evolcore 0.0.39 → 0.0.40

package/dist/core/permission/ec-command-parser.js

@@ -185,6 +185,9 @@ const STDOUT_FILTER_SPECS = new Map([
     // operand. Once an explicit pattern option appears, a bare operand would be
     // a file to read, so the operand budget drops to zero. `-r`/`-R`/`-f` are
     // absent from both tables, which keeps recursion and pattern files out.
+    // `-d recurse` is the same recursion as `-r` and makes grep ignore stdin and
+    // read the working directory, so `-d`/`--directories` are absent too, along
+    // with `--include`/`--exclude`/`--exclude-dir`, which only act on recursion.
     ['grep', {
             flags: new Set([
                 '-i', '--ignore-case', '-v', '--invert-match', '-c', '--count',
@@ -198,7 +201,7 @@ const STDOUT_FILTER_SPECS = new Map([
             valueOptions: new Set([
                 '-m', '--max-count', '-A', '--after-context', '-B', '--before-context',
                 '-C', '--context', '--color', '--colour', '--binary-files', '--label',
-                '--group-separator', '-d', '--directories', '--include', '--exclude', '--exclude-dir',
+                '--group-separator',
             ]),
             patternValueOptions: new Set(['-e', '--regexp']),
             maxOperands: 1,
@@ -2659,11 +2662,24 @@ export function parseStdinOnlyFilterArgv(segment) {
         }
         if (spec.numericShorthand && /^-\d+$/.test(arg))
             continue;
+        // getopt treats the rest of a short option token as that option's value,
+        // so `-A2` / `-n30` / `-ePATTERN` are the same as `-A 2` / `-n 30` /
+        // `-e PATTERN`. Only the leading letter is checked; bundles such as `-iA2`
+        // stay rejected.
+        if (!arg.startsWith('--') && arg.length > 2) {
+            const shortOption = arg.slice(0, 2);
+            if (spec.patternValueOptions?.has(shortOption)) {
+                sawPatternValue = true;
+                continue;
+            }
+            if (spec.valueOptions.has(shortOption))
+                continue;
+        }
         const option = arg.split('=', 1)[0];
         if (spec.patternValueOptions?.has(option)) {
             sawPatternValue = true;
-            // `-ePATTERN` and `--regexp=PATTERN` carry their own value; only the
-            // bare forms consume the next token.
+            // `--regexp=PATTERN` carries its own value; only the bare form consumes
+            // the next token.
             if (!arg.includes('=') && arg.length === option.length)
                 expectsOptionValue = true;
             continue;

