ec-web 0.0.24 → 0.0.26

package/dist/paths.js

@@ -48,7 +48,14 @@ function resolveInstanceSocketPath(root) {
         const hash = crypto.createHash('sha1').update(canonicalRoot).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\daemon-${hash}`;
     }
-    return path.join(root, 'data', 'instance', 'daemon.sock');
+    const filesystemPath = path.join(root, 'data', 'instance', 'daemon.sock');
+    if (Buffer.byteLength(filesystemPath) < 100)
+        return filesystemPath;
+    const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 20);
+    const shortFilesystemPath = path.join(os.tmpdir(), `.ec-${hash.slice(0, 15)}.sock`);
+    if (Buffer.byteLength(shortFilesystemPath) < 100)
+        return shortFilesystemPath;
+    return `\0evolcore-${hash}`;
 }
 export function resolvePaths() {
     const root = resolveRoot();

package/dist/server.js

@@ -40,6 +40,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolcore ping response 对齐的软校验版本
+const ECWEB_TRIGGER_IPC_TYPES = new Set(['trigger.history', 'trigger.eventCatalog']);
 function daemonOwnerMenuAuth(localDirect, actorAid) {
     return {
         localDirect,
@@ -48,6 +49,7 @@ function daemonOwnerMenuAuth(localDirect, actorAid) {
         // authentication gate (local-direct exemption or a valid bearer token).
         // ECWeb is the daemon-owner management surface, so remote tokens receive
         // the same persistent fullaccess approval capability as local requests.
+        daemonOwner: true,
         canApprovePersistentFullAccess: true,
     };
 }
@@ -614,7 +616,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             return;
         }
         if (msg.type === 'ipc' && msg.payload) {
-            if (typeof msg.payload.type !== 'string' || !msg.payload.type.startsWith('trigger.')) {
+            if (typeof msg.payload.type !== 'string' || !ECWEB_TRIGGER_IPC_TYPES.has(msg.payload.type)) {
                 send({ type: 'ipc.response', requestId: msg.requestId, data: { ok: false, error: 'unsupported ipc payload' } });
                 return;
             }
@@ -622,9 +624,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             const timeoutMs = Number.isFinite(Number(msg.timeoutMs)) && Number(msg.timeoutMs) > 0
                 ? Math.min(Number(msg.timeoutMs), 120_000)
                 : 10000;
-            const payload = msg.payload.type === 'trigger.history' || msg.payload.type === 'trigger.eventCatalog'
-                ? { ...msg.payload, controlToken: daemonTriggerControlToken() }
-                : msg.payload;
+            const payload = { ...msg.payload, controlToken: daemonTriggerControlToken() };
             const resp = await ipcQuery(p.socket, payload, timeoutMs);
             send({ type: 'ipc.response', requestId: msg.requestId, data: resp ?? { ok: false, error: 'daemon unreachable' } });
             return;
@@ -796,7 +796,9 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
             }
-            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !isLocalDirect(req), remoteAccess: !isLocalDirect(req) });
+            // Pairing grants daemon-owner management authority, just like local
+            // access. Authorize above; do not downgrade settings by network origin.
+            void handleBasicSettingsApi(req, res);
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
             // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权

