evolcore 0.0.33 → 0.0.35-test.0

package/dist/core/permission/tool-policy.js

@@ -7,6 +7,7 @@ import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsAgentScopeReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
 import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseBoundedOutputShellCommand, parseShellApplyPatchInvocation, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
+import { applyPatchChangePaths, collectFileChangePaths } from './tool-canonical.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
     const raw = typeof env.TMPDIR === 'string' ? env.TMPDIR.trim() : '';
@@ -1438,32 +1439,41 @@ function globReadScope(input, options) {
         ? resolveProtectedCandidate(prefix || path.parse(pattern).root)
         : resolveProtectedCandidate(prefix || '.', base);
 }
-function protectedReadToolStaysInWorkspace(toolName, input, projectPath) {
+function protectedReadToolStaysInWorkspace(toolName, input, projectPath, grantedRoots = [], excludeWorkspace = false) {
     const workspace = resolveProtectedCandidate(projectPath);
+    // A granted root is an explicitly authorized read boundary for this session
+    // (see session-path-grants.ts). Bash already honours its own managed temp
+    // root; read tools must honour the same table or a session cannot read
+    // files the policy layer granted it.
+    // excludeWorkspace：系统会话的 cwd 只用于解析相对路径，本身不是可读根。
+    const withinBoundary = (candidate) => (!excludeWorkspace && isSameOrDescendant(candidate, workspace))
+        || grantedRoots.some(root => isSameOrDescendant(candidate, root));
     if (toolName === 'Read') {
         if (typeof input.file_path !== 'string' || !input.file_path)
             return false;
-        return isSameOrDescendant(resolveProtectedCandidate(input.file_path, projectPath), workspace);
+        return withinBoundary(resolveProtectedCandidate(input.file_path, projectPath));
     }
     if (toolName === 'Grep') {
         const scope = typeof input.path === 'string' && input.path ? input.path : '.';
-        return isSameOrDescendant(resolveProtectedCandidate(scope, projectPath), workspace);
+        return withinBoundary(resolveProtectedCandidate(scope, projectPath));
     }
     if (toolName === 'Glob') {
         const baseValue = typeof input.path === 'string' && input.path ? input.path : '.';
         const base = resolveProtectedCandidate(baseValue, projectPath);
-        if (!isSameOrDescendant(base, workspace))
+        if (!withinBoundary(base))
             return false;
         const scope = globReadScope(input, { cwd: projectPath });
-        return isSameOrDescendant(scope, workspace);
+        return withinBoundary(scope);
     }
     return true;
 }
-function readonlyShellStaysInWorkspace(analysis, projectPath, managedTempDir) {
+function readonlyShellStaysInWorkspace(analysis, projectPath, readRoots = [], excludeWorkspace = false) {
     if (analysis.kind !== 'proven-readonly')
         return false;
     const workspace = resolveProtectedCandidate(projectPath);
-    const managedTemp = managedTempDir ? resolveProtectedCandidate(managedTempDir) : undefined;
+    const roots = readRoots
+        .filter(root => typeof root === 'string' && path.isAbsolute(root))
+        .map(root => resolveProtectedCandidate(root));
     return analysis.ir.pipelines.flatMap(pipeline => pipeline.flatMap(command => command.pathOperands.map(operand => ({
         operand,
         accessKind: command.accessKind ?? (operand.access === 'recursive' ? 'enumerate' : 'content'),
@@ -1471,8 +1481,8 @@ function readonlyShellStaysInWorkspace(analysis, projectPath, managedTempDir) {
         const candidate = accessKind === 'metadata' && operand.access === 'exact'
             ? resolveProtectedCandidateWithoutFinalSymlink(operand.value, projectPath)
             : resolveProtectedCandidate(operand.value, projectPath);
-        return isSameOrDescendant(candidate, workspace)
-            || (!!managedTemp && isSameOrDescendant(candidate, managedTemp));
