evolcore 0.0.35 → 0.0.37

package/dist/utils/restart-safety.js

@@ -1,4 +1,54 @@
+import fs from 'fs';
+import path from 'path';
+import { atomicWriteJson } from './atomic-write.js';
 const REAL_RESTART_TEST_OVERRIDE = 'EVOLCORE_ALLOW_REAL_RESTART_IN_TEST';
+export function readRestartRequest(filePath, requestId) {
+    try {
+        const request = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return request?.requestId === requestId ? request : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createRestartRequest(filePath, request, isProcessAlive) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    try {
+        const previous = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        if ([previous.launcherPid, previous.monitorPid]
+            .some(pid => typeof pid === 'number' && isProcessAlive(pid))
+            || Date.now() - Number(previous.updatedAt ?? previous.timestamp ?? 0) < 30_000)
+            return false;
+        fs.rmSync(filePath, { force: true });
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            return false;
+    }
+    try {
+        fs.writeFileSync(filePath, JSON.stringify(request), { flag: 'wx' });
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            return false;
+        throw error;
+    }
+}
+export function updateRestartRequest(filePath, requestId, update) {
+    const request = readRestartRequest(filePath, requestId);
+    if (!request)
+        return false;
+    atomicWriteJson(filePath, { ...request, ...update, updatedAt: Date.now() });
+    return true;
+}
+export function removeRestartRequest(filePath, requestId) {
+    if (!readRestartRequest(filePath, requestId))
+        return;
+    fs.rmSync(filePath, { force: true });
+    fs.rmSync(`${filePath}_`, { force: true });
+    fs.rmSync(`${filePath}__`, { force: true });
+}
 export function isRestartTestRuntime(env = process.env) {
     return env.VITEST === 'true'
         || env.EVOLCORE_TEST === '1';

