ec-web 0.0.25 → 0.0.27

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 EvolCore contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 EvolCore contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,17 +1,17 @@
-# EC Web
-
-Web console and monitoring dashboard for EvolCore.
-
-## Install
-
-```bash
-npm install -g ec-web
-```
-
-## Run
-
-```bash
-ec-web --home /path/to/runtime-home
-```
-
-Use `ec watch web` when EC Web is managed by the main daemon.
+# EC Web
+
+Web console and monitoring dashboard for EvolCore.
+
+## Install
+
+```bash
+npm install -g ec-web
+```
+
+## Run
+
+```bash
+ec-web --home /path/to/runtime-home
+```
+
+Use `ec watch web` when EC Web is managed by the main daemon.

package/dist/index.js

@@ -107,7 +107,7 @@ for (const list of Object.values(ifaces)) {
 }
 process.stdout.write(`\n${BOLD}${CYAN}EC Web — EvolCore${RST}  ${DIM}(home: ${p.root})${RST}\n\n`);
 process.stdout.write(handle.pairingCode
-    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 7 天，有访问自动续期)${RST}\n\n`
+    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，10 分钟内有效，仅可配对一次，token 缓存 7 天，有访问自动续期)${RST}\n\n`
     : `  ${BOLD}配对码:${RST}  ${YELLOW}daemon 暂不可用，请先启动 EvolCore${RST}\n\n`);
 process.stdout.write(`  ${BOLD}本机:${RST}    http://localhost:${handle.port}\n`);
 for (const ip of lanIps)

package/dist/paths.js

@@ -14,6 +14,10 @@ import os from 'os';
 import crypto from 'crypto';
 const isWindows = process.platform === 'win32';
 let _root = null;
+/** Test helper: drop the cached root so a new EVOLCORE_HOME is picked up. */
+export function _resetRoot() {
+    _root = null;
+}
 export function resolveRoot() {
     if (_root)
         return _root;
@@ -48,7 +52,14 @@ function resolveInstanceSocketPath(root) {
         const hash = crypto.createHash('sha1').update(canonicalRoot).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\daemon-${hash}`;
     }
-    return path.join(root, 'data', 'instance', 'daemon.sock');
+    const filesystemPath = path.join(root, 'data', 'instance', 'daemon.sock');
+    if (Buffer.byteLength(filesystemPath) < 100)
+        return filesystemPath;
+    const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 20);
+    const shortFilesystemPath = path.join(os.tmpdir(), `.ec-${hash.slice(0, 15)}.sock`);
+    if (Buffer.byteLength(shortFilesystemPath) < 100)
+        return shortFilesystemPath;
+    return `\0evolcore-${hash}`;
 }
 export function resolvePaths() {
     const root = resolveRoot();

