evolcore 0.0.37 → 0.0.39

package/dist/core/ownership/owner-resolver.js

@@ -117,7 +117,12 @@ export class OwnerResolver {
                 if (subject.client !== client || subject.generation !== generation)
                     return;
                 const record = this.record(payload);
-                if (!record || record.sub_aid !== subjectAid)
+                if (!record)
+                    return;
+                this.trackBindingRequest(subjectAid, subject, event, record);
+                // When this AID is the prospective owner, the request concerns the
+                // remote sub's ownership, not this AID's own Owner authorization.
+                if (record.sub_aid !== subjectAid)
                     return;
                 if (typeof record.operation_id === 'string') {
                     const key = JSON.stringify([event, record.operation_id, record.step, record.status,
@@ -215,6 +220,9 @@ export class OwnerResolver {
             clearTimeout(subject.pendingRefreshTimer);
         subject.pendingRefreshTimer = undefined;
         subject.taskEvents.clear();
+        subject.requests.clear();
+        subject.decisionTasks.clear();
+        delete subject.view.decisionTask;
         for (const subscription of subject.subscriptions.splice(0)) {
             try {
                 subscription.unsubscribe();
@@ -275,6 +283,7 @@ export class OwnerResolver {
     snapshot(subjectAid) {
         const subject = this.subject(subjectAid);
         const view = JSON.parse(JSON.stringify(subject.view));
+        view.requests = [...subject.requests.values()].map(request => ({ ...request }));
         if (view.consensusStatus === 'consensus' && !this.owner(subjectAid)) {
             view.ownerAid = undefined;
             view.synchronization = { status: 'unavailable' };
@@ -421,6 +430,52 @@ export class OwnerResolver {
                 subject.binding = undefined;
         }
     }
+    async decide(subjectAid, operationId, decision, reason) {
+        this.assertLocalSubject(subjectAid);
+        const subject = this.subject(subjectAid);
+        const client = subject.client;
+        if (!client || !subject.view.connected) {
+            throw new OwnershipError('SUBJECT_UNAVAILABLE', 'Subject AID SDK client is not ready');
+        }
+        const request = subject.requests.get(operationId) ?? subject.decisionTasks.get(operationId);
+        if (!request) {
+            throw new OwnershipError('REQUEST_NOT_FOUND', 'No SDK-verified binding request matches this operation ID; use bind status');
+        }
+        const generation = subject.generation;
+        logger.info(`[ownership] ${decision} requested local=${subjectAid} operationId=${operationId}`);
+        try {
+            // The SDK revalidates the stored request, decision and current relation
+            // before any protocol mutation; this projection is only a discovery aid.
+            const result = decision === 'accept'
+                ? await client.acceptOwnershipRequest(operationId)
+                : await client.rejectOwnershipRequest(operationId, reason);
+            if (subject.client !== client || subject.generation !== generation) {
+                throw new OwnershipError('CLIENT_REPLACED', 'Subject SDK client changed during approval; query status before retrying');
+            }
+            const task = this.bindingTask(result);
+            if (!task || !this.sameBindingTask(task, request)) {
+                throw new OwnershipError('TASK_MISMATCH', 'SDK returned a different ownership decision task');
+            }
+            subject.view.decisionTask = task;
+            subject.decisionTasks.set(operationId, task);
+            subject.requests.delete(operationId);
+            if (request.sub_aid === subjectAid) {
+                this.invalidate(subject, 'Binding decision submitted; fresh consensus is required');
+                this.schedule(subjectAid, subject);
+            }
+            logger.info(`[ownership] ${decision} result ${JSON.stringify(task)}`);
+            if (task.status === 'error' || task.status === 'stopped' || (decision === 'accept' && task.status === 'rejected')) {
+                throw Object.assign(new OwnershipError(task.code ?? 'OWNERSHIP_DECISION_FAILED', task.reason ?? `Ownership task ${task.status}`), { retryable: task.retryable });
+            }
+            return this.snapshot(subjectAid);
+        }
+        catch (error) {
+            logger.warn(`[ownership] ${decision} failed ${JSON.stringify({
+                localAid: subjectAid, operationId, error: error instanceof Error ? error.message : String(error),
+            })}`);
+            throw error;
+        }
+    }
     stop() {
         for (const subjectAid of this.subjects.keys())