+        return (!excludeWorkspace && isSameOrDescendant(candidate, workspace))
+            || roots.some(root => isSameOrDescendant(candidate, root));
     })());
 }
 const READONLY_SOURCE_ROOTS = new Set([
@@ -1571,10 +1581,15 @@ export function checkReadonly(toolName, input, projectPath, context) {
         'Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch',
         'TaskList', 'TaskGet', 'ToolSearch',
     ]);
+    // 会话私有临时根在授权表之外恒为可读：runner 自己的临时产物都落在这里。
+    const grantedRoots = [...new Set([
+            ...(context?.grantedReadRoots ?? []),
+            ...(context?.managedTempDir ? [context.managedTempDir] : []),
+        ])];
     if (readOnlyTools.has(toolName)) {
         const paths = protectedReadToolPaths(toolName, input);
         const pathOptions = { cwd: projectPath, root: context?.root, selfAid: context?.selfAid };
-        if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
+        if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath, grantedRoots, context?.excludeWorkspace === true)) {
             return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
         }
         const directHPath = paths.find(filePath => containsHClassReference(filePath, pathOptions)
@@ -1626,7 +1641,7 @@ export function checkReadonly(toolName, input, projectPath, context) {
         if (protectedOperands.analysis.kind === 'proven-readonly'
             && !protectedOperands.hClass
             && !protectedOperands.lClass
-            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath, managedTempDir)) {
+            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath, grantedRoots, context?.excludeWorkspace === true)) {
             return { behavior: 'allow' };
         }
         if (protectedOperands.hClass) {
@@ -1816,53 +1831,6 @@ function collectFilesystemWriteGrantPaths(value, output, projectRootSubpaths) {
         }
     }
 }
-function collectExplicitFileChangePaths(record, output) {
-    const explicitPathKeys = ['path', 'filePath', 'file_path', 'movePath', 'move_path', 'destinationPath', 'targetPath'];
-    const hasExplicitPath = explicitPathKeys.some(key => typeof record[key] === 'string');
-    for (const key of explicitPathKeys) {
-        if (typeof record[key] === 'string' && record[key])
-            output.push(record[key]);
-    }
-    if (record.kind && typeof record.kind === 'object') {
-        collectExplicitFileChangePaths(record.kind, output);
-    }
-    return hasExplicitPath;
-}
-function collectFileChangePaths(value, output) {
-    if (Array.isArray(value)) {
-        for (const entry of value) {
-            if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
-                collectExplicitFileChangePaths(entry, output);
-            }
-        }
-        return;
-    }
-    if (!value || typeof value !== 'object')
-        return;
-    const record = value;
-    const hasExplicitPath = collectExplicitFileChangePaths(record, output);
-    // Claude-style inputs are maps keyed by path; Codex v2 uses an array of
-    // records with an explicit path field. Only treat keys as paths for the map
-    // shape so diff text and metadata never become path candidates.
-    if (!hasExplicitPath) {
-        for (const [filePath, change] of Object.entries(record)) {
-            if (filePath !== 'kind' && filePath !== 'type')
-                output.push(filePath);
-            if (change && typeof change === 'object' && !Array.isArray(change)) {
-                collectExplicitFileChangePaths(change, output);
-            }
-        }
-    }
-}
-function applyPatchChangePaths(changes) {
-    const paths = [];
-    for (const change of changes) {
-        paths.push(change.path);
-        if (change.movePath)
-            paths.push(change.movePath);
-    }
-    return paths;
-}
 function applyPatchWorkspaceEscape(changes, context) {
     const workspace = resolveProtectedCandidate(context.workspacePath ?? context.projectPath);
     const managedTempDir = context.managedTempDir