package/dist/server.js

@@ -3,7 +3,7 @@
  *
  * - HTTP: 静态资源 + 配对 API
  * - WebSocket: 订阅式实时推送（aid / msg / session）
- * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（7 天滑动续期）
+ * - 鉴权: daemon 通过本地 IPC 提供 6 位一次性配对码（10 分钟有效）和远程访问 token（7 天滑动续期）
  * - 安全: 绑定 0.0.0.0（支持远程访问）；本地自动登录，远程配对后使用 token，登录后权限一致
  *
  * 与 evolcore daemon 通过 IPC socket（状态、Menu 和远程访问凭据）+ 文件系统（历史数据）旁路通信。
@@ -20,7 +20,7 @@ import { ipcQuery } from './ipc-client.js';
 import { setDebugLog, dlog } from './debug-log.js';
 import { aidSource } from './sources/aid.js';
 import { msgSource } from './sources/msg.js';
-import { sessionSource, buildBindMap, readClaudeSessionResult } from './sources/session.js';
+import { sessionSource, buildBindMap, readClaudeSessionResult, resolveSessionBaseagent, refreshConfiguredBaseagent } from './sources/session.js';
 import { cacheSource } from './sources/cache.js';
 import { systemSource } from './sources/system.js';
 import { triggersSource } from './sources/triggers.js';
@@ -33,13 +33,14 @@ import { ccProjectsDir } from './paths.js';
 import { relationRolesSource, handleRelationRolesApi, handlePeerRoleApi } from './sources/relation-roles.js';
 import { roleDefinitionsSource, handleRoleDefinitionsApi } from './sources/role-definitions.js';
 import { handleModelsApi } from './sources/models.js';
-import { detectBaseAgentsAsync } from './sources/baseagent-detector.js';
 import { readCodexSessionResult } from './sources/session-codex.js';
+import { readEcagentSessionResult } from './sources/session-ecagent.js';
 import { handleBasicSettingsApi } from './sources/basic-settings.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolcore ping response 对齐的软校验版本
+const ECWEB_TRIGGER_IPC_TYPES = new Set(['trigger.history', 'trigger.eventCatalog']);
 function daemonOwnerMenuAuth(localDirect, actorAid) {
     return {
         localDirect,
@@ -48,6 +49,7 @@ function daemonOwnerMenuAuth(localDirect, actorAid) {
         // authentication gate (local-direct exemption or a valid bearer token).
         // ECWeb is the daemon-owner management surface, so remote tokens receive
         // the same persistent fullaccess approval capability as local requests.
+        daemonOwner: true,
         canApprovePersistentFullAccess: true,
     };
 }
@@ -583,16 +585,30 @@ function handleConnection(ws, req, log, tokenRecord) {
                 params.source = msg.source;
             if (msg.limit)
                 params.limit = msg.limit;
+            if (msg.archived !== undefined)
+                params.archived = msg.archived;
             dlog(`▸ 订阅 ${msg.view}${msg.aid ? ` aid=${String(msg.aid).split('.')[0]}` : ''}${msg.peer ? ` peer=${String(msg.peer).split('.')[0]}` : ''}${msg.sessionId ? ` session=${String(msg.sessionId).slice(0, 8)}` : ''}${msg.baseagent ? ` baseagent=${msg.baseagent}` : ''} from ${ip}`);
             await switchSubscription(msg.view, params);
             return;
         }
         if (msg.type === 'session.result') {
             const params = msg.params && typeof msg.params === 'object' ? msg.params : {};
-            const result = params.baseagent === 'codex'
-                ? readCodexSessionResult(params)
-                : readClaudeSessionResult(params);
-            send({ type: 'session.result', requestId: msg.requestId, data: result == null ? null : { text: result } });
+            if (!params.baseagent)
+                await refreshConfiguredBaseagent();
+            const baseagent = resolveSessionBaseagent(params);
+            const result = baseagent === 'codex'
+                ? readCodexSessionResult({ ...params, baseagent })
+                : baseagent === 'ecagent'
+                    ? readEcagentSessionResult({ ...params, baseagent })
+                    : baseagent
+                        ? readClaudeSessionResult({ ...params, baseagent })
+                        : Promise.resolve(null);
+            void Promise.resolve(result)
+                .then(text => send({ type: 'session.result', requestId: msg.requestId, data: text == null ? null : { text } }))
+                .catch(error => {
+                dlog(`session.result failed: ${error instanceof Error ? error.message : String(error)}`);
+                send({ type: 'session.result', requestId: msg.requestId, data: null });
+            });
             return;
         }
         if (msg.type === 'menu' && msg.payload) {
@@ -614,7 +630,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             return;
         }
         if (msg.type === 'ipc' && msg.payload) {
-            if (typeof msg.payload.type !== 'string' || !msg.payload.type.startsWith('trigger.')) {
+            if (typeof msg.payload.type !== 'string' || !ECWEB_TRIGGER_IPC_TYPES.has(msg.payload.type)) {
                 send({ type: 'ipc.response', requestId: msg.requestId, data: { ok: false, error: 'unsupported ipc payload' } });
                 return;
             }
@@ -622,9 +638,7 @@ function handleConnection(ws, req, log, tokenRecord) {
             const timeoutMs = Number.isFinite(Number(msg.timeoutMs)) && Number(msg.timeoutMs) > 0
                 ? Math.min(Number(msg.timeoutMs), 120_000)
                 : 10000;
-            const payload = msg.payload.type === 'trigger.history' || msg.payload.type === 'trigger.eventCatalog'
-                ? { ...msg.payload, controlToken: daemonTriggerControlToken() }
-                : msg.payload;
+            const payload = { ...msg.payload, controlToken: daemonTriggerControlToken() };
             const resp = await ipcQuery(p.socket, payload, timeoutMs);
             send({ type: 'ipc.response', requestId: msg.requestId, data: resp ?? { ok: false, error: 'daemon unreachable' } });
             return;
@@ -731,6 +745,8 @@ function bindPort(server, preferred, log) {
 export async function startWatchWebServer(opts = {}) {
     const log = opts.log || (() => { });
     setDebugLog(log);
+    // 会话读取器默认后端来自 defaults.json；启动时同步一次。
+    await refreshConfiguredBaseagent();
     // soft 版本校验：ping daemon 检查 protocolVersion
     const p = resolvePaths();
     const pingResp = await ipcQuery(p.socket, { type: 'ping' }, 1000);
@@ -740,17 +756,12 @@ export async function startWatchWebServer(opts = {}) {
     const server = http.createServer(async (req, res) => {
         const pathname = requestPath(req.url || '');
         const localDirect = isLocalDirect(req);
-        if (req.method === 'GET' && (req.url || '') === '/api/available-baseagents') {
-            // Base agent 可用性检测 API
-            try {
-                const available = await detectBaseAgentsAsync();
-                res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-                res.end(JSON.stringify(available));
-            }
-            catch (error) {
-                res.writeHead(500, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-                res.end(JSON.stringify({ success: false, error: error?.message || String(error) }));
-            }
+        if (req.method === 'GET' && (req.url || '') === '/api/health') {
+            // Keep readiness checks independent from daemon auth and pairing state.
+            // The endpoint is intentionally small so supervisors and proxies can
+            // distinguish ECWeb from an unrelated process on the configured port.
+            res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+            res.end(JSON.stringify({ ok: true, service: 'ecweb', version: ECWEB_VERSION }));
         }
         else if (req.method === 'GET' && (req.url || '') === '/api/pair-code') {
             // 取码 API：仅真本地直连可用（socket 回环 + 无 x-aun-provider-aid）。
@@ -761,7 +772,9 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ error: 'forbidden' }));
                 return;
             }
-            const pair = await remoteAuth('remote-auth.pair-code');
+            const pair = await remoteAuth('remote-auth.pair-code', {
+                source: 'ecweb-local',
+            });
             if (!pair?.ok || typeof pair.code !== 'string' || typeof pair.expiresAt !== 'number') {
                 res.writeHead(503, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'daemon unavailable' }));
@@ -796,7 +809,9 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
             }
-            void handleBasicSettingsApi(req, res, { redactConnectionMaps: !isLocalDirect(req) });
+            // Pairing grants daemon-owner management authority, just like local
+            // access. Authorize above; do not downgrade settings by network origin.
+            void handleBasicSettingsApi(req, res);
         }
         else if (req.method === 'GET' && (req.url || '').startsWith('/api/stats/')) {
             // Stats API — 本地直连自动发 token（免鉴权），远程需鉴权
@@ -910,7 +925,9 @@ export async function startWatchWebServer(opts = {}) {
         });
     });
     const { port, displaced } = await bindPort(server, opts.port ?? DEFAULT_PORT, log);
-    const initialPair = await remoteAuth('remote-auth.pair-code');
+    const initialPair = await remoteAuth('remote-auth.pair-code', {
+        source: 'ecweb-local',
+    });
     return {
         url: `http://0.0.0.0:${port}`,
         port,

