', '/file', '/send', '/rename', '/name', '/queue', '/restart', '/model', '/effort',
+        '/path',
     ];
     /**
      * 从 session 恢复 ReplyContext，用于 ctl send 主动发送文本时的路由
@@ -2462,7 +2506,7 @@ export class CommandHandler {
                 selfAid: grant.selfAid,
                 peerKey: grant.peerKey,
                 channel: grant.channel,
-                role: grant.issuedRole,
+                role: grant.issuedRole ?? 'none',
                 taskId: grant.taskId,
                 messageId: grant.messageId,
                 argvHash: hashArgv(argv),
@@ -2507,7 +2551,7 @@ export class CommandHandler {
             // stay pinned here, and authorizeOperation below remains the authority
             // for every role (member carries currentRelationOnly; visitor is denied).
             const mayReadCrossPeer = hasTrustedFullAccessDelegation(grant)
-                || (parsed.command.kind === 'history' && isAdminRole(grant.issuedRole));
+                || (parsed.command.kind === 'history' && isAdminRole(grant.issuedRole ?? 'none'));
             if (!mayReadCrossPeer && parsed.command.target !== conversationId) {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN private relation can be targeted' };
             }
@@ -2530,7 +2574,7 @@ export class CommandHandler {
             channelId: conversationId,
             chatType: grant.chatType,
             conversationId,
-            ...(isSelectorHistory ? { identity: roleToSessionIdentity(grant.issuedRole) } : {}),
+            ...(isSelectorHistory ? { identity: roleToSessionIdentity(grant.issuedRole ?? null) } : {}),
             processOwners: loadDaemonConfig().owners ?? [],
             ...trustedExecutionIdentityInput(grant),
         });
@@ -2983,6 +3027,15 @@ export class CommandHandler {
             const args = cmd.slice('/queue'.length).trim();
             return await this.handleQueueCommand(sessionId, args);
         }
+        // 5.2 /path: 运行时路径授权（E3-a）。授权校验见 handlePathCommand。
+        if (cmd === '/path' || cmd.startsWith('/path ')) {
+            const args = cmd.slice('/path'.length).trim();
+            return await this.handlePathCommand(sessionId, args, {
+                selfAid: grantSelfAid,
+                actorId: grant.actorId,
+                role: ctlSubject.role,
+            });
+        }
         // 6. 调用现有 handle()，不传 sendMessage 回调（结果直接返回）
         try {
             const result = await this._handleInternal(cmd, session.channel, session.channelId, undefined, // 不发送消息
@@ -3006,6 +3059,10 @@ export class CommandHandler {
             source: 'agent-tool',
             args: { ...relationArgs, ...extra },
         });
+        if (name === 'path') {
+            const action = args[0] === 'grant' ? 'grant' : args[0] === 'revoke' ? 'revoke' : 'list';
+            return intent(`ec.ctl.path.${action}`);
+        }
         if (name === 'send')
             return intent('ec.ctl.send');
         if (name === 'file')
@@ -3047,6 +3104,83 @@ export class CommandHandler {
         }
         return null;
     }
+    // ── Path grant command ──
+    /**
+     * `ec ctl path grant|revoke|list` —— 运行时路径授权（E3-a）。
+     *
+     * 这是提权操作：授予一条路径等于扩大该会话能触及的文件范围。约束有三条，
+     * 缺一条这套机制就能被会话自己解除：
+     *   1. 只有 owner / admin 可调用；
+     *   2. 授予只对**当前会话**生效，不写进任何全局配置；
+     *   3. 会话结束时由 releaseSessionPathGrants(sessionId) 清掉。
+     *
+     * 见 docs/memory/session-profile-design.md §4。
+     */
+    async handlePathCommand(sessionId, args, actor) {
+        if (actor.role !== 'owner' && actor.role !== 'admin') {
+            return {
+                ok: false,
+                code: 'ROLE_ACCESS_DENIED',
+                error: `路径授权仅 owner / admin 可操作（当前角色：${actor.role ?? 'none'}）`,
+            };
+        }
+        const [action = 'list', ...rest] = args.split(/\s+/).filter(Boolean);
+        const flag = (name) => {
+            const index = rest.indexOf(name);
+            return index >= 0 ? rest[index + 1] : undefined;
+        };
+        if (action === 'list') {
+            const grants = listRuntimePathGrants(sessionId);
+            if (grants.length === 0)
+                return { ok: true, result: '当前会话没有运行时路径授权', data: [] };
+            const data = grants.map(record => ({
+                path: record.path,
+                access: record.access,
+                ...(record.identity ? { identity: record.identity } : {}),
+                ...(record.grantedBy ? { grantedBy: record.grantedBy } : {}),
+                grantedAt: new Date(record.grantedAt).toISOString(),
+            }));
+            return {
+                ok: true,
+                data,
+                result: data.map(item => `${item.access.padEnd(5)} ${item.path}`).join('\n'),
+            };
+        }
+        const rawPath = rest[0];
+        if (!rawPath || rawPath.startsWith('--')) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: '缺少路径。用法: ec ctl path grant <绝对路径> [--access read|write|none]' };
+        }
+        if (!path.isAbsolute(rawPath)) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: '路径必须是绝对路径' };
+        }
+        const resolvedPath = path.resolve(rawPath);
+        if (action === 'revoke') {
+            return revokeSessionPath(sessionId, resolvedPath)
+                ? { ok: true, result: `已撤销 ${resolvedPath}` }
+                : { ok: false, code: 'NOT_FOUND', error: `当前会话没有该路径的运行时授权: ${resolvedPath}` };
+        }
+        if (action !== 'grant') {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: `未知子命令: ${action}（支持 grant / revoke / list）` };
+        }
+        const accessValue = flag('--access') ?? 'read';
+        if (accessValue !== 'read' && accessValue !== 'write' && accessValue !== 'none') {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: '--access 必须是 read / write / none' };
+        }
+        const identity = flag('--identity')?.trim();
+        grantSessionPath({
+            sessionId,
+            path: resolvedPath,
+            access: accessValue,
+            ...(identity ? { identity } : {}),
+            ...(actor.actorId ? { grantedBy: actor.actorId } : {}),
+            grantedAt: Date.now(),
+        });
+        logger.info(`[PathGrant] granted session=${sessionId} path=${resolvedPath} access=${accessValue} by=${actor.actorId ?? 'unknown'} self=${actor.selfAid}`);
+        return {
+            ok: true,
+            result: `✓ 已授予 ${accessValue} 于 ${resolvedPath}（仅当前会话，会话结束自动撤销）`,
+        };
+    }
     // ── Queue command ──
     /** 提取命名参数值（如 --cancel msg123 → "msg123"） */
     extractArg(args, flag) {

