ec-web 0.0.22 → 0.0.24

package/dist/sources/basic-settings.js

@@ -176,6 +176,10 @@ function baseagentPath(fieldPath) {
         return null;
     return { baseagent: match[1], field: match[2] };
 }
+function baseagentBlockPath(fieldPath) {
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)$/);
+    return match?.[1] || null;
+}
 export function isAllowedBasicSettingsPath(file, fieldPath) {
     try {
         pathSegments(fieldPath);
@@ -187,6 +191,9 @@ export function isAllowedBasicSettingsPath(file, fieldPath) {
         return DAEMON_EXACT_PATHS.has(fieldPath);
     if (DEFAULTS_EXACT_PATHS.has(fieldPath))
         return true;
+    const block = baseagentBlockPath(fieldPath);
+    if (block)
+        return BASEAGENT_SET.has(block);
     const parsed = baseagentPath(fieldPath);
     return !!parsed && BASEAGENT_SET.has(parsed.baseagent) && BASEAGENT_FIELDS[parsed.baseagent]?.has(parsed.field);
 }
@@ -450,6 +457,11 @@ function validateDefaultsValue(fieldPath, value) {
     const parsed = baseagentPath(fieldPath);
     if (parsed)
         return validateBaseagentValue(parsed.baseagent, parsed.field, fieldPath, value);
+    if (baseagentBlockPath(fieldPath)) {
+        if (!isRecord(value) || Object.keys(value).length > 0)
+            throw new Error(`${fieldPath} must be an empty object`);
+        return;
+    }
     if (fieldPath === 'active_baseagent') {
         if (!BASEAGENT_SET.has(String(value)))
             throw new Error(`${fieldPath} is invalid`);
@@ -510,8 +522,7 @@ export function validateBasicSettingsChange(file, change) {
     else
         validateDefaultsValue(change.path, change.value);
 }
-function validateBaseagentAvailability(config, changes) {
-    const details = detectBaseAgentDetails(config);
+function validateBaseagentAvailability(changes, details) {
     const detected = new Set(details.filter(item => item.detected).map(item => item.id));
     const configured = new Set(details.filter(item => item.configured).map(item => item.id));
     for (const change of changes) {
@@ -522,6 +533,10 @@ function validateBaseagentAvailability(config, changes) {
         if (parsed && !detected.has(parsed.baseagent) && !configured.has(parsed.baseagent)) {
             throw Object.assign(new Error(`Base Agent is not available on this machine: ${parsed.baseagent}`), { statusCode: 400 });
         }
+        const block = baseagentBlockPath(change.path);
+        if (block && change.op === 'set' && !detected.has(block) && !configured.has(block)) {
+            throw Object.assign(new Error(`Base Agent is not available on this machine: ${block}`), { statusCode: 400 });
+        }
     }
 }
 function setAtPath(root, segments, value) {
@@ -675,7 +690,7 @@ async function readSnapshot(options = {}) {
         },
         secrets,
         secretRefs,
-        baseagents: detectBaseAgentDetails(rawDefaults),
+        baseagents: await detectBaseAgentDetails(rawDefaults),
         logTypes: logTypeStats.types,
         logTypeCounts: logTypeStats.counts,
     };
@@ -752,6 +767,9 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             return;
         }
         if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
+            if (options.remoteAccess) {
+                throw Object.assign(new Error('Remote access cannot reveal configuration secrets'), { statusCode: 403 });
+            }
             const file = url.searchParams.get('file') || 'defaults';
             const fieldPath = url.searchParams.get('path') || '';
             if (!requestedSecretPath(file, fieldPath)) {
@@ -767,6 +785,9 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             return;
         }
         if (req.method === 'PATCH' && pathname === '/api/basic-settings') {
+            if (options.remoteAccess) {
+                throw Object.assign(new Error('Remote access cannot mutate basic settings'), { statusCode: 403 });
+            }
             const body = await readJsonBody(req);
             if (!isRecord(body) || (body.file !== 'daemon' && body.file !== 'defaults'))
                 throw new Error('file must be daemon or defaults');
@@ -779,6 +800,8 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             changes.forEach(change => validateBasicSettingsChange(file, change));
             const modules = await getConfigManager();
             const target = file === 'daemon' ? modules.ConfigTarget.Process : modules.ConfigTarget.Defaults;
+            const currentConfig = modules.read(target, undefined, { cache: false, expand: false }) ?? {};
+            const detection = file === 'defaults' ? await detectBaseAgentDetails(currentConfig) : [];
             const mutation = modules.mutateConfig(target, undefined, config => {
                 if (basicSettingsRevision(config) !== body.revision) {
                     throw Object.assign(new Error('Configuration changed after it was loaded. Reload and try again.'), {
@@ -786,7 +809,7 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
                     });
                 }
                 if (file === 'defaults')
-                    validateBaseagentAvailability(config, changes);
+                    validateBaseagentAvailability(changes, detection);
                 applyBasicSettingsChanges(config, file, changes);
                 const errors = modules.validateConfig(target, config);
                 if (errors.length > 0) {

