evolcore 0.0.38 → 0.0.39

package/CHANGELOG.md

@@ -5,6 +5,21 @@
 
 ## Unreleased
 
+## 0.0.39 (2026-10-24)
+
+### Ownership 与 Agent 初始化
+
+- 支持通过 `ec aid bind status` 查看经 SDK 验证的 Ownership 邀约，并按具体操作 ID 接受或拒绝。
+- 按绑定任务上下文校验审批结果，避免处理不相关或已失效的邀约。
+- Bootstrap 会验证本地 `agent.md`；已验签的名片不再重复发布，无效或未签名内容会阻止不安全的重发。
+- 更新 AUN Owner 欢迎文案，更清晰地介绍 Agent 可提供的帮助与个性化设置。
+
+### 权限与兼容性
+
+- 优化 Codex 在 Linux 上的文件权限规则，减少被父目录拒绝规则覆盖的冗余子规则，同时保留必要的读写例外。
+- 将 AUN SDK 最低兼容版本提升至 `0.5.23`，以支持 Ownership 邀约审批。
+- 改进 daemon IPC 连接失败诊断，相关命令现在会保留具体的连接错误信息。
+
 ## 0.0.38 (2026-10-24)
 
 ### npm 升级稳定性

package/dist/agents/codex-runner.js

@@ -6,7 +6,7 @@ import { requestDangerousCommandPermission } from '../core/permission/approval-g
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { isShellToolName } from '../core/permission/tool-canonical.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, getExistingRelationAttachmentDirs, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
+import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, compactCodexLinuxFilesystemRules, getExistingRelationAttachmentDirs, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig, resolveCodexCliPath, resolveCodexPowerShellShimPath, } from './baseagent.js';
 import { logger } from '../utils/logger.js';
@@ -1428,7 +1428,7 @@ export class CodexRunner {
             onlyOtherAgents: true,
         }))
             relationAttachmentDenies[directory] = 'deny';
-        const filesystem = {
+        const filesystem = compactCodexLinuxFilesystemRules({
             ...buildCodexProtectedFilesystemRules(resolveRoot(), {
                 selfAid: this.resolvedConfig.agentAid,
                 denyLClassRead: mode === 'readonly',
@@ -1455,7 +1455,7 @@ export class CodexRunner {
                 [path.join(managedTempDir, 'locks')]: 'write',
                 [path.join(managedTempDir, 'locks') + '/**']: 'write',
             } : {}),
-        };
+        });
         // Codex resolves this complete profile before serializing the Windows
         // helper payload. Check after all runner-owned additions, not merely the
         // protected-path base projection, so Git and managed-temp rules cannot

package/dist/aun/aid/agentmd.js

@@ -538,6 +538,27 @@ function verifyLocal(store, aid, content) {
         return { status: 'invalid', reason: `certificate not available: ${String(e?.message || e).slice(0, 100)}` };
     }
 }
+/** Verify a locally stored agent.md without contacting the AUN gateway. */
+export async function verifyLocalAgentMd(aid, opts = {}) {
+    const aunPath = resolveAgentMdAunPath(opts);
+    const localPath = agentMdPath(aid, aunPath);
+    if (!fs.existsSync(localPath))
+        return { status: 'missing' };
+    const store = opts.store ?? await getAidStore({ slotId: SLOT.cli, aunPath });
+    const ownStore = !opts.store;
+    try {
+        const content = fs.readFileSync(localPath, 'utf-8');
+        const result = verifyLocal(store, aid, content);
+        return { status: result.status, ...(result.reason ? { reason: result.reason } : {}) };
+    }
+    finally {
+        if (ownStore)
+            try {
+                store.close();
+            }
+            catch { /* ignore */ }
+    }
+}
 export async function agentmdGet(aid, opts) {
     const aunPath = resolveAgentMdAunPath(opts);
     const store = opts?.store ?? await getAidStore({ slotId: SLOT.cli, aunPath });