package/dist/sources/aid.js

@@ -65,28 +65,43 @@ function scanAidActivity() {
     }
     return result;
 }
-// evolcore 版本：与 watch aid 状态栏一致。daemon 进程级、整轮 watch 不变，
-// 故缓存一次（首次 menu.query name=system 拿到后复用），避免每秒多发一次 IPC。
+// evolcore 版本：使用 /system 的轻量 version 视图。daemon 进程级、整轮 watch 不变，
+// 故缓存一次并合并 in-flight 请求，避免每秒重复发 IPC。
 const versionCache = new Map();
+const versionInFlight = new Map();
 function authContextKey(params = {}) {
     const auth = watchMenuRequestAuth(params);
     return `${auth.localDirect ? 'local' : 'remote'}:${auth.actorAid || ''}`;
 }
 async function fetchVersion(socket, params = {}) {
-    const key = authContextKey(params);
+    const key = `${socket}\0${authContextKey(params)}`;
     const cached = versionCache.get(key);
     if (cached)
         return cached;
-    try {
-        const r = await ipcQuery(socket, { type: 'menu.exec', payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system' }, auth: watchMenuRequestAuth(params) }, 4000);
-        const v = r?.ok ? r.response?.data?.version : null;
-        if (v)
-            versionCache.set(key, v);
-        return v ?? null;
-    }
-    catch {
-        return null;
-    }
+    const pending = versionInFlight.get(key);
+    if (pending)
+        return pending;
+    const request = (async () => {
+        try {
+            const r = await ipcQuery(socket, {
+                type: 'menu.exec',
+                payload: { type: 'menu.query', id: 'aid-sys-q', name: 'system', args: { view: 'version' } },
+                auth: watchMenuRequestAuth(params),
+            }, 4000);
+            const v = r?.ok ? r.response?.data?.version : null;
+            if (v)
+                versionCache.set(key, v);
+            return v ?? null;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            versionInFlight.delete(key);
+        }
+    })();
+    versionInFlight.set(key, request);
+    return request;
 }
 async function buildSnapshot(fallback = null, params = {}) {
     const p = resolvePaths();