             this.detachClient(subjectAid);
@@ -500,7 +555,8 @@ export class OwnerResolver {
         }
         const task = saved?.subjectAid === subjectAid ? this.task(saved.task) : undefined;
         subject = {
-            generation: 0, epoch: 0, query: 0, subscriptions: [], taskEvents: new Set(), persistenceError,
+            generation: 0, epoch: 0, query: 0, subscriptions: [], taskEvents: new Set(),
+            requests: new Map(), decisionTasks: new Map(), persistenceError,
             view: {
                 subjectAid, consensusStatus: 'unavailable', authorizationStatus: 'unavailable', connected: false, revision: 0,
                 task: task?.sub_aid === subjectAid ? task : undefined,
@@ -639,6 +695,69 @@ export class OwnerResolver {
     record(value) {
         return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
     }
+    trackBindingRequest(localAid, subject, event, record) {
+        const task = this.bindingTask(record);
+        if (!task || (task.sub_aid !== localAid && task.owner_aid !== localAid))
+            return;
+        const request = subject.requests.get(task.operation_id);
+        const decisionTask = subject.decisionTasks.get(task.operation_id);
+        if ((request && !this.sameBindingTask(task, request))
+            || (decisionTask && !this.sameBindingTask(task, decisionTask)))
+            return;
+        if (event === 'ownership.request') {
+            const requester = record.requester_aid;
+            const remote = task.sub_aid === localAid ? task.owner_aid : task.sub_aid;
+            if (task.status !== 'pending' || task.step !== 'approval' || requester !== remote || decisionTask)
+                return;
+            subject.requests.set(task.operation_id, {
+                ...task, requester_aid: remote, local_role: task.sub_aid === localAid ? 'sub' : 'owner',
+            });
+            logger.info(`[ownership] inbound binding ${JSON.stringify({
+                localAid, operationId: task.operation_id, subAid: task.sub_aid, ownerAid: task.owner_aid,
+            })}`);
+        }
+        else {
+            const awaitingApproval = task.step === 'approval'
+                && (task.status === 'pending' || (task.status === 'error' && task.retryable === true))
+                && !['ownership.completed', 'ownership.rejected', 'ownership.stopped'].includes(event);
+            if (request && awaitingApproval)
+                subject.requests.set(task.operation_id, { ...request, ...task });
+            else
+                subject.requests.delete(task.operation_id);
+        }
+        const retryableDecision = task.step !== 'approval'
+            && (task.status === 'pending' || (task.status === 'error' && task.retryable === true))
+            && !['ownership.completed', 'ownership.rejected', 'ownership.stopped'].includes(event);
+        if (decisionTask || retryableDecision) {
+            subject.decisionTasks.set(task.operation_id, task);
+            subject.view.decisionTask = task;
+        }
+        else if (subject.view.decisionTask?.operation_id === task.operation_id) {
+            subject.view.decisionTask = task;
+        }
+    }
+    sameBindingTask(left, right) {
+        return left.operation_id === right.operation_id && left.sub_aid === right.sub_aid
+            && left.owner_aid === right.owner_aid && left.base_relation_version === right.base_relation_version
+            && left.target_relation_version === right.target_relation_version;
+    }
+    /** Only public task fields are exposed; raw SDK records remain SDK-owned. */
+    bindingTask(value) {
+        const task = this.task(value);
+        if (!task || !CREATION_BIND_OPERATION_ID.test(task.operation_id) || task.new_owner_aid !== undefined
+            || task.sub_aid === task.owner_aid || !Number.isSafeInteger(task.base_relation_version)
+            || task.base_relation_version < 0 || !Number.isSafeInteger(task.target_relation_version)
+            || task.target_relation_version !== task.base_relation_version + 1)
+            return undefined;
+        return {
+            operation_id: task.operation_id, operation: 'bind', sub_aid: task.sub_aid, owner_aid: task.owner_aid,
+            base_relation_version: task.base_relation_version, target_relation_version: task.target_relation_version,
+            status: task.status, step: task.step,
+            ...(typeof task.code === 'string' ? { code: task.code } : {}),
+            ...(typeof task.reason === 'string' ? { reason: task.reason } : {}),
+            ...(typeof task.retryable === 'boolean' ? { retryable: task.retryable } : {}),
+        };
+    }
     task(value) {
         const record = this.record(value);
         if (!record || typeof record.operation_id !== 'string' || !record.operation_id

