evolcore 0.0.8 → 0.0.9

package/dist/ipc.js

@@ -519,7 +519,7 @@ export class IpcServer {
                         mentions: Array.isArray(cmd.mentions)
                             ? cmd.mentions.filter((entry) => !!entry && typeof entry === 'object' && !Array.isArray(entry))
                             : undefined,
-                        encrypt: cmd.encrypt === true,
+                        encrypt: typeof cmd.encrypt === 'boolean' ? cmd.encrypt : undefined,
                         thread: typeof cmd.thread === 'string' ? cmd.thread : undefined,
                         returnPolicy: cmd.returnPolicy === 'required' || cmd.returnPolicy === 'none' ? cmd.returnPolicy : undefined,
                         originSessionId: typeof cmd.originSessionId === 'string' ? cmd.originSessionId : undefined,

package/dist/product.js

@@ -10,6 +10,7 @@ export const MAIN_CLI_BIN = 'ec';
 export const WEB_PACKAGE_NAME = 'ec-web';
 export const WEB_CLI_BIN = 'ec-web';
 export const WEB_PACKAGE_LATEST = `${WEB_PACKAGE_NAME}@latest`;
+export const MIN_ECWEB_VERSION = '0.0.8';
 export const DAEMON_CONFIG_FILENAME = 'daemon.json';
 export const DAEMON_SCHEMA_NAME = 'daemon';
 export const RUNTIME_HOME_ENV = 'EVOLCORE_HOME';

package/dist/utils/autostart.js

@@ -0,0 +1,27 @@
+import { configureMacosAutostart, macosAutostartInstalled } from './macos-autostart.js';
+import { configureWindowsAutostart, windowsAutostartInstalled } from './windows-autostart.js';
+export function autostartInstalled() {
+    if (process.platform === 'win32')
+        return windowsAutostartInstalled();
+    if (process.platform === 'darwin')
+        return macosAutostartInstalled();
+    return false;
+}
+export function configureAutostart(enabled, runtimeRoot) {
+    if (process.platform === 'win32')
+        return configureWindowsAutostart(enabled, runtimeRoot);
+    if (process.platform === 'darwin')
+        return configureMacosAutostart(enabled, runtimeRoot);
+    return {
+        ok: !enabled,
+        enabled: false,
+        ...(!enabled ? {} : { error: '登录自启仅支持 Windows 和 macOS 主机' }),
+    };
+}
+export function autostartPlatformLabel() {
+    if (process.platform === 'win32')
+        return 'Windows';
+    if (process.platform === 'darwin')
+        return 'macOS';
+    return undefined;
+}

package/dist/utils/ecweb-utils.js

@@ -1,8 +1,21 @@
 import fs from 'fs';
 import path from 'path';
-import { resolveGlobalPkg } from './npm-ops.js';
+import { compareVersions, resolveGlobalPkg } from './npm-ops.js';
 import { isWindows as platformIsWindows, resolveCommandPath } from './cross-platform.js';
-import { WEB_CLI_BIN, WEB_PACKAGE_NAME } from '../product.js';
+import { MIN_ECWEB_VERSION, WEB_CLI_BIN, WEB_PACKAGE_NAME } from '../product.js';
+/** EC Web owns the session-log reader, so older builds cannot safely serve a newer daemon. */
+export function isEcwebVersionSupported(version) {
+    const normalized = version?.trim();
+    if (!normalized || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalized))
+        return false;
+    return compareVersions(normalized, MIN_ECWEB_VERSION) >= 0;
+}
+export function ecwebVersionRequirementError(version) {
+    if (isEcwebVersionSupported(version))
+        return null;
+    const detected = version?.trim() || 'unknown';
+    return `EC Web ${detected} 低于最低要求 ${MIN_ECWEB_VERSION}，拒绝启动。请运行: npm install -g ${WEB_PACKAGE_NAME}@latest`;
+}
 function readEcwebPackageEntry(pkgJsonPath) {
     try {
         const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));