package/dist/sources/models.js

@@ -32,21 +32,27 @@ export function normalizeModelEntries(models) {
             owned_by: model.owned_by,
             created: model.created,
             family: inferModelFamily(id),
-            status: isAlias ? 'alias' : 'available',
+            status: isAlias ? 'alias' : model.verification || 'unverified',
+            verification: model.verification,
+            reasoningLevels: model.reasoningLevels,
+            aliasFor: model.aliasFor,
             isAlias
         });
     }
     return out;
 }
-export async function getModelCatalogSnapshot(baseagent = 'claude') {
+export async function getModelCatalogSnapshot(baseagent = 'claude', self, refresh = false) {
     const { getCatalog } = await getCatalogModule();
-    const catalog = await getCatalog(undefined, baseagent);
+    const catalog = await getCatalog(self, baseagent, refresh);
     const normalized = normalizeModelEntries(catalog.models || []);
     return {
         models: normalized,
         catalogModels: normalized,
         source: catalog.source || 'unknown',
-        lastUpdate: new Date().toISOString()
+        lastUpdate: catalog.fetchedAt,
+        revision: catalog.revision,
+        freshness: catalog.freshness,
+        diagnostics: catalog.diagnostics,
     };
 }
 function sendJson(res, status, payload) {
@@ -58,11 +64,12 @@ export async function handleModelsApi(req, res) {
         const url = new URL(req.url || '', 'http://localhost');
         if (req.method === 'GET' && url.pathname === '/api/models/catalog') {
             const baseagent = url.searchParams.get('baseagent') || 'claude';
-            if (!/^[a-z0-9_-]+$/i.test(baseagent)) {
+            if (!['claude', 'codex', 'ecagent', 'gemini'].includes(baseagent)) {
                 sendJson(res, 400, { success: false, error: 'Invalid baseagent' });
                 return;
             }
-            const data = await getModelCatalogSnapshot(baseagent);
+            const self = url.searchParams.get('aid') || url.searchParams.get('self') || undefined;
+            const data = await getModelCatalogSnapshot(baseagent, self, url.searchParams.get('refresh') === 'true');
             sendJson(res, 200, { success: true, data });
             return;
         }

