ec-web 0.0.21 → 0.0.22

package/dist/ipc-client.js

@@ -12,7 +12,13 @@ import path from 'path';
 // Keep this list aligned with evolcore's local-control IPC gate.  `evolagent.list`
 // is used by the Agents view and is read-only from EC Web's perspective, but the
 // daemon still requires the local control token before returning its registry.
-const LOCAL_CONTROL_COMMANDS = new Set(['evolagent.list', 'menu.exec', 'monitor-snapshot']);
+const LOCAL_CONTROL_COMMANDS = new Set([
+    'evolagent.list',
+    'menu.exec',
+    'monitor-snapshot',
+    'monitor-subscribe',
+    'monitor-unsubscribe',
+]);
 export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
     let request = cmd;
     if (LOCAL_CONTROL_COMMANDS.has(cmd.type) && typeof cmd.controlToken !== 'string') {

package/dist/paths.js

@@ -25,10 +25,27 @@ export function resolveRoot() {
     }
     return _root;
 }
+function stripTrailingWindowsSeparators(value) {
+    const stripped = value.replace(/[\\/]+$/g, '');
+    // Keep a drive-root separator. `C:` is a drive-relative path on Windows.
+    if (/^[a-zA-Z]:$/.test(stripped) && /^[a-zA-Z]:[\\/]+$/.test(value)) {
+        return `${stripped}\\`;
+    }
+    return stripped;
+}
+/**
+ * Canonicalize EVOLCORE_HOME exactly like the main EvolCore package does.
+ * The CLI and EC Web may receive the same Windows directory with different
+ * casing, slash styles, or a trailing separator; all must select one pipe.
+ */
+export function normalizeWindowsSocketRoot(root) {
+    return stripTrailingWindowsSeparators(path.win32.resolve(root)).toLowerCase();
+}
 /** socket 路径派生：与 evolcore resolveInstanceSocketPath 完全一致 */
 function resolveInstanceSocketPath(root) {
     if (isWindows) {
-        const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 12);
+        const canonicalRoot = normalizeWindowsSocketRoot(root);
+        const hash = crypto.createHash('sha1').update(canonicalRoot).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\daemon-${hash}`;
     }
     return path.join(root, 'data', 'instance', 'daemon.sock');

package/dist/server.js

@@ -555,7 +555,30 @@ function handleConnection(ws, req, log, tokenRecord) {
             send({ type: 'error', message: `unknown view: ${view}` });
             return;
         }
-        const sourceParams = { ...params, __menuAuth: daemonOwnerMenuAuth(localDirect, actorAid) };
+        const sourceParams = {
+            ...params,
+            __menuAuth: daemonOwnerMenuAuth(localDirect, actorAid),
+            __ecwebRequestId: crypto.randomUUID(),
+            __ecwebEndpoint: `WS snapshot:${view}`,
+        };
+        let deactivate = null;
+        if (source.activate) {
+            try {
+                deactivate = await source.activate(sourceParams);
+            }
+            catch (e) {
+                if (generation === subscriptionGeneration)
+                    send({ type: 'error', message: `subscription failed: ${e?.message || e}` });
+                return;
+            }
+            if (generation !== subscriptionGeneration) {
+                deactivate();
+                return;
+            }
+            // Install cleanup before awaiting the initial snapshot, so a view switch
+            // or socket close releases the monitor lease immediately.
+            unsubscribe = deactivate;
+        }
         // System 视图：把 ECWeb 自身版本合并进快照（前端版本卡用）
         const decorate = (data) => (view === 'system' && data ? { ...data, ecwebVersion: ECWEB_VERSION } : data);
         let initialSnapshot;
@@ -570,16 +593,30 @@ function handleConnection(ws, req, log, tokenRecord) {
                 return;
             send({ type: 'error', message: `snapshot failed: ${e?.message || e}` });
         }
-        const nextUnsubscribe = source.subscribe(sourceParams, (data) => {
-            if (generation === subscriptionGeneration && currentView === view) {
-                send({ type: 'delta', view, data: decorate(data) });
+        let nextUnsubscribe;
+        try {
+            nextUnsubscribe = source.subscribe(sourceParams, (data) => {
+                if (generation === subscriptionGeneration && currentView === view) {
+                    send({ type: 'delta', view, data: decorate(data) });
+                }
+            });
+        }
+        catch (e) {
+            deactivate?.();
+            if (generation === subscriptionGeneration) {
+                unsubscribe = null;
+                send({ type: 'error', message: `subscription failed: ${e?.message || e}` });
             }
-        });
+            return;
+        }
         if (generation !== subscriptionGeneration) {
             nextUnsubscribe();
             return;
         }
-        unsubscribe = nextUnsubscribe;
+        unsubscribe = () => {
+            nextUnsubscribe();
+            deactivate?.();
+        };
     };
     ws.on('message', async (raw) => {
         let msg;