package/dist/utils/macos-autostart.js

@@ -0,0 +1,179 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { spawnSync } from 'child_process';
+import { getPackageRoot } from '../paths.js';
+export const MACOS_AUTOSTART_LABEL = 'cn.evolai.evolcore';
+function isMacos() {
+    return process.platform === 'darwin';
+}
+function plistPath() {
+    return path.join(os.homedir(), 'Library', 'LaunchAgents', `${MACOS_AUTOSTART_LABEL}.plist`);
+}
+function launchctl(args) {
+    return spawnSync('/bin/launchctl', args, {
+        encoding: 'utf8',
+        timeout: 15_000,
+    });
+}
+function commandError(result, fallback) {
+    return String(result.error?.message || result.stderr || result.stdout || fallback).trim();
+}
+function guiDomain() {
+    const uid = process.getuid?.();
+    return uid === undefined ? undefined : `gui/${uid}`;
+}
+function xmlLiteral(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+function createPlist(runtimeRoot) {
+    const absoluteRoot = path.resolve(runtimeRoot);
+    const cliEntry = path.join(getPackageRoot(), 'dist', 'cli', 'index.js');
+    if (!fs.existsSync(cliEntry)) {
+        throw new Error(`找不到 EvolCore CLI 入口: ${cliEntry}`);
+    }
+    const environment = [
+        ['EVOLCORE_HOME', absoluteRoot],
+        ['HOME', os.homedir()],
+        ['PATH', Array.from(new Set([
+                path.dirname(process.execPath),
+                ...(process.env.PATH ?? '').split(path.delimiter).filter(Boolean),
+            ])).join(path.delimiter)],
+    ];
+    const environmentXml = environment
+        .map(([key, value]) => `    <key>${xmlLiteral(key)}</key>\n    <string>${xmlLiteral(value)}</string>`)
+        .join('\n');
+    const args = [process.execPath, '--no-warnings=ExperimentalWarning', cliEntry, 'start']
+        .map(value => `    <string>${xmlLiteral(value)}</string>`)
+        .join('\n');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlLiteral(MACOS_AUTOSTART_LABEL)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${environmentXml}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xmlLiteral(path.join(absoluteRoot, 'logs', 'autostart.stdout.log'))}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlLiteral(path.join(absoluteRoot, 'logs', 'autostart.stderr.log'))}</string>
+</dict>
+</plist>
+`;
+}
+function restorePlist(file, previous) {
+    try {
+        if (previous === undefined)
+            fs.rmSync(file, { force: true });
+        else
+            fs.writeFileSync(file, previous, { encoding: 'utf8', mode: 0o600 });
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function macosAutostartInstalled() {
+    if (!isMacos())
+        return false;
+    const domain = guiDomain();
+    if (!domain)
+        return false;
+    const result = launchctl(['print', `${domain}/${MACOS_AUTOSTART_LABEL}`]);
+    return result.status === 0;
+}
+export function configureMacosAutostart(enabled, runtimeRoot) {
+    if (!isMacos()) {
+        return {
+            ok: !enabled,
+            enabled: false,
+            ...(!enabled ? {} : { error: 'macOS 登录自启仅支持 macOS 主机' }),
+        };
+    }
+    const domain = guiDomain();
