evolcore 0.0.7 → 0.0.9

package/CHANGELOG.md

@@ -3,6 +3,49 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.9 (2026-08-06)
+
+### 安装与自启
+
+- 支持在安装或初始化时配置登录自启，Windows 与 macOS 开机登录后自动拉起 EvolCore。
+- 已完成初始化的安装可单独开关登录自启，无需重跑初始化流程。
+
+### AUN 通信
+
+- 出站消息默认加密，可通过配置调整；观察者转发与回执一并遵循该设置。
+- 未连接时的图片与消息发送进入待发队列，连接恢复后按序重投，不再直接丢弃。
+- 完善图片上传的类型识别与结构化内容处理。
+
+### BaseAgent 配置
+
+- 支持为 BaseAgent 自定义请求头和查询参数，便于对接需要额外标识的网关。
+- 统一各 BaseAgent 的推理强度配置项，旧字段仍可识别。
+
+### 运行可靠性
+
+- 修复 Agent 在启动阶段被中断时的状态残留。
+- EC Web 版本过低时拒绝启动并提示升级命令，避免新旧组件搭配下的异常行为。
+- 完善菜单协议的权限校验，并修正系统信息查询。
+
+## 0.0.8 (2026-08-04)
+
+### AID 与域名管理
+
+- 支持通过配置控制 AID 所属域名，并可在变更后自动迁移已有身份记录。
+
+### 运行稳定性
+
+- 完善数据迁移的归档与收尾清理逻辑，降低目录结构演进带来的遗留数据风险。
+- 增强 daemon 启停流程与运行状态诊断，异常时定位信息更准确。
+- 完善 Agent 运行时在失败场景下的状态标记与回退行为。
+- 修复 Windows 下 Codex CLI 的命令解析与进程启动兼容问题。
+
+### 交互体验
+
+- AUN 交互卡片有效期延长至 24 小时，与实际使用节奏匹配。
+- 修复 Web 控制台触发器视图中 daemon 控制触发器无处归属的问题，升级检查触发器包名一并修正。
+- 优化 EC Web 网关状态展示。
+
 ## 0.0.7 (2026-08-03)
 
 ### 运行可靠性

package/README.md

@@ -86,16 +86,16 @@ ResponseEngine.processMessage()
 **一行安装（macOS / Linux）**：
 
 ```bash
-curl -fsSL https://aun-network.oss-cn-hangzhou.aliyuncs.com/evolcore/install.sh | bash
+curl -fsSL https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.sh | bash
 ```
 
 **Windows PowerShell**：
 
 ```powershell
-irm https://aun-network.oss-cn-hangzhou.aliyuncs.com/evolcore/install.ps1 | iex
+& ([scriptblock]::Create((irm https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.ps1))) -AutoStart
 ```
 
-安装器会自动进入 `ec init` 交互向导；只有已有配置同时包含控制 AID 和 Owner 时才跳过。绑定完成后运行 `ec start` 和 `ec status`。安装器不会停止或重启服务，详细流程见 [一键安装脚本说明](docs/evolcore-install-script.md)。
+安装器会自动进入 `ec init` 交互向导；只有已有配置同时包含控制 AID 和 Owner 时才跳过。上面的 Windows 命令会在绑定完成后自动运行 `ec start`；macOS/Linux 需手动运行 `ec start`。安装器不会停止或重启已有服务，详细流程见 [一键安装脚本说明](docs/evolcore-install-script.md)。
 
