@zhin.js/host-http 1.1.10 → 1.1.12

package/lib/console-rest-pages.d.ts

@@ -66,6 +66,7 @@ export interface ConsoleAgentSessionTree {
     resolveActiveSessionId(sessionKey: string): Promise<string | null>;
     getActiveLeafMessageId(sessionId: string): Promise<number | null>;
     listBranchPoints(sessionId: string): Promise<readonly unknown[]>;
+    readBranchMessage?(sessionId: string, messageId: number): Promise<string | null>;
     switchActiveLeaf(sessionId: string, messageId: number): Promise<boolean>;
     jumpToBranchIndex(sessionId: string, index: number): Promise<{
         ok: boolean;

package/lib/console-rest-pages.js

@@ -676,13 +676,22 @@ function registerAgentSessionRoutes(route, base, ctx) {
             error: 'Agent session tree runtime 未就绪（新 Runtime 需经 acquireAgentRuntime 装配 sessionTree）',
         });
     };
-    // HttpHost 无 `:param` 路由，用前缀路由匹配 `<sessionKey>/tree|leaf`。
+    // HttpHost 无 `:param` 路由，用前缀路由匹配 `<sessionKey>/tree|message|leaf`。
     route('GET', `${base}/agent/sessions/*`, async (_request, response, url) => {
-        const parsed = parseSessionAction(url.pathname, prefix, 'tree');
+        const messageAction = parseSessionAction(url.pathname, prefix, 'message');
+        if (messageAction)
+            response.setHeader('Cache-Control', 'no-store');
+        const parsed = messageAction ?? parseSessionAction(url.pathname, prefix, 'tree');
         if (!parsed) {
             writeJson(response, 404, { success: false, error: 'Not found' });
             return;
         }
+        const messageId = Number(url.searchParams.get('messageId'));
+        const expectedSessionId = url.searchParams.get('sessionId');
+        if (messageAction && (!Number.isSafeInteger(messageId) || messageId < 1 || !expectedSessionId)) {
+            writeJson(response, 400, { success: false, error: '需要 sessionId 和正安全整数 messageId' });
+            return;
+        }
         const lease = acquireSessionTree();
         if (!lease) {
             unavailable(response);
@@ -690,7 +699,28 @@ function registerAgentSessionRoutes(route, base, ctx) {
         }
         const runtime = lease.tree;
         try {
+            if (messageAction && !runtime.readBranchMessage) {
+                writeJson(response, 501, { success: false, error: '当前 Agent runtime 不支持读取完整消息' });
+                return;
+            }
             const sessionId = await runtime.resolveActiveSessionId(parsed.sessionKey);
+            if (messageAction) {
+                if (!sessionId) {
+                    writeJson(response, 404, { success: false, error: '未找到活跃会话' });
+                    return;
+                }
+                if (sessionId !== expectedSessionId) {
+                    writeJson(response, 409, { success: false, error: '会话已变化，请重新读取会话列表' });
+                    return;
+                }
+                const text = await runtime.readBranchMessage(sessionId, messageId);
+                if (text === null) {
+                    writeJson(response, 404, { success: false, error: '未找到此会话的用户消息' });
+                    return;
+                }
+                writeJson(response, 200, { success: true, data: { messageId, text } });
+                return;
+            }
             if (!sessionId) {
                 if (!isRuntimeImSessionKey(parsed.sessionKey)) {
                     writeJson(response, 404, {
@@ -738,7 +768,7 @@ function registerAgentSessionRoutes(route, base, ctx) {
         finally {
             lease.release();
         }
-    }, { summary: 'Get agent session tree', tags: ['console', 'agent'] });
+    }, { summary: 'Get agent session tree or message', tags: ['console', 'agent'] });
     route('POST', `${base}/agent/sessions/*`, async (request, response, url, authScope) => {
         const parsed = parseSessionAction(url.pathname, prefix, 'leaf');
         if (!parsed) {