package/dist/sources/monitor.js

@@ -14,6 +14,7 @@
 import fs from 'node:fs';
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc-client.js';
+import crypto from 'node:crypto';
 function processGroupKey(process) {
     return `${process.kind}\u0000${process.name}`;
 }
@@ -192,9 +193,9 @@ function sampleNetworkRate(ts) {
     previousNetworkSample = { ...totals, ts };
     return latestNetworkRate;
 }
-async function fetchSnapshot() {
+async function fetchSnapshot(leaseId) {
     const p = resolvePaths();
-    const resp = await ipcQuery(p.socket, { type: 'monitor-snapshot' }, 3000);
+    const resp = await ipcQuery(p.socket, { type: 'monitor-snapshot', ...(leaseId ? { leaseId } : {}) }, 3000);
     // resp === null → daemon 离线或 socket 不可达；resp.ok === false → 命令不受支持（旧 daemon）
     if (!resp?.ok) {
         return { daemonRunning: resp !== null, snapshot: null, history: { fine: [], mid: [], coarse: [] } };
@@ -237,8 +238,24 @@ async function fetchSnapshot() {
 }
 export const monitorSource = {
     kind: 'monitor',
-    async snapshot() {
-        return fetchSnapshot();
+    async activate(params) {
+        const leaseId = crypto.randomUUID();
+        const p = resolvePaths();
+        const response = await ipcQuery(p.socket, { type: 'monitor-subscribe', leaseId }, 3000);
+        if (!response?.ok)
+            throw new Error('daemon rejected monitor subscription');
+        params.__monitorLeaseId = leaseId;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            delete params.__monitorLeaseId;
+            void ipcQuery(p.socket, { type: 'monitor-unsubscribe', leaseId }, 3000);
+        };
+    },
+    async snapshot(params) {
+        return fetchSnapshot(params?.__monitorLeaseId);
     },
     subscribe(_params, push) {
         let lastJson = '';
@@ -247,7 +264,7 @@ export const monitorSource = {
             if (stopped)
                 return;
             try {
-                const snap = await fetchSnapshot();
+                const snap = await fetchSnapshot(_params.__monitorLeaseId);
                 const json = JSON.stringify(snap);
                 if (json !== lastJson) {
                     lastJson = json;