 **npm 全局安装**：
 
@@ -169,11 +169,45 @@ ec init aun
 ```
 
 **API 继承机制**：`agents.claude` 整个 section 可省略，系统自动按以下优先级继承：
-- `apiKey`：配置文件 → `ANTHROPIC_AUTH_TOKEN` 环境变量 → `~/.claude/settings.json`
+- `apiKey`：配置文件 → `ANTHROPIC_AUTH_TOKEN` / `ANTHROPIC_API_KEY` 环境变量 → `~/.claude/settings.json` 中对应变量
 - `baseUrl`：配置文件 → `ANTHROPIC_BASE_URL` 环境变量 → `~/.claude/settings.json`
 - `model`：配置文件 → `~/.claude/settings.json` → 默认 `sonnet`
 - `effort`：配置文件 → `~/.claude/settings.json` → SDK 默认值（`auto`）
 
+Claude/Codex 兼容网关需要额外请求头或查询参数时，可以直接在 EvolCore 的
+`baseagents` 配置中设置，不需要修改 Claude/Codex 的全局配置文件：
+
+```json
+{
+  "baseagents": {
+    "claude": {
+      "baseUrl": "https://example.com/claude",
+      "headers": {
+        "X-Tenant-Id": "${TENANT_ID}"
+      },
+      "queryParams": {
+        "source": "evolcore"
+      }
+    },
+    "codex": {
+      "baseUrl": "https://example.com/codex",
+      "headers": {
+        "X-Tenant-Id": "${TENANT_ID}"
+      },
+      "queryParams": {
+        "source": "evolcore"
+      }
+    }
+  }
+}
+```
+
+`${VAR}` 会按 EvolCore 的环境变量规则展开。Claude 通过 `ANTHROPIC_CUSTOM_HEADERS`
+传递 Header；Codex app-server 启动时由 EvolCore 注入 `env_http_headers` 和
+`query_params`，所以不需要手改 `~/.codex/config.toml`。`queryParams` 不应放置密钥等敏感信息。
+
+完整设计、运行链路和排障说明见：[Claude/Codex 自定义请求元数据技术文档](docs/baseagent-request-metadata.md)。
+
 ### 3. 运行
 