package/lib/console-rpc-extended/contracts.d.ts

@@ -1,3 +1,9 @@
+interface LoginEndpointIdentity {
+    readonly canonicalId: string;
+    readonly instanceId: string;
+    readonly epoch: number;
+    readonly incarnationId: string;
+}
 export interface ConsoleRpcExtendedCtx {
     /** full scope 才允许写操作；demo scope 只放行只读 RPC。 */
     fullScope: boolean;
@@ -20,13 +26,14 @@ export interface ConsoleRpcExtendedCtx {
             id: string;
             adapter: string;
             endpointKey: string;
+            endpointIdentity?: LoginEndpointIdentity;
             type: string;
             payload: Record<string, unknown>;
             createdAt: number;
             expiresAt?: number;
         }[];
-        submit(id: string, value: string | Record<string, unknown>): boolean;
-        cancel(id: string, reason?: string): boolean;
+        submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
+        cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
     };
     /** Authenticated Root adapter; mutation DTOs deliberately contain no principal/decision fields. */
     workroomProfileControl?: ConsoleWorkroomProfileControlPort;
@@ -137,6 +144,33 @@ export interface InboxModel {
         where(query: Record<string, unknown>): Promise<unknown> | unknown;
     };
 }
+/** HTTP's narrow structural seam; implementations keep platform objects and credentials private. */
+export interface EndpointGroupCommand {
+    readonly groupId: string;
+    readonly signal?: AbortSignal;
+}
+export interface EndpointUserCommand {
+    readonly userId: string;
+    readonly signal?: AbortSignal;
+}
+export interface EndpointMemberCommand extends EndpointGroupCommand, EndpointUserCommand {
+}
+export interface EndpointMuteCommand extends EndpointMemberCommand {
+    readonly durationSeconds: number;
+}
+export interface EndpointAdminCommand extends EndpointMemberCommand {
+    readonly enabled: boolean;
+}
+export interface EndpointApproveCommand {
+    readonly requestId: string;
+    readonly remark?: string;
+    readonly signal?: AbortSignal;
+}
+export interface EndpointRejectCommand {
+    readonly requestId: string;
+    readonly reason?: string;
+    readonly signal?: AbortSignal;
+}
 export interface EndpointManagementPort {
     listFriends?(): Promise<readonly {
         user_id: number | string;
@@ -156,7 +190,7 @@ export interface EndpointManagementPort {
             name?: string;
         };
     }[]>;
-    listGroupMembers?(groupId: string): Promise<readonly unknown[]>;
+    listGroupMembers?(request: EndpointGroupCommand): Promise<readonly unknown[]>;
     listRequests?(): Promise<readonly {
         platform_request_id: string;
         type: string;
@@ -168,10 +202,11 @@ export interface EndpointManagementPort {
         comment?: string | null;
         created_at: number;
     }[]>;
-    approveRequest?(requestId: string, remark?: string): Promise<void>;
-    rejectRequest?(requestId: string, reason?: string): Promise<void>;
-    kickGroupMember?(groupId: string, userId: string): Promise<void>;
-    muteGroupMember?(groupId: string, userId: string, durationSeconds: number): Promise<void>;
-    setGroupAdmin?(groupId: string, userId: string, enabled: boolean): Promise<void>;
-    deleteFriend?(userId: string): Promise<void>;
+    approveRequest?(request: EndpointApproveCommand): Promise<void>;
+    rejectRequest?(request: EndpointRejectCommand): Promise<void>;
+    kickGroupMember?(request: EndpointMemberCommand): Promise<void>;
+    muteGroupMember?(request: EndpointMuteCommand): Promise<void>;
+    setGroupAdmin?(request: EndpointAdminCommand): Promise<void>;
+    deleteFriend?(request: EndpointUserCommand): Promise<void>;
 }
+export {};

package/lib/console-rpc-extended/dispatcher.js

@@ -57,22 +57,16 @@ export async function dispatchExtendedConsoleRpc(type, data, ctx) {
         case 'endpoint.group_kick':
             return groupWriteOp(d, ctx, {
                 method: 'kickGroupMember',
-                buildArgs: (gid, uid) => [gid, uid],
-                requireUser: true,
                 unsupported: '踢出群成员',
             });
         case 'endpoint.group_mute':
             return groupWriteOp(d, ctx, {
                 method: 'muteGroupMember',
-                buildArgs: (gid, uid, extra) => [gid, uid, extra.duration ?? 600],
-                requireUser: true,
                 unsupported: '禁言群成员',
             });
         case 'endpoint.group_admin':
             return groupWriteOp(d, ctx, {
                 method: 'setGroupAdmin',
-                buildArgs: (gid, uid, extra) => [gid, uid, extra.enable !== false],
-                requireUser: true,
                 unsupported: '设置群管理员',
             });
         case 'endpoint.delete_friend':

