evolcore 0.0.11 → 0.0.12

package/dist/utils/cross-platform.js

@@ -6,6 +6,21 @@ import fs from 'fs';
 import { getProcessStartTime, parseCimDate } from './process-introspect.js';
 const execFileAsync = promisify(execFile);
 export const isWindows = process.platform === 'win32';
+/**
+ * Start a detached EvolCore Node process without creating a console window on
+ * Windows. The child is unref'd here so callers cannot accidentally keep the
+ * parent process alive while a lifecycle task is running.
+ */
+export function spawnDetachedNode(args, env = {}) {
+    const child = spawn(process.execPath, [...args], {
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: isWindows,
+        env: { ...process.env, ...env },
+    });
+    child.unref();
+    return child;
+}
 const ENCODE_PATH_MAX = 200;
 function encodePathHash(s) {
     let h = 0;

package/dist/utils/npm-ops.js

@@ -20,7 +20,7 @@ export async function npmInstallGlobal(pkg) {
     // Windows: run via cmd /c to avoid shell:true deprecation warning on Node 22.
     // Unix: npm directly, no shell needed.
     if (isWindows) {
-        cmd = 'cmd';
+        cmd = process.env.ComSpec || path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe');
         args = ['/c', 'npm', 'install', '-g', pkg];
     }
     else {
@@ -28,14 +28,14 @@ export async function npmInstallGlobal(pkg) {
         args = ['install', '-g', pkg];
     }
     try {
-        await execFileAsync(cmd, args, { timeout: 180000 });
+        await execFileAsync(cmd, args, { timeout: 180000, windowsHide: isWindows });
     }
     catch (e) {
         if (e.stderr?.includes('EACCES') || e.message?.includes('EACCES')) {
             if (isWindows) {
                 throw new Error('权限不足。请以管理员身份运行 PowerShell 或 CMD，然后重试');
             }
-            await execFileAsync('sudo', ['npm', 'install', '-g', pkg], { timeout: 180000 });
+            await execFileAsync('sudo', ['npm', 'install', '-g', pkg], { timeout: 180000, windowsHide: false });
         }
         else {
             throw e;
@@ -103,7 +103,7 @@ export function resolveGlobalPkg(pkgName) {
         // 避免 "args 数组 + shell:true" 组合触发 Node DeprecationWarning，且无注入风险。
         const npmCmd = isWindows ? 'npm.cmd' : 'npm';
         const globalRoot = execSync(`${npmCmd} root -g`, {
-            encoding: 'utf-8', timeout: 10000,
+            encoding: 'utf-8', timeout: 10000, windowsHide: true,
         }).trim();
         const pkgPath = path.join(globalRoot, ...pkgName.split('/'), 'package.json');
         if (fs.existsSync(pkgPath)) {
@@ -171,7 +171,7 @@ export async function tryUpgrade() {
 /**
  * 通用全局包升级流程：检查 → 比较 → 安装（失败重试一次）。
  * 仅在包已安装时检查升级，未安装则跳过（resolveFn 返回 null）。
- * fastaun / EC Web 等独立全局包共用此逻辑。
+ * 用于 EC Web 等真正独立于 EvolCore 的全局包。
  */
 export async function tryUpgradeGlobalPkg(resolveInstalled, pkgName) {
     if (isLinkedInstall()) {
@@ -201,10 +201,3 @@ export async function tryUpgradeGlobalPkg(resolveInstalled, pkgName) {
     }
     return { status: 'failed', from: localVer, to: remoteVer, error: lastError };
 }
-/**
- * AUN SDK 升级流程：检查 → 比较 → 安装
- * 仅在 SDK 已安装时检查升级，未安装则跳过。
- */
-export async function tryUpgradeAunSdk(resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG) {
-    return tryUpgradeGlobalPkg(resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG);
-}

package/dist/utils/tool-summary.js

@@ -63,6 +63,17 @@ export function summarizeToolInput(toolName, input) {
         || input.url
         || '';
 }
+/**
+ * Audit-safe tool summary. Keep the useful operation shape while masking
+ * credentials commonly embedded in shell commands or tool arguments.
+ */
+export function summarizeToolInputForAudit(toolName, input) {
+    return summarizeToolInput(toolName, input)
+        .replace(/\b([A-Z0-9_]*(?:TOKEN|KEY|SECRET|PASSWORD|CREDENTIAL)[A-Z0-9_]*)\s*=\s*(?:"[^"]*"|'[^']*'|\S+)/gi, '$1=[REDACTED]')
+        .replace(/\b(authorization\s*:\s*Bearer\s+)[^\s"',;]+/gi, '$1[REDACTED]')
+        .replace(/\b(api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret|authorization|cookie)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, '$1$2[REDACTED]')
+        .replace(/\bBearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]');
+}
 const EDIT_PREVIEW_MAX_LINES = 14;
 const EDIT_PREVIEW_CONTEXT_LINES = 2;
 const EDIT_PREVIEW_INLINE_GAP_LINES = 4;