 ```bash

package/dist/agents/baseagent.js

@@ -50,6 +50,39 @@ function directInferenceValue(...values) {
     }
     return undefined;
 }
+const HTTP_HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function normalizeStringMap(value, field) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${field} must be an object with string values`);
+    }
+    const entries = [];
+    for (const [key, item] of Object.entries(value)) {
+        if (!key)
+            throw new Error(`${field} names cannot be empty`);
+        if (typeof item !== 'string')
+            throw new Error(`${field}.${key} must be a string`);
+        if (field === 'headers') {
+            if (!HTTP_HEADER_NAME.test(key))
+                throw new Error(`Invalid HTTP header name: ${key}`);
+            if (/[\0\r\n]/.test(item))
+                throw new Error(`HTTP header ${key} cannot contain NUL or line breaks`);
+        }
+        entries.push([key, item]);
+    }
+    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+function normalizeRequestMetadata(value) {
+    return {
+        headers: normalizeStringMap(value?.headers, 'headers'),
+        queryParams: normalizeStringMap(value?.queryParams, 'queryParams'),
+    };
+}
+/** Claude Code accepts both names; AUTH_TOKEN is kept first for compatibility. */
+function resolveAnthropicApiKey(...values) {
+    return directInferenceValue(...values);
+}
 function loadClaudeSettings() {
     try {
         const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
@@ -67,25 +100,36 @@ function loadClaudeSettings() {
  */
 export function resolveAnthropicDirectConfig(override) {
     const explicit = directInferencePair(override?.apiKey, override?.baseUrl);
-    if (explicit)
-        return explicit;
+    if (explicit) {
+        return {
+            ...explicit,
+            ...normalizeRequestMetadata(override),
+        };
+    }
     const environment = directInferencePair(directInferenceValue(process.env.ANTHROPIC_AUTH_TOKEN, process.env.ANTHROPIC_API_KEY), process.env.ANTHROPIC_BASE_URL);
-    if (environment)
-        return environment;
+    if (environment) {
+        return {
+            ...environment,
+            ...normalizeRequestMetadata(override),
+        };
+    }
     const settings = loadClaudeSettings();
-    return directInferencePair(directInferenceValue(settings.env?.ANTHROPIC_AUTH_TOKEN, settings.env?.ANTHROPIC_API_KEY), settings.env?.ANTHROPIC_BASE_URL);
+    const settingsResolved = directInferencePair(directInferenceValue(settings.env?.ANTHROPIC_AUTH_TOKEN, settings.env?.ANTHROPIC_API_KEY), settings.env?.ANTHROPIC_BASE_URL);
+    return settingsResolved
+        ? {
+            ...settingsResolved,
+            ...normalizeRequestMetadata(override),
+        }
+        : undefined;
 }
 export function resolveAnthropicConfig(config, override) {
     const settings = loadClaudeSettings();
     const isPlaceholder = (v) => !v || v.includes('your-') || v.includes('placeholder');
     const overrideApiKey = isPlaceholder(override?.apiKey) ? undefined : override?.apiKey;
     const globalApiKey = isPlaceholder(config.agents?.claude?.apiKey) ? undefined : config.agents?.claude?.apiKey;
-    const apiKey = overrideApiKey
-        || globalApiKey
-        || process.env.ANTHROPIC_AUTH_TOKEN
-        || settings.env?.ANTHROPIC_AUTH_TOKEN;
+    const apiKey = resolveAnthropicApiKey(overrideApiKey, globalApiKey, process.env.ANTHROPIC_AUTH_TOKEN, process.env.ANTHROPIC_API_KEY, settings.env?.ANTHROPIC_AUTH_TOKEN, settings.env?.ANTHROPIC_API_KEY);
     if (!apiKey) {
-        throw new Error('No API key found. Set one of: baseagents.claude.apiKey (per-agent or defaults), env ANTHROPIC_AUTH_TOKEN, or ~/.claude/settings.json env.ANTHROPIC_AUTH_TOKEN');
+        throw new Error('No API key found for Claude. Set baseagents.claude.apiKey, env ANTHROPIC_AUTH_TOKEN or ANTHROPIC_API_KEY, or the corresponding variable in ~/.claude/settings.json');
     }
     const isPlaceholderUrl = (v) => !v || v.includes('api.anthropic.com');
     const overrideBaseUrl = isPlaceholderUrl(override?.baseUrl) ? undefined : override?.baseUrl;
@@ -94,6 +138,8 @@ export function resolveAnthropicConfig(config, override) {
         || globalBaseUrl
         || process.env.ANTHROPIC_BASE_URL
         || settings.env?.ANTHROPIC_BASE_URL;
+    const headers = normalizeStringMap(override?.headers ?? config.agents?.claude?.headers, 'headers');
+    const queryParams = normalizeStringMap(override?.queryParams ?? config.agents?.claude?.queryParams, 'queryParams');
     const model = override?.model
         || config.agents?.claude?.model
         || settings.model
@@ -105,19 +151,22 @@ export function resolveAnthropicConfig(config, override) {
     const pickExec = (v) => (!v || v.includes('your-') || v.includes('placeholder')) ? undefined : v;
     const pathToClaudeCodeExecutable = pickExec(override?.pathToClaudeCodeExecutable)
         || pickExec(config.agents?.claude?.pathToClaudeCodeExecutable);
-    return { apiKey, baseUrl, model, effort, pathToClaudeCodeExecutable };