package/lib/console-rpc-extended/endpoint-rpc.d.ts

@@ -5,11 +5,6 @@ export declare function listChannels(d: Record<string, unknown>, ctx: ConsoleRpc
 export declare function listGroupMembers(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): Promise<ExtendedRpcResult>;
 interface GroupWriteSpec {
     method: 'kickGroupMember' | 'muteGroupMember' | 'setGroupAdmin';
-    buildArgs(groupId: string, userId: string, extra: {
-        duration?: number;
-        enable?: boolean;
-    }): unknown[];
-    requireUser: boolean;
     /** 中文操作名，用于"该平台不支持 xxx"。 */
     unsupported: string;
 }

package/lib/console-rpc-extended/endpoint-rpc.js

@@ -47,7 +47,7 @@ export async function listGroupMembers(d, ctx) {
         if (!method) {
             return { error: `当前适配器（${adapter}）不支持群成员列表` };
         }
-        const members = [...await method(groupId)];
+        const members = [...await method.call(management, { groupId })];
         return { data: { members, count: members.length } };
     });
 }
@@ -59,7 +59,7 @@ export async function groupWriteOp(d, ctx, spec) {
     if (!adapter || !endpointKey || !groupId) {
         return { error: 'adapter, endpointKey, and groupId are required' };
     }
-    if (spec.requireUser && !userId) {
+    if (!userId) {
         return { error: 'userId is required' };
     }
     return withLiveEndpoint(ctx, adapter, endpointKey, async (management) => {
@@ -69,13 +69,19 @@ export async function groupWriteOp(d, ctx, spec) {
         }
         const durationRaw = d.duration;
         const enableRaw = d.enable;
-        const args = spec.buildArgs(groupId, userId, {
-            duration: typeof durationRaw === 'number' && Number.isFinite(durationRaw)
-                ? durationRaw
-                : undefined,
-            enable: typeof enableRaw === 'boolean' ? enableRaw : undefined,
-        });
-        await method.call(management, ...args);
+        // The discriminant selects one typed semantic request; no argument arrays or casts.
+        switch (spec.method) {
+            case 'kickGroupMember':
+                await management.kickGroupMember({ groupId, userId });
+                break;
+            case 'muteGroupMember':
+                await management.muteGroupMember({ groupId, userId,
+                    durationSeconds: typeof durationRaw === 'number' && Number.isFinite(durationRaw) ? durationRaw : 600 });
+                break;
+            case 'setGroupAdmin':
+                await management.setGroupAdmin({ groupId, userId, enabled: enableRaw !== false });
+                break;
+        }
         return { data: { success: true } };
     });
 }
@@ -91,7 +97,7 @@ export async function deleteFriend(d, ctx) {
         if (!method) {
             return { error: '当前适配器暂不支持删除好友' };
         }
-        await method(userId);
+        await method.call(management, { userId });
         return { data: { success: true } };
     });
 }

package/lib/console-rpc-extended/inbox-rpc.js

@@ -322,7 +322,10 @@ export async function actOnRequest(type, d, ctx) {
         const extra = approve
             ? strField(d, 'remark')
             : strField(d, 'reason');
-        await method.call(management, requestId, extra || undefined);
+        if (approve)
+            await management.approveRequest({ requestId, remark: extra || undefined });
+        else
+            await management.rejectRequest({ requestId, reason: extra || undefined });
         const model = getInboxModel(ctx, TABLE_REQUEST);
         if (model && typeof model.update === 'function') {
             await model.update({ resolved: 1, resolved_at: Date.now() }).where({