package/dist/sources/role-definitions.js

@@ -278,7 +278,7 @@ function resolveRequestedAid(raw, agents) {
     return agents.find(agent => agent?.aid)?.aid || null;
 }
 function isReservedRoleName(roleName) {
-    return roleName === 'owner' || roleName === 'admin';
+    return roleName === 'owner' || roleName === 'admin' || roleName === 'daemon-owner';
 }
 function isValidUserRoleName(roleName) {
     return /^[a-z0-9_-]+$/.test(roleName) && !isReservedRoleName(roleName);
@@ -309,11 +309,12 @@ function normalizeDefaultRoleInput(value, current) {
         return value;
     return current ?? null;
 }
-function validateRoleDefinitionName(roleName) {
+function validateRoleDefinitionName(roleName, options = {}) {
     if (!roleName || !/^[a-z0-9_-]+$/.test(roleName))
         return 'Invalid role name';
-    if (isReservedRoleName(roleName))
-        return 'owner/admin are management identities and cannot be user role definitions';
+    if (isReservedRoleName(roleName) && (!options.allowManagement || roleName === 'daemon-owner')) {
+        return 'owner/admin/daemon-owner are management identities and cannot be user role definitions';
+    }
     return null;
 }
 function inferSelectionMode(allowedModels = []) {
@@ -557,12 +558,12 @@ async function filterAllowedCatalogModels(models, allowedModels) {
     const { isModelAllowedByPatterns } = await getRoleConstraintsModule();
     return models.filter(model => !model.isAlias && isModelAllowedByPatterns(model.id, allowedModels));
 }
-async function buildModelPermissionResponse(roleName, roleDef, override) {
+async function buildModelPermissionResponse(roleName, roleDef, override, aid) {
     const currentPerm = getModelPermission(roleDef);
     const defaultModel = override?.defaultModel ?? currentPerm.default ?? '';
     const allowOverride = override?.allowOverride ?? currentPerm.allowOverride ?? false;
     const allowedModels = override?.allowedModels ?? (Array.isArray(currentPerm.allowedModels) ? currentPerm.allowedModels : []);
-    const catalog = await getModelCatalogSnapshot('claude');
+    const catalog = await getModelCatalogSnapshot('claude', aid);
     const matchingModels = await filterAllowedCatalogModels(catalog.models, allowedModels);
     return {
         role: roleName,
@@ -653,6 +654,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
         const aid = resolveRequestedAid(parsedUrl.query.aid, agents);
         const modules = await getRolesModule();
         const { readRolesConfig, read, ConfigTarget } = modules;
+        let authorizationDecision = null;
         const roleRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)$/);
         const roleNestedRoute = urlPath.match(/^\/api\/role-definitions\/([^/]+)\/([^/]+)$/);
         const decodeRoleName = (raw) => {
@@ -679,6 +681,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 method: req.method,
                 path: urlPath,
             });
+            authorizationDecision = decision;
             if (!decision.allow) {
                 console.warn('[role-definitions] Role policy access forbidden:', {
                     method: req.method,
@@ -724,13 +727,33 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
             try {
                 const incoming = await readJsonBody(req);
                 const currentConfig = readRolesConfig(aid || undefined);
+                // A complete snapshot may contain both management identities. Keep the
+                // same hierarchy guard used by the per-role endpoint for bulk updates.
+                if (!isDaemonOwnerAuth(read(ConfigTarget.Process) || {}, auth)
+                    && authorizationDecision?.subject?.role === 'admin'
+                    && incoming.roles && typeof incoming.roles === 'object'
+                    && Object.prototype.hasOwnProperty.call(incoming.roles, 'owner')) {
+                    sendJson(res, 403, {
+                        error: 'forbidden: agent admin cannot modify owner role policy',
+                        code: 'PERMISSION_DENIED',
+                        actorRole: 'admin',
+                    });
+                    return;
+                }
                 if (incoming.roles && typeof incoming.roles === 'object') {
                     for (const [roleName, roleDef] of Object.entries(incoming.roles)) {
-                        const nameError = validateRoleDefinitionName(roleName);
+                        // The collection endpoint receives the complete snapshot, including
+                        // management-role overrides. Creation of new management identities
+                        // remains forbidden; updates are narrowed by the runtime ceiling.
+                        const nameError = validateRoleDefinitionName(roleName, { allowManagement: true });
                         if (nameError) {
                             sendJson(res, 400, { error: `${nameError}: ${roleName}` });
                             return;
                         }
+                        if (isReservedRoleName(roleName) && !Object.prototype.hasOwnProperty.call(currentConfig.roles, roleName)) {
+                            sendJson(res, 404, { error: `Management role not found: ${roleName}` });
+                            return;
+                        }
                         const validation = await validateRoleModelPermission(roleDef);
                         if (!validation.ok) {
                             sendJson(res, 400, { error: `Invalid model permissions for role ${roleName}`, errors: validation.errors });
@@ -842,7 +865,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 sendJson(res, 404, { success: false, error: 'Role not found' });
                 return;
             }
-            const data = await buildModelPermissionResponse(roleName, roleDef);
+            const data = await buildModelPermissionResponse(roleName, roleDef, undefined, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
@@ -861,7 +884,7 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 sendJson(res, 400, { success: false, error: 'Invalid model permissions', errors: validation.errors });
                 return;
             }
-            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value);
+            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
@@ -891,13 +914,13 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
                 allowedModels: validation.value.allowedModels,
             };
             modules.roleService.writeRoleDefinition(aid, roleName, roleDef);
-            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value);
+            const data = await buildModelPermissionResponse(roleName, roleDef, validation.value, aid || undefined);
             sendJson(res, 200, { success: true, data });
             return;
         }
         if (req.method === 'POST' && roleNestedRoute?.[2] === 'reset') {
             const roleName = decodeRoleName(roleNestedRoute[1]);
-            if (!['admin', 'member', 'visitor'].includes(roleName)) {
+            if (!['owner', 'admin', 'member', 'visitor'].includes(roleName)) {
                 sendJson(res, 403, { error: 'Only builtin role overrides can be reset' });
                 return;
             }
@@ -940,7 +963,9 @@ export async function handleRoleDefinitionsApi(req, res, auth = {}) {
             try {
                 const roleName = decodeRoleName(roleRoute[1]);
                 const updates = await readJsonBody(req);
-                const nameError = validateRoleDefinitionName(roleName);
+                // owner/admin are reserved identities, but their policy definitions may
+                // be overridden (subject to the management-role ceiling).
+                const nameError = validateRoleDefinitionName(roleName, { allowManagement: true });
                 if (nameError) {
                     sendJson(res, 400, { error: nameError });
                     return;