package/dist/sources/basic-settings.js

@@ -580,7 +580,7 @@ export function restartRequiredForChanges(file, changes) {
     const prefixes = file === 'daemon' ? RESTART_DAEMON_PREFIXES : RESTART_DEFAULTS_PREFIXES;
     return changes.map(change => change.path).filter(fieldPath => prefixes.some(prefix => fieldPath === prefix || fieldPath.startsWith(prefix)));
 }
-function redactSecrets(config, file, secrets, secretRefs, options = {}) {
+function redactSecrets(config, file, secrets, secretRefs) {
     const redacted = clone(config);
     if (file !== 'defaults' || !isRecord(redacted.baseagents))
         return redacted;
@@ -600,26 +600,6 @@ function redactSecrets(config, file, secrets, secretRefs, options = {}) {
                 raw.apiKey = '******';
             }
         }
-        // Headers and query parameters are also common credential channels. They
-        // remain visible to local callers for editing, but remote snapshots must
-        // not disclose any map value, including values under custom key names.
-        if (options.redactConnectionMaps) {
-            for (const field of ['headers', 'queryParams']) {
-                if (!Object.prototype.hasOwnProperty.call(raw, field))
-                    continue;
-                const fieldPath = `defaults.baseagents.${name}.${field}`;
-                if (isRecord(raw[field])) {
-                    raw[field] = Object.fromEntries(Object.keys(raw[field]).map(key => {
-                        secrets[`${fieldPath}.${key}`] = true;
-                        return [key, '******'];
-                    }));
-                }
-                else {
-                    secrets[fieldPath] = true;
-                    raw[field] = '******';
-                }
-            }
-        }
     }
     return redacted;
 }
@@ -670,7 +650,7 @@ export function collectLogTypeStats(configured, logsDir = resolvePaths().logs) {
 export function collectLogTypes(configured, logsDir = resolvePaths().logs) {
     return collectLogTypeStats(configured, logsDir).types;
 }
-async function readSnapshot(options = {}) {
+async function readSnapshot() {
     const modules = await getConfigManager();
     const daemonFile = modules.read(modules.ConfigTarget.Process, undefined, { cache: false, expand: false });
     const defaultsFile = modules.read(modules.ConfigTarget.Defaults, undefined, { cache: false, expand: false });
@@ -682,8 +662,8 @@ async function readSnapshot(options = {}) {
     const secretRefs = {};
     const logTypeStats = collectLogTypeStats(rawDaemon?.watch?.logTypes);
     return {
-        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs, options),
-        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs, options),
+        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs),
+        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs),
         revisions: {
             daemon: basicSettingsRevision(rawDaemon),
             defaults: basicSettingsRevision(rawDefaults),
@@ -758,12 +738,12 @@ function basicSettingsPath(rawUrl) {
         return rawUrl.split('?')[0].replace(/\/+$/, '') || '/';
     }
 }
-export async function handleBasicSettingsApi(req, res, options = {}) {
+export async function handleBasicSettingsApi(req, res) {
     try {
         const url = new URL(req.url || '', 'http://localhost');
         const pathname = basicSettingsPath(req.url || '');
         if (req.method === 'GET' && pathname === '/api/basic-settings') {
-            sendJson(res, 200, { success: true, data: await readSnapshot(options) });
+            sendJson(res, 200, { success: true, data: await readSnapshot() });
             return;
         }
         if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
@@ -816,7 +796,7 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
                 changed: mutation.changed,
                 restartRequired: mutation.changed && restartPaths.length > 0,
                 restartPaths: mutation.changed ? restartPaths : [],
-                data: await readSnapshot(options),
+                data: await readSnapshot(),
             });
             return;
         }