package/dist/utils/upgrade-jobs.js

@@ -0,0 +1,304 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { daemonControlDir, getPackageRoot, resolvePaths } from '../paths.js';
+import { MAIN_PACKAGE_NAME, RESTART_REQUEST_ID_ENV, RUNTIME_HOME_ENV, SESSION_ID_ENV } from '../product.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { atomicWriteJson, withFileLock } from './atomic-write.js';
+import { isLinkedInstall, preparePackageCache } from './npm-ops.js';
+import { isProcessRunning, launchMonitorAndConfirm, resolveCliEntry } from './cross-platform.js';
+import { scanInstances } from './instance-registry.js';
+import { createRestartRequest, readRestartRequest, removeRestartRequest, shouldSuppressRealRestart, updateRestartRequest } from './restart-safety.js';
+import { refreshManagedPackageVersions, resolveUpgradeDistTag, VERSION_INFO_PACKAGES } from './package-version-info.js';
+const directory = () => path.join(resolvePaths().dataDir, 'upgrade-jobs');
+const jobPath = (jobId) => {
+    if (!/^job_[a-f0-9-]{36}$/.test(jobId))
+        throw new Error('Invalid upgrade jobId');
+    return path.join(directory(), `${jobId}.json`);
+};
+const terminal = (status) => !['accepted', 'running'].includes(status);
+const subscriptions = new Map();
+const blankCheck = (distTag) => ({
+    operation: 'version-check', devMode: isLinkedInstall(), distTag, hasUpdate: null,
+    packages: Object.fromEntries(VERSION_INFO_PACKAGES.map(name => [name, { currentVersion: null, targetVersion: null, checkedAt: null }])),
+});
+export function structuredUpgradeCheck(results, distTag) {
+    const check = blankCheck(distTag);
+    for (const result of results) {
+        check.packages[result.packageName] = {
+            currentVersion: result.entry.currentVersion,
+            targetVersion: result.status === 'ok' ? result.entry.latestVersion ?? null : null,
+            checkedAt: result.status === 'ok' ? result.entry.checkedAt ?? null : null,
+            ...(result.status !== 'ok' && result.entry.checkedAt ? { lastCheckedVersion: result.entry.latestVersion, lastCheckedAt: result.entry.checkedAt } : {}),
+            ...(result.error ? { error: result.error } : {}),
+        };
+    }
+    const core = results.find(result => result.packageName === MAIN_PACKAGE_NAME);
+    check.hasUpdate = core?.status === 'ok' && core.entry.currentVersion ? core.hasUpdate : null;
+    return check;
+}
+export function readUpgradeJob(jobId) {
+    const file = jobPath(jobId);
+    try {
+        const job = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return job.jobId === jobId && Array.isArray(job.events) ? job : null;
+    }
+    catch {
+        return null;
+    }
+}
+function save(job) {
+    atomicWriteJson(jobPath(job.jobId), job);
+}
+export function updateUpgradeJob(jobId, patch, message) {
+    const lock = `${jobPath(jobId)}.lock`;
+    const deadline = Date.now() + 3_000;
+    let descriptor;
+    for (;;) {
+        try {
+            descriptor = fs.openSync(lock, 'wx', 0o600);
+            fs.writeFileSync(descriptor, JSON.stringify({ pid: process.pid }));
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const owner = JSON.parse(fs.readFileSync(lock, 'utf8'));
+                if (Number.isSafeInteger(owner.pid) && !isProcessRunning(owner.pid)) {
+                    fs.rmSync(lock, { force: true });
+                    continue;
+                }
+            }
+            catch { }
+            if (Date.now() >= deadline)
+                throw new Error('Upgrade job state is busy');
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+        }
+    }
+    try {
+        return writeUpgradeJob(jobId, patch, message);
+    }
+    finally {
+        fs.closeSync(descriptor);
+        fs.rmSync(lock, { force: true });
+    }
+}
+function writeUpgradeJob(jobId, patch, message) {
+    const job = readUpgradeJob(jobId);
+    if (!job)
+        return null;
+    if (terminal(job.status) && patch.status && patch.status !== job.status)
+        return job;
+    Object.assign(job, patch, { updatedAt: Date.now() });
+    if (message) {
+        job.seq++;
+        const event = {
+            operation: 'version-check', devMode: job.devMode, distTag: job.distTag, hasUpdate: job.hasUpdate, packages: job.packages,
+            type: 'menu.event', event: terminal(job.status) ? 'upgrade.result' : 'upgrade.progress',
+            requestId: job.requestId, jobId, seq: job.seq, phase: job.phase, at: new Date(job.updatedAt).toISOString(),
+            elapsedMs: job.updatedAt - job.createdAt, message, status: job.status,
+            ...(job.success !== undefined ? { success: job.success } : {}),
+            ...(job.code ? { code: job.code, reason: job.reason } : {}),
+        };
+        job.events = [...job.events.slice(-255), event];
+    }
+    save(job);
+    return job;
+}
+export function upgradeJobView(job) {
