ec-web 0.0.25 → 0.0.26

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 EvolCore contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 EvolCore contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,17 +1,17 @@
-# EC Web
-
-Web console and monitoring dashboard for EvolCore.
-
-## Install
-
-```bash
-npm install -g ec-web
-```
-
-## Run
-
-```bash
-ec-web --home /path/to/runtime-home
-```
-
-Use `ec watch web` when EC Web is managed by the main daemon.
+# EC Web
+
+Web console and monitoring dashboard for EvolCore.
+
+## Install
+
+```bash
+npm install -g ec-web
+```
+
+## Run
+
+```bash
+ec-web --home /path/to/runtime-home
+```
+
+Use `ec watch web` when EC Web is managed by the main daemon.

package/dist/paths.js

@@ -48,7 +48,14 @@ function resolveInstanceSocketPath(root) {
         const hash = crypto.createHash('sha1').update(canonicalRoot).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\daemon-${hash}`;
     }
-    return path.join(root, 'data', 'instance', 'daemon.sock');
+    const filesystemPath = path.join(root, 'data', 'instance', 'daemon.sock');
+    if (Buffer.byteLength(filesystemPath) < 100)
+        return filesystemPath;
+    const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 20);
+    const shortFilesystemPath = path.join(os.tmpdir(), `.ec-${hash.slice(0, 15)}.sock`);
+    if (Buffer.byteLength(shortFilesystemPath) < 100)
+        return shortFilesystemPath;
+    return `\0evolcore-${hash}`;
 }
 export function resolvePaths() {
     const root = resolveRoot();

package/dist/server.js

@@ -40,6 +40,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolcore ping response 对齐的软校验版本
+const ECWEB_TRIGGER_IPC_TYPES = new Set(['trigger.history', 'trigger.eventCatalog']);
 function daemonOwnerMenuAuth(localDirect, actorAid) {
     return {
         localDirect,
@@ -48,6 +49,7 @@ function daemonOwnerMenuAuth(localDirect, actorAid) {
         // authentication gate (local-direct exemption or a valid bearer token).
         // ECWeb is the daemon-owner management surface, so remote tokens receive
         // the same persistent fullaccess approval capability as local requests.
+        daemonOwner: true,
         canApprovePersistentFullAccess: true,
     };
 }
@@ -614,7 +616,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             return;
         }
         if (msg.type === 'ipc' && msg.payload) {
-            if (typeof msg.payload.type !== 'string' || !msg.payload.type.startsWith('trigger.')) {
+            if (typeof msg.payload.type !== 'string' || !ECWEB_TRIGGER_IPC_TYPES.has(msg.payload.type)) {
                 send({ type: 'ipc.response', requestId: msg.requestId, data: { ok: false, error: 'unsupported ipc payload' } });
                 return;
             }
@@ -622,9 +624,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             const timeoutMs = Number.isFinite(Number(msg.timeoutMs)) && Number(msg.timeoutMs) > 0
                 ? Math.min(Number(msg.timeoutMs), 120_000)
                 : 10000;
-            const payload = msg.payload.type === 'trigger.history' || msg.payload.type === 'trigger.eventCatalog'
-                ? { ...msg.payload, controlToken: daemonTriggerControlToken() }
-                : msg.payload;
+            const payload = { ...msg.payload, controlToken: daemonTriggerControlToken() };
             const resp = await ipcQuery(p.socket, payload, timeoutMs);
             send({ type: 'ipc.response', requestId: msg.requestId, data: resp ?? { ok: false, error: 'daemon unreachable' } });
             return;
@@ -796,7 +796,9 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
             }
-            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !isLocalDirect(req) });
+            // Pairing grants daemon-owner management authority, just like local
+            // access. Authorize above; do not downgrade settings by network origin.
+            void handleBasicSettingsApi(req, res);
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
             // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权