package/lib/console-rpc-extended/login-rpc.js

@@ -7,6 +7,7 @@ export function listLoginPending(ctx) {
         id: task.id,
         adapter: task.adapter,
         endpointKey: task.endpointKey,
+        ...(task.endpointIdentity ? { endpointIdentity: task.endpointIdentity } : {}),
         type: task.type,
         payload: task.payload,
         createdAt: task.createdAt,
@@ -25,7 +26,10 @@ export function submitLogin(d, ctx) {
     const value = typeof raw === 'string' || (raw && typeof raw === 'object')
         ? raw
         : String(raw ?? '');
-    const ok = assist.submit(id, value);
+    const identity = readEndpointIdentity(d.endpointIdentity);
+    if (identity === false)
+        return { error: 'Invalid login Endpoint identity' };
+    const ok = identity ? assist.submit(id, value, identity) : assist.submit(id, value);
     if (!ok)
         return { error: `login task not found: ${id}` };
     return { data: { success: true } };
@@ -38,9 +42,23 @@ export function cancelLogin(d, ctx) {
     if (!id)
         return { error: 'taskId is required' };
     const reason = strField(d, 'reason') || 'cancelled';
-    const ok = assist.cancel(id, reason);
+    const identity = readEndpointIdentity(d.endpointIdentity);
+    if (identity === false)
+        return { error: 'Invalid login Endpoint identity' };
+    const ok = identity ? assist.cancel(id, reason, identity) : assist.cancel(id, reason);
     if (!ok)
         return { error: `login task not found: ${id}` };
     return { data: { success: true } };
 }
 // ---------------------------------------------------------------- 社交读取
+function readEndpointIdentity(value) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const identity = value;
+    if (Object.keys(identity).length !== 4 || typeof identity.canonicalId !== 'string' || !identity.canonicalId
+        || typeof identity.instanceId !== 'string' || !identity.instanceId || typeof identity.incarnationId !== 'string' || !identity.incarnationId || !Number.isSafeInteger(identity.epoch) || Number(identity.epoch) < 1)
+        return false;
+    return { canonicalId: identity.canonicalId, instanceId: identity.instanceId, epoch: Number(identity.epoch), incarnationId: identity.incarnationId };
+}

package/lib/console-rpc.js

@@ -838,6 +838,12 @@ function errorReply(payloads, requestId, error) {
 export function isDemoHttpAllowed(method, pathname, apiBase) {
     const normalizedBase = apiBase.replace(/\/$/u, '') || '/api';
     const m = method.toUpperCase();
+    // These handlers require an authenticated principal and verify its bound personal owner.
+    if ((m === 'GET' || m === 'PUT') && (pathname === `${normalizedBase}/agent/personal-models`
+        || pathname === `${normalizedBase}/agent/personal-session`))
+        return true;
+    if (m === 'GET' && pathname === `${normalizedBase}/agent/personal-sessions`)
+        return true;
     if (m === 'GET' && pathname === `${normalizedBase}/events`)
         return true;
     if (m === 'GET' && pathname === `${normalizedBase}/events/history`)

package/lib/http-host.js

@@ -112,26 +112,30 @@ export function createHttpHost(options = {}) {
         try {
             wss.handleUpgrade(request, socket, head, (ws) => {
                 let settled = false;
-                const retireSubscriptions = [];
+                const stopSubscriptions = [];
                 const releaseAdmissions = () => {
                     if (settled)
                         return;
                     settled = true;
-                    for (const dispose of retireSubscriptions)
-                        dispose();
+                    for (const unsubscribe of stopSubscriptions)
+                        unsubscribe();
                     for (const item of admitted)
                         item.release?.();
                 };
                 ws.once('close', releaseAdmissions);
                 ws.once('error', releaseAdmissions);
-                for (const item of admitted) {
-                    if (item.entry.admission) {
-                        retireSubscriptions.push(item.entry.admission.onDeactivate(() => {
-                            if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
-                                ws.close(1012, 'Generation retired');
-                            }
-                        }));
-                    }
+                // Replacement closes new upgrades, not accepted plugin work. Explicit Root stop
+                // still closes its sockets before waiting for their admission leases to drain.
+                const stops = new Set(admitted.map(item => item.entry.admission?.stopSignal).filter(signal => signal !== undefined));
+                for (const signal of stops) {
+                    const stop = () => {
+                        if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING)
+                            ws.close(1012, 'Root stopped');
+                    };
+                    signal.addEventListener('abort', stop, { once: true });
+                    stopSubscriptions.push(() => signal.removeEventListener('abort', stop));
+                    if (signal.aborted)
+                        stop();
                 }
                 const connection = Object.freeze({
                     socket: ws,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/host-http",
-  "version": "1.1.10",
+  "version": "1.1.12",
   "description": "Minimal HTTP and WebSocket host for Plugin Runtime (no Koa)",
   "type": "module",
   "main": "./lib/index.js",
@@ -21,7 +21,7 @@
     "@zhin.js/host-http-contract": "1.1.1",
     "@zhin.js/logger": "1.1.2",
     "@zhin.js/schedule": "1.1.3",
-    "@zhin.js/plugin-runtime": "1.1.17"
+    "@zhin.js/plugin-runtime": "1.1.18"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