package/dist/core/permission/protected-paths.js

@@ -787,6 +787,57 @@ export function compactWindowsCodexFilesystemRules(filesystem, platform = proces
     }
     return compacted;
 }
+/** Remove Linux mount targets already hidden by a read-only parent deny. */
+export function compactCodexLinuxFilesystemRules(filesystem, platform = process.platform) {
+    if (platform !== 'linux')
+        return filesystem;
+    const entries = Object.entries(filesystem);
+    const denyDirectories = entries
+        .filter(([target, access]) => {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(target))
+            return false;
+        try {
+            return fs.lstatSync(target).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    })
+        .map(([target]) => target);
+    if (denyDirectories.length === 0)
+        return filesystem;
+    const exceptionTargets = entries.flatMap(([target, access]) => {
+        if (access !== 'read' && access !== 'write')
+            return [];
+        const globIndex = target.search(CODEX_GLOB_MAGIC);
+        if (globIndex < 0)
+            return [target];
+        const prefix = target.slice(0, target.lastIndexOf('/', globIndex));
+        return prefix ? [prefix] : [];
+    });
+    let compacted;
+    for (const [target, access] of entries) {
+        if (access !== 'deny')
+            continue;
+        const recursive = target.endsWith('/**');
+        const candidate = recursive ? target.slice(0, -3) : target;
+        if (CODEX_GLOB_MAGIC.test(candidate))
+            continue;
+        const covered = denyDirectories.some(parent => {
+            if (candidate === parent)
+                return recursive && target !== parent;
+            return isSameOrDescendant(candidate, parent);
+        });
+        if (!covered)
+            continue;
+        const hasException = exceptionTargets.some(exception => isSameOrDescendant(exception, candidate) || isSameOrDescendant(candidate, exception));
+        if (hasException)
+            continue;
+        compacted ??= { ...filesystem };
+        delete compacted[target];
+    }
+    return compacted ?? filesystem;
+}
 /**
  * Codex 0.154 serializes resolved Windows deny-read targets into a base64
  * command-line argument for codex-windows-sandbox-setup.exe.  Recursive file

package/dist/utils/npm-ops.js

@@ -394,20 +394,36 @@ export async function preparePackageCache(target, registry, options = {}) {
     const run = (args) => new Promise((resolve, reject) => {
         let failure = null;
         let output = '';
+        let errorOutput = '';
         const child = execFile(npm.command, [...npm.argsPrefix, ...args, '--registry', registry, ...npmConfigArgs(options.npmConfig), '--ignore-scripts'], {
             timeout: 180_000, windowsHide: isWindows, signal: options.signal, maxBuffer: 8 * 1024 * 1024,
-        }, (error, stdout) => { failure = error; output = String(stdout ?? ''); });
+        }, (error, stdout, stderr) => {
+            failure = error;
+            output = String(stdout ?? '');
+            errorOutput = String(stderr ?? '');
+        });
         child.once('error', error => { failure = error; });
         child.once('close', code => {
-            if (failure || code !== 0 || options.signal?.aborted)
-                reject(new Error(options.signal?.aborted
-                    ? 'Package cache preparation timed out or was cancelled' : 'npm cache preparation failed; check registry connectivity, credentials, disk space and permissions'));
-            else
+            if (!failure && code === 0 && !options.signal?.aborted) {
                 resolve(output);
+                return;
+            }
+            if (options.signal?.aborted) {
+                reject(new Error('Package cache preparation timed out or was cancelled'));
+                return;
+            }
+            const codeText = failure && 'code' in failure && failure.code ? ` (${String(failure.code)})` : '';
+            const detail = (errorOutput || failure?.stderr || failure?.message || '')
+                .replace(/\s+/g, ' ').trim().slice(0, 500);
+            reject(new Error(`npm cache preparation failed${codeText}${detail ? `: ${detail}` : ''}`));
         });
     });
     options.onPhase?.('downloading');
-    await run(['cache', 'add', spec, '--prefer-offline']);
+    // Revalidate registry metadata before resolving the exact version. A stale
+    // install-v1 packument can otherwise report ETARGET even when the registry
+    // already contains the selected release. The tarball itself remains cached
+    // and is reused when npm can do so.
+    await run(['cache', 'add', spec, '--prefer-online']);
     options.onPhase?.('tarball-check');
     const metadata = JSON.parse(await run(['view', spec, 'name', 'version', 'dist', '--json', '--offline']));
     const [packed] = JSON.parse(await run(['pack', spec, '--dry-run', '--json', '--offline']));