package/dist/core/permission/tool-policy.js

@@ -2354,7 +2354,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         return {
             behavior: 'deny',
             input,
-            message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${managedPathCheck.reason}`,
+            message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${managedPathCheck.reason}。在 PowerShell 中用 $env:TMPDIR 读取此路径，例如 $tmp = $env:TMPDIR。`,
             policyCode: 'temporary_path_outside_tmpdir',
             matchedPath: managedPathCheck.paths[0],
         };
@@ -2385,7 +2385,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             return {
                 behavior: 'deny',
                 input,
-                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${tempCheck.reason}`,
+                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${tempCheck.reason}。在 PowerShell 中用 $env:TMPDIR 读取此路径，例如 $tmp = $env:TMPDIR。`,
                 policyCode: 'temporary_path_outside_tmpdir',
             };
         }
@@ -2420,8 +2420,8 @@ export function evaluateToolPreflight(toolName, input, context) {
                 behavior: 'deny',
                 input,
                 message: invalidArgument
-                    ? 'apply_patch 参数格式错误：需要一个完整补丁文档（以 *** Begin Patch 开头、以 *** End Patch 结尾），普通命令行参数不是补丁；这不是权限不足。'
-                    : '文件修改 patch 无法安全解析：' + applyPatch.reason,
+                    ? 'apply_patch 参数格式错误：需要一个完整补丁文档（以 *** Begin Patch 开头、以 *** End Patch 结尾），普通命令行参数不是补丁；这不是权限不足。如果补丁内容本身完整但仍报此错，通常是 Windows apply_patch.bat 截断了多行参数；请改用 FileChange 工具直接写文件，或绕过 .bat 直接调用 codex.exe --codex-run-as-apply-patch，不要用 here-string 变体重试。'
+                    : '文件修改 patch 无法安全解析：' + applyPatch.reason + '。Windows 上通过 PowerShell here-string 传递补丁时，结尾的 *** End Patch 行通常会被截断导致此错误；请改用 FileChange 工具直接写文件，不要继续用 here-string 变体重试。',
                 policyCode: invalidArgument ? 'apply_patch_invalid_argument' : 'apply_patch_unparseable',
                 errorDetailCode: invalidArgument ? 'INVALID_ARGUMENT' : 'APPLY_PATCH_UNPARSEABLE',
             };
@@ -2639,10 +2639,10 @@ export function evaluateToolPreflight(toolName, input, context) {
                 return { behavior: 'deny', input, message: '🔒 PowerShell 调用 ec.cmd 会截断物理多行参数；请保持原有 ec ... 调用，由 PowerShell 原生 shim 无损传递。', policyCode: 'ec_shell_lossy_cmd_shim' };
             }
             const message = shellDialect === 'powershell'
-                ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。'
+                ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。如需先查询再操作，请拆成两条独立命令分两次调用。'
                 : shellDialect === 'cmd'
-                    ? '🔒 EC 命令调用被拒绝：一次 cmd.exe/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接其它命令，不要使用 &、|、重定向、变量展开或 ^ 转义。'
-                    : '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。';
+                    ? '🔒 EC 命令调用被拒绝：一次 cmd.exe/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接其它命令，不要使用 &、|、重定向、变量展开或 ^ 转义。如需先查询再操作，请拆成两条独立命令分两次调用。'
+                    : '🔒 EC 命令调用被拒绝：一次 Bash 调用只能执行一条完整的 `ec` 命令，不要先用 `command -v` 探测，也不要用 `&&`、`||`、`;`、子 shell、`sh -c`/`bash -lc` 拼接其它命令。安全规则只允许在 ec 后接只读 stdin 的过滤管道：head、tail、grep、wc、sort、cut、uniq、tr（不含读文件、递归、跟随类选项）。jq、awk、sed、python 等能读文件或执行代码的工具不在其内；需要用这类工具时，先 `ec ... > $TMPDIR/<新文件>` 存盘，再另起一次调用处理该文件。';
             return {
                 behavior: 'deny',
                 input,

package/dist/core/role/runtime-policy.js

@@ -4,6 +4,7 @@ import { ConfigTarget, read } from '../../config/config-manager.js';
 import { resolvePrincipal } from '../../config/contact-book.js';
 import { getDaemonOwners, ownerResolver } from '../ownership/owner-resolver.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
+import { isTopicSession } from '../thread/topic-id.js';
 const PERMISSION_MODE_AUTHORITY = {
     readonly: 0,
     auto: 1,
@@ -159,6 +160,69 @@ export function agentFullAccessStatus(agentAid, principalId) {
     const eligible = isAgentFullAccessOwner(agentAid, principalId);
     return { enabled, eligible, effective: enabled && eligible };
 }
+export function sessionFullAccessStatus(session, principalId) {
+    const override = session.metadata?.sessionFullAccess;
+    const agentStatus = session.selfAID ? agentFullAccessStatus(session.selfAID, principalId) : {
+        enabled: false, eligible: false, effective: false,
+    };
+    if (isTopicSession(session) && !override) {
+        return { enabled: false, eligible: agentStatus.eligible, effective: false, inherited: false };
+    }
+    if (!override || typeof override !== 'object') {
+        return { ...agentStatus, inherited: true };
+    }
+    const eligible = !!session.selfAID && isAgentFullAccessOwner(session.selfAID, principalId);
+    return {
+        enabled: override.enabled === true,
+        eligible,
+        effective: override.enabled === true && eligible && principalId === override.authorizedBy,
+        inherited: false,
+        authorizedBy: override.authorizedBy,
+    };
+}
+export function hasSessionFullAccessOverride(session) {
+    return !!session.metadata && Object.prototype.hasOwnProperty.call(session.metadata, 'sessionFullAccess');
+}
+export function createSessionFullAccessAuthorization(input) {
+    const config = input.session.metadata?.sessionFullAccess;
+    if (!config?.enabled
+        || input.session.chatType !== 'private'
+        || (input.source !== undefined && input.source !== 'user')
+        || ['agent', 'ai', 'bot', 'service', 'group'].includes((input.peerType ?? '').toLowerCase())
+        || !hasTrustedPrincipal(input.actor)
+        || input.actor.principalId !== config.authorizedBy
+        || !input.session.selfAID
+        || !isAgentFullAccessOwner(input.session.selfAID, config.authorizedBy))
+        return undefined;
+    return {
+        permissionMode: 'fullaccess',
+        processRole: 'fullaccess-run',
+        dataScope: 'daemon',
+        source: 'session-policy',
+        agentAid: input.session.selfAID,
+        sessionId: input.session.id,
+        authorizedBy: config.authorizedBy,
+        policyActor: { ...input.actor },
+    };
+}
+export function assertSessionFullAccessAuthorization(authorization, session) {
+    if (authorization.source !== 'session-policy'
+        || !session
+        || authorization.sessionId !== session.id
+        || !authorization.agentAid
+        || !authorization.policyActor
+        || !hasTrustedPrincipal(authorization.policyActor)) {
+        throw new Error('session fullaccess authorization is missing or malformed');
+    }
+    const current = resolvePrincipal(authorization.agentAid, authorization.policyActor.operatorChannelType, authorization.policyActor.operatorId, authorization.policyActor.operatorChannelKey);
+    if (!hasTrustedPrincipal({ ...authorization.policyActor, ...current })
+        || current.principalId !== authorization.authorizedBy
+        || session.metadata?.sessionFullAccess?.enabled !== true
+        || session.metadata.sessionFullAccess.authorizedBy !== authorization.authorizedBy
+        || !isAgentFullAccessOwner(authorization.agentAid, authorization.authorizedBy)) {
+        throw new Error('session fullaccess authorization is no longer active');
+    }
+}
 /** Create a trusted per-call claim for a direct private message. */
 export function createAgentPolicyAuthorization(input) {
     if (input.chatType !== 'private'