package/kits/docs/channels/aun.md

@@ -52,5 +52,5 @@ AUN keystore seed 由 EvolCore 使用固定应用值管理，不再提供配置
 - **E2EE 加密**：可选端到端加密，回复默认跟随对端消息加密状态（密文回密文，明文回明文）；keystore seed 由 EvolCore 固定管理。
 - **断线重连**：SDK 内置退避策略自动重连。实时连接状态用 `ec watch aid` 查看（`ec aid` 是身份/证书管理，不显示连接状态）。
 - **群 ID 格式**：当前协议规范使用 `g-{slug}.issuer-domain` canonical 形式，输入也可接受本域简写 `g-{slug}` 或兼容形式 `g-{slug}@issuer-domain`。历史会话里可能仍出现 `group.{issuer}/{group_no}` 一类旧格式，运行时需兼容读取。
-- **群分发模式**：`dispatch_mode=broadcast|mention` 是群级配置，只决定哪些群消息进入 Agent LLM 上下文，不影响 AUN 协议层投递；被过滤消息仍应本地存档。
+- **群 @ 处理策略**：`mention_mode=disabled|mention-only` 是群级配置，只决定哪些群消息进入 Agent LLM 上下文，不影响 AUN 协议层投递；被过滤消息仍应本地存档。
 - **身份体系**：对端以 AID 标识，关系层 peerKey 形如 `aun#alice.aid.pub`。

package/kits/docs/context-assembly.md

@@ -163,6 +163,7 @@ manifest 是 `{ "$schema_version": 1, "sections": [...] }`。每个 section：
 
 - 覆盖文件含 `"mode": "replace"` → **完全替换**，只用覆盖文件的 sections。
 - 否则 **patch 合并**：以 `id` 为键，覆盖文件里同 id 的字段浅合并进基础 section（`{...base, ...override}`），新 id 追加。
+- 旧 patch 中的 `relation-group-profile` 已废弃并会被忽略；群与私聊 profile 统一通过 `peer-profile` 配置，避免同一文件重复加载。`mode: "replace"` 不做此兼容处理。
 