package/src/console-rest-pages.ts

@@ -71,6 +71,7 @@ export interface ConsoleAgentSessionTree {
   resolveActiveSessionId(sessionKey: string): Promise<string | null>;
   getActiveLeafMessageId(sessionId: string): Promise<number | null>;
   listBranchPoints(sessionId: string): Promise<readonly unknown[]>;
+  readBranchMessage?(sessionId: string, messageId: number): Promise<string | null>;
   switchActiveLeaf(sessionId: string, messageId: number): Promise<boolean>;
   jumpToBranchIndex(
     sessionId: string,
@@ -872,13 +873,21 @@ function registerAgentSessionRoutes(
     });
   };
 
-  // HttpHost 无 `:param` 路由，用前缀路由匹配 `<sessionKey>/tree|leaf`。
+  // HttpHost 无 `:param` 路由，用前缀路由匹配 `<sessionKey>/tree|message|leaf`。
   route('GET', `${base}/agent/sessions/*`, async (_request, response, url) => {
-    const parsed = parseSessionAction(url.pathname, prefix, 'tree');
+    const messageAction = parseSessionAction(url.pathname, prefix, 'message');
+    if (messageAction) response.setHeader('Cache-Control', 'no-store');
+    const parsed = messageAction ?? parseSessionAction(url.pathname, prefix, 'tree');
     if (!parsed) {
       writeJson(response, 404, { success: false, error: 'Not found' });
       return;
     }
+    const messageId = Number(url.searchParams.get('messageId'));
+    const expectedSessionId = url.searchParams.get('sessionId');
+    if (messageAction && (!Number.isSafeInteger(messageId) || messageId < 1 || !expectedSessionId)) {
+      writeJson(response, 400, { success: false, error: '需要 sessionId 和正安全整数 messageId' });
+      return;
+    }
     const lease = acquireSessionTree();
     if (!lease) {
       unavailable(response);
@@ -886,7 +895,28 @@ function registerAgentSessionRoutes(
     }
     const runtime = lease.tree;
     try {
+      if (messageAction && !runtime.readBranchMessage) {
+        writeJson(response, 501, { success: false, error: '当前 Agent runtime 不支持读取完整消息' });
+        return;
+      }
       const sessionId = await runtime.resolveActiveSessionId(parsed.sessionKey);
+      if (messageAction) {
+        if (!sessionId) {
+          writeJson(response, 404, { success: false, error: '未找到活跃会话' });
+          return;
+        }
+        if (sessionId !== expectedSessionId) {
+          writeJson(response, 409, { success: false, error: '会话已变化，请重新读取会话列表' });
+          return;
+        }
+        const text = await runtime.readBranchMessage!(sessionId, messageId);
+        if (text === null) {
+          writeJson(response, 404, { success: false, error: '未找到此会话的用户消息' });
+          return;
+        }
+        writeJson(response, 200, { success: true, data: { messageId, text } });
+        return;
+      }
       if (!sessionId) {
         if (!isRuntimeImSessionKey(parsed.sessionKey)) {
           writeJson(response, 404, {
@@ -934,7 +964,7 @@ function registerAgentSessionRoutes(
     } finally {
       lease.release();
     }
-  }, { summary: 'Get agent session tree', tags: ['console', 'agent'] });
+  }, { summary: 'Get agent session tree or message', tags: ['console', 'agent'] });
 
   route('POST', `${base}/agent/sessions/*`, async (request, response, url, authScope) => {
     const parsed = parseSessionAction(url.pathname, prefix, 'leaf');
@@ -1038,7 +1068,7 @@ function isRuntimeImSessionKey(value: string): boolean {
 function parseSessionAction(
   pathname: string,
   prefix: string,
-  action: 'tree' | 'leaf',
+  action: 'tree' | 'message' | 'leaf',
 ): { sessionKey: string } | null {
   if (!pathname.startsWith(prefix)) return null;
   const rest = pathname.slice(prefix.length).replace(/\/+$/u, '');