+    return { apiKey, baseUrl, headers, queryParams, model, effort, pathToClaudeCodeExecutable };
 }
 function loadCodexSettings() {
     try {
-        const authPath = path.join(os.homedir(), '.codex', 'auth.json');
+        const configuredHome = process.env.CODEX_HOME?.trim();
+        const codexHome = configuredHome ? path.resolve(configuredHome) : path.join(os.homedir(), '.codex');
+        const authPath = path.join(codexHome, 'auth.json');
         let apiKey;
         if (fs.existsSync(authPath)) {
             const auth = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
             apiKey = auth.OPENAI_API_KEY;
         }
-        const configPath = path.join(os.homedir(), '.codex', 'config.toml');
+        const configPath = path.join(codexHome, 'config.toml');
         let model;
         let baseUrl;
+        let provider;
         if (fs.existsSync(configPath)) {
             const content = fs.readFileSync(configPath, 'utf-8');
             const modelMatch = content.match(/^model\s*=\s*"([^"]+)"/m);
@@ -125,17 +174,35 @@ function loadCodexSettings() {
                 model = modelMatch[1];
             const providerMatch = content.match(/^model_provider\s*=\s*"([^"]+)"/m);
             if (providerMatch) {
-                const provider = providerMatch[1];
-                const baseUrlMatch = content.match(new RegExp(`\\[model_providers\\.${provider}\\][\\s\\S]*?base_url\\s*=\\s*"([^"]+)"`, 'm'));
-                if (baseUrlMatch)
-                    baseUrl = baseUrlMatch[1];
+                provider = providerMatch[1];
+                baseUrl = readCodexProviderBaseUrl(content, provider);
             }
         }
-        return { apiKey, baseUrl, model };
+        return { apiKey, baseUrl, model, provider };
     }
     catch { }
     return {};
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function readCodexProviderBaseUrl(content, provider) {
+    const segments = /^[A-Za-z0-9_-]+$/.test(provider)
+        ? [provider, JSON.stringify(provider)]
+        : [JSON.stringify(provider)];
+    for (const segment of segments) {
+        const section = new RegExp(`^\\s*\\[\\s*model_providers\\s*\\.\\s*${escapeRegExp(segment)}\\s*\\]\\s*(?:#.*)?$`, 'm').exec(content);
+        if (!section || section.index === undefined)
+            continue;
+        const tail = content.slice(section.index + section[0].length);
+        const nextSection = tail.search(/^\s*\[/m);
+        const block = nextSection >= 0 ? tail.slice(0, nextSection) : tail;
+        const baseUrl = block.match(/^\s*base_url\s*=\s*"([^"]+)"/m)?.[1];
+        if (baseUrl)
+            return baseUrl;
+    }
+    return undefined;
+}
 /**
  * Resolve a complete credential/endpoint pair for direct OpenAI HTTP calls.
  * auth.json and config.toml together form the Codex SDK source; fields are
@@ -143,13 +210,27 @@ function loadCodexSettings() {
  */
 export function resolveOpenaiDirectConfig(override) {
     const explicit = directInferencePair(override?.apiKey, override?.baseUrl);
-    if (explicit)
-        return explicit;
+    if (explicit) {
+        return {
+            ...explicit,
+            ...normalizeRequestMetadata(override),
+        };
+    }
     const environment = directInferencePair(process.env.OPENAI_API_KEY, process.env.OPENAI_BASE_URL);
-    if (environment)
-        return environment;
+    if (environment) {
+        return {
+            ...environment,
+            ...normalizeRequestMetadata(override),
+        };
+    }
     const settings = loadCodexSettings();
-    return directInferencePair(settings.apiKey, settings.baseUrl);
+    const settingsResolved = directInferencePair(settings.apiKey, settings.baseUrl);
+    return settingsResolved
+        ? {
+            ...settingsResolved,
+            ...normalizeRequestMetadata(override),
+        }
+        : undefined;
 }
 export function resolveOpenaiConfig(config, override) {
     const codexSettings = loadCodexSettings();
@@ -171,6 +252,8 @@ export function resolveOpenaiConfig(config, override) {
         || process.env.OPENAI_BASE_URL
         || codexSettings.baseUrl
         || undefined;
+    const headers = normalizeStringMap(override?.headers ?? config.agents?.codex?.headers, 'headers');
+    const queryParams = normalizeStringMap(override?.queryParams ?? config.agents?.codex?.queryParams, 'queryParams');
     const model = override?.model
         || config.agents?.codex?.model
         || codexSettings.model
@@ -186,7 +269,17 @@ export function resolveOpenaiConfig(config, override) {
     const approvalsReviewer = override?.approvalsReviewer
         ?? config.agents?.codex?.approvalsReviewer
         ?? undefined;
-    return { apiKey, baseUrl, model, effort, enableRequestUserInput, approvalsReviewer };
+    return {
+        apiKey,
+        baseUrl,
+        provider: codexSettings.provider,
+        headers,
+        queryParams,
+        model,
+        effort,
+        enableRequestUserInput,
+        approvalsReviewer,
+    };
 }
 export function resolveGoogleConfig(config, override) {
     const googleCfg = config.agents?.gemini;