package/dist/sources/aid.js

@@ -65,28 +65,43 @@ function scanAidActivity() {
     }
     return result;
 }
-// evolcore 版本：与 watch aid 状态栏一致。daemon 进程级、整轮 watch 不变，
-// 故缓存一次（首次 menu.query name=system 拿到后复用），避免每秒多发一次 IPC。
+// evolcore 版本：使用 /system 的轻量 version 视图。daemon 进程级、整轮 watch 不变，
+// 故缓存一次并合并 in-flight 请求，避免每秒重复发 IPC。
 const versionCache = new Map();
+const versionInFlight = new Map();
 function authContextKey(params = {}) {
     const auth = watchMenuRequestAuth(params);
     return `${auth.localDirect ? 'local' : 'remote'}:${auth.actorAid || ''}`;
 }
 async function fetchVersion(socket, params = {}) {
-    const key = authContextKey(params);
+    const key = `${socket}\0${authContextKey(params)}`;
     const cached = versionCache.get(key);
     if (cached)
         return cached;
-    try {
-        const r = await ipcQuery(socket, { type: 'menu.exec', payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system' }, auth: watchMenuRequestAuth(params) }, 4000);
-        const v = r?.ok ? r.response?.data?.version : null;
-        if (v)
-            versionCache.set(key, v);
-        return v ?? null;
-    }
-    catch {
-        return null;
-    }
+    const pending = versionInFlight.get(key);
+    if (pending)
+        return pending;
+    const request = (async () => {
+        try {
+            const r = await ipcQuery(socket, {
+                type: 'menu.exec',
+                payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system', args: { view: 'version' } },
+                auth: watchMenuRequestAuth(params),
+            }, 4000);
+            const v = r?.ok ? r.response?.data?.version : null;
+            if (v)
+                versionCache.set(key, v);
+            return v ?? null;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            versionInFlight.delete(key);
+        }
+    })();
+    versionInFlight.set(key, request);
+    return request;
 }
 async function buildSnapshot(fallback = null, params = {}) {
     const p = resolvePaths();

package/dist/sources/basic-settings.js

@@ -580,7 +580,7 @@ export function restartRequiredForChanges(file, changes) {
     const prefixes = file === 'daemon' ? RESTART_DAEMON_PREFIXES : RESTART_DEFAULTS_PREFIXES;
     return changes.map(change => change.path).filter(fieldPath => prefixes.some(prefix => fieldPath === prefix || fieldPath.startsWith(prefix)));
 }
-function redactSecrets(config, file, secrets, secretRefs, options = {}) {
+function redactSecrets(config, file, secrets, secretRefs) {
     const redacted = clone(config);
     if (file !== 'defaults' || !isRecord(redacted.baseagents))
         return redacted;
@@ -600,26 +600,6 @@ function redactSecrets(config, file, secrets, secretRefs, options = {}) {
                 raw.apiKey = '******';
             }
         }
-        // Headers and query parameters are also common credential channels. They
-        // remain visible to local callers for editing, but remote snapshots must
-        // not disclose any map value, including values under custom key names.
-        if (options.redactConnectionMaps) {
-            for (const field of ['headers', 'queryParams']) {
-                if (!Object.prototype.hasOwnProperty.call(raw, field))
-                    continue;
-                const fieldPath = `defaults.baseagents.${name}.${field}`;
-                if (isRecord(raw[field])) {
-                    raw[field] = Object.fromEntries(Object.keys(raw[field]).map(key => {
-                        secrets[`${fieldPath}.${key}`] = true;
-                        return [key, '******'];
-                    }));
-                }
-                else {
-                    secrets[fieldPath] = true;
-                    raw[field] = '******';
-                }
-            }
-        }
     }
     return redacted;
 }
@@ -670,7 +650,7 @@ export function collectLogTypeStats(configured, logsDir = resolvePaths().logs) {
 export function collectLogTypes(configured, logsDir = resolvePaths().logs) {
     return collectLogTypeStats(configured, logsDir).types;
 }
-async function readSnapshot(options = {}) {
+async function readSnapshot() {
     const modules = await getConfigManager();
     const daemonFile = modules.read(modules.ConfigTarget.Process, undefined, { cache: false, expand: false });
     const defaultsFile = modules.read(modules.ConfigTarget.Defaults, undefined, { cache: false, expand: false });
@@ -682,8 +662,8 @@ async function readSnapshot(options = {}) {
     const secretRefs = {};
     const logTypeStats = collectLogTypeStats(rawDaemon?.watch?.logTypes);
     return {
-        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs, options),
-        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs, options),
+        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs),
+        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs),
         revisions: {
             daemon: basicSettingsRevision(rawDaemon),
             defaults: basicSettingsRevision(rawDefaults),
@@ -758,18 +738,15 @@ function basicSettingsPath(rawUrl) {
         return rawUrl.split('?')[0].replace(/\/+$/, '') || '/';
     }
 }
-export async function handleBasicSettingsApi(req, res, options = {}) {
+export async function handleBasicSettingsApi(req, res) {
     try {
         const url = new URL(req.url || '', 'http://localhost');
         const pathname = basicSettingsPath(req.url || '');
         if (req.method === 'GET' && pathname === '/api/basic-settings') {
-            sendJson(res, 200, { success: true, data: await readSnapshot(options) });
+            sendJson(res, 200, { success: true, data: await readSnapshot() });
             return;
         }
         if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
-            if (options.remoteAccess) {
-                throw Object.assign(new Error('Remote access cannot reveal configuration secrets'), { statusCode: 403 });
-            }
             const file = url.searchParams.get('file') || 'defaults';
             const fieldPath = url.searchParams.get('path') || '';
             if (!requestedSecretPath(file, fieldPath)) {
@@ -785,9 +762,6 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             return;
         }
         if (req.method === 'PATCH' && pathname === '/api/basic-settings') {
-            if (options.remoteAccess) {
-                throw Object.assign(new Error('Remote access cannot mutate basic settings'), { statusCode: 403 });
-            }
             const body = await readJsonBody(req);
             if (!isRecord(body) || (body.file !== 'daemon' && body.file !== 'defaults'))
                 throw new Error('file must be daemon or defaults');
@@ -822,7 +796,7 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
                 changed: mutation.changed,
                 restartRequired: mutation.changed && restartPaths.length > 0,
                 restartPaths: mutation.changed ? restartPaths : [],
-                data: await readSnapshot(options),
+                data: await readSnapshot(),
             });
             return;
         }