package/dist/aun/aid/client.js

@@ -39,7 +39,7 @@ export function suppressSdkLogs() {
     };
 }
 // ==================== SDK package ====================
-export const MIN_AUN_CORE_SDK = [0, 5, 22];
+export const MIN_AUN_CORE_SDK = [0, 5, 23];
 export const AUN_CORE_SDK_PKG = '@agentunion/fastaun';
 function compareVersion(a, min) {
     const parts = a.split('.').map(n => parseInt(n, 10));

package/dist/aun/aid/ownership-operation.js

@@ -1,6 +1,8 @@
 import { isValidAid } from './validation.js';
 import { ownerResolver, OwnershipError } from '../../core/ownership/owner-resolver.js';
 import { logger } from '../../utils/logger.js';
+import { MAIN_CLI_BIN } from '../../product.js';
+const OWNERSHIP_OPERATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 export function ownershipFailure(error) {
     const details = error && typeof error === 'object' ? error : {};
     return {
@@ -14,22 +16,42 @@ export function ownershipFailure(error) {
 export function parseOwnershipCommand(argv) {
     const args = argv[0] === 'aid' ? argv.slice(1) : [...argv];
     if (args[0] !== 'bind' || !args[1]) {
-        throw new OwnershipError('INVALID_ARGUMENT', 'Use ec aid bind <ownerAid> or ec aid bind status');
+        throw new OwnershipError('INVALID_ARGUMENT', `Use ${MAIN_CLI_BIN} aid bind <ownerAid>, status, accept, or reject`);
     }
-    const action = args[1] === 'status' ? 'status' : 'bind';
+    const action = ['status', 'accept', 'reject'].includes(args[1]) ? args[1] : 'bind';
     if (action === 'bind' && !isValidAid(args[1]))
         throw new OwnershipError('INVALID_AID', 'A valid owner AID is required');
+    if ((action === 'accept' || action === 'reject') && !OWNERSHIP_OPERATION_ID.test(args[2] ?? '')) {
+        throw new OwnershipError('INVALID_OPERATION', 'A valid ownership operation ID is required');
+    }
     let subjectAid;
+    let reason;
     let formatSeen = false;
-    for (let index = 2; index < args.length; index += 2) {
-        if (args[index] === '--subject' && !subjectAid && isValidAid(args[index + 1] ?? ''))
-            subjectAid = args[index + 1];
-        else if (args[index] === '--format' && args[index + 1] === 'json' && !formatSeen)
+    const positionalEnd = action === 'bind' || action === 'status' ? 2 : 3;
+    for (let index = positionalEnd; index < args.length; index += 2) {
+        const flag = args[index];
+        const value = args[index + 1];
+        if (flag === '--subject' && !subjectAid && isValidAid(value ?? '')) {
+            subjectAid = value;
+        }
+        else if (flag === '--format' && value === 'json' && !formatSeen) {
             formatSeen = true;
-        else
-            throw new OwnershipError('INVALID_ARGUMENT', 'Only one --subject <subjectAid> and --format json are supported');
+        }
+        else if (flag === '--reason' && action === 'reject' && reason === undefined
+            && value !== undefined && !value.startsWith('--')) {
+            reason = value;
+        }
+        else {
+            throw new OwnershipError('INVALID_ARGUMENT', 'Supported options are --subject <subjectAid>, --reason <text>, and --format json');
+        }
     }
-    return action === 'status' ? { action, subjectAid } : { action, subjectAid, ownerAid: args[1] };
+    if (action === 'status')
+        return { action, subjectAid };
+    if (action === 'accept')
+        return { action, operationId: args[2], subjectAid };
+    if (action === 'reject')
+        return { action, operationId: args[2], ...(reason !== undefined ? { reason } : {}), subjectAid };
+    return { action, subjectAid, ownerAid: args[1] };
 }
 export async function executeOwnershipCommand(command, defaultSubjectAid) {
     const subjectAid = command.subjectAid ?? defaultSubjectAid;
@@ -39,6 +61,9 @@ export async function executeOwnershipCommand(command, defaultSubjectAid) {
         ownerResolver.assertLocalSubject(subjectAid);
         return ownerResolver.refresh(subjectAid);
     }
+    if (command.action === 'accept' || command.action === 'reject') {
+        return ownerResolver.decide(subjectAid, command.operationId, command.action, command.action === 'reject' ? command.reason : undefined);
+    }
     logger.info(`[ownership] bind requested subject=${subjectAid} owner=${command.ownerAid}`);
     try {
         ownerResolver.assertLocalSubject(subjectAid);