package/dist/sources/relation-roles.js

@@ -1,8 +1,17 @@
 import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../paths.js';
-import { getSessionsAunDir, listPeers, readJsonFile, readMessages, } from '../fs-utils.js';
+import { getSessionsAunDir, isTransientProtocolMessage, readJsonFile, readAllJsonlLines, scanChatDirs, } from '../fs-utils.js';
 import { resolveParentDistModule, toFileUrl } from './parent-package.js';
+import crypto from 'node:crypto';
+function ecwebAuditContext(auth, aid, operation) {
+    return {
+        ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+        targetAgentAid: aid,
+        endpoint: auth.endpoint ?? 'ECWeb relation roles',
+        logicalToolName: operation,
+    };
+}
 async function getParentModules() {
     const configPath = resolveParentDistModule('config', 'config-manager.js');
     const rolesPath = resolveParentDistModule('config', 'roles.js');
@@ -116,6 +125,7 @@ async function authorizeRoleAssignmentRead(modules, aid, auth) {
         reason: decision.allow ? undefined : decision.reason,
         matchedRule: decision.matchedRule,
         argsSummary: { self: aid },
+        ...ecwebAuditContext(auth, aid, 'role.relation.read'),
     });
     if (decision.allow)
         return { allow: true, actorRole: actor.actorRole };
@@ -150,6 +160,7 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             code: 'IMMUTABLE_STATIC_OWNER',
             reason,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -194,6 +205,7 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             reason: decision.reason,
             matchedRule: decision.matchedRule,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -227,6 +239,7 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             reason,
             matchedRule: decision.matchedRule,
             argsSummary: { ...args, targetRole },
+            ...ecwebAuditContext(auth, aid, operation),
         });
         return {
             allow: false,
@@ -251,6 +264,7 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
         decision: 'allow',
         matchedRule: decision.matchedRule,
         argsSummary: { ...args, targetRole },
+        ...ecwebAuditContext(auth, aid, operation),
     });
     return { allow: true, actorRole };
 }
@@ -323,12 +337,6 @@ function relationTargetFromId(raw) {
     }
     return { peerKey: formatPeerKey('aun', value), channelId: value };
 }
-function readActive(aunDir, aid, conversationId) {
-    return readJsonFile(path.join(aunDir, encodeSegmentForRoleSource(aid), encodeSegmentForRoleSource(conversationId), 'active.json'));
-}
-function encodeSegmentForRoleSource(s) {
-    return s.replace(/[<>:"/\\|?*\x00-\x1F%]/g, ch => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
-}
 function frontmatterValue(frontmatter, key) {
     const re = new RegExp(`^${key}:\\s*(?:"([^"]*)"|'([^']*)'|([^\\r\\n#]*))\\s*(?:#.*)?$`, 'm');
     const match = frontmatter.match(re);
@@ -380,6 +388,20 @@ function createLocalAgentMdLookup() {
         return info;
     };
 }
+function readPeerVerificationStatus(selfAid, peerId) {
+    if (!selfAid || !peerId)
+        return 'unknown';
+    const peerKey = formatPeerKey('aun', peerId);
+    const identity = readJsonFile(path.join(resolvePaths().root, 'agents', selfAid, 'relations', peerKey, 'peer-identity.json'));
+    const raw = String(identity?.source ?? identity?.verifyStatus ?? identity?.verify_status ?? '').trim().toLowerCase();
+    if (raw === 'agentmd' || raw === 'verified')
+        return 'agentmd';
+    if (raw === 'agentmd-unverified' || raw === 'unverified')
+        return 'agentmd-unverified';
+    if (raw === 'invalid')
+        return 'invalid';
+    return 'unknown';
+}
 function latestMessageAt(messages) {
     let lastAt = 0;
     for (const message of messages) {
@@ -418,7 +440,7 @@ function firstMessagePeerType(messages, peerId) {
 function conversationSortName(seed) {
     return (seed.name || seed.peerAid || seed.groupId || seed.conversationId).toLowerCase();
 }
-function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
+function groupMembersFromMessages(selfAid, messages, localAgentMdLookup, peerVerificationLookup) {
     const members = new Map();
     for (const message of messages) {
         const sender = message.from;
@@ -448,6 +470,7 @@ function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
         const localInfo = localAgentMdLookup(member.peerId);
         member.peerName = localInfo?.name ?? member.peerName;
         member.peerType = localInfo?.peerType ?? member.peerType;
+        member.verifyStatus = peerVerificationLookup(selfAid, member.peerId);
     }
     return [...members.values()].sort((a, b) => {
         const lastDiff = (b.lastAt ?? 0) - (a.lastAt ?? 0);
@@ -456,7 +479,7 @@ function groupMembersFromMessages(selfAid, messages, localAgentMdLookup) {
