ec-web 0.0.28 → 0.0.29

package/dist/server.js

@@ -616,13 +616,31 @@ function handleConnection(ws, req, log, tokenRecord) {
             const timeoutMs = Number.isFinite(Number(msg.timeoutMs)) && Number(msg.timeoutMs) > 0
                 ? Math.min(Number(msg.timeoutMs), 120_000)
                 : 5000;
+            const ecwebRequestId = (typeof msg.requestId === 'string' || typeof msg.requestId === 'number')
+                ? String(msg.requestId)
+                : crypto.randomUUID();
+            const logicalToolName = typeof msg.payload?.name === 'string' && msg.payload.name.trim()
+                ? msg.payload.name.trim()
+                : typeof msg.payload?.cmd === 'string' && msg.payload.cmd.trim()
+                    ? msg.payload.cmd.trim().split(/\s+/, 1)[0]
+                    : typeof msg.payload?.type === 'string' ? msg.payload.type : undefined;
             const menuAuth = daemonOwnerMenuAuth(localDirect, actorAid);
-            const resp = await ipcQuery(p.socket, { type: 'menu.exec', payload: msg.payload, auth: { source: 'ecweb', ...menuAuth } }, timeoutMs);
+            const resp = await ipcQuery(p.socket, {
+                type: 'menu.exec',
+                payload: msg.payload,
+                auth: {
+                    source: 'ecweb',
+                    ...menuAuth,
+                    ecwebRequestId,
+                    endpoint: 'WS menu.exec',
+                    logicalToolName,
+                },
+            }, timeoutMs);
             if (resp?.ok) {
-                send({ type: 'menu.response', requestId: msg.requestId, data: resp.response });
+                send({ type: 'menu.response', requestId: ecwebRequestId, data: resp.response });
             }
             else {
-                send({ type: 'menu.response', requestId: msg.requestId, data: {
+                send({ type: 'menu.response', requestId: ecwebRequestId, data: {
                         type: 'menu.response', id: msg.payload?.id ?? '',
                         error: { code: 'INTERNAL', message: resp?.error ?? 'daemon unreachable' },
                     } });

package/dist/sources/basic-settings.js

@@ -18,13 +18,13 @@ const SERVICE_VISIBILITIES = new Set(['public', 'private', 'aun-auth']);
 const SENSITIVE_METADATA_KEY = /(?:^|[_-])(endpoint|url|uri|token|access[_-]?token|authorization|cookie|secret|password|private[_-]?key|key|cert|certificate)(?:$|[_-])/i;
 const DAEMON_EXACT_PATHS = new Set([
     'owners',
-    'fullaccess.enabled',
     'aun.defaultAidDomain',
     'aun.minEvolVersion',
     'aun.menuTokenRequired',
     'aun.defaultEncrypt',
     'services',
     'configSnapshots',
+    'restartRecovery.enabled',
     'idleMonitor.enabled',
     'idleMonitor.timeout',
     'idleMonitor.apiRetryTimeout',
@@ -97,10 +97,10 @@ const BASEAGENT_FIELDS = {
     ]),
 };
 const BOOLEAN_PATHS = new Set([
-    'fullaccess.enabled',
     'aun.menuTokenRequired',
     'aun.defaultEncrypt',
     'configSnapshots',
+    'restartRecovery.enabled',
     'idleMonitor.enabled',
     'debug.aunTrace',
     'debug.aunSdkLog',
@@ -122,6 +122,7 @@ const RESTART_DAEMON_PREFIXES = [
     'aun.',
     'services',
     'configSnapshots',
+    'restartRecovery.',
     'idleMonitor.',
     'debug.',
 ];
@@ -484,7 +485,7 @@ function validateDefaultsValue(fieldPath, value) {
         return;
     }
     if (fieldPath === 'config.mentionMode') {
-        if (!['disabled', 'mention-only'].includes(String(value)))
+        if (!['disabled', 'mention-only', 'auto'].includes(String(value)))
             throw new Error(`${fieldPath} is invalid`);
         return;
     }