+    if (!domain) {
+        return { ok: false, enabled: false, error: '无法确定当前 macOS 用户 UID' };
+    }
+    const file = plistPath();
+    if (!enabled) {
+        const result = launchctl(['bootout', `${domain}/${MACOS_AUTOSTART_LABEL}`]);
+        if (result.status !== 0 && macosAutostartInstalled()) {
+            return {
+                ok: false,
+                enabled: true,
+                error: commandError(result, '删除 macOS 登录自启失败'),
+            };
+        }
+        try {
+            fs.rmSync(file, { force: true });
+        }
+        catch (error) {
+            // Keep the previous state coherent: a LaunchAgents plist that cannot be
+            // removed would otherwise silently re-enable the job at the next login.
+            const restored = launchctl(['bootstrap', domain, file]);
+            return {
+                ok: false,
+                enabled: restored.status === 0 || macosAutostartInstalled(),
+                error: `删除 macOS 登录自启配置失败: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        return { ok: true, enabled: false };
+    }
+    let previousPlist;
+    let previouslyInstalled = false;
+    try {
+        const absoluteRoot = path.resolve(runtimeRoot);
+        if (fs.existsSync(file)) {
+            previousPlist = fs.readFileSync(file, 'utf8');
+            previouslyInstalled = macosAutostartInstalled();
+        }
+        fs.mkdirSync(path.join(absoluteRoot, 'logs'), { recursive: true });
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, createPlist(absoluteRoot), { encoding: 'utf8', mode: 0o600 });
+        // Re-bootstrap so repeated `ec init --auto-start` updates the command and paths.
+        launchctl(['bootout', `${domain}/${MACOS_AUTOSTART_LABEL}`]);
+        const result = launchctl(['bootstrap', domain, file]);
+        if (result.status !== 0) {
+            const restoreError = restorePlist(file, previousPlist);
+            let restored = false;
+            if (!restoreError && previouslyInstalled && previousPlist !== undefined) {
+                const restoreResult = launchctl(['bootstrap', domain, file]);
+                restored = restoreResult.status === 0 || macosAutostartInstalled();
+            }
+            else if (!previouslyInstalled) {
+                // A failed bootstrap may still have partially loaded the job.
+                launchctl(['bootout', `${domain}/${MACOS_AUTOSTART_LABEL}`]);
+            }
+            const rollbackSuffix = restoreError ? `; 恢复原配置失败: ${restoreError}` : '';
+            return {
+                ok: false,
+                enabled: restored,
+                error: `${commandError(result, '创建 macOS 登录自启失败')}${rollbackSuffix}`,
+            };
+        }
+        return { ok: true, enabled: true };
+    }
+    catch (error) {
+        const restoreError = restorePlist(file, previousPlist);
+        const rollbackSuffix = restoreError ? `; 恢复原配置失败: ${restoreError}` : '';
+        return {
+            ok: false,
+            enabled: previouslyInstalled,
+            error: `${error instanceof Error ? error.message : String(error)}${rollbackSuffix}`,
+        };
+    }
+}