package/dist/cli/agent-create.js

@@ -6,6 +6,7 @@ import { parse } from 'yaml';
 import { resolvePaths, aunPath as defaultAunPath, agentConfig, agentDataDir, agentPersonalDir, aidLocalDir, agentMdPath } from '../paths.js';
 import { loadDefaults, loadAgent, saveAgent, ensureAgentDirSkeleton } from '../config-store.js';
 import { ConfigTarget, write as cfgWrite, ensureFile as cfgEnsure, read as cfgRead } from '../config/config-manager.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { ipcQuery } from '../ipc.js';
 import { CONFIG_SCHEMA_VERSION } from '../types.js';
 import { ensureInitialRoleRegistry } from '../config/role-service.js';
@@ -1220,9 +1221,13 @@ export async function runInitializationCommand(args) {
         return initializationCommandResult(result);
     }
     const request = async (poll) => {
-        return await ipcQuery(resolvePaths().socket, {
+        const { response, transportError } = await queryDaemon(resolvePaths().socket, {
             type: 'evolagent.initialize', argv, poll,
-        }, 10_000) ?? { ok: false, code: 'DAEMON_UNAVAILABLE', error: 'Initialization requires a running daemon' };
+        }, 10_000);
+        return response ?? {
+            ok: false, code: 'DAEMON_UNAVAILABLE',
+            error: daemonUnavailableMessage(transportError, 'Initialization requires a running daemon'),
+        };
     };
     let result = await request(false);
     if (parsed.dryRun)