package/dist/static/app.js

@@ -1976,6 +1976,58 @@ async function tryLocalAutoPair() {
   return false;
 }
 
+let authRecoveryPromise = null;
+
+function authenticatedRequestUrl(pathOrUrl) {
+  const raw = String(pathOrUrl || '');
+  const target = raw.startsWith(BASE) ? raw : apiUrl(raw);
+  const parsed = new URL(target, location.origin);
+  const token = localStorage.getItem(TOKEN_KEY);
+  if (token) parsed.searchParams.set('token', token);
+  else parsed.searchParams.delete('token');
+  return parsed.pathname + parsed.search + parsed.hash;
+}
+
+function authenticatedRequestInit(init = {}) {
+  const headers = new Headers(init.headers || {});
+  const token = localStorage.getItem(TOKEN_KEY);
+  if (token) headers.set('Authorization', `Bearer ${token}`);
+  else headers.delete('Authorization');
+  return { ...init, headers };
+}
+
+async function recoverHttpAuthentication() {
+  if (authRecoveryPromise) return authRecoveryPromise;
+  localStorage.removeItem(TOKEN_KEY);
+  authRecoveryPromise = (async () => {
+    if (await tryLocalAutoPair()) return true;
+    showPairPage(t('pair.error.tokenInvalid'));
+    return false;
+  })().finally(() => {
+    authRecoveryPromise = null;
+  });
+  return authRecoveryPromise;
+}
+
+async function authFetch(pathOrUrl, init = {}) {
+  const send = async () => {
+    const token = localStorage.getItem(TOKEN_KEY);
+    const response = await fetch(authenticatedRequestUrl(pathOrUrl), authenticatedRequestInit(init));
+    return { response, token };
+  };
+
+  let attempt = await send();
+  if (attempt.response.status !== 401) return attempt.response;
+
+  const currentToken = localStorage.getItem(TOKEN_KEY);
+  if (currentToken && currentToken !== attempt.token) {
+    return (await send()).response;
+  }
+  if (!(await recoverHttpAuthentication())) return attempt.response;
+  attempt = await send();
+  return attempt.response;
+}
+
 function showPairPage(hint) {
   if (ws) { try { ws.close(); } catch {} ws = null; }
   $('#pair-page').style.display = 'flex';
@@ -4138,12 +4190,7 @@ function agentOpNew() {
   openAgentCreateDrawer();
 }
 
-const AGENT_BASEAGENT_TYPES = ['claude', 'codex', 'gemini'];
-const AGENT_EFFORT_FALLBACK = {
-  claude: ['low', 'medium', 'high', 'xhigh', 'max'],
-  codex: ['low', 'medium', 'high'],
-  gemini: [],
-};
+const AGENT_BASEAGENT_TYPES = ['claude', 'codex', 'gemini', 'ecagent'];
 const AGENT_AID_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){2,}$/;
 let _agentEdit = null;
 let _agentCreate = null;
@@ -4594,7 +4641,7 @@ async function agentFetchCreateModelOptions(baseagent) {
   const catalog = await fetchModelCatalogData(baseagent);
   return (catalog?.models || []).map(model => ({
     value: model.id,
-    label: model.id,
+    label: `${model.id}${model.verification === 'unverified' ? ' [unverified]' : ''}`,
   }));
 }
 