package/dist/utils/windows-autostart.js

@@ -0,0 +1,130 @@
+import fs from 'fs';
+import path from 'path';
+import { spawnSync } from 'child_process';
+import { getPackageRoot } from '../paths.js';
+export const WINDOWS_AUTOSTART_TASK_NAME = 'EvolCore';
+function isWindows() {
+    return process.platform === 'win32';
+}
+function runSchtasks(args) {
+    return spawnSync('schtasks.exe', args, {
+        encoding: 'utf8',
+        windowsHide: true,
+        timeout: 15_000,
+    });
+}
+function commandError(result, fallback) {
+    return String(result.error?.message || result.stderr || result.stdout || fallback).trim();
+}
+function powershellLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+function windowsCommandLiteral(value) {
+    return `"${value}"`;
+}
+function wrapperPath(runtimeRoot) {
+    return path.join(runtimeRoot, 'data', 'evolcore-autostart.ps1');
+}
+export function windowsAutostartInstalled() {
+    if (!isWindows())
+        return false;
+    const result = runSchtasks(['/Query', '/TN', WINDOWS_AUTOSTART_TASK_NAME]);
+    return result.status === 0;
+}
+function createWrapper(runtimeRoot) {
+    const scriptPath = wrapperPath(runtimeRoot);
+    const cliEntry = path.join(getPackageRoot(), 'dist', 'cli', 'index.js');
+    if (!fs.existsSync(cliEntry)) {
+        throw new Error(`找不到 EvolCore CLI 入口: ${cliEntry}`);
+    }
+    const pathValue = process.env.PATH ?? '';
+    const script = [
+        `$env:EVOLCORE_HOME = ${powershellLiteral(runtimeRoot)}`,
+        `$env:Path = ${powershellLiteral(pathValue)}`,
+        `& ${powershellLiteral(process.execPath)} --no-warnings=ExperimentalWarning ${powershellLiteral(cliEntry)} start`,
+        'exit $LASTEXITCODE',
+        '',
+    ].join('\r\n');
+    fs.mkdirSync(path.dirname(scriptPath), { recursive: true });
+    fs.writeFileSync(scriptPath, script, 'utf8');
+    return scriptPath;
+}
+function restoreWrapper(file, previous) {
+    try {
+        if (previous === undefined)
+            fs.rmSync(file, { force: true });
+        else
+            fs.writeFileSync(file, previous, 'utf8');
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function configureWindowsAutostart(enabled, runtimeRoot) {
+    if (!isWindows()) {
+        return {
+            ok: !enabled,
+            enabled: false,
+            ...(!enabled ? {} : { error: 'Windows 开机自启仅支持 Windows 主机' }),
+        };
+    }
+    const absoluteRoot = path.resolve(runtimeRoot);
+    const scriptPath = wrapperPath(absoluteRoot);
+    if (!enabled) {
+        const result = runSchtasks(['/Delete', '/TN', WINDOWS_AUTOSTART_TASK_NAME, '/F']);
+        if (result.status !== 0 && windowsAutostartInstalled()) {
+            return {
+                ok: false,
+                enabled: true,
+                error: commandError(result, '删除 Windows 开机自启任务失败'),
+            };
+        }
+        try {
+            fs.rmSync(scriptPath, { force: true });
+        }
+        catch { }
+        return { ok: true, enabled: false };
+    }
+    let previousWrapper;
+    let previouslyInstalled = false;
+    try {
+        if (fs.existsSync(scriptPath))
+            previousWrapper = fs.readFileSync(scriptPath, 'utf8');
+        previouslyInstalled = windowsAutostartInstalled();
+        const taskScript = createWrapper(absoluteRoot);
+        const systemRoot = process.env.SystemRoot || 'C:\\Windows';
+        const powershell = path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+        const taskCommand = `${windowsCommandLiteral(powershell)} -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ${windowsCommandLiteral(taskScript)}`;
+        // Omitting /RU keeps the task attached to the user creating it and avoids a password prompt.
+        const args = [
+            '/Create',
+            '/TN', WINDOWS_AUTOSTART_TASK_NAME,
+            '/SC', 'ONLOGON',
+            '/TR', taskCommand,
+            '/RL', 'LIMITED',
+            '/F',
+        ];
+        const result = runSchtasks(args);
+        if (result.status !== 0) {
+            const restoreError = restoreWrapper(scriptPath, previousWrapper);
+            const stillInstalled = windowsAutostartInstalled();
+            const rollbackSuffix = restoreError ? `; 恢复原启动脚本失败: ${restoreError}` : '';
+            return {
+                ok: false,
+                enabled: stillInstalled,
+                error: `${commandError(result, '创建 Windows 开机自启任务失败')}${rollbackSuffix}`,
+            };
+        }
+        return { ok: true, enabled: true };
+    }
+    catch (error) {
+        const restoreError = restoreWrapper(scriptPath, previousWrapper);
+        const rollbackSuffix = restoreError ? `; 恢复原启动脚本失败: ${restoreError}` : '';
+        return {
+            ok: false,
+            enabled: previouslyInstalled,
+            error: `${error instanceof Error ? error.message : String(error)}${rollbackSuffix}`,
+        };
+    }
+}

package/ecagent/dist/agent-loop.d.ts

@@ -2,7 +2,7 @@
  * Agent loop that works with AgentMessage throughout.
  * Transforms to Message[] only at the LLM call boundary.
  */
-import { EventStream } from "ecagent/runtime/compat";
+import { EventStream } from "./runtime/compat.ts";
 import type { AgentContext, AgentEvent, AgentLoopConfig, AgentMessage, StreamFn } from "./types.ts";
 export type AgentEventSink = (event: AgentEvent) => Promise<void> | void;
 /**

package/ecagent/dist/agent-loop.js

@@ -2,7 +2,7 @@
  * Agent loop that works with AgentMessage throughout.
  * Transforms to Message[] only at the LLM call boundary.
  */
-import { EventStream, streamSimple, validateToolArguments, } from "ecagent/runtime/compat";
+import { EventStream, streamSimple, validateToolArguments, } from "./runtime/compat.js";
 /**
  * Start an agent loop with a new prompt message.
  * The prompt is added to the context and events are emitted for it.