package/dist/agents/claude-runner.js

@@ -65,6 +65,19 @@ function isClaudeMcpTool(toolName) {
 function isUnknownClaudeTool(toolName) {
     return !isClaudeMcpTool(toolName) && !CLAUDE_BUILTIN_TOOLS.has(toolName);
 }
+function appendQueryParams(baseUrl, queryParams) {
+    if (!baseUrl || !queryParams || Object.keys(queryParams).length === 0)
+        return baseUrl;
+    try {
+        const parsed = new URL(baseUrl);
+        for (const [name, value] of Object.entries(queryParams))
+            parsed.searchParams.set(name, value);
+        return parsed.toString();
+    }
+    catch {
+        return baseUrl;
+    }
+}
 function stableClaudePermissionValue(value, depth = 0) {
     if (depth > 8)
         return '[truncated]';
@@ -529,6 +542,8 @@ export class AgentRunner {
     effort;
     permissionMode = DEFAULT_PERMISSION_MODE;
     baseUrl;
+    customHeaders;
+    customQueryParams;
     config;
     activeSessions = new Map();
     activeStreams = new Map();
@@ -556,15 +571,22 @@ export class AgentRunner {
         if (config) {
             const anthropic = resolveAnthropicConfig(config);
             this.claudeExecutablePath = anthropic.pathToClaudeCodeExecutable;
+            this.customHeaders = anthropic.headers;
+            this.customQueryParams = anthropic.queryParams;
         }
     }
     getAgentEnv(runtimeEnv, evolcoreSessionId) {
+        const anthropicBaseUrl = appendQueryParams(this.baseUrl, this.customQueryParams);
         const env = {
             ...process.env,
             ANTHROPIC_AUTH_TOKEN: this.apiKey,
+            ANTHROPIC_API_KEY: this.apiKey,
             PATH: process.env.PATH,
             DISABLE_AUTOUPDATER: '1',
-            ...(this.baseUrl ? { ANTHROPIC_BASE_URL: this.baseUrl } : {}),
+            ...(anthropicBaseUrl ? { ANTHROPIC_BASE_URL: anthropicBaseUrl } : {}),
+            ...(this.customHeaders
+                ? { ANTHROPIC_CUSTOM_HEADERS: Object.entries(this.customHeaders).map(([name, value]) => `${name}: ${value}`).join('\n') }
+                : {}),
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
         };
@@ -2297,6 +2319,7 @@ export class AgentRunner {
         })();
     }
     async interrupt(sessionId) {
+        const streamRegistered = this.activeStreams.has(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
         const cancelledInputIds = [];
@@ -2326,7 +2349,10 @@ export class AgentRunner {
         if (query && typeof query.close === 'function')
             query.close();
         const done = this.streamDone.get(sessionId);
-        if (done) {
+        // A stream interrupted after runQuery resolves but before registerStream has
+        // no consumer that can enter the wrapper generator's finally block. Waiting
+        // for streamDone here would always burn the full timeout.
+        if (done && streamRegistered) {
             await Promise.race([done, new Promise(resolve => setTimeout(resolve, 5_000))]);
         }
         this.interruptFns.delete(sessionId);
@@ -2342,6 +2368,9 @@ export class AgentRunner {
     cleanupStream(sessionId) {
         this.activeMessageStreams.get(sessionId)?.end();
         this.activeMessageStreams.delete(sessionId);
+        this.streamDoneResolvers.get(sessionId)?.();
+        this.streamDoneResolvers.delete(sessionId);
+        this.streamDone.delete(sessionId);
         this.activeStreams.delete(sessionId);
         this.interruptFns.delete(sessionId);
         this.activeQueries.delete(sessionId);