package/dist/utils/welcome.js

@@ -183,36 +183,30 @@ export function parseAgentWelcomeMetadata(content) {
  * 生成统一的欢迎消息文本
  */
 export function generateWelcomeMessage(options) {
-    const channelDesc = getChannelDescription(options.channelType);
     const greeting = options.ownerName
         ? `👋 你好，${options.ownerName}！`
         : '👋 你好！';
     const agentIntro = options.agentName
-        ? `我是 ${options.agentName}，你的 AI Agent 网关。`
-        : '我是您的 AI Agent 网关。';
-    const channelInfo = `已成功连接到${channelDesc}。`;
+        ? `我是 ${options.agentName}，很高兴认识你。`
+        : '我是你的 AI 助手，很高兴认识你。';
     const channelSpecificNote = getChannelSpecificNote(options.channelType);
-    const bindingNote = options.includeBindingNote
-        ? `\n\n🔐 **绑定说明**：\n- 这条消息表示您的设备已和此 Agent 绑定\n- 只有您能看到和使用这个 Agent\n- AUN 提供端到端加密和跨设备同步`
+    // Owner 才会收到：说明可以随时通过对话调整 Agent 的设定
+    const ownerNote = options.includeBindingNote
+        ? '\n\n🎨 我的名字、性格和说话风格都可以由你来定，想调整时直接告诉我。'
         : '';
-    return `🎉 欢迎使用 EvolCore！
+    return `${greeting}
 
-${greeting}
+${agentIntro}有什么需要，直接用平常说话的方式告诉我就行，不用记任何指令。
 
-${agentIntro}${channelInfo}
+我可以帮你：
+- 💬 解答问题、出主意、一起梳理思路
+- 📝 写文案、改文档、整理总结
+- ⏰ 定时提醒、到点跟进事情
+- 🧠 记住你的习惯和偏好，下次不用重复交代${channelSpecificNote}${ownerNote}
 
-📋 **日常使用方法**：
+想看更多玩法，随时发送 /help。
 
-1. **查看帮助**：发送 \`/help\` 查看所有可用命令
-2. **查看状态**：发送 \`/status\` 查看当前会话状态
-3. **会话管理**：发送 \`/session\` 查看和切换会话
-
-💡 **提示**：
-- 直接发送消息即可与 Claude/Codex 对话
-- 支持多会话管理，每个会话独立上下文
-- 所有命令以 \`/\` 开头${channelSpecificNote}${bindingNote}
-
-现在就可以开始工作了！`;
+那我们从哪儿开始？`;
 }
 export function renderPostBootstrapWelcomeMessage(options) {
     const validation = validateWelcomeTemplate(options.template);
@@ -306,15 +300,15 @@ function getChannelDescription(channelType) {
 function getChannelSpecificNote(channelType) {
     switch (channelType) {
         case 'aun':
-            return '\n- AUN 提供端到端加密和跨设备同步';
+            return '';
         case 'feishu':
-            return '\n- 群聊中使用 @机器人 来触发对话';
+            return '\n- 👥 拉我进群，@我 就能一起讨论';
         case 'wechat':
             return '';
         case 'dingtalk':
-            return '\n- 群聊中使用 @机器人 来触发对话';
+            return '\n- 👥 拉我进群，@我 就能一起讨论';
         case 'qqbot':
-            return '\n- 群聊中使用 @机器人 来触发对话';
+            return '\n- 👥 拉我进群，@我 就能一起讨论';
         case 'wecom':
             return '';
         default:

package/kits/docs/evolcore/aid.md

@@ -12,7 +12,11 @@
 ec aid show <当前 self AID> [--format json]
 ec aid lookup <任意合法 AID> [--format json]
 ec aid agentmd get <任意合法 AID> [--format json]
+ec aid bind status [--subject <本地AID>] [--format json]
 # 仅 request / bypass
+ec aid bind <ownerAid> [--subject <本地AID>] [--format json]
+ec aid bind accept <operationId> [--subject <本地AID>] [--format json]
+ec aid bind reject <operationId> [--reason '<原因>'] [--subject <本地AID>] [--format json]
 ec aid agentmd put <当前 self AID> [--format json]
 ec aid agentmd set <当前 self AID> <name|type|description|version|tags> <value> [--format json]
 ec aid avatar <当前 self AID> (--file <path> | --url <https-url>) [--format json]
@@ -33,6 +37,7 @@ init 不等待人工审批、不启动 daemon，也不把该目标写入 `daemon
 容器入口随后启动 daemon，由 SDK 恢复同一任务，审批事件触发新鲜共识核验后才产生协议 Owner 权限。
 