package/dist/sources/aid.js

@@ -65,28 +65,43 @@ function scanAidActivity() {
     }
     return result;
 }
-// evolcore 版本：与 watch aid 状态栏一致。daemon 进程级、整轮 watch 不变，
-// 故缓存一次（首次 menu.query name=system 拿到后复用），避免每秒多发一次 IPC。
+// evolcore 版本：使用 /system 的轻量 version 视图。daemon 进程级、整轮 watch 不变，
+// 故缓存一次并合并 in-flight 请求，避免每秒重复发 IPC。
 const versionCache = new Map();
+const versionInFlight = new Map();
 function authContextKey(params = {}) {
     const auth = watchMenuRequestAuth(params);
     return `${auth.localDirect ? 'local' : 'remote'}:${auth.actorAid || ''}`;
 }
 async function fetchVersion(socket, params = {}) {
-    const key = authContextKey(params);
+    const key = `${socket}\0${authContextKey(params)}`;
     const cached = versionCache.get(key);
     if (cached)
         return cached;
-    try {
-        const r = await ipcQuery(socket, { type: 'menu.exec', payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system' }, auth: watchMenuRequestAuth(params) }, 4000);
-        const v = r?.ok ? r.response?.data?.version : null;
-        if (v)
-            versionCache.set(key, v);
-        return v ?? null;
-    }
-    catch {
-        return null;
-    }
+    const pending = versionInFlight.get(key);
+    if (pending)
+        return pending;
+    const request = (async () => {
+        try {
+            const r = await ipcQuery(socket, {
+                type: 'menu.exec',
+                payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system', args: { view: 'version' } },
+                auth: watchMenuRequestAuth(params),
+            }, 4000);
+            const v = r?.ok ? r.response?.data?.version : null;
+            if (v)
+                versionCache.set(key, v);
+            return v ?? null;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            versionInFlight.delete(key);
+        }
+    })();
+    versionInFlight.set(key, request);
+    return request;
 }
 async function buildSnapshot(fallback = null, params = {}) {
     const p = resolvePaths();

package/dist/sources/basic-settings.js

@@ -580,7 +580,7 @@ export function restartRequiredForChanges(file, changes) {
     const prefixes = file === 'daemon' ? RESTART_DAEMON_PREFIXES : RESTART_DEFAULTS_PREFIXES;
     return changes.map(change => change.path).filter(fieldPath => prefixes.some(prefix => fieldPath === prefix || fieldPath.startsWith(prefix)));
 }
-function redactSecrets(config, file, secrets, secretRefs, options = {}) {
+function redactSecrets(config, file, secrets, secretRefs) {
     const redacted = clone(config);
     if (file !== 'defaults' || !isRecord(redacted.baseagents))
         return redacted;
@@ -600,26 +600,6 @@ function redactSecrets(config, file, secrets, secretRefs, options = {}) {
                 raw.apiKey = '******';
             }
         }
-        // Headers and query parameters are also common credential channels. They
-        // remain visible to local callers for editing, but remote snapshots must
-        // not disclose any map value, including values under custom key names.
-        if (options.redactConnectionMaps) {
-            for (const field of ['headers', 'queryParams']) {
-                if (!Object.prototype.hasOwnProperty.call(raw, field))
-                    continue;
-                const fieldPath = `defaults.baseagents.${name}.${field}`;
-                if (isRecord(raw[field])) {
-                    raw[field] = Object.fromEntries(Object.keys(raw[field]).map(key => {
-                        secrets[`${fieldPath}.${key}`] = true;
-                        return [key, '******'];
-                    }));
-                }
-                else {
-                    secrets[fieldPath] = true;
-                    raw[field] = '******';
-                }
-            }
-        }
     }
     return redacted;
 }
@@ -670,7 +650,7 @@ export function collectLogTypeStats(configured, logsDir = resolvePaths().logs) {
 export function collectLogTypes(configured, logsDir = resolvePaths().logs) {
     return collectLogTypeStats(configured, logsDir).types;
 }
-async function readSnapshot(options = {}) {
+async function readSnapshot() {
     const modules = await getConfigManager();
     const daemonFile = modules.read(modules.ConfigTarget.Process, undefined, { cache: false, expand: false });
     const defaultsFile = modules.read(modules.ConfigTarget.Defaults, undefined, { cache: false, expand: false });
@@ -682,8 +662,8 @@ async function readSnapshot(options = {}) {
     const secretRefs = {};
     const logTypeStats = collectLogTypeStats(rawDaemon?.watch?.logTypes);
     return {
-        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs, options),
-        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs, options),
+        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs),
+        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs),
         revisions: {
             daemon: basicSettingsRevision(rawDaemon),
             defaults: basicSettingsRevision(rawDefaults),
@@ -758,12 +738,12 @@ function basicSettingsPath(rawUrl) {
         return rawUrl.split('?')[0].replace(/\/+$/, '') || '/';
     }
 }
-export async function handleBasicSettingsApi(req, res, options = {}) {
+export async function handleBasicSettingsApi(req, res) {
     try {
         const url = new URL(req.url || '', 'http://localhost');
         const pathname = basicSettingsPath(req.url || '');
         if (req.method === 'GET' && pathname === '/api/basic-settings') {
-            sendJson(res, 200, { success: true, data: await readSnapshot(options) });
+            sendJson(res, 200, { success: true, data: await readSnapshot() });
             return;
         }
         if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
@@ -816,7 +796,7 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
                 changed: mutation.changed,
                 restartRequired: mutation.changed && restartPaths.length > 0,
                 restartPaths: mutation.changed ? restartPaths : [],
-                data: await readSnapshot(options),
+                data: await readSnapshot(),
             });
             return;
         }