         return (a.peerName || a.peerAid).localeCompare(b.peerName || b.peerAid);
     });
 }
-export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () => undefined) {
+export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () => undefined, peerVerificationLookup = readPeerVerificationStatus) {
     const seeds = [];
     for (const peer of peerInfos) {
         const messages = peer.messages || [];
@@ -478,7 +501,7 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
                 lastAt,
                 inbound: counts.inbound,
                 outbound: counts.outbound,
-                members: groupMembersFromMessages(aid, messages, localAgentMdLookup),
+                members: groupMembersFromMessages(aid, messages, localAgentMdLookup, peerVerificationLookup),
             });
             continue;
         }
@@ -499,6 +522,7 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
             peerKey: peerId,
             peerName,
             peerType,
+            verifyStatus: peerVerificationLookup(aid, peerId),
             lastAt,
             inbound: counts.inbound,
             outbound: counts.outbound,
@@ -515,13 +539,20 @@ export function buildConversationSeeds(aid, peerInfos, localAgentMdLookup = () =
 }
 function loadConversationSeeds(aid) {
     const aunDir = getSessionsAunDir();
+    const peerInfoById = new Map();
+    for (const chat of scanChatDirs(aunDir).filter(item => item.channelType === 'aun' && item.selfAID === aid)) {
+        const current = peerInfoById.get(chat.channelId) ?? { conversationId: chat.channelId, messages: [] };
+        const active = readJsonFile(path.join(chat.dirPath, 'active.json'));
+        if (active && (!current.active || Number(active.updatedAt || 0) >= Number(current.active.updatedAt || 0))) {
+            current.active = active;
+        }
+        current.messages.push(...readAllJsonlLines(path.join(chat.dirPath, 'messages.jsonl'))
+            .filter(message => !isTransientProtocolMessage(message)));
+        peerInfoById.set(chat.channelId, current);
+    }
     const localAgentMdLookup = createLocalAgentMdLookup();
-    const peerInfos = listPeers(aunDir, aid).map(conversationId => ({
-        conversationId,
-        active: readActive(aunDir, aid, conversationId),
-        messages: readMessages(aunDir, aid, conversationId),
-    }));
-    return buildConversationSeeds(aid, peerInfos, localAgentMdLookup);
+    const peerInfos = [...peerInfoById.values()];
+    return buildConversationSeeds(aid, peerInfos, localAgentMdLookup, readPeerVerificationStatus);
 }
 function readRelationConfig(config, aid, peerKey) {
     return config.read(config.ConfigTarget.Relation, { self: aid, peerKey }, { cache: true }) || {};
@@ -648,6 +679,11 @@ function listRelationRoleAssignments(config, aid) {
     return out;
 }
 async function buildSnapshot(auth = {}) {
+    auth = {
+        ...auth,
+        ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+        endpoint: auth.endpoint ?? 'WS snapshot:roles',
+    };
     const modules = await getParentModules();
     const agents = await getAgentsFromIpc();
     const snapshotAgents = [];
@@ -678,7 +714,11 @@ export const relationRolesSource = {
     kind: 'roles',
     async snapshot(params = {}) {
         try {
-            return await buildSnapshot(params.__menuAuth ?? {});
+            return await buildSnapshot({
+                ...(params.__menuAuth ?? {}),
+                ecwebRequestId: params.__ecwebRequestId,
+                endpoint: params.__ecwebEndpoint,
+            });
         }
         catch (err) {
             return { agents: [], conversations: [], error: String(err) };
@@ -765,6 +805,11 @@ function deleteScopedAssignment(configMod, aid, body, fallbackTargetId) {
 export async function handleRelationRolesApi(req, res, auth = {}) {
     try {
         const urlPath = (req.url || '').split('?')[0];
+        auth = {
+            ...auth,
+            ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: auth.endpoint ?? `${req.method ?? 'UNKNOWN'} ${urlPath}`,
+        };
         const modules = await getParentModules();
         if (req.method === 'GET' && urlPath.startsWith('/api/roles/agent/')) {
             const aid = decodeURIComponent(urlPath.split('/').filter(Boolean).pop() || '');
@@ -802,6 +847,11 @@ export async function handleRelationRolesApi(req, res, auth = {}) {
 export async function handlePeerRoleApi(req, res, auth = {}) {
     try {
         const urlPath = (req.url || '').split('?')[0];
+        auth = {
+            ...auth,
+            ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: auth.endpoint ?? `${req.method ?? 'UNKNOWN'} ${urlPath}`,
+        };
         const target = assignmentFromPath(urlPath);
         if (!target)
             return sendJson(res, 400, { error: 'missing aid or target id' });