+    const { target: _target, npmConfig: _npmConfig, requestKey: _requestKey, scopeKey: _scopeKey, ownerPid: _ownerPid, monitorPid: _monitorPid, launcherPid: _launcherPid, ...view } = job;
+    return view;
+}
+export function subscribeUpgradeJob(jobId, send, key) {
+    if (key)
+        subscriptions.get(key)?.();
+    let seq = 0;
+    let busy = false;
+    const deadline = Date.now() + 6 * 60_000;
+    const stop = () => { clearInterval(timer); if (key && subscriptions.get(key) === stop)
+        subscriptions.delete(key); };
+    const timer = setInterval(() => {
+        if (Date.now() >= deadline) {
+            stop();
+            return;
+        }
+        if (busy)
+            return;
+        busy = true;
+        void (async () => {
+            const job = readUpgradeJob(jobId);
+            if (!job) {
+                stop();
+                return;
+            }
+            for (const event of job.events.filter(item => item.seq > seq)) {
+                await send(event);
+                seq = event.seq;
+                if (event.event === 'upgrade.result')
+                    atomicWriteJson(`${jobPath(jobId)}.ack`, { seq });
+            }
+            if (terminal(job.status))
+                stop();
+        })().catch(() => { stop(); }).finally(() => { busy = false; });
+    }, 200);
+    timer.unref();
+    if (key)
+        subscriptions.set(key, stop);
+    return stop;
+}
+export async function acknowledgeUpgradeRestart(jobId) {
+    const deadline = Date.now() + 2_000;
+    while (Date.now() < deadline) {
+        try {
+            if (JSON.parse(fs.readFileSync(`${jobPath(jobId)}.ack`, 'utf8')).seq >= (readUpgradeJob(jobId)?.seq ?? Infinity))
+                return;
+        }
+        catch { }
+        await new Promise(resolve => setTimeout(resolve, 50));
+    }
+}
+function jobs() {
+    try {
+        return fs.readdirSync(directory()).filter(file => /^job_[a-f0-9-]{36}\.json$/.test(file)).map(file => readUpgradeJob(file.slice(0, -5))).filter((job) => !!job);
+    }
+    catch {
+        return [];
+    }
+}
+export async function startUpgradeJob(requestId, scope) {
+    fs.mkdirSync(directory(), { recursive: true });
+    return withFileLock(path.join(directory(), 'active.lock'), async () => {
+        const existing = jobs();
+        const requestKey = crypto.createHash('sha256').update(JSON.stringify([scope, requestId])).digest('hex');
+        const scopeKey = crypto.createHash('sha256').update(scope).digest('hex');
+        const replay = existing.find(job => job.requestKey === requestKey);
+        if (replay)
+            return { job: replay, reused: true };
+        const monitors = scanInstances().restartMonitors.filter(item => item.alive);
+        for (const job of existing) {
+            const liveMonitor = !!job.monitorPid && isProcessRunning(job.monitorPid);
+            const liveLauncher = !!job.launcherPid && isProcessRunning(job.launcherPid);
+            if (!job.released || liveMonitor || liveLauncher) {
+                if (liveMonitor || liveLauncher || (!job.released && !job.restartRequestId && isProcessRunning(job.ownerPid)) || monitors.length) {
+                    if (job.scopeKey !== scopeKey)
+                        throw Object.assign(new Error('An update is already running for another requester'), { code: 'CONFLICT' });
+                    return { job, reused: true };
+                }
+                updateUpgradeJob(job.jobId, { status: 'failed', success: false, released: true, code: 'UPGRADE_INTERRUPTED', reason: 'Update worker exited before completing the transaction' }, '更新进程已退出，可重新发起');
+            }
+        }
+        if (monitors.length)
+            throw Object.assign(new Error('A restart transaction is still running'), { code: 'CONFLICT' });
+        const now = Date.now();
+        const job = {
+            ...blankCheck(resolveUpgradeDistTag()), jobId: `job_${crypto.randomUUID()}`, requestId, requestKey, scopeKey,
+            status: 'accepted', phase: 'upgrade-check', seq: 0, createdAt: now, updatedAt: now,
+            deadline: now + 5 * 60_000, ownerPid: process.pid, released: false, events: [],
+        };
+        save(job);
+        for (const expired of existing.filter(item => item.released).sort((left, right) => right.updatedAt - left.updatedAt).slice(49)) {
+            for (const suffix of ['', '_', '__', '.ack', '.ack_'])
+                fs.rmSync(`${jobPath(expired.jobId)}${suffix}`, { force: true });
+        }
+        setTimeout(() => { void runUpgradeJob(job).catch(() => { }); }, 50);
+        return { job, reused: false };
+    });
+}
+async function runUpgradeJob(job) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), Math.max(1, job.deadline - Date.now()));
+    let heartbeat;
+    let handedOff = false;
+    try {
+        updateUpgradeJob(job.jobId, { status: 'running' }, '正在检查版本');
+        const results = await refreshManagedPackageVersions(VERSION_INFO_PACKAGES, { distTag: job.distTag, source: 'menu-update', signal: controller.signal, includeUninstalled: true });