package/dist/agents/codex-app-server-client.js

@@ -2,6 +2,23 @@ import { spawn } from 'child_process';
 import readline from 'readline';
 import { logger } from '../utils/logger.js';
 import { buildHClassGuardCommand } from '../core/permission/sandbox-runtime.js';
+import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
+import { createHash } from 'crypto';
+function tomlProviderKey(value) {
+    if (!value || /[\0\r\n]/.test(value)) {
+        throw new Error(`Invalid Codex provider name: ${value}`);
+    }
+    return /^[A-Za-z0-9_-]+$/.test(value) ? value : JSON.stringify(value);
+}
+function tomlInlineStringTable(values) {
+    return `{${Object.entries(values)
+        .map(([name, value]) => `${JSON.stringify(name)}=${JSON.stringify(value)}`)
+        .join(',')}}`;
+}
+function codexHeaderEnvName(headerName) {
+    const digest = createHash('sha256').update(headerName).digest('hex').slice(0, 16).toUpperCase();
+    return `EVOLCORE_CODEX_HEADER_${digest}`;
+}
 function hasPermissionProfile(config) {
     if (!config || typeof config.default_permissions !== 'string' || !config.default_permissions)
         return false;
@@ -326,15 +343,21 @@ export class CodexAppServerClient {
     startProcess() {
         const env = { ...process.env, ...this.options.env };
         env.CODEX_API_KEY = this.options.apiKey;
+        for (const [name, value] of Object.entries(this.options.headers ?? {})) {
+            env[codexHeaderEnvName(name)] = value;
+        }
         if (this.options.baseUrl) {
             env.OPENAI_BASE_URL = this.options.baseUrl;
         }
         const args = this.buildProcessArgs();
-        const guardedCommand = buildHClassGuardCommand('codex', args);
+        const launchCommand = resolveCodexLaunchCommand(args);
+        if (!launchCommand)
+            throw new Error('Codex CLI not found');
+        const guardedCommand = buildHClassGuardCommand(launchCommand.command, launchCommand.args);
         if (process.platform === 'linux' && !guardedCommand) {
             throw new Error('Codex 缺少 EvolCore H 类路径隔离运行时，已拒绝启动 app-server');
         }
-        this.proc = spawn(guardedCommand?.command ?? 'codex', guardedCommand?.args ?? args, {
+        this.proc = spawn(guardedCommand?.command ?? launchCommand.command, guardedCommand?.args ?? launchCommand.args, {
             cwd: this.options.cwd,
             env,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -363,6 +386,18 @@ export class CodexAppServerClient {
         if (this.options.baseUrl) {
             args.push('--config', `openai_base_url=${JSON.stringify(this.options.baseUrl)}`);
         }
+        const headerEnvNames = Object.fromEntries(Object.keys(this.options.headers ?? {}).map(name => [name, codexHeaderEnvName(name)]));
+        const hasHeaders = Object.keys(headerEnvNames).length > 0;
+        const hasQueryParams = Object.keys(this.options.queryParams ?? {}).length > 0;
+        if (hasHeaders || hasQueryParams) {
+            const provider = tomlProviderKey(this.options.provider || 'openai');
+            if (hasHeaders) {
+                args.push('--config', `model_providers.${provider}.env_http_headers=${tomlInlineStringTable(headerEnvNames)}`);
+            }
+            if (hasQueryParams) {
+                args.push('--config', `model_providers.${provider}.query_params=${tomlInlineStringTable(this.options.queryParams ?? {})}`);
+            }
+        }
         if (this.options.effort) {
             args.push('--config', `model_reasoning_effort=${JSON.stringify(this.options.effort)}`);
         }