 `bindingStatus` 为 `submitted` 仅表示 SDK 已确认邀约 `message.send` 回执；它不代表 Owner 已审批。
+
 `already_bound` 必须经过当前共识核验。旧版本留下的注册意图会由 SDK 恢复原任务，
 初始化复用原 `operation_id`，不重新注册身份或创建第二个绑定任务。
 提交超时返回 `unknown`，错误结果中的 `initialized: true` 表示配置和控制身份仍然保留；
@@ -40,6 +45,30 @@ init 不等待人工审批、不启动 daemon，也不把该目标写入 `daemon
 相同注册意图复用原 operation_id，不同目标返回冲突，`--force` 不覆盖协议 Owner。
 实现与验证说明见 `docs/init-control-aid-owner-registration.md`。
 
+## 收到绑定邀约后确认或拒绝
+
+先查询接收方本地 AID 的待确认邀约，再按确切的 `operation_id` 作决定：
+
+```bash
+ec aid bind status --subject <接收方本地AID> --format json
+ec aid bind accept <operationId> --subject <接收方本地AID> --format json
+ec aid bind reject <operationId> --subject <接收方本地AID> --reason '用户拒绝' --format json
+```
+
+`--subject` 始终指定执行审批的本地 AID。省略时，独立 CLI 使用 daemon Control AID，托管会话使用当前 self AID。
+例如 B 请求由 A 担任 Owner，在 A 上确认时应选 `--subject A`。A 的状态中 `requests` 展示 SDK 已验证的
+待确认绑定任务，包括 `operation_id`、`sub_aid`、`owner_aid`、`requester_aid`、本端 `local_role` 和关系版本。
+本端既可以是拟任 Owner，也可以是接受 Owner 绑定的 sub；转移、解绑及未验证请求不通过该入口审批。
+
+CLI 经 daemon 已有的 SDK 客户端调用 `acceptOwnershipRequest` / `rejectOwnershipRequest`，不新建连接。
+请求的真实性、当前关系、固定参与方和决定一致性由 SDK 在执行时复核。未处理的邀约保持待审批。
+请求摘要只保存在当前客户端的内存中，daemon 重启或更换客户端后由 SDK 从持久任务重新发出事件恢复。
+
+审批回执的 `decisionTask` 是这次提交决定的任务；`pending` 表示仍在推进，`completed` 表示 SDK 已核验任务完成。
+接受回执本身不授予权限，Owner 权限仍由新鲜 Ownership 共识确定。后续 SDK 事件更新当前进程的 `decisionTask`。
+托管会话审批需要当前 Agent Owner 或 daemon Owner，以及 `request` / `bypass` 任务；admin 仅可查询。
+选择另一个本地 AID 需要 daemon Owner。Fullaccess 执行不额外授予协议绑定或审批权限。
+
 ## Ownership 共识缓存
 
 Agent 的首个配置 Owner 可在该 Agent 的 AUN 私聊中发送纯 `/bind`，由 Agent
@@ -86,6 +115,10 @@ ec aid agentmd put <aid>
 ec aid agentmd get <aid>
 ec aid agentmd set <aid> <name|type|description|version|tags> <value>
 ec aid avatar <aid> (--file <path> | --url <https-url>)
+ec aid bind <ownerAid> [--subject <subjectAid>]
+ec aid bind status [--subject <subjectAid>]
+ec aid bind accept <operationId> [--subject <subjectAid>]
+ec aid bind reject <operationId> [--reason '<text>'] [--subject <subjectAid>]
 
 # 删除指定本地 AID（无网络注销）
 ec aid delete <aid>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",
@@ -54,14 +54,14 @@
     "prepublishOnly": "npm test"
   },
   "dependencies": {
-    "@agentunion/fastaun": "0.5.22",
+    "@agentunion/fastaun": "0.5.23",
     "@anthropic-ai/claude-agent-sdk": "0.3.300",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ajv": "^8.20.0",
     "chokidar": "^5.0.0",
     "cron-parser": "^5.5.0",
     "dotenv": "^17.4.2",
-    "ec-web": "0.0.36",
+    "ec-web": "0.0.39",
     "ignore": "7.0.5",
     "image-type": "^6.0.0",
     "partial-json": "0.1.7",