+        const check = structuredUpgradeCheck(results, job.distTag);
+        updateUpgradeJob(job.jobId, check, '版本检查完成');
+        if (controller.signal.aborted)
+            throw new Error('Update timed out');
+        if (check.hasUpdate === false) {
+            updateUpgradeJob(job.jobId, { status: 'no-update', success: true, released: true }, '当前 EvolCore 无可升级版本');
+            return;
+        }
+        if (check.hasUpdate === null)
+            throw new Error(check.packages[MAIN_PACKAGE_NAME].error ?? 'Cannot determine the EvolCore target version');
+        if (check.devMode)
+            throw new Error('Linked development installations cannot be updated with npm');
+        const coreResult = results.find(result => result.packageName === MAIN_PACKAGE_NAME);
+        const target = coreResult.entry;
+        updateUpgradeJob(job.jobId, { target, npmConfig: coreResult.npmConfig, phase: 'downloading' }, '正在准备更新包，优先读取 npm 缓存');
+        heartbeat = setInterval(() => {
+            try {
+                updateUpgradeJob(job.jobId, {}, '正在准备更新包，等待 npm 完成');
+            }
+            catch {
+                controller.abort();
+            }
+        }, 1_000);
+        await preparePackageCache(target.latestVersion, target.registry, {
+            signal: controller.signal,
+            npmConfig: coreResult.npmConfig,
+            onPhase: phase => { updateUpgradeJob(job.jobId, { phase }, phase === 'tarball-check' ? '正在校验 npm 缓存包' : '正在下载或复用缓存'); },
+        });
+        clearInterval(heartbeat);
+        heartbeat = undefined;
+        if (controller.signal.aborted)
+            throw new Error('Update timed out');
+        if (shouldSuppressRealRestart())
+            throw new Error('Real restart is disabled in this test runtime');
+        const pending = path.join(daemonControlDir(), 'restart-pending.json');
+        const requestId = crypto.randomUUID();
+        if (!createRestartRequest(pending, {
+            requestId, requesterPid: process.pid, status: 'requested', timestamp: Date.now(), upgradeJobId: job.jobId,
+        }, isProcessRunning))
+            throw new Error('Another restart request is pending');
+        updateUpgradeJob(job.jobId, { restartRequestId: requestId }, '缓存校验通过，正在交由重启监控器处理');
+        const entry = resolveCliEntry(getPackageRoot());
+        const launch = await launchMonitorAndConfirm([...entry.args, 'restart'], {
+            [RUNTIME_HOME_ENV]: resolvePaths().root, [RESTART_REQUEST_ID_ENV]: requestId,
+            [SESSION_ID_ENV]: '', [AGENT_DELEGATION_TOKEN_ENV]: '',
+        }, () => {
+            const request = readRestartRequest(pending, requestId);
+            return request?.status === 'accepted' || request?.status === 'ready';
+        }, () => false, {
+            requestId, timeoutMs: 8_000, logFilePath: path.join(resolvePaths().logs, `restart-launch-${requestId}.log`),
+            onSpawn: pid => { updateRestartRequest(pending, requestId, { launcherPid: pid }); updateUpgradeJob(job.jobId, { launcherPid: pid }); },
+            isPendingInRegistry: () => scanInstances().restartMonitors.some(item => item.alive && item.record.requestId === requestId),
+        });
+        handedOff = launch.ok || launch.pending === true;
+        if (!handedOff) {
+            removeRestartRequest(pending, requestId);
+            throw new Error('Restart monitor did not accept the update; inspect restart launch diagnostics');
+        }
+        while (!terminal(readUpgradeJob(job.jobId)?.status ?? 'failed')) {
+            if (controller.signal.aborted) {
+                removeRestartRequest(pending, requestId);
+                throw new Error('Update timed out before restart acceptance');
+            }
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+    }
+    catch (error) {
+        const current = readUpgradeJob(job.jobId);
+        if (current && !terminal(current.status))
+            updateUpgradeJob(job.jobId, {
+                status: controller.signal.aborted ? 'timeout' : 'failed', success: false, released: true,
+                code: controller.signal.aborted ? 'UPGRADE_TIMEOUT' : 'UPGRADE_FAILED',
+                reason: error instanceof SyntaxError ? 'npm returned invalid package metadata' : sanitizeUpgradeReason(error instanceof Error ? error.message : 'Update failed'),
+            }, '更新未完成，可重新发起');
+    }
+    finally {
+        clearTimeout(timeout);
+        if (heartbeat)
+            clearInterval(heartbeat);
+        if (!handedOff) {
+            const current = readUpgradeJob(job.jobId);
+            if (current?.released === false && terminal(current.status))
+                updateUpgradeJob(job.jobId, { released: true });
+        }
+    }
+}
+export function sanitizeUpgradeReason(reason) {
+    return reason.replace(/https?:\/\/\S+/gi, '[registry]').replace(/(?:token|password|authorization)\s*[:=]\s*\S+/gi, '[redacted]').slice(0, 1_000);
+}