package/dist/sources/msg.js

@@ -14,7 +14,7 @@ import { decodeDirSegment, isTransientProtocolMessage, readAllJsonlLines, readJs
 function topicMatchesArchiveFilter(chat, archived) {
     if (archived === 'all')
         return true;
-    const isArchived = chat.partition === 'thread' && chat.lable === '归档';
+    const isArchived = chat.partition === 'thread' && chat.topicStatus === 'archived';
     return archived === true ? isArchived : !isArchived;
 }
 let contextModulesPromise = null;
@@ -589,8 +589,10 @@ function loadChats(peerDisplayResolver, metrics) {
                 threadName: item.partition === 'thread'
                     ? String(partitionActive.name || partitionActive.metadata?.topicName || item.threadId)
                     : null,
-                lable: item.partition === 'thread' && typeof partitionActive.lable === 'string'
-                    ? partitionActive.lable || null : null,
+                label: item.partition === 'thread'
+                    ? partitionActive.label || (partitionActive.lable === '归档' ? null : partitionActive.lable || null) : null,
+                topicStatus: item.partition === 'thread'
+                    ? partitionActive.topicStatus || (partitionActive.lable === '归档' ? 'archived' : 'pending') : null,
                 updatedAt,
                 messages: item.messages,
                 active: partitionActive,
@@ -700,7 +702,8 @@ function mergePeerInfo(chats) {
                 partition: chat.partition,
                 threadId: chat.threadId,
                 threadName: chat.threadName,
-                lable: chat.lable,
+                label: chat.label,
+                topicStatus: chat.topicStatus,
                 inbound: 0,
                 outbound: 0,
                 lastAt: 0,
@@ -831,7 +834,8 @@ async function buildSessionContext(chat) {
         sessionId: active.id || null,
         evolcoreSessionId: active.id || null,
         name: active.name || null,
-        lable: chat.lable,
+        label: chat.label,
+        topicStatus: chat.topicStatus,
         baseagent: active.baseagent || active.agentType || null,
         chatMode,
         permissionMode,

package/dist/sources/relation-roles.js

@@ -129,6 +129,7 @@ async function authorizeRoleAssignmentRead(modules, aid, auth) {
         processRole: actor.daemonOwner ? 'daemon-owner' : 'none',
         isDaemonOwner: actor.daemonOwner,
         decision: decision.allow ? 'allow' : 'deny',
+        ...(decision.allow ? {} : { decisionSource: 'role', errorCode: 'ROLE_DENIED' }),
         code: decision.allow ? undefined : decision.code,
         reason: decision.allow ? undefined : decision.reason,
         matchedRule: decision.matchedRule,
@@ -209,6 +210,8 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             processRole: daemonOwner ? 'daemon-owner' : 'none',
             isDaemonOwner: daemonOwner,
             decision: 'deny',
+            decisionSource: 'role',
+            errorCode: 'ROLE_DENIED',
             code: decision.code,
             reason: decision.reason,
             matchedRule: decision.matchedRule,
@@ -243,6 +246,8 @@ async function authorizeRoleAssignmentWrite(modules, aid, auth, operation, targe
             processRole: daemonOwner ? 'daemon-owner' : 'none',
             isDaemonOwner: daemonOwner,
             decision: 'deny',
+            decisionSource: 'role',
+            errorCode: 'ROLE_DENIED',
             code: 'NOT_ALLOWED',
             reason,
             matchedRule: decision.matchedRule,