package/dist/sources/msg.js

@@ -10,6 +10,13 @@ import { ipcQuery } from '../ipc-client.js';
 import { resolvePaths } from '../paths.js';
 import { resolveParentDistModule, toFileUrl } from './parent-package.js';
 import { decodeDirSegment, isTransientProtocolMessage, readAllJsonlLines, readJsonFile, scanChatDirs, tryParseChannelSessionKey, } from '../fs-utils.js';
+// ECWeb builds as a separate package. Keep this wire contract aligned with session-mapper.ts.
+function topicMatchesArchiveFilter(chat, archived) {
+    if (archived === 'all')
+        return true;
+    const isArchived = chat.partition === 'thread' && chat.lable === '归档';
+    return archived === true ? isArchived : !isArchived;
+}
 let contextModulesPromise = null;
 const sessionAdapterPromises = new Map();
 let peerDisplayResolverPromise = null;
@@ -96,6 +103,7 @@ function getSessionAdapter(baseagent) {
             claude: 'ClaudeSessionFileAdapter',
             codex: 'CodexSessionFileAdapter',
             gemini: 'GeminiSessionFileAdapter',
+            ecagent: 'EcagentSessionFileAdapter',
         };
         const className = classNames[baseagent];
         const promise = !className
@@ -581,6 +589,8 @@ function loadChats(peerDisplayResolver, metrics) {
                 threadName: item.partition === 'thread'
                     ? String(partitionActive.name || partitionActive.metadata?.topicName || item.threadId)
                     : null,
+                lable: item.partition === 'thread' && typeof partitionActive.lable === 'string'
+                    ? partitionActive.lable || null : null,
                 updatedAt,
                 messages: item.messages,
                 active: partitionActive,
@@ -690,6 +700,7 @@ function mergePeerInfo(chats) {
                 partition: chat.partition,
                 threadId: chat.threadId,
                 threadName: chat.threadName,
+                lable: chat.lable,
                 inbound: 0,
                 outbound: 0,
                 lastAt: 0,
@@ -766,7 +777,7 @@ async function sessionTurns(active, messages) {
     if (baseagent && agentSessionId && projectPath) {
         try {
             const adapter = await getSessionAdapter(baseagent);
-            const turns = Number(adapter?.getFileInfo(projectPath, agentSessionId)?.turns);
+            const turns = Number(adapter?.getFileInfo(projectPath, agentSessionId, active.selfAID)?.turns);
             if (Number.isFinite(turns) && turns > 0)
                 return turns;
         }
@@ -820,6 +831,7 @@ async function buildSessionContext(chat) {
         sessionId: active.id || null,
         evolcoreSessionId: active.id || null,
         name: active.name || null,
+        lable: chat.lable,
         baseagent: active.baseagent || active.agentType || null,
         chatMode,
         permissionMode,
@@ -830,6 +842,10 @@ async function buildSessionContext(chat) {
     };
 }
 async function buildSnapshot(params) {
+    const archived = params.archived;
+    if (archived !== undefined && archived !== false && archived !== true && archived !== 'all') {
+        throw new Error('archived 必须是布尔值或 "all"');
+    }
     const startedAt = Date.now();
     const metrics = {
         files: 0,
@@ -853,13 +869,14 @@ async function buildSnapshot(params) {
         : requestedScope;
     const peer = params.peer || null;
     const inScope = selectedChats(chats, scope);
-    const peers = scope ? mergePeerInfo(inScope) : [];
+    const visibleChats = inScope.filter(chat => topicMatchesArchiveFilter(chat, archived));
+    const peers = scope ? mergePeerInfo(visibleChats) : [];
     const requestedLimit = Number(params.limit);
     const limit = Number.isFinite(requestedLimit) ? Math.min(Math.max(Math.trunc(requestedLimit), 20), 200) : 100;
     const requestedBefore = params.before == null ? Number.NaN : Number(params.before);
     const before = Number.isFinite(requestedBefore) && requestedBefore >= 0 ? Math.trunc(requestedBefore) : null;
-    const page = scope && peer ? messagesFor(inScope, peer, before, limit) : { messages: [], nextBefore: null, hasMore: false };
-    const currentChat = peer ? inScope.find(chat => chatKey(chat) === peer) : undefined;
+    const page = scope && peer ? messagesFor(visibleChats, peer, before, limit) : { messages: [], nextBefore: null, hasMore: false };
+    const currentChat = peer ? visibleChats.find(chat => chatKey(chat) === peer) : undefined;
     const sessionContext = await buildSessionContext(currentChat);
     metrics.totalMs = Date.now() - startedAt;
     return {