package/dist/sources/relation-roles.js

@@ -24,9 +24,11 @@ async function getParentModules() {
 async function getCommandModules() {
     const permissionPath = resolveParentDistModule('core', 'auth', 'operation-authorizer.js');
     const auditPath = resolveParentDistModule('core', 'auth', 'authorization-audit.js');
+    const runtimePolicyPath = resolveParentDistModule('core', 'role', 'runtime-policy.js');
     const permission = await import(toFileUrl(permissionPath));
     const audit = await import(toFileUrl(auditPath));
-    return { permission, audit };
+    const runtimePolicy = await import(toFileUrl(runtimePolicyPath));
+    return { permission, audit, runtimePolicy };
 }
 export const ROLE_ASSIGNMENT_POLICY = {
     owner: {
@@ -38,15 +40,17 @@ export const ROLE_ASSIGNMENT_POLICY = {
         revoke: 'user-roles',
     },
 };
-function isManagementRoleName(role) {
-    return role === 'owner' || role === 'admin';
-}
 function isAssignableUserRole(role) {
-    return typeof role === 'string' && !!role && !isManagementRoleName(role);
+    // `admin` is a management role, but it is still a valid relation role.
+    // `owner` and `daemon-owner` remain reserved for process/Agent config and
+    // can never be assigned through a relation.
+    return typeof role === 'string' && !!role && role !== 'owner' && role !== 'daemon-owner';
 }
 export function canAssignRole(actorRole, targetRole) {
     if (!isAssignableUserRole(targetRole))
         return false;
+    if (targetRole === 'admin')
+        return actorRole === 'owner';
     return actorRole === 'owner' || actorRole === 'admin';
 }
 export function canRevokeRole(actorRole, targetRole) {
@@ -54,6 +58,8 @@ export function canRevokeRole(actorRole, targetRole) {
         return true;
     if (actorRole !== 'admin' || !targetRole)
         return false;
+    if (targetRole === 'admin')
+        return false;
     return isAssignableUserRole(targetRole);
 }
 async function getAgentsFromIpc() {
@@ -74,7 +80,8 @@ function resolveEcwebActor(modules, aid, auth) {
     const processOwners = Array.isArray(processConfig?.owners)
         ? processConfig.owners.map((value) => String(value || '').trim()).filter(Boolean)
         : [];
-    const daemonOwner = !!auth.localDirect || (!!auth.actorAid && processOwners.includes(auth.actorAid));
+    const daemonOwner = auth.daemonOwner === true || !!auth.localDirect
+        || (!!auth.actorAid && processOwners.includes(auth.actorAid));
     const actorRole = daemonOwner
         ? 'owner'
         : auth.actorAid
@@ -89,11 +96,11 @@ function resolveEcwebActor(modules, aid, auth) {
     return {
         daemonOwner,
         actorRole,
-        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || (daemonOwner ? 'ecweb-remote' : undefined),
     };
 }
 async function authorizeRoleAssignmentRead(modules, aid, auth) {
-    const { permission, audit } = await getCommandModules();
+    const { permission, audit, runtimePolicy } = await getCommandModules();
     const actor = resolveEcwebActor(modules, aid, auth);
     const decision = permission.authorizeCommand({
         intent: {
@@ -118,6 +125,7 @@ async function authorizeRoleAssignmentRead(modules, aid, auth) {
         actorId: actor.actorId,
         selfAid: aid,
         role: actor.actorRole,
+        permissionMode: runtimePolicy.resolveRuntimePermissionMode({ selfAid: aid, role: actor.actorRole }).effectiveValue,
         processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
         isDaemonOwner: actor.daemonOwner,
         decision: decision.allow ? 'allow' : 'deny',
@@ -696,11 +704,17 @@ async function buildSnapshot(auth = {}) {
         if (!readDecision.allow)
             continue;
         const roleConfig = modules.roles.readRolesConfig(aid);
+        const availableRoles = Object.keys(roleConfig.roles || {});
+        // Management roles are resolved separately from user-role definitions.
+        // Include the assignable management role in the ECWeb snapshot so relation
+        // editors can offer it; owner remains reserved for config.json owners[].
+        if (roleExists(modules.roles, aid, 'admin'))
+            availableRoles.push('admin');
         snapshotAgents.push({
             aid,
             displayName: agent.displayName ?? agent.personalName,
             name: agent.name,
-            roles: Object.keys(roleConfig.roles || {}).filter(role => isAssignableUserRole(role)),
+            roles: [...new Set(availableRoles)].filter(role => isAssignableUserRole(role)),
             defaultRoles: roleConfig.defaultRoles ?? { private: null, group: null },
             assignments: listRelationRoleAssignments(modules.config, aid),
         });