package/dist/sources/relation-roles.js

@@ -24,9 +24,11 @@ async function getParentModules() {
 async function getCommandModules() {
     const permissionPath = resolveParentDistModule('core', 'auth', 'operation-authorizer.js');
     const auditPath = resolveParentDistModule('core', 'auth', 'authorization-audit.js');
+    const runtimePolicyPath = resolveParentDistModule('core', 'role', 'runtime-policy.js');
     const permission = await import(toFileUrl(permissionPath));
     const audit = await import(toFileUrl(auditPath));
-    return { permission, audit };
+    const runtimePolicy = await import(toFileUrl(runtimePolicyPath));
+    return { permission, audit, runtimePolicy };
 }
 export const ROLE_ASSIGNMENT_POLICY = {
     owner: {
@@ -38,15 +40,17 @@ export const ROLE_ASSIGNMENT_POLICY = {
         revoke: 'user-roles',
     },
 };
-function isManagementRoleName(role) {
-    return role === 'owner' || role === 'admin';
-}
 function isAssignableUserRole(role) {
-    return typeof role === 'string' && !!role && !isManagementRoleName(role);
+    // `admin` is a management role, but it is still a valid relation role.
+    // `owner` and `daemon-owner` remain reserved for process/Agent config and
+    // can never be assigned through a relation.
+    return typeof role === 'string' && !!role && role !== 'owner' && role !== 'daemon-owner';
 }
 export function canAssignRole(actorRole, targetRole) {
     if (!isAssignableUserRole(targetRole))
         return false;
+    if (targetRole === 'admin')
+        return actorRole === 'owner';
     return actorRole === 'owner' || actorRole === 'admin';
 }
 export function canRevokeRole(actorRole, targetRole) {
@@ -54,6 +58,8 @@ export function canRevokeRole(actorRole, targetRole) {
         return true;
     if (actorRole !== 'admin' || !targetRole)
         return false;
+    if (targetRole === 'admin')
+        return false;
     return isAssignableUserRole(targetRole);
 }
 async function getAgentsFromIpc() {
@@ -74,7 +80,8 @@ function resolveEcwebActor(modules, aid, auth) {
     const processOwners = Array.isArray(processConfig?.owners)
         ? processConfig.owners.map((value) => String(value || '').trim()).filter(Boolean)
         : [];
-    const daemonOwner = !!auth.localDirect || (!!auth.actorAid && processOwners.includes(auth.actorAid));
+    const daemonOwner = auth.daemonOwner === true || !!auth.localDirect
+        || (!!auth.actorAid && processOwners.includes(auth.actorAid));
     const actorRole = daemonOwner
         ? 'owner'
         : auth.actorAid
@@ -89,11 +96,11 @@ function resolveEcwebActor(modules, aid, auth) {
     return {
         daemonOwner,
         actorRole,
-        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || (daemonOwner ? 'ecweb-remote' : undefined),
     };
 }
 async function authorizeRoleAssignmentRead(modules, aid, auth) {
-    const { permission, audit } = await getCommandModules();
+    const { permission, audit, runtimePolicy } = await getCommandModules();
     const actor = resolveEcwebActor(modules, aid, auth);
     const decision = permission.authorizeCommand({
         intent: {
@@ -118,6 +125,7 @@ async function authorizeRoleAssignmentRead(modules, aid, auth) {
         actorId: actor.actorId,
         selfAid: aid,
         role: actor.actorRole,
+        permissionMode: runtimePolicy.resolveRuntimePermissionMode({ selfAid: aid, role: actor.actorRole }).effectiveValue,
         processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
         isDaemonOwner: actor.daemonOwner,
         decision: decision.allow ? 'allow' : 'deny',
@@ -696,11 +704,17 @@ async function buildSnapshot(auth = {}) {
         if (!readDecision.allow)
             continue;
         const roleConfig = modules.roles.readRolesConfig(aid);
+        const availableRoles = Object.keys(roleConfig.roles || {});
+        // Management roles are resolved separately from user-role definitions.
+        // Include the assignable management role in the ECWeb snapshot so relation
+        // editors can offer it; owner remains reserved for config.json owners[].
+        if (roleExists(modules.roles, aid, 'admin'))
+            availableRoles.push('admin');
         snapshotAgents.push({
             aid,
             displayName: agent.displayName ?? agent.personalName,
             name: agent.name,
-            roles: Object.keys(roleConfig.roles || {}).filter(role => isAssignableUserRole(role)),
+            roles: [...new Set(availableRoles)].filter(role => isAssignableUserRole(role)),
             defaultRoles: roleConfig.defaultRoles ?? { private: null, group: null },
             assignments: listRelationRoleAssignments(modules.config, aid),
         });

package/dist/sources/role-definitions.js

@@ -105,8 +105,8 @@ function isReadMethod(method) {
 async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, operation, args) {
     const actor = auth.actorAid || '';
     const processOwners = Array.isArray(processConfig?.owners) ? processConfig.owners.map(String) : [];
-    const syntheticOwner = !!auth.localDirect || (!!actor && processOwners.includes(actor));
-    const actorId = auth.localDirect ? 'local-direct' : actor || undefined;
+    const syntheticOwner = isDaemonOwnerAuth(processConfig, auth);
+    const actorId = auth.localDirect ? 'local-direct' : actor || (syntheticOwner ? 'ecweb-remote' : undefined);
     const subject = modules.buildAuthSubject({
         selfAid: aid,
         actorId,
@@ -116,6 +116,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
         chatType: 'private',
         conversationId: actor || 'ecweb',
         processOwners,
+        trustedProcessRole: syntheticOwner ? 'daemon-owner' : undefined,
         ...(syntheticOwner ? {
             roleDetail: {
                 effectiveRole: 'owner',
@@ -123,8 +124,8 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
                 isAuthenticated: true,
                 allowAccess: true,
                 roleExists: true,
-                // buildAuthSubject uses the authenticated actor separately from the
-                // resolved relation role to determine daemon-owner provenance.
+                // Keep the token's actor provenance separate from the management
+                // authority established by the ECWeb authentication gate.
                 actor: {
                     operatorId: actorId || 'ecweb',
                     operatorChannelKey: `ecweb#${aid}`,
@@ -155,7 +156,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
     });
 }
 function isDaemonOwnerAuth(processConfig, auth) {
-    if (auth.localDirect)
+    if (auth.daemonOwner === true || auth.localDirect)
         return true;
     const actor = typeof auth.actorAid === 'string' ? auth.actorAid.trim() : '';
     const processOwners = Array.isArray(processConfig?.owners)