@@ -4664,8 +4711,17 @@ async function syncAgentCreateOptionFields(ctx, values) {
   setAgentSelectLoading(modelSelect, currentModel, currentModel ? `${currentModel} (${t('common.loadingSuffix')})` : t('common.loading'));
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
 
+  let catalog;
   try {
-    const models = await agentFetchCreateModelOptions(baseagent);
+    // Load the catalog once for both selectors.  The catalog endpoint is
+    // connection-scoped and may perform a live gateway refresh, so issuing a
+    // second identical request for effort metadata is both wasteful and can
+    // produce mismatched model/effort options during a refresh.
+    catalog = await fetchModelCatalogData(baseagent);
+    const models = (catalog?.models || []).map(model => ({
+      value: model.id,
+      label: `${model.id}${model.verification === 'unverified' ? ' [unverified]' : ''}`,
+    }));
     if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
     modelSelect.innerHTML = agentSelectOptions(models, currentModel, t('common.defaultModel'));
   } catch (e) {
@@ -4677,14 +4733,22 @@ async function syncAgentCreateOptionFields(ctx, values) {
     if (_agentCreate === ctx && ctx.optionLoadToken === token) modelSelect.disabled = Boolean(ctx.saving);
   }
 
-  const selectedModel = modelSelect?.value || currentModel;
-  await syncAgentCreateEffortOptions(ctx, baseagent, selectedModel, currentEffort, token);
+  // A freshly rendered select may not expose its browser-selected value until
+  // the next layout tick (and lightweight embedders may not implement the DOM
+  // value reflection at all).  Use the first catalog model as the default so
+  // its reasoning levels are available immediately.
+  const selectedModel = modelSelect?.value || currentModel || catalog?.models?.[0]?.id || '';
+  const efforts = catalog?.models?.find(entry => entry.id === selectedModel)?.reasoningLevels || [];
+  if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
+  effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
+  effortSelect.disabled = Boolean(ctx.saving);
 }
 
 async function syncAgentCreateEffortOptions(ctx, baseagent, model, currentEffort, token) {
   const effortSelect = ctx.backdrop.querySelector('#ag-create-effort');
   if (!effortSelect) return;
-  const efforts = AGENT_EFFORT_FALLBACK[baseagent] || [];
+  const catalog = await fetchModelCatalogData(baseagent);
+  const efforts = catalog.models.find(entry => entry.id === model)?.reasoningLevels || [];
   if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
   effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
   effortSelect.disabled = Boolean(ctx.saving);
@@ -5085,12 +5149,11 @@ async function syncAgentEffortOptions(ctx, baseagent, model, currentEffort, toke
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
   try {
     let efforts = await agentFetchOptions('effort', ctx.aid, { baseagent, model, effort: currentEffort || 'auto' });
-    if (!efforts.length && AGENT_EFFORT_FALLBACK[baseagent]) efforts = AGENT_EFFORT_FALLBACK[baseagent];
     if (_agentEdit !== ctx || ctx.optionLoadToken !== token) return;
     effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
   } catch (e) {
     if (_agentEdit === ctx && ctx.optionLoadToken === token) {
-      const fallback = AGENT_EFFORT_FALLBACK[baseagent] || [];
+      const fallback = [];
       effortSelect.innerHTML = agentSelectOptions(fallback, currentEffort, t('common.default'));
       toast(e.message || String(e), true);
     }
@@ -6883,12 +6946,11 @@ async function syncTriggerEffortOptions(ctx, baseagent, model, currentEffort, to
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
   try {
     let efforts = await agentFetchOptions('effort', ctx.original.agentAid, { baseagent, model, effort: currentEffort || 'auto' });
-    if (!efforts.length && AGENT_EFFORT_FALLBACK[baseagent]) efforts = AGENT_EFFORT_FALLBACK[baseagent];
     if (_triggerEdit !== ctx || ctx.optionLoadToken !== token) return;
     effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.inherited'));
   } catch (e) {
     if (_triggerEdit === ctx && ctx.optionLoadToken === token) {
-      const fallback = AGENT_EFFORT_FALLBACK[baseagent] || [];
+      const fallback = [];
       effortSelect.innerHTML = agentSelectOptions(fallback, currentEffort, t('common.inherited'));
       toast(e.message || String(e), true);
     }
@@ -7811,7 +7873,7 @@ async function loadUsageOverview(rangeType, customFrom, customTo) {
     if (fromTs) params.set('from', String(fromTs));
     if (toTs) params.set('to', String(toTs));
 