package/dist/cli/agent.js

@@ -8,6 +8,7 @@ import { initConfigManager } from '../config/config-manager.js';
 import { resolveConfigCommand } from '../config/resolved-config-op.js';
 import { executeResolvedConfigCommandAsync } from '../config/config-operation-service.js';
 import { ipcQuery, IpcTransportError } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { CONFIG_SCHEMA_VERSION } from '../types.js';
 import { ensureInitialRoleRegistry } from '../config/role-service.js';
 import { agentProjectRootFromDefaults, deriveAgentProjectPath } from '../utils/project-path.js';
@@ -30,22 +31,20 @@ export async function runManagedAgentOperation(argv, timeoutMs = 60_000) {
     if (!delegationToken) {
         return { ok: false, code: 'DELEGATION_REQUIRED', error: `${AGENT_DELEGATION_TOKEN_ENV} is not set for the active task` };
     }
-    try {
-        const response = await ipcQuery(resolvePaths().socket, {
-            type: 'agent.op',
-            argv: ['agent', ...argv],
-            sessionId,
-            delegationToken,
-        }, timeoutMs);
-        if (!response)
-            return { ok: false, code: 'DAEMON_UNAVAILABLE', error: 'Unable to connect to the evolcore daemon' };
-        if (!response.ok)
-            return { ok: false, code: response.code, error: response.error || 'agent operation failed', ...(response.data ? { data: response.data } : {}) };
-        return response.result ?? { ok: true, ...(response.data ?? {}) };
-    }
-    catch (error) {
-        return { ok: false, code: 'DAEMON_UNAVAILABLE', error: error instanceof Error ? error.message : String(error) };
-    }
+    const { response, transportError } = await queryDaemon(resolvePaths().socket, {
+        type: 'agent.op',
+        argv: ['agent', ...argv],
+        sessionId,
+        delegationToken,
+    }, timeoutMs);
+    if (!response)
+        return {
+            ok: false, code: 'DAEMON_UNAVAILABLE',
+            error: daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'),
+        };
+    if (!response.ok)
+        return { ok: false, code: response.code, error: response.error || 'agent operation failed', ...(response.data ? { data: response.data } : {}) };
+    return response.result ?? { ok: true, ...(response.data ?? {}) };
 }
 function getAgentMdPath(aid) {
     return getAgentMdPathFromPaths(aid);
@@ -761,29 +760,23 @@ export async function agentReady(aid, commandArgs) {
         };
     }
     const p = resolvePaths();
-    try {
-        const delegationToken = managedSessionId ? readDelegationCredential() : undefined;
-        if (managedSessionId && !delegationToken) {
-            return { ok: false, code: 'DELEGATION_REQUIRED', error: `${AGENT_DELEGATION_TOKEN_ENV} is not set for the active task` };
-        }
-        const result = await ipcQuery(p.socket, {
-            type: 'evolagent.bootstrapComplete',
-            aid,
-            ...(managedSessionId ? { argv: ['agent', ...(commandArgs ?? ['ready', aid])] } : {}),
-            ...(managedSessionId ? { sessionId: managedSessionId, delegationToken } : {}),
-        }, 30_000);
-        if (!result)
-            return { ok: false, code: 'DAEMON_UNAVAILABLE', error: 'Unable to connect to the EvolCore daemon; agent ready requires daemon IPC' };
-        if (!result.ok) {
-            return { ok: false, code: result.code, error: result.error || 'Failed to complete bootstrap' };
-        }
-        return { ...result, ok: true, aid, reloaded: result.reloaded === true };
+    const delegationToken = managedSessionId ? readDelegationCredential() : undefined;
+    if (managedSessionId && !delegationToken) {
+        return { ok: false, code: 'DELEGATION_REQUIRED', error: `${AGENT_DELEGATION_TOKEN_ENV} is not set for the active task` };
     }
-    catch (e) {
+    const { response: result, transportError } = await queryDaemon(p.socket, {
+        type: 'evolagent.bootstrapComplete',
+        aid,
+        ...(managedSessionId ? { argv: ['agent', ...(commandArgs ?? ['ready', aid])] } : {}),
+        ...(managedSessionId ? { sessionId: managedSessionId, delegationToken } : {}),
+    }, 30_000);
+    if (!result)
         return {
-            ok: false,
-            code: 'DAEMON_UNAVAILABLE',
-            error: e instanceof Error ? e.message : 'Unable to connect to the EvolCore daemon',
+            ok: false, code: 'DAEMON_UNAVAILABLE',
+            error: daemonUnavailableMessage(transportError, 'Unable to connect to the EvolCore daemon; agent ready requires daemon IPC'),
         };
+    if (!result.ok) {
+        return { ok: false, code: result.code, error: result.error || 'Failed to complete bootstrap' };
     }
+    return { ...result, ok: true, aid, reloaded: result.reloaded === true };
 }