package/dist/core/session/session-manager.js

@@ -227,7 +227,7 @@ export function pageForkHistory(snapshot, before = snapshot.items.length, limit
     };
 }
 /** Metadata keys owned by ordinary topic/session routing writers. */
-const TOPIC_METADATA_PROTECTED_KEYS = new Set(['turnState', 'resumeAt', 'agentSessions', 'sessionLoop']);
+const TOPIC_METADATA_PROTECTED_KEYS = new Set(['turnState', 'resumeAt', 'agentSessions', 'sessionLoop', 'sessionFullAccess']);
 const TOPIC_BACKEND_SCOPED_KEYS = ['resumeAt', 'agentSessions'];
 function topicMetadataOwnershipError(key) {
     const error = new Error(`topic metadata field is owned by a dedicated updater: ${key}`);
@@ -659,13 +659,17 @@ export class SessionManager {
      * @returns 是否真的写入了 .jsonl（去重命中时返回 false）
      */
     persistSession(session, intent, opts) {
-        if (!opts?.sessionLoopMutation) {
+        if (!opts?.sessionLoopMutation && !opts?.sessionFullAccessMutation) {
             const latest = this.readMetaLatest(this.metaPathForSession(session));
             const metadata = { ...(session.metadata ?? {}) };
             if (latest?.metadata?.sessionLoop !== undefined)
                 metadata.sessionLoop = latest.metadata.sessionLoop;
             else
                 delete metadata.sessionLoop;
+            if (latest?.metadata?.sessionFullAccess !== undefined)
+                metadata.sessionFullAccess = latest.metadata.sessionFullAccess;
+            else
+                delete metadata.sessionFullAccess;
             session.metadata = metadata;
         }
         // Topic session snapshots can be written by synchronous legacy paths
@@ -1400,8 +1404,9 @@ export class SessionManager {
         if (updates.name !== undefined)
             current.name = updates.name;
         if (updates.metadata !== undefined) {
-            if (Object.hasOwn(updates.metadata, 'sessionLoop'))
-                throw topicMetadataOwnershipError('sessionLoop');
+            if (Object.hasOwn(updates.metadata, 'sessionLoop') || Object.hasOwn(updates.metadata, 'sessionFullAccess')) {
+                throw topicMetadataOwnershipError(Object.hasOwn(updates.metadata, 'sessionLoop') ? 'sessionLoop' : 'sessionFullAccess');
+            }
             if (isTopicSession(current)) {
                 for (const key of Object.keys(updates.metadata)) {
                     if (TOPIC_METADATA_PROTECTED_KEYS.has(key))
@@ -1431,7 +1436,7 @@ export class SessionManager {
             return;
         const { current } = loaded;
         for (const key of Object.keys(patch)) {
-            if (key === 'sessionLoop')
+            if (key === 'sessionLoop' || key === 'sessionFullAccess')
                 throw topicMetadataOwnershipError(key);
             if (isTopicSession(current) && TOPIC_METADATA_PROTECTED_KEYS.has(key)) {
                 throw topicMetadataOwnershipError(key);
@@ -1462,6 +1467,19 @@ export class SessionManager {
             return current;
         });
     }
+    updateSessionFullAccess(sessionId, config) {
+        if (typeof config.enabled !== 'boolean' || !config.authorizedBy.trim()) {
+            throw Object.assign(new Error('invalid session fullaccess configuration'), { code: 'INVALID_ARGUMENT' });
+        }
+        return this.mutateLatestTopicSession(sessionId, current => {
+            if (!isTopicSession(current)) {
+                throw Object.assign(new Error('session fullaccess requires a topic session'), { code: 'INVALID_CONTEXT' });
+            }
+            current.metadata = { ...(current.metadata ?? {}), sessionFullAccess: { ...config } };
+            this.persistSession(current, 'none', { sessionFullAccessMutation: true });
+            return current;
+        });
+    }
     /** Persist only the turn coordinator-owned metadata field. */
     async updateTurnState(sessionId, turnState) {
         const loaded = this.loadSessionForUpdate(sessionId);
@@ -1479,6 +1497,7 @@ export class SessionManager {
     getOrCreateThreadSession(channel, channelId, threadId, defaultProjectPath, metadata, name, baseagent, selfAID, channelType, peerType, chatType, label, topicStatus) {
         const topicMetadata = { ...(metadata ?? {}) };
         delete topicMetadata.sessionLoop;
+        delete topicMetadata.sessionFullAccess;
         // 使用精确路径（channelType + selfAID）
         const chatDir = (channelType && selfAID)
             ? (() => { const d = chatDirPath(this.sessionsDir, channelType, channelId, selfAID, channel); fs.mkdirSync(d, { recursive: true }); fs.mkdirSync(path.join(d, '_threads'), { recursive: true }); return d; })()
@@ -2319,6 +2338,7 @@ export class SessionManager {
         delete metadata.resumeAt;
         delete metadata.replyContext;
         delete metadata.sessionLoop;
+        delete metadata.sessionFullAccess;
         metadata.__sessionRenewedAt = Date.now();
         const session = {
             id: generateSessionId(),