@@ -2066,7 +2034,7 @@ export function checkHClassWrite(toolName, input, context) {
             }
             else if (normalized.includes('/backups/config/') || normalized.includes('/.snapshots/')) {
                 suggestion = '\n\n💡 快照由系统自动管理，请使用：\n' +
-                    '  • 创建快照：ec config snapshot --desc "说明"\n' +
+                    `  • 创建快照：ec config snapshot --desc '<说明>'\n` +
                     '  • 查看历史：ec config history\n' +
                     '  • 恢复快照：ec config restore <version>';
             }
@@ -2346,6 +2314,36 @@ function prepareBoundedOutputInput(input, command, kind, context) {
         reason: kind === 'ec' ? 'ec-command' : 'host-process-command',
     };
 }
+const BASH_RISK_LEVELS = new Set(['低', '中', '高']);
+/**
+ * Bash 调用的 description 必须是「<命令目标描述> [<风险等级>]」。
+ * 只适用于 Bash 工具 schema 带 description 字段的基座（Claude Code、ecagent），
+ * 是调用格式约定而非权限判定，不区分会话类型与 permissionMode。
+ */
+export function checkBashDescription(toolName, input) {
+    if (toolName !== 'Bash')
+        return undefined;
+    const FORMAT_HINT = 'description 格式为「<命令目标描述> [<风险等级>]」，风险等级只能是 [低]、[中]、[高] 之一。示例："查看工作区未提交的改动 [低]"、"安装项目依赖 [中]"、"推送 main 分支到远端 [高]"。这是格式问题，不是权限问题，补全后重试。';
+    const deny = (problem, policyCode) => ({
+        behavior: 'deny',
+        input,
+        message: `Bash 调用被拒：${problem}。${FORMAT_HINT}`,
+        policyCode,
+    });
+    const description = typeof input.description === 'string' ? input.description.trim() : '';
+    if (!description) {
+        return deny('缺少 description，既没有命令目标描述，也没有风险等级标记', 'bash_description_missing');
+    }
+    const tag = description.match(/\[([^[\]]*)\]$/);
+    if (!tag)
+        return deny('description 末尾缺少风险等级标记', 'bash_risk_level_missing');
+    if (!BASH_RISK_LEVELS.has(tag[1]))
+        return deny(`风险等级标记 [${tag[1]}] 无效`, 'bash_risk_level_invalid');
+    if (!description.slice(0, tag.index).trim()) {
+        return deny('description 缺少命令目标描述，只有风险等级标记', 'bash_description_target_missing');
+    }
+    return undefined;
+}
 /** Shared fail-closed preflight used before runner-specific mode and approval handling. */
 export function evaluateToolPreflight(toolName, input, context) {
     let applyPatchFileChanges;
@@ -2602,7 +2600,7 @@ export function evaluateToolPreflight(toolName, input, context) {
                     ? '🔒 EC 命令包含无法安全解析的 PowerShell 展开；临时路径仅支持已登记的当前会话 $env:TMPDIR 或 ${env:TMPDIR}，也可使用完整路径。纯文字请使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令包含未转义的 cmd.exe 展开；请不要使用 %VAR%、!VAR! 或 ^ 转义。cmd.exe 传给 ec 时必须保持原文字面量'
-                        : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';
+                        : '🔒 EC 自由文本参数（正文、--desc、--name、--keywords 等）一律用单引号包住；双引号内的反引号与 $ 会被 shell 展开。正文含单引号时改用 $\'…\' 语法（支持 \\n \\t \\\\ \\\'）。';
                 return {
                     behavior: 'deny',
                     input,
@@ -2612,10 +2610,10 @@ export function evaluateToolPreflight(toolName, input, context) {
             }
             if (ecCommand.issue === 'invalid-quote') {
                 const message = shellDialect === 'powershell'
-                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 也会解释中文弯引号。请按 PowerShell 规则转义，或把消息正文写入当前 $TMPDIR 后使用 --text-from-file'
+                    ? '🔒 EC 命令引号未闭合或存在错误嵌套。Note: PowerShell 把 U+2018/U+2019/U+201A/U+201B 也当引号定界符——正文里出现这四个字符同样会报此错。正文一律用半角单引号（ASCII 0x27）包住，正文内部的半角撇号用 `ʼ`（U+02BC）或 `＇`（U+FF07）代替，或把消息正文写入当前 $TMPDIR 后使用 --text-from-file'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令引号未闭合或存在错误嵌套；cmd.exe carrier 的命令正文请保持一个完整参数，不要用未配对的双引号'
-                        : '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"';
+                        : '🔒 EC 命令引号未闭合或存在错误嵌套。自由文本参数用单引号包住；正文含单引号时改用 $\'…\' 语法，内部用 \\\' 转义，如 $\'it\\\'s fine\'。';
                 return {
                     behavior: 'deny',
                     input,

package/dist/core/relation/peer-identity.js

@@ -1,3 +1,54 @@
+/**
+ * 解析 agent.md 的 YAML frontmatter。
+ *
+ * agent.md 形如：
+ *   ---
+ *   aid: xxx
+ *   type: human
+ *   ...