package/dist/cli/aid-bind-command.js

@@ -2,9 +2,15 @@ import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
 import { parseOwnershipCommand, ownershipFailure } from '../aun/aid/ownership-operation.js';
 import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { MAIN_CLI_BIN } from '../product.js';
 export async function cmdAidBind(args) {
     if (args.includes('--help') || args.includes('-h')) {
-        console.log('用法: ec aid bind <ownerAid> [--subject <subjectAid>] [--format json]\nec aid bind status [--subject <subjectAid>] [--format json]');
+        console.log([
+            `用法: ${MAIN_CLI_BIN} aid bind <ownerAid> [--subject <subjectAid>] [--format json]`,
+            `${MAIN_CLI_BIN} aid bind status [--subject <subjectAid>] [--format json]`,
+            `${MAIN_CLI_BIN} aid bind accept <operationId> [--subject <subjectAid>] [--format json]`,
+            `${MAIN_CLI_BIN} aid bind reject <operationId> [--reason <text>] [--subject <subjectAid>] [--format json]`,
+        ].join('\n'));
         return;
     }
     const formatJson = args.includes('--format') && args[args.indexOf('--format') + 1] === 'json';
@@ -32,6 +38,11 @@ export async function cmdAidBind(args) {
             console.log(`运行态同步: ${state.synchronization.status}`);
             if (state.task)
                 console.log(`绑定任务: ${state.task.operation_id} (${state.task.status}/${state.task.step})`);
+            if (state.decisionTask)
+                console.log(`审批任务: ${state.decisionTask.operation_id} (${state.decisionTask.status}/${state.decisionTask.step})`);
+            for (const request of state.requests ?? []) {
+                console.log(`待确认邀约: ${request.operation_id} (sub=${request.sub_aid}, owner=${request.owner_aid}, 本端=${request.local_role})`);
+            }
             if (state.requestedOwnerAid)
                 console.log(`请求绑定: ${state.requestedOwnerAid}`);
             if (state.requestStatus)

package/dist/cli/aun-commands.js

@@ -4,7 +4,7 @@ import crypto from 'crypto';
 import { agentMdPath, resolvePaths, resolveRoot } from '../paths.js';
 import { isExplicitGroupId, normalizeGroupAid, sameGroupAid } from '../aun/group/index.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
-import { ipcQuery } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { isValidAid as validSendAid } from '../aun/aid/validation.js';
 import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { isManagementRole } from '../config/builtin-roles.js';
@@ -137,14 +137,15 @@ async function runManagedAid(args, formatJson) {
     if (requiresSelfAid && runtime?.selfAid && parsed.command.aid !== runtime.selfAid.replace(/^@/, '')) {
         failManagedAid(formatJson, 'SCOPE_MISMATCH', `托管任务只能操作当前 self AID：${runtime.selfAid}`);
     }
-    const response = await ipcQuery(resolvePaths().socket, {
+    const { response, transportError } = await queryDaemon(resolvePaths().socket, {
         type: 'aid.op',
         argv: ['aid', ...args],
         sessionId,
         delegationToken,
     }, 30_000);
-    if (!response)
-        failManagedAid(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    if (!response) {
+        failManagedAid(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+    }
     if (!response.ok || !response.result) {
         const error = response.error || 'AID operation failed';
         const aid = args[0] === 'agentmd' ? args[2] : args[1];
@@ -220,14 +221,15 @@ async function runManagedGroup(args, formatJson) {
         failManagedGroup(formatJson, parsed.code, parsed.reason);
     const runtime = await readBestTaskRuntimeContext();
     validateManagedGroupScope(parsed.command.from, parsed.command.groupId, runtime, formatJson);
-    const response = await ipcQuery(resolvePaths().socket, {
+    const { response, transportError } = await queryDaemon(resolvePaths().socket, {
         type: 'group.op',
         argv: ['group', ...args],
         sessionId,
         delegationToken,
     }, 60_000);
-    if (!response)
-        failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    if (!response) {
+        failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+    }
     if (!response.ok || !response.result) {
         failManagedGroup(formatJson, response.code || 'GROUP_OPERATION_FAILED', response.error || 'Group operation failed');
     }
@@ -277,14 +279,15 @@ async function runManagedMsg(args, formatJson) {
             failManagedGroup(formatJson, 'SCOPE_MISMATCH', `只能读取当前 AUN 私聊对端：${runtime.channelId}`);
         }
     }
-    const response = await ipcQuery(resolvePaths().socket, {
+    const { response, transportError } = await queryDaemon(resolvePaths().socket, {
         type: 'msg.op',
         argv: ['msg', ...args],
         sessionId,
         delegationToken,
     }, 30_000);
-    if (!response)
-        failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    if (!response) {
+        failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+    }
     if (!response.ok || !response.result) {
         failManagedGroup(formatJson, response.code || 'MSG_OPERATION_FAILED', response.error || 'Msg operation failed');
     }
@@ -469,6 +472,8 @@ Commands:
   avatar <aid> --file <path> | --url <https-url>  上传头像并更新 agent.md
   bind <ownerAid> [--subject <subjectAid>]      发起 Ownership 2.1 绑定
   bind status [--subject <subjectAid>]         核验协议 Owner、任务和同步状态
+  bind accept <operationId> [--subject <subjectAid>]  接受绑定邀约
+  bind reject <operationId> [--reason <text>] [--subject <subjectAid>]  拒绝绑定邀约
 