package/dist/core/system-session/memory.js

@@ -11,12 +11,11 @@
  *   generalize B, A/consolidated, A/MEMORY.md, R/consolidated, M
  *   promote    B, O/consolidated, O/MEMORY.md, R/consolidated, M
  *   profile    B, R/consolidated, R/MEMORY.md, M
- *   forget     B, X/consolidated, X/MEMORY.md（X=触发层级），X=relation 时加 M
+ *   forget     B, X/consolidated, X/MEMORY.md（X=触发层级，一次只审一层），X=relation 时加 M
  *
  * 详见 docs/memory/system-session-plugin-design.md §5-§8
  */
 import path from 'path';
-import fs from 'fs';
 import { resolveRoot } from '../../paths.js';
 import { parseCodexToolCommand } from '../permission/ec-command-parser.js';
 import { canonicalToolCall } from '../permission/tool-canonical.js';
@@ -70,22 +69,8 @@ export function memoryReadRoots(ctx) {
             add(...consolidated('relation'), messages);
             break;
         case 'forget':
-            if (ctx.memoryScope === 'agent') {
-                // agent 级 forget：给所有 relation 的 consolidated 目录 + agent 自身的 consolidated
-                const relationsRoot = path.join(resolveRoot(), 'agents', ctx.selfAid, 'relations');
-                if (fs.existsSync(relationsRoot)) {
-                    for (const peerKey of fs.readdirSync(relationsRoot)) {
-                        const consolidatedDir = path.join(relationsRoot, peerKey, 'memory', 'consolidated');
-                        const indexPath = path.join(relationsRoot, peerKey, 'memory', 'MEMORY.md');
-                        if (fs.existsSync(consolidatedDir)) {
-                            add(consolidatedDir, indexPath);
-                        }
-                    }
-                }
-                add(...consolidated('agent'));
-            }
-            else if (ctx.memoryScope) {
-                // relation / owner 级 forget：只给当前层级
+            // 一次会话只审一层：关系层由关系整理链逐关系审，agent 层只审 personal/memory 自身
+            if (ctx.memoryScope) {
                 add(...consolidated(ctx.memoryScope));
                 if (ctx.memoryScope === 'relation')
                     add(messages);