-    const resp = await fetch(authApiUrl('api/stats/overview?' + params.toString()), {
+    const resp = await authFetch('api/stats/overview?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     data = resp.ok ? await resp.json() : null;
@@ -8016,7 +8078,7 @@ function initDetailQuery() {
 
 async function loadDetailAgentList() {
   try {
-    const resp = await fetch(authApiUrl('api/stats/agents'), {
+    const resp = await authFetch('api/stats/agents', {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8056,7 +8118,7 @@ async function loadDetailModelList() {
     if (timeRange.fromTs) params.set('from', String(timeRange.fromTs));
     if (timeRange.toTs) params.set('to', String(timeRange.toTs));
 
-    const resp = await fetch(authApiUrl('api/stats/models?' + params.toString()), {
+    const resp = await authFetch('api/stats/models?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8109,7 +8171,7 @@ async function queryDetailUsage() {
   params.set('offset', String(offset));
 
   try {
-    const resp = await fetch(authApiUrl('api/stats/detail?' + params.toString()), {
+    const resp = await authFetch('api/stats/detail?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (seq !== _detailQuerySeq) return; // 已有更新的查询发出，丢弃本次结果
@@ -8430,7 +8492,7 @@ async function loadExplorerModels() {
   if (_expTimeRange.toTs) params.set('to', String(_expTimeRange.toTs));
 
   try {
-    const resp = await fetch(authApiUrl('api/stats/models?' + params.toString()), {
+    const resp = await authFetch('api/stats/models?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8467,7 +8529,7 @@ async function fetchExplorerOverviewData(filterParams) {
       if (filterParams.peer) params.set('peer', filterParams.peer);
     }
 
-    const resp = await fetch(authApiUrl('api/stats/overview?' + params.toString()), {
+    const resp = await authFetch('api/stats/overview?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     const data = resp.ok ? await resp.json() : null;
@@ -8499,7 +8561,7 @@ async function loadExplorerSidebar() {
   var token = localStorage.getItem(TOKEN_KEY);
   var headers = { Authorization: 'Bearer ' + token };
   try {
-    var agentsResp = await fetch(authApiUrl('api/stats/agents'), { headers });
+    var agentsResp = await authFetch('api/stats/agents', { headers });
     var agents = agentsResp.ok ? await agentsResp.json() : [];
     renderExplorerAgentList(agents);
 
@@ -8560,7 +8622,7 @@ async function loadPeersForAgent(agentAid) {
     params.set('agent', agentAid);
     // 不传递时间范围，获取该 agent 的所有 peers
 
-    var resp = await fetch(authApiUrl('api/stats/peers?' + params.toString()), { headers });
+    var resp = await authFetch('api/stats/peers?' + params.toString(), { headers });
     var peers = resp.ok ? await resp.json() : [];
     renderExplorerPeerList(peers);
   } catch {
@@ -8642,7 +8704,7 @@ async function runExplorerQuery() {
 
   var data;
   try {
-    var resp = await fetch(authApiUrl('api/stats/explorer?' + params.toString()), {
+    var resp = await authFetch('api/stats/explorer?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -9430,7 +9492,7 @@ async function updatePeerRoleOverride(agentAid, scope, targetId, role, groupId,
     if (peerId) body.peerId = peerId;
     if (role) body.role = role;
 