package/src/console-rpc-extended/contracts.ts

@@ -1,3 +1,10 @@
+interface LoginEndpointIdentity {
+  readonly canonicalId: string;
+  readonly instanceId: string;
+  readonly epoch: number;
+  readonly incarnationId: string;
+}
+
 export interface ConsoleRpcExtendedCtx {
   /** full scope 才允许写操作；demo scope 只放行只读 RPC。 */
   fullScope: boolean;
@@ -20,13 +27,14 @@ export interface ConsoleRpcExtendedCtx {
       id: string;
       adapter: string;
       endpointKey: string;
+      endpointIdentity?: LoginEndpointIdentity;
       type: string;
       payload: Record<string, unknown>;
       createdAt: number;
       expiresAt?: number;
     }[];
-    submit(id: string, value: string | Record<string, unknown>): boolean;
-    cancel(id: string, reason?: string): boolean;
+    submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
+    cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
   };
   /** Authenticated Root adapter; mutation DTOs deliberately contain no principal/decision fields. */
   workroomProfileControl?: ConsoleWorkroomProfileControlPort;
@@ -126,6 +134,15 @@ export interface InboxModel {
   };
 }
 
+/** HTTP's narrow structural seam; implementations keep platform objects and credentials private. */
+export interface EndpointGroupCommand { readonly groupId: string; readonly signal?: AbortSignal }
+export interface EndpointUserCommand { readonly userId: string; readonly signal?: AbortSignal }
+export interface EndpointMemberCommand extends EndpointGroupCommand, EndpointUserCommand {}
+export interface EndpointMuteCommand extends EndpointMemberCommand { readonly durationSeconds: number }
+export interface EndpointAdminCommand extends EndpointMemberCommand { readonly enabled: boolean }
+export interface EndpointApproveCommand { readonly requestId: string; readonly remark?: string; readonly signal?: AbortSignal }
+export interface EndpointRejectCommand { readonly requestId: string; readonly reason?: string; readonly signal?: AbortSignal }
+
 export interface EndpointManagementPort {
   listFriends?(): Promise<readonly { user_id: number | string; nickname: string; remark: string }[]>;
   listGroups?(): Promise<readonly { group_id: number | string; name: string }[]>;
@@ -134,7 +151,7 @@ export interface EndpointManagementPort {
     name?: string;
     parent?: { type: string; id: string; name?: string };
   }[]>;
-  listGroupMembers?(groupId: string): Promise<readonly unknown[]>;
+  listGroupMembers?(request: EndpointGroupCommand): Promise<readonly unknown[]>;
   listRequests?(): Promise<readonly {
     platform_request_id: string;
     type: string;
@@ -146,10 +163,10 @@ export interface EndpointManagementPort {
     comment?: string | null;
     created_at: number;
   }[]>;
-  approveRequest?(requestId: string, remark?: string): Promise<void>;
-  rejectRequest?(requestId: string, reason?: string): Promise<void>;
-  kickGroupMember?(groupId: string, userId: string): Promise<void>;
-  muteGroupMember?(groupId: string, userId: string, durationSeconds: number): Promise<void>;
-  setGroupAdmin?(groupId: string, userId: string, enabled: boolean): Promise<void>;
-  deleteFriend?(userId: string): Promise<void>;
+  approveRequest?(request: EndpointApproveCommand): Promise<void>;
+  rejectRequest?(request: EndpointRejectCommand): Promise<void>;
+  kickGroupMember?(request: EndpointMemberCommand): Promise<void>;
+  muteGroupMember?(request: EndpointMuteCommand): Promise<void>;
+  setGroupAdmin?(request: EndpointAdminCommand): Promise<void>;
+  deleteFriend?(request: EndpointUserCommand): Promise<void>;
 }

package/src/console-rpc-extended/dispatcher.ts

@@ -77,22 +77,16 @@ export async function dispatchExtendedConsoleRpc(
     case 'endpoint.group_kick':
       return groupWriteOp(d, ctx, {
         method: 'kickGroupMember',
-        buildArgs: (gid, uid) => [gid, uid],
-        requireUser: true,
         unsupported: '踢出群成员',
       });
     case 'endpoint.group_mute':
       return groupWriteOp(d, ctx, {
         method: 'muteGroupMember',
-        buildArgs: (gid, uid, extra) => [gid, uid, extra.duration ?? 600],
-        requireUser: true,
         unsupported: '禁言群成员',
       });
     case 'endpoint.group_admin':
       return groupWriteOp(d, ctx, {
         method: 'setGroupAdmin',
-        buildArgs: (gid, uid, extra) => [gid, uid, extra.enable !== false],
-        requireUser: true,
         unsupported: '设置群管理员',
       });
     case 'endpoint.delete_friend':