package/dist/agents/codex-runner.js

@@ -23,6 +23,7 @@ import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
+import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
 import { createHash, randomBytes } from 'crypto';
 import fs from 'fs';
 import path from 'path';
@@ -128,7 +129,7 @@ export function isCodexCliVersionSupported(version) {
 }
 export function getCodexCliVersion() {
     try {
-        const output = execFileSync('codex', ['--version'], {
+        const output = execCodexCliSync(['--version'], {
             encoding: 'utf-8',
             timeout: 3000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -140,6 +141,10 @@ export function getCodexCliVersion() {
     }
 }
 export function getCodexAppServerAvailability() {
+    if (!resolveCodexCliPath()) {
+        const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
+        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+    }
     const version = getCodexCliVersion();
     const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
     if (!version) {
@@ -153,7 +158,7 @@ export function getCodexAppServerAvailability() {
         };
     }
     try {
-        execFileSync('codex', ['app-server', '--help'], {
+        execCodexCliSync(['app-server', '--help'], {
             encoding: 'utf-8',
             timeout: 3000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -171,7 +176,7 @@ function fetchCodexCatalog() {
     if (codexCatalogCache)
         return codexCatalogCache;
     try {
-        const output = execFileSync('codex', ['debug', 'models'], {
+        const output = execCodexCliSync(['debug', 'models'], {
             encoding: 'utf-8',
             timeout: 5000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -250,6 +255,9 @@ export class CodexRunner {
             const client = new CodexAppServerClient({
                 apiKey: this.resolvedConfig.apiKey,
                 baseUrl: this.resolvedConfig.baseUrl,
+                provider: this.resolvedConfig.provider,
+                headers: this.resolvedConfig.headers,
+                queryParams: this.resolvedConfig.queryParams,
                 model: this.model,
                 effort: this.effort,
                 enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,