package/dist/sources/role-definitions.js

@@ -105,8 +105,8 @@ function isReadMethod(method) {
 async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, operation, args) {
     const actor = auth.actorAid || '';
     const processOwners = Array.isArray(processConfig?.owners) ? processConfig.owners.map(String) : [];
-    const syntheticOwner = !!auth.localDirect || (!!actor && processOwners.includes(actor));
-    const actorId = auth.localDirect ? 'local-direct' : actor || undefined;
+    const syntheticOwner = isDaemonOwnerAuth(processConfig, auth);
+    const actorId = auth.localDirect ? 'local-direct' : actor || (syntheticOwner ? 'ecweb-remote' : undefined);
     const subject = modules.buildAuthSubject({
         selfAid: aid,
         actorId,
@@ -116,6 +116,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
         chatType: 'private',
         conversationId: actor || 'ecweb',
         processOwners,
+        trustedProcessRole: syntheticOwner ? 'daemon-owner' : undefined,
         ...(syntheticOwner ? {
             roleDetail: {
                 effectiveRole: 'owner',
@@ -123,8 +124,8 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
                 isAuthenticated: true,
                 allowAccess: true,
                 roleExists: true,
-                // buildAuthSubject uses the authenticated actor separately from the
-                // resolved relation role to determine daemon-owner provenance.
+                // Keep the token's actor provenance separate from the management
+                // authority established by the ECWeb authentication gate.
                 actor: {
                     operatorId: actorId || 'ecweb',
                     operatorChannelKey: `ecweb#${aid}`,
@@ -155,7 +156,7 @@ async function authorizeRolePolicyOperation(modules, processConfig, auth, aid, o
     });
 }
 function isDaemonOwnerAuth(processConfig, auth) {
-    if (auth.localDirect)
+    if (auth.daemonOwner === true || auth.localDirect)
         return true;
     const actor = typeof auth.actorAid === 'string' ? auth.actorAid.trim() : '';
     const processOwners = Array.isArray(processConfig?.owners)

package/dist/sources/session-codex.js

@@ -205,12 +205,12 @@ function listProjects() {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
-      FROM threads
-      WHERE archived = 0
-      GROUP BY cwd
-      ORDER BY lastActivity DESC
+        const rows = db.prepare(`
+      SELECT cwd, COUNT(*) as count, MAX(updated_at) as lastActivity
+      FROM threads
+      WHERE archived = 0
+      GROUP BY cwd
+      ORDER BY lastActivity DESC
     `).all();
         const projects = rows.map(r => {
             const cwd = r.cwd || '';
@@ -382,11 +382,11 @@ function listTranscripts(encoded, cwd) {
     if (!db)
         return [];
     try {
-        const rows = db.prepare(`
-      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
-      FROM threads
-      WHERE cwd = ? AND archived = 0
-      ORDER BY updated_at DESC
+        const rows = db.prepare(`
+      SELECT id, title, first_user_message, updated_at, rollout_path, source, thread_source
+      FROM threads
+      WHERE cwd = ? AND archived = 0
+      ORDER BY updated_at DESC
     `).all(cwd);
         const out = [];
         let parsed = 0, hitMem = 0, hitDisk = 0;