package/src/console-rpc-extended/endpoint-rpc.ts

@@ -61,7 +61,7 @@ export async function listGroupMembers(
     if (!method) {
       return { error: `当前适配器（${adapter}）不支持群成员列表` };
     }
-    const members = [...await method(groupId)];
+    const members = [...await method.call(management, { groupId })];
     return { data: { members, count: members.length } };
   });
 }
@@ -70,8 +70,6 @@ export async function listGroupMembers(
 
 interface GroupWriteSpec {
   method: 'kickGroupMember' | 'muteGroupMember' | 'setGroupAdmin';
-  buildArgs(groupId: string, userId: string, extra: { duration?: number; enable?: boolean }): unknown[];
-  requireUser: boolean;
   /** 中文操作名，用于"该平台不支持 xxx"。 */
   unsupported: string;
 }
@@ -88,7 +86,7 @@ export async function groupWriteOp(
   if (!adapter || !endpointKey || !groupId) {
     return { error: 'adapter, endpointKey, and groupId are required' };
   }
-  if (spec.requireUser && !userId) {
+  if (!userId) {
     return { error: 'userId is required' };
   }
   return withLiveEndpoint(ctx, adapter, endpointKey, async (management) => {
@@ -98,13 +96,19 @@ export async function groupWriteOp(
     }
     const durationRaw = d.duration;
     const enableRaw = d.enable;
-    const args = spec.buildArgs(groupId, userId, {
-      duration: typeof durationRaw === 'number' && Number.isFinite(durationRaw)
-        ? durationRaw
-        : undefined,
-      enable: typeof enableRaw === 'boolean' ? enableRaw : undefined,
-    });
-    await (method as (...args: unknown[]) => Promise<void>).call(management, ...args);
+    // The discriminant selects one typed semantic request; no argument arrays or casts.
+    switch (spec.method) {
+      case 'kickGroupMember':
+        await management.kickGroupMember!({ groupId, userId });
+        break;
+      case 'muteGroupMember':
+        await management.muteGroupMember!({ groupId, userId,
+          durationSeconds: typeof durationRaw === 'number' && Number.isFinite(durationRaw) ? durationRaw : 600 });
+        break;
+      case 'setGroupAdmin':
+        await management.setGroupAdmin!({ groupId, userId, enabled: enableRaw !== false });
+        break;
+    }
     return { data: { success: true } };
   });
 }
@@ -124,7 +128,7 @@ export async function deleteFriend(
     if (!method) {
       return { error: '当前适配器暂不支持删除好友' };
     }
-    await method(userId);
+    await method.call(management, { userId });
     return { data: { success: true } };
   });
 }

package/src/console-rpc-extended/inbox-rpc.ts

@@ -364,7 +364,8 @@ export async function actOnRequest(
     const extra = approve
       ? strField(d, 'remark')
       : strField(d, 'reason');
-    await method.call(management, requestId, extra || undefined);
+    if (approve) await management.approveRequest!({ requestId, remark: extra || undefined });
+    else await management.rejectRequest!({ requestId, reason: extra || undefined });
     const model = getInboxModel(ctx, TABLE_REQUEST);
     if (model && typeof model.update === 'function') {
       await model.update({resolved: 1, resolved_at: Date.now()}).where({