package/dist/sources/relation-roles.js

@@ -24,9 +24,11 @@ async function getParentModules() {
 async function getCommandModules() {
     const permissionPath = resolveParentDistModule('core', 'auth', 'operation-authorizer.js');
     const auditPath = resolveParentDistModule('core', 'auth', 'authorization-audit.js');
+    const runtimePolicyPath = resolveParentDistModule('core', 'role', 'runtime-policy.js');
     const permission = await import(toFileUrl(permissionPath));
     const audit = await import(toFileUrl(auditPath));
-    return { permission, audit };
+    const runtimePolicy = await import(toFileUrl(runtimePolicyPath));
+    return { permission, audit, runtimePolicy };
 }
 export const ROLE_ASSIGNMENT_POLICY = {
     owner: {
@@ -38,15 +40,17 @@ export const ROLE_ASSIGNMENT_POLICY = {
         revoke: 'user-roles',
     },
 };
-function isManagementRoleName(role) {
-    return role === 'owner' || role === 'admin';
-}
 function isAssignableUserRole(role) {
-    return typeof role === 'string' && !!role && !isManagementRoleName(role);
+    // `admin` is a management role, but it is still a valid relation role.
+    // `owner` and `daemon-owner` remain reserved for process/Agent config and
+    // can never be assigned through a relation.
+    return typeof role === 'string' && !!role && role !== 'owner' && role !== 'daemon-owner';
 }
 export function canAssignRole(actorRole, targetRole) {
     if (!isAssignableUserRole(targetRole))
         return false;
+    if (targetRole === 'admin')
+        return actorRole === 'owner';
     return actorRole === 'owner' || actorRole === 'admin';
 }
 export function canRevokeRole(actorRole, targetRole) {
@@ -54,6 +58,8 @@ export function canRevokeRole(actorRole, targetRole) {
         return true;
     if (actorRole !== 'admin' || !targetRole)
         return false;
+    if (targetRole === 'admin')
+        return false;
     return isAssignableUserRole(targetRole);
 }
 async function getAgentsFromIpc() {
@@ -74,7 +80,8 @@ function resolveEcwebActor(modules, aid, auth) {
     const processOwners = Array.isArray(processConfig?.owners)
         ? processConfig.owners.map((value) => String(value || '').trim()).filter(Boolean)
         : [];
-    const daemonOwner = !!auth.localDirect || (!!auth.actorAid && processOwners.includes(auth.actorAid));
+    const daemonOwner = auth.daemonOwner === true || !!auth.localDirect
+        || (!!auth.actorAid && processOwners.includes(auth.actorAid));
     const actorRole = daemonOwner
         ? 'owner'
         : auth.actorAid
@@ -89,11 +96,11 @@ function resolveEcwebActor(modules, aid, auth) {
     return {
         daemonOwner,
         actorRole,
-        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || undefined,
+        actorId: auth.localDirect ? 'local-direct' : auth.actorAid || (daemonOwner ? 'ecweb-remote' : undefined),
     };
 }
 async function authorizeRoleAssignmentRead(modules, aid, auth) {
-    const { permission, audit } = await getCommandModules();
+    const { permission, audit, runtimePolicy } = await getCommandModules();
     const actor = resolveEcwebActor(modules, aid, auth);
     const decision = permission.authorizeCommand({
         intent: {
@@ -118,6 +125,7 @@ async function authorizeRoleAssignmentRead(modules, aid, auth) {
         actorId: actor.actorId,
         selfAid: aid,
         role: actor.actorRole,
+        permissionMode: runtimePolicy.resolveRuntimePermissionMode({ selfAid: aid, role: actor.actorRole }).effectiveValue,
         processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
         isDaemonOwner: actor.daemonOwner,
         decision: decision.allow ? 'allow' : 'deny',
@@ -696,11 +704,17 @@ async function buildSnapshot(auth = {}) {
         if (!readDecision.allow)
             continue;
         const roleConfig = modules.roles.readRolesConfig(aid);
+        const availableRoles = Object.keys(roleConfig.roles || {});
+        // Management roles are resolved separately from user-role definitions.
+        // Include the assignable management role in the ECWeb snapshot so relation
+        // editors can offer it; owner remains reserved for config.json owners[].
+        if (roleExists(modules.roles, aid, 'admin'))
+            availableRoles.push('admin');
         snapshotAgents.push({
             aid,
             displayName: agent.displayName ?? agent.personalName,
             name: agent.name,
-            roles: Object.keys(roleConfig.roles || {}).filter(role => isAssignableUserRole(role)),
+            roles: [...new Set(availableRoles)].filter(role => isAssignableUserRole(role)),
             defaultRoles: roleConfig.defaultRoles ?? { private: null, group: null },
             assignments: listRelationRoleAssignments(modules.config, aid),
         });