+ *   ---
+ *   <正文>
+ *
+ * 返回整份 frontmatter（不是只挑 type/name），调用方据此写完整画像。
+ * 文档不合法（无 frontmatter、YAML 解析失败）时返回空对象——身份缓存
+ * 不应因为一个可选的元数据块解析失败而整体失效。
+ */
+export function parseAgentMdFrontmatter(content) {
+    const text = content.replace(/^\uFEFF/, '');
+    const lines = text.split(/\r\n|\n|\r/);
+    if (lines[0]?.trim() !== '---')
+        return {};
+    const end = lines.slice(1).findIndex(line => line.trim() === '---');
+    if (end < 0)
+        return {};
+    try {
+        const parsed = parseYaml(lines.slice(1, end + 1).join('\n'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * 兼容旧缓存文件：字段从 `isAgent` 改名为 `isMachine` 之前写下的
+ * peer-identity.json 只有 isAgent。两者语义相同（type !== 'human'），
+ * 缓存有效期长达 30 天，不能指望靠下一次刷新自然迁移——
+ * 读取时直接归一，缺字段就用旧字段或 type 推出。
+ */
+function normalizeCachedIdentity(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const value = raw;
+    const type = typeof value.type === 'string' ? value.type : 'unknown';
+    const isMachine = typeof value.isMachine === 'boolean'
+        ? value.isMachine
+        : typeof value.isAgent === 'boolean'
+            ? value.isAgent
+            : type !== 'human';
+    return { ...value, type, isMachine, isAgent: isMachine };
+}
 /**
  * PeerIdentityCache - 对端身份缓存管理
  *
@@ -13,6 +64,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as crypto from 'crypto';
+import { parse as parseYaml } from 'yaml';
 import { logger } from '../../utils/logger.js';
 import { agentMdPath } from '../../paths.js';
 /**
@@ -56,7 +108,7 @@ export class PeerIdentityCache {
         const filePath = this.getFilePath(channelType, peerId, agentDir);
         try {
             const content = fs.readFileSync(filePath, 'utf-8');
-            return JSON.parse(content);
+            return normalizeCachedIdentity(JSON.parse(content));
         }
         catch {
             return null;
@@ -87,6 +139,10 @@ export class PeerIdentityCache {
         const cached = this.get(channelType, peerId, agentDir);
         if (!cached)
             return true;
+        // 旧快照缺 metadata（字段补全之前写入）时需要重建一次，否则 30 天内
+        // 都会直接命中缓存，新字段永远补不上。
+        if (cached.source !== 'unknown' && cached.metadata === undefined)
+            return true;
         const effectiveMaxAge = cached.source === 'unknown'
             ? Math.min(maxAgeMs, this.UNKNOWN_CACHE_MAX_AGE_MS)
             : maxAgeMs;
@@ -98,17 +154,28 @@ export class PeerIdentityCache {
      * @param verifiedAt 验签通过时间戳；未验签传 0
      */
     static updateFromAgentMd(channelType, peerId, agentDir, agentMd, verifiedAt, source = 'agentmd') {
-        const typeMatch = agentMd.match(/^type:\s*["']?([^"'\n]+?)["']?\s*$/m);
-        const nameMatch = agentMd.match(/^name:\s*["']?(.+?)["']?\s*$/m);
-        const type = typeMatch?.[1] || 'unknown';
-        const isAgent = type !== 'human';
-        const name = nameMatch?.[1]?.trim();
+        // 保留整份 frontmatter：这份缓存是对端自我声明的完整画像，
+        // 只截取 type/name 会在上游新增字段（exttype/owner/tags/avatar…）时静默丢失。
+        const metadata = parseAgentMdFrontmatter(agentMd);
+        const readString = (key) => {
+            const value = metadata[key];
+            return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+        };
+        const type = readString('type') ?? 'unknown';
+        const isMachine = type !== 'human';
+        const name = readString('name');
+        const exttype = readString('exttype');
+        const owner = readString('owner');
         const agentMdHash = 'sha256:' + crypto.createHash('sha256').update(agentMd, 'utf-8').digest('hex');
         const now = Date.now();
         const identity = {
             aid: peerId,
             type,
-            isAgent,
+            isMachine,
+            isAgent: isMachine,
+            ...(exttype ? { exttype } : {}),
+            ...(owner ? { owner } : {}),
+            metadata,
             name,
             agentMdHash,