package/ecagent/dist/agent.d.ts

@@ -1,4 +1,4 @@
-import { type ImageContent, type Message, type SimpleStreamOptions, type ThinkingBudgets, type Transport } from "ecagent/runtime/compat";
+import { type ImageContent, type Message, type SimpleStreamOptions, type ThinkingBudgets, type Transport } from "./runtime/compat.ts";
 import type { AfterToolCallContext, AfterToolCallResult, AgentEvent, AgentLoopTurnUpdate, AgentMessage, AgentState, BeforeToolCallContext, BeforeToolCallResult, PrepareNextTurnContext, QueueMode, StreamFn, ToolExecutionMode } from "./types.ts";
 export type { QueueMode } from "./types.ts";
 /** Options for constructing an {@link Agent}. */

package/ecagent/dist/agent.js

@@ -1,4 +1,4 @@
-import { streamSimple, } from "ecagent/runtime/compat";
+import { streamSimple, } from "./runtime/compat.js";
 import { runAgentLoop, runAgentLoopContinue } from "./agent-loop.js";
 function defaultConvertToLlm(messages) {
     return messages.filter((message) => message.role === "user" || message.role === "assistant" || message.role === "toolResult");

package/ecagent/dist/harness/agent-harness.d.ts

@@ -1,4 +1,4 @@
-import type { AssistantMessage, ImageContent, Model, Models } from "ecagent/runtime";
+import type { AssistantMessage, ImageContent, Model, Models } from "../runtime/index.ts";
 import type { AgentMessage, AgentTool, QueueMode, ThinkingLevel } from "../types.ts";
 import type { AbortResult, AgentHarnessEvent, AgentHarnessEventResultMap, AgentHarnessOptions, AgentHarnessOwnEvent, AgentHarnessResources, AgentHarnessStreamOptions, ExecutionEnv, NavigateTreeResult, PromptTemplate, Skill } from "./types.ts";
 export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate extends PromptTemplate = PromptTemplate, TTool extends AgentTool = AgentTool> {

package/ecagent/dist/harness/compaction/branch-summarization.d.ts

@@ -1,4 +1,4 @@
-import type { Model, Models } from "ecagent/runtime";
+import type { Model, Models } from "../../runtime/index.ts";
 import type { AgentMessage } from "../../types.ts";
 import type { BranchSummaryResult, Session, SessionTreeEntry } from "../types.ts";
 import { BranchSummaryError, type Result } from "../types.ts";

package/ecagent/dist/harness/compaction/compaction.d.ts

@@ -1,4 +1,4 @@
-import type { Model, Models, Usage } from "ecagent/runtime";
+import type { Model, Models, Usage } from "../../runtime/index.ts";
 import type { AgentMessage, ThinkingLevel } from "../../types.ts";
 import { CompactionError, type Result, type SessionTreeEntry } from "../types.ts";
 import { type FileOperations } from "./utils.ts";

package/ecagent/dist/harness/compaction/utils.d.ts

@@ -1,4 +1,4 @@
-import type { Message } from "ecagent/runtime";
+import type { Message } from "../../runtime/index.ts";
 import type { AgentMessage } from "../../types.ts";
 /** File paths touched by a session branch or compaction range. */
 export interface FileOperations {

package/ecagent/dist/harness/messages.d.ts

@@ -1,4 +1,4 @@
-import type { ImageContent, Message, TextContent } from "ecagent/runtime";
+import type { ImageContent, Message, TextContent } from "../runtime/index.ts";
 import type { AgentMessage } from "../types.ts";
 export declare const COMPACTION_SUMMARY_PREFIX = "The conversation history before this point was compacted into the following summary:\n\n<summary>\n";
 export declare const COMPACTION_SUMMARY_SUFFIX = "\n</summary>";