package/dist/sources/role-definitions.js

@@ -14,6 +14,7 @@
 import { getModelCatalogSnapshot } from './models.js';
 import { resolveParentDistModule, toFileUrl } from './parent-package.js';
 import { resolvePaths } from '../paths.js';
+import crypto from 'node:crypto';
 // 动态导入 evolcore 主项目的角色配置模块
 async function getRolesModule() {
     const rolesPath = resolveParentDistModule('config', 'roles.js');
@@ -82,6 +83,14 @@ async function getOperationRegistryModule() {
         listOperations: mod.listOperations,
     };
 }
+function ecwebAuditContext(auth, aid, operation) {
+    return {
+        ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+        targetAgentAid: aid,
+        endpoint: auth.endpoint ?? 'ECWeb role policy',
+        logicalToolName: operation,
+    };
+}
 export function visibleRoleDefinitionOptions(roleOptions) {
     return roleOptions
         .filter(item => item?.kind === 'user' || item?.value === 'admin')
@@ -142,6 +151,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
                 ...args,
             },
         },
+        auditMetadata: ecwebAuditContext(auth, aid, operation),
     });
 }
 function isDaemonOwnerAuth(processConfig, auth) {
@@ -574,6 +584,11 @@ async function buildModelPermissionResponse(roleName, roleDef, override) {
 }
 async function buildSnapshot(params = {}, auth = {}) {
     try {
+        auth = {
+            ...auth,
+            ecwebRequestId: params.__ecwebRequestId ?? auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: params.__ecwebEndpoint ?? auth.endpoint ?? 'WS snapshot:roleDefinitions',
+        };
         const agents = await getAgentsFromIpc();
         const aid = resolveRequestedAid(params.aid, agents);
         if (!aid)
@@ -614,7 +629,11 @@ async function buildSnapshot(params = {}, auth = {}) {
 export const roleDefinitionsSource = {
     kind: 'roleDefinitions',
     async snapshot(params = {}) {
-        return buildSnapshot(params, params.__menuAuth ?? {});
+        return buildSnapshot(params, {
+            ...(params.__menuAuth ?? {}),
+            ecwebRequestId: params.__ecwebRequestId,
+            endpoint: params.__ecwebEndpoint,
+        });
     },
     subscribe(_params, _push) {
         return () => { };
@@ -625,6 +644,11 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
     try {
         const parsedUrl = parseUrl(req.url || '');
         const urlPath = parsedUrl.path;
+        auth = {
+            ...auth,
+            ecwebRequestId: auth.ecwebRequestId ?? crypto.randomUUID(),
+            endpoint: auth.endpoint ?? `${req.method ?? 'UNKNOWN'} ${urlPath}`,
+        };
         const agents = await getAgentsFromIpc();
         const aid = resolveRequestedAid(parsedUrl.query.aid, agents);
         const modules = await getRolesModule();
@@ -693,7 +717,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
             }
         }
         if (req.method === 'GET' && urlPath === '/api/role-definitions') {
-            sendJson(res, 200, await buildSnapshot({ aid }, auth));
+            sendJson(res, 200, await buildSnapshot({ aid, __ecwebRequestId: auth.ecwebRequestId, __ecwebEndpoint: auth.endpoint }, auth));
             return;
         }
         if (req.method === 'PUT' && urlPath === '/api/role-definitions') {
@@ -755,7 +779,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                     }
                     writeRoleRegistry(modules, aid, nextDefaults);
                 }
-                sendJson(res, 200, { ok: true, data: await buildSnapshot({ aid }, auth) });
+                sendJson(res, 200, { ok: true, data: await buildSnapshot({ aid, __ecwebRequestId: auth.ecwebRequestId, __ecwebEndpoint: auth.endpoint }, auth) });
             }
             catch (err) {
                 console.error('[role-definitions] Failed to update agent role config:', err);

package/dist/sources/session-codex.js

@@ -581,20 +581,32 @@ function approvalAuditFromPayload(payload) {
 }
 function classifyCodexToolRejection(text, payload) {
     const normalized = text.replace(/\\(["'])/g, '$1');
-    if (!/Rejected\(\s*["']rejected by user["']\s*\)/i.test(normalized))
+    const hookMatch = normalized.match(/(?:Command|Tool call) blocked by PreToolUse hook:\s*(.+?)(?:\.\s+(?:Command|Tool):|$)/is);
+    const genericRejected = /Rejected\(\s*["']rejected by user["']\s*\)/i.test(normalized);
+    if (!hookMatch && !genericRejected)
         return undefined;
     const audit = approvalAuditFromPayload(payload);
-    const source = audit.policyCode || audit.decisionSource?.toLowerCase().includes('policy')
+    const source = hookMatch || audit.policyCode || audit.decisionSource?.toLowerCase().includes('policy')
         ? 'evolcore-policy'
         : 'codex-approval';
+    const backendReason = hookMatch?.[1]?.trim()
+        || 'Rejected("rejected by user")';
+    const inferredPolicyCode = audit.policyCode
+        || (hookMatch && /工具调用已达到\s*\d+\s*次/.test(backendReason)
+            ? 'proactive_tool_report_required'
+            : hookMatch && /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(backendReason)
+                ? 'proactive_first_send_required'
+                : undefined);
     return {
-        kind: 'approval_rejected',
+        kind: source === 'evolcore-policy' ? 'policy_blocked' : 'approval_rejected',
         source,
-        reason: 'rejected_by_user',
+        reason: source === 'evolcore-policy' ? 'policy_denied' : 'rejected_by_user',
         executed: false,
         evidence: audit.available ? 'structured_metadata' : 'backend_text',
-        backendReason: 'Rejected("rejected by user")',
-        audit,
+        backendReason,
+        audit: inferredPolicyCode && !audit.policyCode
+            ? { ...audit, policyCode: inferredPolicyCode }
+            : audit,
     };
 }
 export function parseCodexToolEvent(event) {