package/src/console-rpc-extended/login-rpc.ts

@@ -8,6 +8,7 @@ export function listLoginPending(ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult
     id: task.id,
     adapter: task.adapter,
     endpointKey: task.endpointKey,
+    ...(task.endpointIdentity ? { endpointIdentity: task.endpointIdentity } : {}),
     type: task.type,
     payload: task.payload,
     createdAt: task.createdAt,
@@ -28,7 +29,9 @@ export function submitLogin(
   const value = typeof raw === 'string' || (raw && typeof raw === 'object')
     ? raw as string | Record<string, unknown>
     : String(raw ?? '');
-  const ok = assist.submit(id, value);
+  const identity = readEndpointIdentity(d.endpointIdentity);
+  if (identity === false) return { error: 'Invalid login Endpoint identity' };
+  const ok = identity ? assist.submit(id, value, identity) : assist.submit(id, value);
   if (!ok) return { error: `login task not found: ${id}` };
   return { data: { success: true } };
 }
@@ -42,9 +45,20 @@ export function cancelLogin(
   const id = strField(d, 'taskId');
   if (!id) return { error: 'taskId is required' };
   const reason = strField(d, 'reason') || 'cancelled';
-  const ok = assist.cancel(id, reason);
+  const identity = readEndpointIdentity(d.endpointIdentity);
+  if (identity === false) return { error: 'Invalid login Endpoint identity' };
+  const ok = identity ? assist.cancel(id, reason, identity) : assist.cancel(id, reason);
   if (!ok) return { error: `login task not found: ${id}` };
   return { data: { success: true } };
 }
 
 // ---------------------------------------------------------------- 社交读取
+
+function readEndpointIdentity(value: unknown): { readonly canonicalId: string; readonly instanceId: string; readonly epoch: number; readonly incarnationId: string } | false | undefined {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const identity = value as Record<string, unknown>;
+  if (Object.keys(identity).length !== 4 || typeof identity.canonicalId !== 'string' || !identity.canonicalId
+    || typeof identity.instanceId !== 'string' || !identity.instanceId || typeof identity.incarnationId !== 'string' || !identity.incarnationId || !Number.isSafeInteger(identity.epoch) || Number(identity.epoch) < 1) return false;
+  return { canonicalId: identity.canonicalId, instanceId: identity.instanceId, epoch: Number(identity.epoch), incarnationId: identity.incarnationId };
+}

package/src/console-rpc.ts

@@ -1056,6 +1056,10 @@ function errorReply(
 export function isDemoHttpAllowed(method: string, pathname: string, apiBase: string): boolean {
   const normalizedBase = apiBase.replace(/\/$/u, '') || '/api';
   const m = method.toUpperCase();
+  // These handlers require an authenticated principal and verify its bound personal owner.
+  if ((m === 'GET' || m === 'PUT') && (pathname === `${normalizedBase}/agent/personal-models`
+    || pathname === `${normalizedBase}/agent/personal-session`)) return true;
+  if (m === 'GET' && pathname === `${normalizedBase}/agent/personal-sessions`) return true;
   if (m === 'GET' && pathname === `${normalizedBase}/events`) return true;
   if (m === 'GET' && pathname === `${normalizedBase}/events/history`) return true;
   if (m === 'GET' && DEMO_INTROSPECTION_PATHS.has(pathname.slice(normalizedBase.length))) return true;

package/src/http-host.ts

@@ -256,23 +256,25 @@ export function createHttpHost(options: HttpHostOptions = {}): ProcessHttpHost {
     try {
       wss.handleUpgrade(request, socket, head, (ws) => {
         let settled = false;
-        const retireSubscriptions: Array<() => void> = [];
+        const stopSubscriptions: Array<() => void> = [];
         const releaseAdmissions = () => {
           if (settled) return;
           settled = true;
-          for (const dispose of retireSubscriptions) dispose();
+          for (const unsubscribe of stopSubscriptions) unsubscribe();
           for (const item of admitted) item.release?.();
         };
         ws.once('close', releaseAdmissions);
         ws.once('error', releaseAdmissions);
-        for (const item of admitted) {
-          if (item.entry.admission) {
-            retireSubscriptions.push(item.entry.admission.onDeactivate(() => {
-              if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
-              ws.close(1012, 'Generation retired');
-              }
-            }));
-          }
+        // Replacement closes new upgrades, not accepted plugin work. Explicit Root stop
+        // still closes its sockets before waiting for their admission leases to drain.
+        const stops = new Set(admitted.map(item => item.entry.admission?.stopSignal).filter(signal => signal !== undefined));
+        for (const signal of stops) {
+          const stop = () => {
+            if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) ws.close(1012, 'Root stopped');
+          };
+          signal.addEventListener('abort', stop, { once: true });
+          stopSubscriptions.push(() => signal.removeEventListener('abort', stop));
+          if (signal.aborted) stop();
         }
         const connection = Object.freeze({
           socket: ws,