 Options:
   --format json     输出 JSON 格式
@@ -1159,7 +1164,7 @@ Options:
                 console.error('用法: ec storage upload <aid> <local-file> <remote-path> [--public]');
                 process.exit(1);
             }
-            const result = await ipcQuery(resolvePaths().socket, {
+            const { response: result, transportError } = await queryDaemon(resolvePaths().socket, {
                 type: 'storage.upload',
                 argv: ['storage', ...args],
                 aid,
@@ -1169,8 +1174,9 @@ Options:
                 sessionId: process.env.EVOLCORE_SESSION_ID,
                 delegationToken,
             }, null);
-            if (!result)
-                failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+            if (!result) {
+                failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+            }
             if (!result.ok)
                 failManagedGroup(formatJson, result.code || 'STORAGE_UPLOAD_FAILED', result.error || 'Storage upload failed');
             if (formatJson)
@@ -1185,11 +1191,12 @@ Options:
             }
             return;
         }
-        const authorization = await ipcQuery(resolvePaths().socket, {
+        const { response: authorization, transportError } = await queryDaemon(resolvePaths().socket, {
             type: 'storage.auth', argv: ['storage', ...args], operation, aid, sessionId: process.env.EVOLCORE_SESSION_ID, delegationToken,
         }, 10_000);
-        if (!authorization)
-            failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+        if (!authorization) {
+            failManagedGroup(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+        }
         if (!authorization.ok)
             failManagedGroup(formatJson, authorization.code || 'STORAGE_AUTH_FAILED', authorization.error || 'Storage operation denied');
         if (sub === 'ls') {
@@ -1531,7 +1538,7 @@ async function applyCrossThreadSendEffects(input) {
             originThreadName,
             targetThreadName,
         });
-        const triggerRes = await ipcQuery(resolvePaths().socket, {
+        const { response: triggerRes, transportError } = await queryDaemon(resolvePaths().socket, {
             type: 'trigger.create',
             definition: triggerDef,
             files: [],
@@ -1543,7 +1550,7 @@ async function applyCrossThreadSendEffects(input) {
             delegationToken: readDelegationCredential(),
         }, 30_000);
         if (!triggerRes?.ok) {
-            process.stderr.write(`⚠ Trigger 创建失败: ${triggerRes?.error ?? 'unknown'}（inbox 仍会写入）\n`);
+            process.stderr.write(`⚠ Trigger 创建失败: ${triggerRes?.error ?? daemonUnavailableMessage(transportError, 'unknown')}（inbox 仍会写入）\n`);
         }
         else {
             // 以 daemon 落盘的结果为准（definition 已带 id，正常应与预设值相同；
@@ -1691,13 +1698,13 @@ Options:
             console.error(`request status is limited to the delegated self AID: ${runtime.selfAid}`);
             process.exit(1);
         }
-        const result = await ipcQuery(resolvePaths().socket, {
+        const { response: result, transportError } = await queryDaemon(resolvePaths().socket, {
             type: 'aun-msg-request-get', aid, requestId,
             sessionId: process.env.EVOLCORE_SESSION_ID,
             delegationToken: readDelegationCredential(),
         }, 10_000);
         if (!result) {
-            console.error('unable to connect to the EvolCore daemon');
+            console.error(daemonUnavailableMessage(transportError, 'unable to connect to the EvolCore daemon'));
             process.exit(1);
         }
         if (formatJson)
@@ -3388,12 +3395,13 @@ async function runManagedSend(argv, formatJson) {
     if (!delegationToken)
         failManagedGroup(formatJson, 'DELEGATION_REQUIRED', 'Managed send requires delegation');
     const runtime = await readBestTaskRuntimeContext();
-    const result = await ipcQuery(resolvePaths().socket, {
+    const { response: result, transportError } = await queryDaemon(resolvePaths().socket, {
         type: 'aun-msg-send', argv, delegationToken,
         originSessionId: process.env.EVOLCORE_SESSION_ID, originMessageId: runtime?.messageId,
     }, null);
-    if (!result)
-        failManagedGroup(formatJson, 'AUN_DAEMON_UNAVAILABLE', 'Unable to connect to the EvolCore daemon');
+    if (!result) {
+        failManagedGroup(formatJson, 'AUN_DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the EvolCore daemon'));
+    }
     if (!result.ok)
         failManagedGroup(formatJson, result.code ?? 'AUN_SEND_FAILED', `${result.error ?? 'Send failed'}${result.request_id ? ` request_id=${result.request_id}` : ''}`, {
             ...(typeof result.detail_code === 'string' ? { detail_code: result.detail_code } : {}),