package/dist/sources/triggers.js

@@ -60,6 +60,63 @@ function normalizeAgent(item) {
         baseagent: typeof item?.baseagent === 'string' ? item.baseagent : undefined,
     };
 }
+function channelTypeFromKey(channelKey) {
+    const value = typeof channelKey === 'string' ? channelKey.trim() : '';
+    if (!value)
+        return '';
+    const separator = value.indexOf('#');
+    return separator > 0 ? value.slice(0, separator) : value;
+}
+function triggerScheduleView(definition, fallback) {
+    const source = definition?.source ?? fallback?.source;
+    if (source && typeof source === 'object') {
+        switch (source.type) {
+            case 'once': return { scheduleType: 'once', scheduleValue: '' };
+            case 'delay': return { scheduleType: 'delay', scheduleValue: String(source.afterMs ?? '') };
+            case 'at': return { scheduleType: 'at', scheduleValue: String(source.at ?? '') };
+            case 'cron': return { scheduleType: 'cron', scheduleValue: String(source.expression ?? '') };
+            case 'interval': return { scheduleType: 'interval', scheduleValue: String(source.everyMs ?? '') };
+            case 'event': return { scheduleType: 'event', scheduleValue: String(source.eventPattern ?? '') };
+            default: break;
+        }
+    }
+    return {
+        scheduleType: String(fallback?.scheduleType ?? ''),
+        scheduleValue: String(fallback?.scheduleValue ?? ''),
+    };
+}
+function triggerDisplayFields(definition, fallback) {
+    const feedback = definition?.feedback ?? fallback?.feedback;
+    const origin = definition?.origin;
+    const target = feedback?.strategy === 'target'
+        ? (feedback.target ?? fallback?.feedback?.target)
+        : feedback?.strategy === 'origin'
+            ? {
+                channelKey: origin?.channelKey,
+                channelId: origin?.channelId ?? origin?.peerId,
+                channelType: origin?.channelType,
+            }
+            : null;
+    const schedule = triggerScheduleView(definition, fallback);
+    const targetChannel = target?.channelKey ?? fallback?.targetChannel ?? '';
+    const targetChannelType = target?.channelType
+        ?? fallback?.targetChannelType
+        ?? (feedback?.strategy === 'target'
+            ? channelTypeFromKey(targetChannel)
+            : (origin?.channelType ?? channelTypeFromKey(targetChannel)));
+    return {
+        scheduleType: schedule.scheduleType,
+        scheduleValue: schedule.scheduleValue,
+        targetChannel,
+        targetChannelName: targetChannel || fallback?.targetChannelName || '',
+        targetChannelId: target?.channelId ?? fallback?.targetChannelId ?? '',
+        targetChannelType,
+        createdByPeerId: origin?.peerId ?? fallback?.createdByPeerId ?? '',
+        createdByChannel: origin?.channelKey ?? fallback?.createdByChannel ?? '',
+        createdAt: definition?.createdAt ?? fallback?.createdAt,
+        updatedAt: definition?.updatedAt ?? fallback?.updatedAt,
+    };
+}
 async function listTriggersForAgent(agentAid, agentLabel) {
     const p = resolvePaths();
     const controlToken = readTriggerControlToken(p.instanceDir);
@@ -106,6 +163,7 @@ async function listTriggersForAgent(agentAid, agentLabel) {
             revision,
             definitionError,
             subscription,
+            ...triggerDisplayFields(definition, trigger),
         };
     }));
 }