package/dist/core/command/daemon-diagnostics.js

@@ -30,6 +30,7 @@ const LOG_SOURCES = [
     { id: 'menu-protocol', label: 'Menu Protocol', pattern: /^menu-protocol(?:-.+)?\.log$/ },
     { id: 'causation', label: 'Causation spans', pattern: /^causation-spans(?:-.+)?\.log$/ },
     { id: 'command-audit', label: 'Command audit', pattern: /^command-audit(?:-.+)?\.log$/ },
+    { id: 'delegation-audit', label: 'Delegation audit', pattern: /^delegation-audit(?:-.+)?\.log$/ },
     { id: 'role-mutations', label: 'Role mutations', pattern: /^role-mutations(?:-.+)?\.log$/ },
 ];
 const LOG_LEVELS = ['trace', 'debug', 'info', 'warn', 'error', 'fatal'];

package/dist/core/command/menu-catalog.js

@@ -178,6 +178,9 @@ export async function resolveMenuCatalogContext(input) {
             processRole,
             isDaemonOwner: processRole === 'daemon-owner',
             fromControlChannel: subject.fromControlChannel,
+            ecwebManagement: subject.ecwebManagement,
+            agentFullAccessManagement: subject.agentFullAccessManagement,
+            canApprovePersistentFullAccess: subject.canApprovePersistentFullAccess,
             allowAccess: processRole !== 'none' || rebuilt.allowAccess,
         };
         const access = authorizeAccess(bound);