package/dist/cli/config.js

@@ -2,7 +2,7 @@ import { isHelpFlag, wantsHelp, getArgValue } from './help.js';
 import { initConfigManager } from '../config/config-manager.js';
 import { resolveConfigCommand } from '../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommandAsync, } from '../config/config-operation-service.js';
-import { ipcQuery } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { resolvePaths } from '../paths.js';
 import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { splitConfigBatchGetArgv } from './cli-argv.js';
@@ -135,23 +135,19 @@ function managedSession(formatJson) {
     return { sessionId, delegationToken };
 }
 async function managedConfigQuery(args, sessionId, delegationToken) {
-    try {
-        return await ipcQuery(resolvePaths().socket, {
-            type: 'config.op',
-            argv: ['config', ...args],
-            sessionId,
-            delegationToken,
-        }, 10_000);
-    }
-    catch {
-        return null;
-    }
+    return queryDaemon(resolvePaths().socket, {
+        type: 'config.op',
+        argv: ['config', ...args],
+        sessionId,
+        delegationToken,
+    }, 10_000);
 }
 async function runManagedConfig(args, formatJson) {
     const { sessionId, delegationToken } = managedSession(formatJson);
-    const response = await managedConfigQuery(args, sessionId, delegationToken);
-    if (!response)
-        fail(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    const { response, transportError } = await managedConfigQuery(args, sessionId, delegationToken);
+    if (!response) {
+        fail(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+    }
     if (!response.ok || !response.result) {
         fail(formatJson, response.code || 'CONFIG_AUTH_FAILED', response.error || 'config operation failed', response.data);
     }
@@ -197,9 +193,10 @@ async function runDirectBatchGet(fields, rest, formatJson) {
 }
 async function runManagedBatchGet(fields, rest, formatJson) {
     const { sessionId, delegationToken } = managedSession(formatJson);
-    const response = await managedConfigQuery(['get', ...fields, ...rest], sessionId, delegationToken);
-    if (!response)
-        fail(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    const { response, transportError } = await managedConfigQuery(['get', ...fields, ...rest], sessionId, delegationToken);
+    if (!response) {
+        fail(formatJson, 'DAEMON_UNAVAILABLE', daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'));
+    }
     if (!response.ok || !response.result) {
         fail(formatJson, response.code || 'CONFIG_AUTH_FAILED', response.error || 'config operation failed', response.data);
     }