package/dist/static/app.js

@@ -2256,6 +2256,12 @@ function subscribeRoleManagementSubview() {
 function setRoleManagementSubview(subview, options = {}) {
   roleManagementSubview = subview === 'assignments' ? 'assignments' : 'definitions';
   localStorage.setItem(ROLE_SUBVIEW_KEY, roleManagementSubview);
+  const newRoleButton = $('#btn-new-role');
+  if (newRoleButton) {
+    const visible = roleManagementSubview === 'definitions';
+    newRoleButton.hidden = !visible;
+    newRoleButton.setAttribute('aria-hidden', String(!visible));
+  }
   document.querySelectorAll('[data-role-subview]').forEach(tab => {
     const active = tab.dataset.roleSubview === roleManagementSubview;
     tab.classList.toggle('active', active);
@@ -3815,7 +3821,7 @@ function renderBlocks(blocks, options = {}) {
         : '';
       out += `<details class="blk blk-tool" open><summary class="tool-head">${icon} <span class="tool-name">${esc(tool)}</span></summary>${toolParams}</details>`;
     } else if (b.kind === 'tool_result') {
-      const rejection = b.rejection?.kind === 'approval_rejected' ? b.rejection : undefined;
+      const rejection = b.rejection && (b.rejection.kind === 'approval_rejected' || b.rejection.kind === 'policy_blocked') ? b.rejection : undefined;
       const cls = b.isError ? `blk-result err${rejection ? ' rejection' : ''}` : 'blk-result';
       const loadFull = b.truncated && b.resultKey
         ? `<button class="ctrl-btn result-load-full" type="button" data-result-key="${esc(b.resultKey)}">${t('sessions.loadFullResult') || '加载完整结果'}</button>`
@@ -3839,7 +3845,7 @@ function renderBlocks(blocks, options = {}) {
             : '';
           return '<div class="result-rejection-meta">' +
           `<span class="result-rejection-badge">⚠ ${t('sessions.block.rejection.title')}</span>` +
-          `<span>${rejection.source === 'evolcore-policy' ? t('sessions.block.rejection.source.policy') : t('sessions.block.rejection.source.approval')}</span>` +
+          `<span>${rejection.kind === 'policy_blocked' || rejection.source === 'evolcore-policy' ? t('sessions.block.rejection.source.policy') : t('sessions.block.rejection.source.approval')}</span>` +
           `<span>${t('sessions.block.rejection.notExecuted')}</span>` +
           `<span>${t(`sessions.block.rejection.evidence.${evidenceKey}`)}</span>` +
           backendReason + auditText +
@@ -9092,11 +9098,39 @@ function monDualLine(elId, varKey, times, isDark, title, series, fmtY, yRange) {
 }
 
 function renderRoles(data) {
-  if (!data) return;
-
   const agentSelect = $('#roles-agent-select');
+  const tbody = document.querySelector('#relations-table tbody');
+  if (!data) {
+    if (tbody) {
+      tbody.innerHTML = '';
+      const row = tbody.insertRow();
+      const cell = row.insertCell();
+      cell.colSpan = 7;
+      cell.textContent = t('common.loading');
+      cell.style.textAlign = 'center';
+      cell.style.color = 'var(--dim)';
+      cell.style.padding = '40px';
+    }
+    return;
+  }
   if (!agentSelect) return;
 
+  if (data.error) {
+    agentSelect.innerHTML = `<option value="">${esc(t('roles.selectAgentPlaceholder'))}</option>`;
+    rolesCurrentAgent = null;
+    if (tbody) {
+      tbody.innerHTML = '';
+      const row = tbody.insertRow();
+      const cell = row.insertCell();
+      cell.colSpan = 7;
+      cell.textContent = `${t('common.error')}: ${String(data.error)}`;
+      cell.style.textAlign = 'center';
+      cell.style.color = 'var(--red)';
+      cell.style.padding = '40px';
+    }
+    return;
+  }
+
   agentSelect.innerHTML = '';
   const placeholderOption = document.createElement('option');
   placeholderOption.value = '';
@@ -9152,6 +9186,34 @@ function peerTypeText(peerType) {
   return '-';
 }
 
+function roleVerificationStatus(item) {
+  const status = String(item?.verifyStatus || 'unknown').toLowerCase();
+  if (status === 'agentmd' || status === 'verified') return 'verified';
+  if (status === 'agentmd-unverified' || status === 'unverified') return 'agentmd-unverified';
+  if (status === 'invalid') return 'invalid';
+  return 'unknown';
+}
+
+function roleVerificationMatches(item, filter) {
+  if (!filter) return true;
+  const status = roleVerificationStatus(item);
+  return filter === 'verified' ? status === 'verified' : status === filter;
+}
+
+function roleVerificationBadge(item) {
+  const status = roleVerificationStatus(item);
+  if (status === 'invalid') {
+    return ` <span class="verify-badge verify-invalid" title="${esc(t('roles.verify.invalid'))}">⚠️ ${esc(t('roles.verify.invalidShort'))}</span>`;
+  }
+  if (status === 'agentmd-unverified') {
+    return ` <span class="verify-badge verify-unverified" title="${esc(t('roles.verify.unverified'))}">⚠️</span>`;
+  }
+  if (status === 'unknown') {
+    return ` <span class="verify-badge verify-unknown" title="${esc(t('roles.verify.unknown'))}">❓</span>`;
+  }
+  return '';
+}
+
 function roleClass(role) {
   return String(role || 'none').replace(/[^a-z0-9_-]/gi, '-');
 }
@@ -9188,6 +9250,16 @@ function renderRelationsTable(data, filterAid = null) {
   if (!tbody) return;
 