package/dist/sources/role-definitions.js

@@ -189,7 +189,9 @@ const COMMAND_CONSTRAINT_KEYS = new Set([
     'requireDaemonOwner',
     'requireControlChannel',
     'requireExplicitDangerousGrant',
+    'currentRelationOnly',
     'requireFieldOverride',
+    'configFieldPolicy',
     'allowedArgs',
     'deniedArgs',
     'forbiddenFlags',
@@ -211,7 +213,9 @@ const COMMAND_BOOLEAN_CONSTRAINTS = new Set([
     'requireDaemonOwner',
     'requireControlChannel',
     'requireExplicitDangerousGrant',
+    'currentRelationOnly',
 ]);
+const COMMAND_CONFIG_FIELD_POLICIES = new Set(['behavior-read', 'role-overridable-write']);
 const COMMAND_STRING_ARRAY_CONSTRAINTS = new Set([
     'forbiddenFlags',
     'allowedConfigKeys',
@@ -394,6 +398,9 @@ function validateCommandPermissionConstraints(rule, constraints, errors) {
         else if (key === 'requireFieldOverride' && typeof value !== 'string') {
             errors.push(`${label} must be a string`);
         }
+        else if (key === 'configFieldPolicy' && !COMMAND_CONFIG_FIELD_POLICIES.has(String(value))) {
+            errors.push(`${label} must be behavior-read or role-overridable-write`);
+        }
         else if (COMMAND_STRING_ARRAY_CONSTRAINTS.has(key)) {
             if (!Array.isArray(value) || !value.every(item => typeof item === 'string')) {
                 errors.push(`${label} must be a string array`);

package/dist/sources/session-origin.js

@@ -197,13 +197,13 @@ export function classifyTranscriptSource(binding, cliCandidate) {
 let historyModulePromise = null;
 async function historyModule() {
     if (!historyModulePromise) {
-        historyModulePromise = import(toFileUrl(resolveParentDistModule('core', 'session', 'runner-task-history.js')));
+        historyModulePromise = import(toFileUrl(resolveParentDistModule('core', 'session', 'runner-event-summary.js')));
     }
     return historyModulePromise;
 }
 export async function readRunnerTaskTurns(logsDir, evolSessionId) {
     const module = await historyModule();
-    return module.readRunnerTaskHistory(logsDir, evolSessionId).map((task) => ({
+    return module.readRunnerEventSummary(logsDir, evolSessionId).map((task) => ({
         role: 'system', ts: task.startedAt,
         uuid: `runner-task:${evolSessionId}:${task.taskId}`,
         category: 'subtask', blocks: [{ kind: 'subtask', ...task }],

package/dist/sources/triggers.js

@@ -39,15 +39,6 @@ function readDaemonOwnerAid(p) {
         return null;
     }
 }
-function readFullAccessEnabled(p) {
-    try {
-        const raw = JSON.parse(fs.readFileSync(p.daemonConfig, 'utf8'));
-        return raw?.fullaccess?.enabled === undefined || raw.fullaccess.enabled === true;
-    }
-    catch {
-        return false;
-    }
-}
 function normalizeAgent(item) {
     const aid = String(item?.value || item?.aid || '').trim();
     if (!aid)
@@ -169,7 +160,6 @@ async function listTriggersForAgent(agentAid, agentLabel) {
 }
 async function buildSnapshot(params) {
     const p = resolvePaths();
-    const fullaccessEnabled = readFullAccessEnabled(p);
     // This capability is derived from the server-injected ECWeb connection
     // context; browser-supplied subscription parameters are never trusted for it.
     const canApprovePersistentFullAccess = watchMenuAuth(params).canApprovePersistentFullAccess;
@@ -201,11 +191,11 @@ async function buildSnapshot(params) {
     if (agent) {
         const found = agentInfos.find((x) => x.aid === agent);
         const triggers = await listTriggersForAgent(agent, found?.label || agent);
-        return { agents: agentInfos, triggers, selectedAgent: agent, fullaccessEnabled, canApprovePersistentFullAccess };
+        return { agents: agentInfos, triggers, selectedAgent: agent, canApprovePersistentFullAccess };
     }
     const batches = await Promise.all(agentInfos.map((x) => listTriggersForAgent(x.aid, x.label)));
     const triggers = batches.flat();
-    return { agents: agentInfos, triggers, selectedAgent: agent, fullaccessEnabled, canApprovePersistentFullAccess };
+    return { agents: agentInfos, triggers, selectedAgent: agent, canApprovePersistentFullAccess };
 }
 export const triggersSource = {
     kind: 'triggers',