package/dist/core/command/menu-handler.js

@@ -1144,6 +1144,18 @@ function buildMenuAuthSubject(owner, params) {
         fromControlChannel: params.fromControlChannel,
     });
 }
+function agentFullAccessMenuSubject(subject, source) {
+    return {
+        ...subject,
+        agentFullAccessManagement: source === 'control'
+            ? subject.agentFullAccessManagement === true
+            : source === 'menu'
+                && subject.channelType === 'aun'
+                && !subject.fromControlChannel
+                && subject.canApprovePersistentFullAccess === true
+                && subject.processRole === 'daemon-owner',
+    };
+}
 async function authorizeMenuIntent(params) {
     const { intent, identity, session, channel, channelId, userId, fromControlChannel } = params;
     if (!intent)
@@ -1719,8 +1731,8 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
         if (!selfAid)
             throw { code: 'FORBIDDEN', message: '当前 channel 无绑定 agent' };
         const res = this.agentApplicationService
-            ? await execAgentQuery({ aid: selfAid }, this.agentApplicationService, subject)
-            : await execAgentQuery({ aid: selfAid }, undefined, subject);
+            ? await execAgentQuery({ aid: selfAid }, this.agentApplicationService, agentFullAccessMenuSubject(subject, source))
+            : await execAgentQuery({ aid: selfAid }, undefined, agentFullAccessMenuSubject(subject, source));
         if ('error' in res)
             throw { code: res.code, message: res.error };
         const ag = res.data;
@@ -2286,8 +2298,8 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (fromControlChannel) {
             if (args?.aid) {
                 return this.agentApplicationService
-                    ? await execAgentQuery(args, this.agentApplicationService, subject)
-                    : await execAgentQuery(args, undefined, subject);
+                    ? await execAgentQuery(args, this.agentApplicationService, agentFullAccessMenuSubject(subject, source))
+                    : await execAgentQuery(args, undefined, agentFullAccessMenuSubject(subject, source));
             }
             return this.agentApplicationService
                 ? await execAgentOptions(args, this.agentApplicationService)
@@ -2297,8 +2309,8 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (!selfAid)
             return { error: '当前 channel 无绑定 agent', code: 'FORBIDDEN' };
         return this.agentApplicationService
-            ? await execAgentQuery({ ...(args ?? {}), aid: selfAid }, this.agentApplicationService, subject)
-            : await execAgentQuery({ ...(args ?? {}), aid: selfAid }, undefined, subject);
+            ? await execAgentQuery({ ...(args ?? {}), aid: selfAid }, this.agentApplicationService, agentFullAccessMenuSubject(subject, source))
+            : await execAgentQuery({ ...(args ?? {}), aid: selfAid }, undefined, agentFullAccessMenuSubject(subject, source));
     }
     // ── /gateway 查询（只读，列出全部作用域的网关配置；apiKey 已掩码） ──
     if (cmdBase === '/gateway') {
@@ -2944,6 +2956,8 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             const config = value === true
                 ? { enabled: true, idleSeconds: args?.idleSeconds ?? DEFAULT_SESSION_LOOP_SECONDS }
                 : { enabled: false };
+            if (config.enabled)
+                this.assertSessionLoopTrigger(current.session);
             return { data: sessionLoopPayload(writeSessionLoopConfig(this.sessionManager, current, config)) };
         }
         catch (error) {
@@ -3705,7 +3719,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 }
             }
         }
-        return await execAgentAction(action, a, userId ?? '', this.eventBus, this.agentApplicationService, subject);
+        return await execAgentAction(action, a, userId ?? '', this.eventBus, this.agentApplicationService, agentFullAccessMenuSubject(subject, source));
     }
     // ── 关系级 /trigger（不走 owners；复用 isAdmin + scoped 逻辑，D4 直调底层） ──
     if (cmdBase === '/trigger') {
@@ -4820,6 +4834,7 @@ async function execMenuForSystemControl(payload, context) {
             : undefined,
     });
     const trustedIdentity = trustedSubject.identity;
+    trustedSubject.agentFullAccessManagement = context.source === 'control' && context.authMethod === 'daemon-owner';
     const cmd = name ? (menuCommandForName(name) ?? payload.cmd) : payload.cmd;
     if (payload?.type === 'menu.action'
         && menuCommandToken(cmd) === '/system'

package/dist/core/command/menu-protocol.js

@@ -470,6 +470,7 @@ const STABLE_CODES = new Set([
     'RESPONSE_TOO_LARGE',
     'ACTIVITY_NOT_FOUND', 'ACTIVITY_EXPIRED',
     'TOPIC_SESSION_NOT_FOUND', 'TOPIC_SESSION_LOOKUP_FAILED',
+    'LOOP_TRIGGER_NOT_FOUND', 'LOOP_TRIGGER_DISABLED', 'LOOP_TRIGGER_INVALID',
     'ROOT_NOT_FOUND', 'ROOT_FORBIDDEN', 'ROOT_EXPIRED', 'ROOT_SCOPE_MISMATCH', 'ROOT_PEER_MISMATCH',
     'INVALID_ROOT_ID', 'MISSING_ROOT_ID', 'INVALID_ROOT_PATH', 'NOT_A_DIRECTORY', 'FILE_TOO_LARGE',
 ]);

package/dist/core/command/slash-handler.js

@@ -603,6 +603,8 @@ export async function handleSlashCommand(content, channel, channelId, sendMessag
         }
         try {
             const latest = await refreshSessionLoopTarget(this.sessionManager, route, target);
+            if (next.enabled)
+                this.assertSessionLoopTrigger(latest.session);
             const updated = writeSessionLoopConfig(this.sessionManager, latest, next);
             const payload = sessionLoopPayload(updated);
             if (this.shouldSuppressCardTriggerResult(source, channel))