-    const res = await fetch(authApiUrl(`api/assignments/peer/${encodeURIComponent(agentAid)}/${encodeURIComponent(targetId)}`), {
+    const res = await authFetch(`api/assignments/peer/${encodeURIComponent(agentAid)}/${encodeURIComponent(targetId)}`, {
       method: role ? 'PUT' : 'DELETE',
       headers: {
         'Content-Type': 'application/json',
@@ -9725,7 +9787,7 @@ function renderDefaultRoleSelector(data) {
     const next = { private: privateSelect.value || null, group: groupSelect.value || null };
     try {
       const token = localStorage.getItem(TOKEN_KEY);
-      const writeRes = await fetch(roleDefinitionsApi('api/role-definitions'), {
+      const writeRes = await authFetch(roleDefinitionsApi('api/role-definitions'), {
         method: 'PUT',
         headers: {
           'Content-Type': 'application/json',
@@ -9793,7 +9855,7 @@ function formatCommandPermissions(commandPermissions) {
 async function fetchRoleOperationsCatalog() {
   if (roleOperationsCache) return roleOperationsCache;
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(authApiUrl('api/role-definitions/operations'), {
+  const res = await authFetch('api/role-definitions/operations', {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load CLI operation catalog');
@@ -10315,8 +10377,9 @@ function createRoleCard(roleName, roleDef) {
   const model = roleDef.permissions?.['baseagents.claude.model']?.default || '—';
   const commandStats = getCommandPermissionStats(roleDef.commandPermissions);
 
-  // 判断是否为内置角色
-  const builtinRoles = ['admin', 'member', 'visitor'];
+  // Management identities and built-in user roles are both protected from
+  // deletion; their local policy overrides can be reset instead.
+  const builtinRoles = ['owner', 'admin', 'member', 'visitor'];
   const isBuiltin = builtinRoles.includes(roleName);
 
   card.innerHTML = `
@@ -10402,7 +10465,7 @@ function initRoleDefinitionsTab() {
 
       try {
         const token = localStorage.getItem(TOKEN_KEY);
-        const res = await fetch(roleDefinitionsApi(`api/role-definitions/${roleName}/reset`), {
+        const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${roleName}/reset`), {
           method: 'POST',
           headers: { 'Authorization': `Bearer ${token}` }
         });
@@ -10447,7 +10510,7 @@ function initRoleDefinitionsTab() {
           : replacement
             ? `?replacementRoleId=${encodeURIComponent(replacement)}`
             : '';
-        const res = await fetch(roleDefinitionsApi(`api/role-definitions/${roleName}${replacementQuery}`), {
+        const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${roleName}${replacementQuery}`), {
           method: 'DELETE',
           headers: { 'Authorization': `Bearer ${token}` }
         });
@@ -10600,7 +10663,7 @@ function renderRoleModelPermissionSection(roleDef) {
 
 async function fetchRoleModelPermissionData(roleName) {
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(roleName)}/configurable-models`), {
+  const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(roleName)}/configurable-models`), {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load role model permissions');
@@ -10608,13 +10671,14 @@ async function fetchRoleModelPermissionData(roleName) {
   return json.data;
 }
 
-async function fetchModelCatalogData(baseagent = 'claude') {
+async function fetchModelCatalogData(baseagent = 'claude', aid = '') {
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(authApiUrl(`api/models/catalog?baseagent=${encodeURIComponent(baseagent)}`), {
+  const res = await authFetch(`api/models/catalog?baseagent=${encodeURIComponent(baseagent)}${aid ? `&aid=${encodeURIComponent(aid)}` : ''}`, {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load model catalog');
   const json = await res.json();
+  if (json.data?.diagnostics?.some(d => d.code === 'AUTH_FAILED')) throw new Error('Model gateway authentication failed');
   return json.data;
 }
 
@@ -10777,7 +10841,7 @@ async function initRoleModelPermissionEditor(container, roleName, roleDef) {
   try {
     const data = roleName && roleName !== '__new__'
       ? await fetchRoleModelPermissionData(roleName)
-      : await fetchModelCatalogData();
+      : await fetchModelCatalogData('claude', roleDefinitionsCurrentAgent || state.roleDefinitions?.aid || '');
     catalogModels = data?.catalog?.models || data?.models || [];
   } catch (err) {
     console.warn('[roleDefinitions] Failed to load model catalog:', err);
@@ -11574,7 +11638,7 @@ async function saveRoleDefinition() {
     const method = isNew ? 'POST' : 'PUT';
     const url = isNew ? roleDefinitionsApi('api/role-definitions') : roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(actualRoleName)}`);
 
-    const res = await fetch(url, {
+    const res = await authFetch(url, {
       method,
       headers: {
         'Content-Type': 'application/json',