package/ecagent/dist/harness/session/session.d.ts

@@ -1,4 +1,4 @@
-import type { ImageContent, TextContent } from "ecagent/runtime";
+import type { ImageContent, TextContent } from "../../runtime/index.ts";
 import type { AgentMessage } from "../../types.ts";
 import type { CustomEntry, SessionContext, SessionMetadata, SessionStorage, SessionTreeEntry } from "../types.ts";
 export type ContextEntryTransform = (entries: readonly SessionTreeEntry[]) => readonly SessionTreeEntry[];

package/ecagent/dist/harness/types.d.ts

@@ -1,4 +1,4 @@
-import type { ImageContent, Model, Models, SimpleStreamOptions, TextContent, Transport } from "ecagent/runtime";
+import type { ImageContent, Model, Models, SimpleStreamOptions, TextContent, Transport } from "../runtime/index.ts";
 import type { AgentEvent, AgentMessage, AgentTool, QueueMode, ThinkingLevel } from "../index.ts";
 import type { Session } from "./session/session.ts";
 /** Result of a fallible operation. Expected failures are returned as `ok: false` instead of thrown. */

package/ecagent/dist/proxy.d.ts

@@ -2,7 +2,7 @@
  * Proxy stream function for apps that route LLM calls through a server.
  * The server manages auth and proxies requests to LLM providers.
  */
-import { type AssistantMessage, type AssistantMessageEvent, type Context, EventStream, type Model, type SimpleStreamOptions, type StopReason } from "ecagent/runtime";
+import { type AssistantMessage, type AssistantMessageEvent, type Context, EventStream, type Model, type SimpleStreamOptions, type StopReason } from "./runtime/index.ts";
 declare class ProxyMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {
     constructor();
 }

package/ecagent/dist/proxy.js

@@ -3,7 +3,7 @@
  * The server manages auth and proxies requests to LLM providers.
  */
 // Internal import for JSON parsing utility
-import { EventStream, parseStreamingJson, } from "ecagent/runtime";
+import { EventStream, parseStreamingJson, } from "./runtime/index.js";
 // Create stream class matching ProxyMessageEventStream
 class ProxyMessageEventStream extends EventStream {
     constructor() {

package/ecagent/dist/types.d.ts

@@ -1,4 +1,4 @@
-import type { Api, AssistantMessage, AssistantMessageEvent, AssistantMessageEventStream, Context, ImageContent, Message, Model, SimpleStreamOptions, TextContent, Tool, ToolResultMessage } from "ecagent/runtime";
+import type { Api, AssistantMessage, AssistantMessageEvent, AssistantMessageEventStream, Context, ImageContent, Message, Model, SimpleStreamOptions, TextContent, Tool, ToolResultMessage } from "./runtime/index.ts";
 import type { Static, TSchema } from "typebox";
 /**
  * Stream function used by the agent loop. `Models.streamSimple` satisfies

package/kits/migrations/migrate-role-config-v5.mjs

@@ -45,6 +45,17 @@ function isRecord(value) {
   return !!value && typeof value === 'object' && !Array.isArray(value);
 }
 
+function normalizeRoleEffortCompat(value) {
+  if (!isRecord(value) || !isRecord(value.permissions)
+    || !Object.prototype.hasOwnProperty.call(value.permissions, 'baseagents.codex.reasoning')) return value;
+  const permissions = { ...value.permissions };
+  if (!Object.prototype.hasOwnProperty.call(permissions, 'baseagents.codex.effort')) {
+    permissions['baseagents.codex.effort'] = permissions['baseagents.codex.reasoning'];
+  }
+  delete permissions['baseagents.codex.reasoning'];
+  return { ...value, permissions };
+}
+
 function isValidAid(name) {
   const labels = name.split('.');
   return labels.length >= 3 && labels.every(label => /^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$/.test(label));
@@ -111,7 +122,21 @@ function planMigration(home) {
     if (fs.existsSync(registryFile) && input.roles !== undefined) {
       throw new Error(`${agentFile}: both config.roles and roles/index.json exist; resolve the ambiguous role source before migration`);
     }
-    if (input.$schema_version === 5 && input.roles === undefined && fs.existsSync(registryFile)) continue;
+    if (input.$schema_version === 5 && input.roles === undefined && fs.existsSync(registryFile)) {
+      const { value: registry } = readJson(registryFile);
+      validateOrThrow(validators.registry, registry, registryFile);
+      for (const roleId of registry.roles) {
+        const roleFile = path.join(rolesDir, `${roleId}.json`);
+        if (!fs.existsSync(roleFile)) continue;
+        const { value: roleValue, text: roleText } = readJson(roleFile);
+        const normalizedRole = normalizeRoleEffortCompat(roleValue);
+        validateRoleOrThrow(validators.role, normalizedRole, roleFile);
+        if (appendChange(changes, roleFile, 'role-config', roleText, normalizedRole)) {
+          summary.rolesWritten += 1;
+        }
+      }
+      continue;
+    }
 