             agentMdUpdatedAt: now,
@@ -120,7 +187,7 @@ export class PeerIdentityCache {
         try {
             fs.mkdirSync(path.join(path.dirname(filePath), 'shared'), { recursive: true });
             fs.writeFileSync(filePath, JSON.stringify(identity, null, 2), 'utf-8');
-            logger.debug(`[PeerIdentityCache] Updated: ${channelType}#${peerId} type=${type} isAgent=${isAgent} source=${source}`);
+            logger.debug(`[PeerIdentityCache] Updated: ${channelType}#${peerId} type=${type} isMachine=${isMachine} source=${source}`);
         }
         catch (err) {
             logger.warn(`[PeerIdentityCache] Failed to write cache: ${filePath} err=${err}`);
@@ -146,6 +213,7 @@ export class PeerIdentityCache {
         const identity = {
             aid: peerId,
             type: 'unknown',
+            isMachine: true,
             isAgent: true,
             agentMdHash: '',
             agentMdUpdatedAt: 0,
@@ -188,6 +256,7 @@ export class PeerIdentityCache {
             return {
                 aid: '',
                 type: 'unknown',
+                isMachine: true,
                 isAgent: true,
                 agentMdHash: '',
                 agentMdUpdatedAt: 0,
@@ -212,7 +281,10 @@ export class PeerIdentityCache {
         try {
             logger.debug(`[PeerIdentityCache] Syncing agent.md: ${channelType}#${peerId}`);
             const { agentmdSync } = await import('../../aun/aid/agentmd.js');
-            const invalidated = stale?.lastCheckedAt === 0 || revision > 0;
+            // 缺 metadata 的旧快照（字段补全之前写入的）也要重写一次：
+            // 否则命中 hash 相同分支只会 touch，永远补不上 exttype/owner/metadata。
+            const invalidated = stale?.lastCheckedAt === 0 || revision > 0
+                || (!!stale && stale.source !== 'unknown' && stale.metadata === undefined);
             const result = await agentmdSync(peerId, {
                 store,
                 aunPath: resolvedAunPath,
@@ -222,7 +294,7 @@ export class PeerIdentityCache {
             if ((this.invalidationRevisions.get(cachePath) ?? 0) !== revision) {
                 // A newer event arrived during this read. Its next lookup must refresh.
                 return this.get(channelType, peerId, agentDir) ?? {
-                    aid: peerId, type: 'unknown', isAgent: true, agentMdHash: '', agentMdUpdatedAt: 0,
+                    aid: peerId, type: 'unknown', isMachine: true, isAgent: true, agentMdHash: '', agentMdUpdatedAt: 0,
                     verifiedAt: 0, lastCheckedAt: 0, source: 'unknown',
                 };
             }
@@ -241,10 +313,13 @@ export class PeerIdentityCache {
             if (!verified) {
                 logger.info(`[PeerIdentityCache] agent.md unverified for ${peerId}: status=${result.verification?.status ?? 'unknown'} reason=${result.verification?.reason ?? '-'} (type 仍按声明解析)`);
             }
-            // 3. 比较 hash，内容与可信级别都未变时仅 touch
+            // 3. 比较 hash，内容与可信级别都未变时仅 touch。
+            //    例外：旧快照若缺 metadata（字段补全之前写入），必须重写一次，
+            //    否则这里每次都走 touch，新字段永远补不上。
             const newHash = 'sha256:' + crypto.createHash('sha256').update(content, 'utf-8').digest('hex');
             const cached = this.get(channelType, peerId, agentDir);
-            if (cached && cached.agentMdHash === newHash && cached.source === source) {
+            if (cached && cached.agentMdHash === newHash && cached.source === source
+                && cached.metadata !== undefined) {
                 return this.touchLastChecked(channelType, peerId, agentDir, cached);
             }
             return this.updateFromAgentMd(channelType, peerId, agentDir, content, verified ? Date.now() : 0, source);

package/dist/core/role/runtime-policy.js

@@ -147,13 +147,17 @@ export function validateRuntimeStringFieldOverride(input) {
  * Resolve the Agent-level host execution policy for one authenticated principal.