package/dist/aun/aid/control-aid.js

@@ -1,35 +1,46 @@
 import crypto from 'crypto';
 import { aidCreate } from './index.js';
+import { DEFAULT_AID_DOMAIN, normalizeAidDomain } from './domain.js';
 import { getAidStore, SLOT } from './store.js';
 import { logger } from '../../utils/logger.js';
 const MAX_ATTEMPTS = 5;
-/** 解析控制 AID 的 issuer：环境变量 EVOLCORE_ISSUER → 兜底 agentid.pub */
-export function resolveControlIssuer() {
-    const env = process.env.EVOLCORE_ISSUER?.trim();
-    if (env) {
-        // Validate issuer format: must be valid domain-like structure
-        if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(env)) {
-            logger.error(`[control-aid] Invalid EVOLCORE_ISSUER format: ${env}, using default`);
-            return 'agentid.pub';
-        }
-        // Prevent localhost/local domains
-        if (env === 'localhost' || env.endsWith('.localhost') || env.startsWith('127.') || env.startsWith('0.')) {
-            logger.error(`[control-aid] EVOLCORE_ISSUER cannot be localhost/local: ${env}, using default`);
-            return 'agentid.pub';
-        }
-        // Length limit
-        if (env.length > 253) {
-            logger.error(`[control-aid] EVOLCORE_ISSUER too long: ${env.length} chars, using default`);
-            return 'agentid.pub';
-        }
+export { DEFAULT_AID_DOMAIN } from './domain.js';
+function environmentValue(name) {
+    if (!Object.prototype.hasOwnProperty.call(process.env, name))
+        return undefined;
+    return process.env[name]?.trim() ?? '';
+}
+/**
+ * Resolve the AID domain for automatically generated control identities.
+ *
+ * Explicit values fail closed. This avoids silently registering an identity
+ * under a different domain when deployment configuration is malformed.
+ */
+export function resolveControlAidDomain(configuredAidDomain) {
+    const environmentDomain = environmentValue('EVOLCORE_AID_DOMAIN');
+    if (environmentDomain !== undefined)
+        return normalizeAidDomain(environmentDomain, 'EVOLCORE_AID_DOMAIN');
+    const legacyEnvironmentDomain = environmentValue('EVOLCORE_ISSUER');
+    if (legacyEnvironmentDomain !== undefined) {
+        logger.warn('[control-aid] EVOLCORE_ISSUER is deprecated; use EVOLCORE_AID_DOMAIN instead');
+        return normalizeAidDomain(legacyEnvironmentDomain, 'EVOLCORE_ISSUER');
     }
-    return env || 'agentid.pub';
+    if (configuredAidDomain !== undefined) {
+        return normalizeAidDomain(configuredAidDomain, 'daemon.json.aun.defaultAidDomain');
+    }
+    return DEFAULT_AID_DOMAIN;
+}
+/** @deprecated Use resolveControlAidDomain(). */
+export function resolveControlIssuer(configuredAidDomain) {
+    return resolveControlAidDomain(configuredAidDomain);
 }
-/** 生成候选控制 AID：ec + 5位随机数字 + .{issuer} */
-export function candidateAid(issuer) {
+/** 生成候选控制 AID：ec + 5位随机数字 + .{aidDomain} */
+export function candidateAid(aidDomain) {
     const n = crypto.randomInt(10000, 100000); // 5 位：10000-99999
-    const finalIssuer = issuer || resolveControlIssuer();
-    return `ec${n}.${finalIssuer}`;
+    const finalAidDomain = aidDomain === undefined
+        ? resolveControlAidDomain()
+        : normalizeAidDomain(aidDomain, 'aidDomain');
+    return `ec${n}.${finalAidDomain}`;
 }
 /**
  * 候选 AID 是否已在 PKI 注册。
@@ -56,12 +67,14 @@ async function candidateExists(store, candidate) {
  * - fail-fast：查重探测失败（网关不可达）立即抛错，不掩盖成"均冲突"
  * - agent.md 不上传：aidCreate 仅注册身份 + 写私钥，不调 agentmdPut
  */
-export async function generateControlAid() {
-    const issuer = resolveControlIssuer();
+export async function generateControlAid(aidDomain) {
+    const finalAidDomain = aidDomain === undefined
+        ? resolveControlAidDomain()
+        : normalizeAidDomain(aidDomain, 'aidDomain');
     const store = await getAidStore({ slotId: SLOT.cli });
     try {
         for (let i = 0; i < MAX_ATTEMPTS; i++) {
-            const candidate = candidateAid(issuer);
+            const candidate = candidateAid(finalAidDomain);
             if (await candidateExists(store, candidate)) {
                 logger.info(`[control-aid] ${candidate} 已注册，重试 (${i + 1}/${MAX_ATTEMPTS})`);
                 continue;

package/dist/aun/aid/domain.js

@@ -0,0 +1,23 @@
+export const DEFAULT_AID_DOMAIN = 'agentid.cn';
+const DOMAIN_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+const IPV4_RE = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+/** Normalize and validate the suffix domain used to construct an AID. */
+export function normalizeAidDomain(value, source) {
+    if (typeof value !== 'string') {
+        throw new Error(`[aid-domain] ${source} must be a string`);
+    }
+    const aidDomain = value.trim().toLowerCase();
+    if (!DOMAIN_RE.test(aidDomain)) {
+        throw new Error(`[aid-domain] ${source} must be a valid multi-level domain: ${value}`);
+    }
+    if (IPV4_RE.test(aidDomain)) {
+        throw new Error(`[aid-domain] ${source} cannot be an IP address: ${value}`);
+    }
+    if (aidDomain.endsWith('.localhost')) {
+        throw new Error(`[aid-domain] ${source} cannot be a localhost/local domain: ${value}`);
+    }
+    if (aidDomain.length > 253) {
+        throw new Error(`[aid-domain] ${source} is too long: ${aidDomain.length} chars`);
+    }
+    return aidDomain;
+}