package/dist/cli/contact.js

@@ -1,7 +1,7 @@
 import { resolvePaths } from '../paths.js';
 import { loadAllAgents } from '../config-store.js';
 import { executeResolvedContactCommand, resolveContactCommand, } from '../config/contact-operation-service.js';
-import { ipcQuery } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 export async function cmdContact(args) {
@@ -48,18 +48,15 @@ async function runManaged(args, json) {
     const delegationToken = readDelegationCredential();
     if (!delegationToken)
         fail(`${AGENT_DELEGATION_TOKEN_ENV} is not set for the active task`, 'DELEGATION_REQUIRED');
-    let response = null;
-    try {
-        response = await ipcQuery(resolvePaths().socket, {
-            type: 'contact.op',
-            argv: ['contact', ...args],
-            sessionId,
-            delegationToken,
-        }, 10_000);
+    const { response, transportError } = await queryDaemon(resolvePaths().socket, {
+        type: 'contact.op',
+        argv: ['contact', ...args],
+        sessionId,
+        delegationToken,
+    }, 10_000);
+    if (!response) {
+        fail(daemonUnavailableMessage(transportError, 'Unable to connect to the evolcore daemon'), 'DAEMON_UNAVAILABLE');
     }
-    catch { }
-    if (!response)
-        fail('Unable to connect to the evolcore daemon', 'DAEMON_UNAVAILABLE');
     if (!response.ok || !response.result) {
         fail(response.error || 'contact operation failed', response.code || 'CONTACT_AUTH_FAILED', response.data);
     }

package/dist/cli/ctl-command.js

@@ -1,5 +1,5 @@
 import { resolvePaths } from '../paths.js';
-import { ipcQuery } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { isHelpFlag, wantsHelp } from './help.js';
 import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 // ==================== Ctl ====================
@@ -44,14 +44,14 @@ export async function cmdCtl(args) {
         process.exit(1);
     }
     const socketPath = resolvePaths().socket;
-    const result = await ipcQuery(socketPath, {
+    const { response: result, transportError } = await queryDaemon(socketPath, {
         type: 'ctl',
         argv: ['ctl', ...args],
         sessionId,
         delegationToken: readDelegationCredential(),
     }, 10_000);
     if (!result) {
-        console.error('错误: 无法连接 evolcore 服务');
+        console.error(`错误: ${daemonUnavailableMessage(transportError, '无法连接 evolcore 服务')}`);
         process.exit(1);
     }
     const ctlResult = result;

package/dist/cli/diag.js

@@ -1,4 +1,4 @@
-import { ipcQuery } from '../ipc.js';
+import { daemonUnavailableMessage, queryDaemon } from './help.js';
 import { resolvePaths } from '../paths.js';
 import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { parseDiagArgs } from '../core/command/diag-service.js';
@@ -13,13 +13,17 @@ export async function cmdDiag(args) {
     let result;
     try {
         parseDiagArgs(args);
-        result = await ipcQuery(resolvePaths().socket, {
+        const { response, transportError } = await queryDaemon(resolvePaths().socket, {
             type: 'diag', argv,
             ...(process.env.EVOLCORE_SESSION_ID ? {
                 sessionId: process.env.EVOLCORE_SESSION_ID,
                 delegationToken: readDelegationCredential(),
             } : {}),
-        }, 30_000) ?? { ok: false, code: 'DAEMON_UNAVAILABLE', message: 'daemon 未返回结果，请检查其运行状态；发送结果尚未确认' };
+        }, 30_000);
+        result = response ?? {
+            ok: false, code: 'DAEMON_UNAVAILABLE',
+            message: daemonUnavailableMessage(transportError, 'daemon 未返回结果，请检查其运行状态；发送结果尚未确认'),
+        };
     }
     catch (error) {
         result = { ok: false, code: 'INVALID_ARGUMENT', message: error.message };