     const policy = isRecord(input.roles) ? input.roles : {};
     const definitions = isRecord(policy.definitions) ? policy.definitions : {};
@@ -156,7 +181,7 @@ function planMigration(home) {
     appendChange(changes, registryFile, 'role-registry', existingRegistry, registry);
     for (const [roleId, definition] of Object.entries(definitions)) {
       const roleFile = path.join(rolesDir, `${roleId}.json`);
-      const roleValue = { $schema_version: 1, ...definition };
+      const roleValue = normalizeRoleEffortCompat({ $schema_version: 1, ...definition });
       validateRoleOrThrow(validators.role, roleValue, roleFile);
       if (appendChange(changes, roleFile, 'role-config', fs.existsSync(roleFile) ? fs.readFileSync(roleFile, 'utf8') : null, roleValue)) {
         summary.rolesWritten += 1;

package/kits/schemas/agent-config.schema.10.json

@@ -144,7 +144,13 @@
     "aun": {
       "type": "object",
       "x-merge": "dict",
-      "description": "Agent 级 AUN 通信配置"
+      "description": "Agent 级 AUN 通信配置",
+      "properties": {
+        "defaultEncrypt": {
+          "not": {},
+          "description": "不支持在 Agent 配置；请使用 daemon.json.aun.defaultEncrypt"
+        }
+      }
     },
     "models": {
       "type": "object",
@@ -164,6 +170,18 @@
         "not": {
           "type": "object",
           "required": ["fallbackModels"]
+        },
+        "properties": {
+          "headers": {
+            "type": "object",
+            "propertyNames": { "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$" },
+            "additionalProperties": { "type": "string", "pattern": "^[^\\u0000\\r\\n]*$" }
+          },
+          "queryParams": {
+            "type": "object",
+            "propertyNames": { "minLength": 1 },
+            "additionalProperties": { "type": "string" }
+          }
         }
       }
     },

package/kits/schemas/daemon.schema.4.json

@@ -82,6 +82,10 @@
           "type": "boolean",
           "default": false,
           "description": "是否要求普通 AUN Menu 请求携带有效 menu_token；默认 false"
+        },
+        "defaultEncrypt": {
+          "type": "boolean",
+          "description": "所有 daemon 管理的 AUN 通道共用的出站默认加密值；省略时为 true"
         }
       }
     },

package/kits/schemas/defaults.schema.4.json

@@ -35,6 +35,16 @@
         "type": "object",
         "additionalProperties": true,
         "properties": {
+          "headers": {
+            "type": "object",
+            "propertyNames": { "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$" },
+            "additionalProperties": { "type": "string", "pattern": "^[^\\u0000\\r\\n]*$" }
+          },
+          "queryParams": {
+            "type": "object",
+            "propertyNames": { "minLength": 1 },
+            "additionalProperties": { "type": "string" }
+          },
           "fallbackModels": {
             "type": "array",
             "maxItems": 3,
@@ -68,7 +78,11 @@
       "properties": {
         "keystorePath": { "type": "string" },
         "encryptionSeed": { "type": "string" },
-        "gatewayUrl": { "type": "string" }
+        "gatewayUrl": { "type": "string" },
+        "defaultEncrypt": {
+          "not": {},
+          "description": "不支持在 Agent defaults 配置；请使用 daemon.json.aun.defaultEncrypt"
+        }
       }
     },
     "responseMode": { "type": "string", "x-merge": "scalar" },