package/dist/core/daemon-bootstrap.js

@@ -4,7 +4,7 @@ import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { AUNChannel } from '../channels/aun.js';
 import { BindService } from '../utils/aid-bind.js';
-import { commandExists } from '../utils/cross-platform.js';
+import { detectBaseagentDetails } from '../agents/baseagent-availability.js';
 import { logger } from '../utils/logger.js';
 import { remoteAccessService } from './auth/remote-access-store.js';
 import { IpcServer } from '../ipc.js';
@@ -13,12 +13,9 @@ import { controlReplyContext } from './message/outbound.js';
 import { TriggerDefinitionManager } from '../trigger/manager.js';
 import { seedUpgradeCheckTrigger } from '../trigger/system-definitions.js';
 export function detectAvailableBaseagents() {
-    const out = [];
-    for (const command of ['claude', 'gemini', 'codex']) {
-        if (commandExists(command))
-            out.push(command);
-    }
-    return out;
+    // 与 init/ECWeb 的探测保持同一判据；claude 在这里也走内置二进制，
+    // 不再只看 PATH——否则 daemon 会对外声明一个实际跑不起来的 baseagent。
+    return detectBaseagentDetails().filter(item => item.detected).map(item => item.id);
 }
 export async function runBindBootstrapDaemon(daemonCfg) {
     logger.warn('[daemon-bootstrap] starting control AID + IPC only');

package/dist/core/file-integrity/read.js

@@ -0,0 +1,61 @@
+// 读取受台账保护的文件，并按调用方策略决定是否校验。
+//
+// 为什么要有这一层：ECK 文档和技能文件的读取走 FileCache，`on-reload` 策略下
+// 缓存命中时根本不会碰磁盘。篡改发生在首次读盘之后时，只看盘上字节是发现不了的；
+// 所以这里校验的是**将要被使用的那份内容**（缓存里的或刚读到的），
+// 让读到的内容就是校验过的内容（TOCTOU）。
+import fs from 'fs';
+import path from 'path';
+import { kitsDir } from '../../paths.js';
+import { logger } from '../../utils/logger.js';
+import { verifyFile } from './store.js';
+/**
+ * 判断一个路径是否属于随包发布的内容（`kits/`）。
+ *
+ * 只有随包发布的东西才该建立基线：它们在开发仓里由 agent 随手改、打包后应当冻结。
+ * `$EVOLCORE_HOME` 下的运行时数据不能套用这套语义——那些文件本来就是给用户和
+ * CLI 改的，一旦校验就会把合法修改回滚掉。
+ */
+export function isShippedPath(filePath) {
+    const kits = path.resolve(kitsDir());
+    const target = path.resolve(filePath);
+    const rel = path.relative(kits, target);
+    return rel !== '' && !path.isAbsolute(rel) && rel !== '..' && !rel.startsWith(`..${path.sep}`);
+}
+/**
+ * 返回可用于本次注入的文档内容。
+ *
+ * 返回 null 有三种情况，调用方都应拒绝使用该文档（本函数已记日志）：
+ * - 文件不存在或读不出来
+ * - sha 与台账不符、且快照也损坏，恢复不了
+ *
+ * 台账无记录时按设计用本次读到的内容自动登记，视为 verified（安装模式首次加载建基线）。
+ */
+export function readVerifiedText(filePath, opts) {
+    const tag = opts.tag ?? 'file-integrity';
+    if (!opts.verify) {
+        try {
+            return { text: fs.readFileSync(filePath, 'utf-8'), status: 'unverified' };
+        }
+        catch (err) {
+            logger.warn(`[${tag}] read failed path=${filePath} ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    }
+    const restoreOnFail = opts.restoreOnFail ?? true;
+    const result = verifyFile(filePath, { restoreOnFail });
+    if (result.status === 'missing') {
+        logger.warn(`[${tag}] missing path=${filePath}`);
+        return null;
+    }
+    if (!result.bytes) {
+        // 要求恢复却没恢复成功：只有 expected/actual，没有 bytes
+        logger.error(`[${tag}] tampered-and-unrecoverable path=${filePath} expected=${result.expected} actual=${result.actual}`);
+        return null;
+    }
+    if (result.status === 'restored') {
+        logger.warn(`[${tag}] restored path=${filePath}`);
+        return { text: result.bytes.toString('utf-8'), status: 'restored' };
+    }
+    return { text: result.bytes.toString('utf-8'), status: 'verified' };
+}