package/dist/utils/windows-autostart.js

@@ -48,7 +48,7 @@ function accessDeniedError(action, result) {
         + '若自启动已由管理员配置且只需确认服务，请执行：ec status。';
 }
 function isTaskNotFoundMessage(message) {
-    return /cannot find the file specified|系统找不到指定的文件|找不到指定的文件|指定的任务不存在|任务不存在/i.test(message);
+    return /cannot find the (?:file|path) specified|系统找不到指定的(?:文件|路径)|找不到指定的(?:文件|路径)|指定的任务不存在|任务不存在/i.test(message);
 }
 function isRegistryValueNotFoundMessage(message) {
     return /unable to find|cannot find|系统找不到|找不到指定的注册表项|找不到指定的文件/i.test(message);
@@ -232,9 +232,9 @@ function taskOwnership(xml, runtimeRoot) {
         : undefined;
     const principalCurrent = principalBlocks.length === 1
         && /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(principalBlocks[0])
-        // schtasks /RL LIMITED can omit RunLevel entirely because
-        // LeastPrivilege is the schema default.
-        && (runLevel === undefined || /^LeastPrivilege$/i.test(runLevel));
+        // The task is intentionally created with /RL HIGHEST so startup can
+        // provision the managed Codex hook and other machine-level requirements.
+        && /^HighestAvailable$/i.test(runLevel ?? '');
     const triggerCurrent = triggerTypes.length === 1 && triggerTypes[0] === 'logontrigger';
     const current = managed
         && normalizeCommandLine(args) === normalizeCommandLine(expectedArgs)
@@ -698,14 +698,23 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
     ];
     const result = runSchtasks(args);
     if (result.status !== 0) {
-        if (isAccessDenied(result) && taskBeforeCreate.state === 'not-found') {
+        const taskError = isAccessDenied(result)
+            ? accessDeniedError('启用', result)
+            : commandError(result, '创建 Windows 登录自启任务失败');
+        // Some Windows installations can query tasks but cannot create one
+        // because Task Scheduler's backing path is unavailable. HKCU Run does
+        // not depend on that path. Only fall back when no existing task is owned.
+        const canUseUserRun = isAccessDenied(result) || isTaskNotFoundMessage(resultOutput(result));
+        if (canUseUserRun && taskBeforeCreate.state === 'not-found') {
             const fallback = createUserRunAutostart(absoluteRoot, scriptPath, wrapperCurrent);
             const fallbackMayBeInstalled = fallback.enabled && fallback.backend === 'user-run';
             const restoreError = restoreWrapperUnlessNeeded(scriptPath, previousWrapper, fallback.ok || fallbackMayBeInstalled || (existingRun.state === 'installed' && existingRun.managed));
             if (fallback.ok) {
                 return {
                     ...fallback,
-                    warning: '任务计划程序拒绝访问，已回退到当前用户 HKCU Run 自启动（无需管理员权限）。如需改用计划任务，请以管理员身份再次运行 ec init --auto-start。',
+                    warning: isAccessDenied(result)
+                        ? '任务计划程序拒绝访问，已回退到当前用户 HKCU Run 自启动（无需管理员权限）。如需改用计划任务，请以管理员身份再次运行 ec init --auto-start。'
+                        : `任务计划程序创建失败：${commandError(result, '找不到指定的文件或路径')}；已回退到当前用户 HKCU Run 自启动（无需管理员权限）。`,
                 };
             }
             const fallbackError = fallback.error ? `；用户级 Run 回退失败：${fallback.error}` : '';
@@ -714,7 +723,7 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
                 ok: false,
                 enabled: fallback.enabled,
                 ...(fallback.backend ? { backend: fallback.backend } : {}),
-                error: `${accessDeniedError('启用', result)}${fallbackError}${rollbackSuffix}`,
+                error: `${taskError}${fallbackError}${rollbackSuffix}`,
             };
         }
         const restoreError = restoreWrapperUnlessNeeded(scriptPath, previousWrapper, taskBeforeCreate.state === 'installed' || (existingRun.state === 'installed' && existingRun.managed));
@@ -728,9 +737,7 @@ export function configureWindowsAutostart(enabled, runtimeRoot) {
             ok: false,
             enabled: previousBackend !== undefined,
             ...(previousBackend ? { backend: previousBackend } : {}),
-            error: `${isAccessDenied(result)
-                ? accessDeniedError('启用', result)
-                : commandError(result, '创建 Windows 登录自启任务失败')}${rollbackSuffix}`,
+            error: `${taskError}${rollbackSuffix}`,
         };
     }
     const verified = probeWindowsTask(absoluteRoot);

package/kits/docs/INDEX.md

@@ -18,6 +18,9 @@
 | 速查表 | `aun/CHEATSHEET.md` | AUN 协议命名空间与常用操作速查 |
 | SDK 文档指引 | `aun/SDK.md` | AUN SDK 文档位置（`$AUN_SDK_DOCS`）、结构与常用入口；四语言版本共用同一份协议文档 |
 | 同步协议 | `aun/SYNC_PROTOCOL.md` | 上游协议同步 SOP |
+| Ability 调用 | `aun/ABILITY_CALLING.md` | AID 能力发现、原始 JSON 调用、ACK/等待、超时和 request 查询 |
+
+EvolCore 能力插件体系的实施设计位于源码仓库 `$PACKAGE_ROOT/docs/ability/plugin-system/README.md`。该设计尚未实现，不是当前可用的 Ability 插件命令手册。
 
 ## EvolCore 命令
 
@@ -28,6 +31,8 @@
 |------|------|------|
 | 命令集目录 | `evolcore/INDEX.md` | msg/group/agent/aid/storage/ctl/rpc/bench 全集索引 |
 | 联系人命令 | `evolcore/contact.md` | Contact Book 添加申请、拉黑与托管会话权限边界 |
+| Agent 生命周期与 Bootstrap | `evolcore/agent-create.md` | 生命周期与新 Agent 首次设定参考；创建者操作已迁移到 `ec-agent-create` 技能 |
+| 群聊协作入口 | `evolcore/group-collaboration.md` | 旧文档入口；完整任务流程已迁移到 `ec-group-collaboration` 技能 |
 
 ## 身份