  * The Agent flag is independent of role permissionMode values.
  */
+export function isAgentFullAccessOwner(agentAid, principalId) {
+    if (!principalId)
+        return false;
+    const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });
+    return config?.owners?.includes(principalId) === true
+        && loadDaemonConfig().owners?.includes(principalId) === true;
+}
 export function agentFullAccessStatus(agentAid, principalId) {
     const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });
-    const daemon = loadDaemonConfig();
     const enabled = config?.fullaccess?.enabled === true;
-    const eligible = !!principalId
-        && !!config?.owners?.includes(principalId)
-        && !!daemon.owners?.includes(principalId);
+    const eligible = isAgentFullAccessOwner(agentAid, principalId);
     return { enabled, eligible, effective: enabled && eligible };
 }
 /** Create a trusted per-call claim for a direct private message. */
@@ -189,13 +193,20 @@ export function assertAgentPolicyAuthorization(authorization) {
         throw new Error('Agent fullaccess policy disabled or current owner is no longer eligible');
     }
 }
-/** Only the authenticated EC Web Agent settings may mutate this policy. */
-export function agentFullAccessWriteError(input) {
-    if (!input.ecwebManagement) {
-        return 'Agent fullaccess can only be configured from ECWeb';
+/** Only authenticated ECWeb management or a direct double-Owner Menu request may mutate this policy. */
+export function agentFullAccessWriteError(agentAid, subject) {
+    if (subject?.ecwebManagement === true) {
+        if (!subject.isDaemonOwner || subject.canApprovePersistentFullAccess === false || subject.chatType !== 'private') {
+            return 'Only authenticated ECWeb management may configure Agent fullaccess';
+        }
+        return undefined;
     }
-    if (!input.daemonOwner || input.delegated) {
-        return 'Only authenticated ECWeb management may configure Agent fullaccess';
+    if (subject?.agentFullAccessManagement !== true
+        || subject.chatType !== 'private'
+        || !subject.isDaemonOwner
+        || subject.processRole !== 'daemon-owner'
+        || !isAgentFullAccessOwner(agentAid, subject.principalId)) {
+        return 'Agent fullaccess requires a direct Menu request from both the target Agent Owner and daemon Owner';
     }
     return undefined;
 }

package/dist/core/session/session-fs-store.js

@@ -178,6 +178,111 @@ export function appendJsonlDurable(filePath, record) {
         fs.closeSync(fd);
     }
 }
+/**
+ * meta_*.jsonl（含 `_threads/`）是快照日志：每行一份完整 Session，只有最后一行是权威状态，
+ * 之前的行只供排障回看。超过 256KB 压到最近 50 行。
+ */
+export const SESSION_META_COMPACT_POLICY = {
+    maxBytes: 256 * 1024,
+    keepLines: 50,
+};
+/**
+ * 从 [0, endExclusive) 区间由后往前逐行产出（不含换行符，含空行）。
+ * 按 64KB 分块倒读，内存只与单行长度相关，与文件大小无关。
+ */
+function* iterateLinesBackward(fd, endExclusive, filePath) {
+    const chunkSize = 64 * 1024;
+    let cursor = endExclusive;
+    let carry = Buffer.alloc(0);
+    while (cursor > 0) {
+        const start = Math.max(0, cursor - chunkSize);
+        const chunk = readExactAt(fd, cursor - start, start, filePath);
+        const buf = carry.length ? Buffer.concat([chunk, carry]) : chunk;
+        let end = buf.length;
+        let newline = buf.lastIndexOf(0x0a, end - 1);
+        while (newline >= 0) {
+            yield buf.subarray(newline + 1, end);
+            end = newline;