package/dist/sources/types.js

@@ -13,6 +13,7 @@ export function watchMenuAuth(params) {
     return {
         localDirect: auth?.localDirect === true,
         actorAid: typeof auth?.actorAid === 'string' ? auth.actorAid : null,
+        daemonOwner: auth?.daemonOwner === true,
         // This marker is injected by the ECWeb server, never read from browser
         // request parameters. Authenticated ECWeb has daemon-owner authority.
         canApprovePersistentFullAccess: auth?.canApprovePersistentFullAccess === true,

package/dist/static/app.js

@@ -9296,7 +9296,7 @@ function assignedRoleFor(scope, item) {
 function assignableRolesForAgent(agentAid) {
   const agent = (state.roles?.agents || []).find(item => item.aid === agentAid);
   const roles = agent?.roles || Object.keys(state.roleDefinitions?.roles || {});
-  return Array.from(new Set(roles)).filter(role => role !== 'owner' && role !== 'admin');
+  return Array.from(new Set(roles)).filter(role => role !== 'owner');
 }
 
 function memberMatchesSearch(member) {

package/dist/static/index.html

@@ -49,7 +49,7 @@
 
       </nav>
       <span style="flex:1"></span>
-      2026-09-14 01:48
+      <span class="build-ts" style="font-size:10px;color:var(--dim)" data-i18n-title="common.buildTime" title="构建时间">2026-09-18 10:34</span>
       <span id="conn-status" class="conn-status" data-i18n="status.connecting">连接中…</span>
       <button id="lang-btn" class="theme-btn" data-i18n-title="language.buttonTitle" title="切换语言">🌐</button>
       <button id="theme-btn" class="theme-btn" data-i18n-title="theme.buttonTitle" title="主题">🌗</button>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ec-web",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Web console and monitoring dashboard for EvolCore",
   "type": "module",
   "bin": {
@@ -10,7 +10,7 @@
     "dist/"
   ],
   "scripts": {
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && node -e \"try{require('child_process').execFileSync('chmod',['+x','dist/index.js'])}catch{}\" && node -e \"const fs=require('fs'),path=require('path');fs.cpSync('src/static','dist/static',{recursive:true});const f='dist/static/index.html',n=new Date(),ts=n.getFullYear()+'-'+String(n.getMonth()+1).padStart(2,'0')+'-'+String(n.getDate()).padStart(2,'0')+' '+String(n.getHours()).padStart(2,'0')+':'+String(n.getMinutes()).padStart(2,'0');fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace(/(\\<span class=\\\"build-ts\\\"[^>]*\\>)[^<]+(\\<\\/span\\>)/,'$1'+ts+'$2'))\"",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && node -e \"try{require('child_process').execFileSync('chmod',['+x','dist/index.js'])}catch{}\" && node -e \"const fs=require('fs'),path=require('path');fs.cpSync('src/static','dist/static',{recursive:true});const f='dist/static/index.html',n=new Date(),ts=n.getFullYear()+'-'+String(n.getMonth()+1).padStart(2,'0')+'-'+String(n.getDate()).padStart(2,'0')+' '+String(n.getHours()).padStart(2,'0')+':'+String(n.getMinutes()).padStart(2,'0');fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace(/(\\<span class=\\\"build-ts\\\"[^>]*\\>)[^<]+(\\<\\/span\\>)/,(_match,open,close)=>open+ts+close))\"",
     "dev": "node dev.mjs",
     "prepublishOnly": "npm run build"
   },