   tbody.innerHTML = '';
+  if (data?.error) {
+    const row = tbody.insertRow();
+    const cell = row.insertCell();
+    cell.colSpan = 7;
+    cell.textContent = `${t('common.error')}: ${String(data.error)}`;
+    cell.style.textAlign = 'center';
+    cell.style.color = 'var(--red)';
+    cell.style.padding = '40px';
+    return;
+  }
   let conversations = data.conversations || [];
 
   if (filterAid) {
@@ -9215,6 +9287,16 @@ function renderRelationsTable(data, filterAid = null) {
     conversations = conversations.filter(conv => conv.chatType === rolesChatTypeFilter);
   }
 
+  if (rolesVerifyFilter) {
+    conversations = conversations
+      .map(conv => conv.chatType === 'group'
+        ? { ...conv, members: (conv.members || []).filter(member => roleVerificationMatches(member, rolesVerifyFilter)) }
+        : conv)
+      .filter(conv => conv.chatType === 'group'
+        ? (conv.members || []).length > 0
+        : roleVerificationMatches(conv, rolesVerifyFilter));
+  }
+
   conversations.sort((a, b) => {
     const lastDiff = (b.lastAt || 0) - (a.lastAt || 0);
     if (lastDiff !== 0) return lastDiff;
@@ -9244,10 +9326,12 @@ function renderPrivateConversationRow(tbody, conv) {
   const peerId = conv.peerId || conv.peerAid || conv.peerKey || conv.conversationId;
   const name = conv.peerName || conv.name || shortAid(peerId);
   const assignedRole = assignedRoleFor('private', conv);
+  const verifyBadge = roleVerificationBadge(conv);
+  const verifyClass = roleVerificationStatus(conv) === 'verified' ? '' : ` peer-${roleVerificationStatus(conv) === 'unknown' ? 'unknown' : 'unverified'}`;
   const row = tbody.insertRow();
   row.innerHTML = `
     <td><span class="chat-tag chat-tag-private">${esc(t('roles.chatType.private') || 'Private')}</span></td>
-    <td><strong>${esc(name)}</strong></td>
+    <td class="${verifyClass.trim()}"><strong>${esc(name)}</strong>${verifyBadge}</td>
     <td><code>${esc(peerId)}</code></td>
     <td>${esc(peerTypeText(conv.peerType))}</td>
     <td><span class="role-badge role-${esc(roleClass(conv.role))}">${esc(displayRole(conv.role))}</span></td>
@@ -9312,11 +9396,13 @@ function renderGroupMemberRow(tbody, conv, member) {
   const peerId = member.peerId || member.peerAid || member.peerKey;
   const name = member.peerName || shortAid(peerId);
   const assignedRole = assignedRoleFor('group-member', member);
+  const verifyBadge = roleVerificationBadge(member);
+  const verifyClass = roleVerificationStatus(member) === 'verified' ? '' : ` peer-${roleVerificationStatus(member) === 'unknown' ? 'unknown' : 'unverified'}`;
   const row = tbody.insertRow();
   row.className = 'group-member-row';
   row.innerHTML = `
     <td></td>
-    <td><span class="group-member-indent">${esc(name)}</span></td>
+    <td class="${verifyClass.trim()}"><span class="group-member-indent">${esc(name)}</span>${verifyBadge}</td>
     <td><code>${esc(peerId)}</code></td>
     <td>${esc(peerTypeText(member.peerType))}</td>
     <td><span class="role-badge role-${esc(roleClass(member.role))}">${esc(displayRole(member.role))}</span></td>

package/dist/static/index.html

@@ -49,7 +49,7 @@
 
       </nav>
       <span style="flex:1"></span>
-      2026-09-03 11:55
+      2026-09-05 04:51
       <span id="conn-status" class="conn-status" data-i18n="status.connecting">连接中…</span>
       <button id="lang-btn" class="theme-btn" data-i18n-title="language.buttonTitle" title="切换语言">🌐</button>
       <button id="theme-btn" class="theme-btn" data-i18n-title="theme.buttonTitle" title="主题">🌗</button>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ec-web",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "Web console and monitoring dashboard for EvolCore",
   "type": "module",
   "bin": {