+            newline = end > 0 ? buf.lastIndexOf(0x0a, end - 1) : -1;
+        }
+        carry = Buffer.from(buf.subarray(0, end));
+        cursor = start;
+    }
+    if (carry.length)
+        yield carry;
+}
+/**
+ * 快照日志的尾部压缩：文件超过 policy.maxBytes 时，只保留最近 keepLines 行
+ * （且不超过 maxBytes/2 字节，至少保留最后一行），写 tmp → fsync → rename 覆盖。
+ *
+ * - 保留行按字节原样拷贝，不解析，坏的末行仍交给读取方报错，不在这里被掩盖。
+ * - 末尾未以换行结束（崩溃残留或有人正在写）时不压缩，留给下次 append 的尾部修复。
+ * - rename 前复查文件大小，期间有其他进程追加则放弃本次压缩，避免吞掉新写入的行。
+ * - 直接 rename 覆盖，不先 unlink，不留目标文件缺失的窗口给并发读者。
+ *
+ * @returns 是否实际做了压缩。失败时抛错，原文件保持不变。
+ */
+export function compactJsonlTail(filePath, policy) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, 'r');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    let output;
+    let size;
+    try {
+        size = fs.fstatSync(fd).size;
+        if (size <= policy.maxBytes)
+            return false;
+        if (readExactAt(fd, 1, size - 1, filePath)[0] !== 0x0a)
+            return false;
+        const budget = Math.floor(policy.maxBytes / 2);
+        const kept = [];
+        let keptBytes = 0;
+        for (const line of iterateLinesBackward(fd, size - 1, filePath)) {
+            if (line.toString('utf8').trim() === '')
+                continue;
+            if (kept.length > 0 && (kept.length >= policy.keepLines || keptBytes + line.length + 1 > budget))
+                break;
+            kept.push(Buffer.from(line));
+            keptBytes += line.length + 1;
+        }
+        if (keptBytes >= size)
+            return false;
+        output = Buffer.concat(kept.reverse().flatMap(line => [line, Buffer.from('\n')]));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const tmpPath = filePath + '.compact.tmp';
+    const tmpFd = fs.openSync(tmpPath, 'w');
+    try {
+        writeAllSync(tmpFd, output);
+        fs.fsyncSync(tmpFd);
+    }
+    finally {
+        fs.closeSync(tmpFd);
+    }
+    try {
+        if (fs.statSync(filePath).size !== size) {
+            fs.unlinkSync(tmpPath);
+            return false;
+        }
+        fs.renameSync(tmpPath, filePath);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(tmpPath);
+        }
+        catch { /* best effort */ }
+        throw error;
+    }
+    return true;
+}
 function writeAllSync(fd, content) {
     let offset = 0;
     while (offset < content.length) {
@@ -323,12 +428,24 @@ export function readJsonFile(filePath) {
         throw e;
     }
 }
+/**
+ * 宽松读取最后一条可解析记录：从尾部倒读，跳过空行和坏行（含未终止的尾行）。
+ * 开销只与末尾几行有关，不随文件大小增长。
+ */
 export function readLastJsonlLine(filePath) {
+    let fd;
     try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const lines = content.trimEnd().split('\n');
-        for (let i = lines.length - 1; i >= 0; i--) {
-            const line = lines[i].trim();
+        fd = fs.openSync(filePath, 'r');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+    try {
+        const size = fs.fstatSync(fd).size;
+        for (const raw of iterateLinesBackward(fd, size, filePath)) {
+            const line = raw.toString('utf8').trim();
             if (!line)
                 continue;
             try {
@@ -340,10 +457,8 @@ export function readLastJsonlLine(filePath) {
         }
         return undefined;
     }
-    catch (e) {
-        if (e.code === 'ENOENT')
-            return undefined;
-        throw e;
+    finally {
+        fs.closeSync(fd);
     }
 }
 export function readAllJsonlLines(filePath) {