 合并后统一按 `order` 升序排序。改某段行为（如关掉某层、调顺序、换条件）优先用覆盖文件，不动基础 manifest。
 
@@ -295,7 +296,6 @@ coding 场景（无 channel/无身份）下，`chatType`、`channel`、`selfAid`
 | 40 | venue-fragment | fragment | chatType≠null | ✓ |
 | 41 | venue-chattype | `$KITS_DOCS/venues/{{chatType}}.md` | chatType≠null | ✗ |
 | 42 | venue-channel-chattype | `$KITS_DOCS/venues/{{channel}}-{{chatType}}.md` | chatType≠null | ✗ |
-| 43 | relation-group-profile | `$RELATIONS_DIR/{{peerKey}}/profile.md` | groupId≠null | ✗ |
 | 44 | venue-client | `$KITS_DOCS/venues/client-{{clientType}}.md` | clientType≠null | ✗ |
 | 50 | channel-layer | fragment | channel≠null | ✓ |
 | 55 | commands | fragment | channel≠null | ✓ |
@@ -322,7 +322,7 @@ $KITS_DOCS/venues/                  通用环境文档（随包发布，只读
 ```
 
 > **注意**：具体群/私聊实例的 profile 数据落**关系层** `$RELATIONS_DIR/<peerKey>/profile.md`，
-> 由 `relation-group-profile` 段注入，不在 venues 目录。
+> 统一由 `peer-profile` 段注入，不在 venues 目录；群不会再通过另一个 section 重复加载。
 
 ## 输出结构
 

package/kits/docs/evolcore/agent.md

@@ -17,9 +17,10 @@ ec agent <aid>
 ec agent new [aid]
 
 # 创建 agent（非交互式，自动化场景）
-ec agent new <aid> --non-interactive --project <绝对路径> \
-  [--baseagent claude|codex|gemini] [--owner <aid>] \
-  [--name "<显示名>"] [--description "<text>"] [--force]
+ec agent new <aid> --non-interactive \
+  [--project <路径>] [--baseagent claude|codex|gemini|ecagent] \
+  [--owner <aid>] [--name "<显示名>"] [--description "<text>"] \
+  [--dry-run] [--force]
 
 # 启用 / 停用
 ec agent enable <aid>
@@ -44,9 +45,13 @@ ec agent delete <aid> [--purge]
 
 ## 非交互创建必填项
 
-`ec agent new <aid> --non-interactive` 时：
-- 必填：`--project <absolute path>`
-- 可选：`--baseagent`（默认 PATH 中第一个可用项）、`--owner`、`--name`、`--description`、`--force`（覆盖已有 config.json）
+`ec agent new <aid> --non-interactive` 时，只有 `<aid>` 必填：
+- `--project` 缺省为当前目录，并自动转为绝对路径。
+- `--baseagent` 优先使用 `agents/defaults.json`，否则检测本机可用基座。
+- `--owner` 缺省使用 `daemon.json` 的第一个 owner；未配置时省略。
+- `--name` / `--description` 缺省读取当前项目 `package.json`，再回退到目录名 / 空描述。
+- `--dry-run` 只输出最终创建计划，不注册 AID、不写配置、不上传 `agent.md`。
+- `--force` 覆盖已有 `config.json`；AID 密钥保留。
 
 ## 头像更新
 

package/kits/docs/evolcore/aid.md

@@ -2,6 +2,20 @@
 
 管理本地 AID 身份（证书、私钥、agent.md 名片），以及远程探测对端 AID。触发词：身份/证书/名片/探测对端/创建身份。
 
+## 运行边界
+
+本页列出独立终端中 `ec aid` 的完整 CLI 能力。在 EvolCore 托管 Agent 会话中，为防止会话枚举、创建、删除或切换身份，只允许当前 self AID 上的以下精确命令：
+
+```bash
+ec aid show <当前 self AID> [--format json]
+ec aid lookup <当前 self AID> [--format json]
+ec aid agentmd get <当前 self AID> [--format json]
+# 仅 request / bypass
+ec aid agentmd put <当前 self AID> [--format json]
+```
+
+仅允许不带选项的基本形式，或在末尾附加一组完整的 `--format json`；不能使用 `--aun-path`、未知选项、管道、重定向或其他 AID。`show`、`lookup` 和 `agentmd get` 是 self-scoped 查询，可在所有 `permissionMode` 执行；`agentmd put` 会发布远端名片，属于写操作，仅允许 `request`、`bypass`，`readonly`、`auto` 和未知模式均拒绝。该身份范围边界早于模式审批，`bypass` 也不能跨越当前 self AID。`show` 会对自身身份做本地签名/验签自检，但不输出私钥；`lookup` 只探测已知的自身 AID；`get` 不改变身份或远端数据，但会下载并验签自身公开名片，同时刷新本地 AID 缓存。`list`、其他 AID 的 `show/lookup/agentmd get/put` 以及 `new/delete` 均拒绝。独立终端不受此托管会话限制。
+
 ## 子命令
 
 ```bash

package/kits/docs/prompt-loading-architecture.md

@@ -69,7 +69,7 @@
 | **vars 粒度** | 会话级（一次构造，整批复用） | item 级（每条叠加 peerName/now/images） |
 | **模板空行** | 删除（stripBlankLines=true，紧凑） | 保留（stripBlankLines=false，消息多段） |
 | **content 注入** | N/A | 哨兵末步字面量注入（防二次解析） |
-| **缓存** | per-sessionId（跨消息复用文件内容） | per-renderMessageBody 调用（局部） |
+| **缓存** | 随包 `kits/` 文件跨 session 缓存到 reload；personal/relations 等运行时文件按 mtime 刷新 | 随包模板缓存到 reload，消息数据不缓存 |
 | **debug 输出** | `eck-debug/context-*.md` `fragments-*.md` `manifest-*.md` `vars-*.json` | `eck-debug/msg-render-*.md` |
 
 ---
@@ -109,7 +109,6 @@
 | 40 | venue-fragment | chatType≠null | ✓ | 环境层 fragment |
 | 41 | venue-chattype | chatType≠null | ✗ | `venues/{{chatType}}.md` |
 | 42 | venue-channel-chattype | chatType≠null | ✗ | `venues/{{channel}}-{{chatType}}.md` |
-| 43 | venue-group-profile | groupId≠null | ✗ | 群 venue profile.md |
 | 44 | venue-client | clientType≠null | ✗ | `venues/client-{{clientType}}.md` |
 | 50 | channel-layer | channel≠null | ✓ | 渠道层 fragment |
 | 55 | commands | channel≠null | ✓ | 命令集能力卡 |

package/kits/docs/venues/group.md

@@ -5,7 +5,7 @@
 ## 行为准则
 - `mentionMode: mention-only` — 仅响应明确 @ 自己的消息
 - `mentionMode: disabled` — 所有消息可见，自主判断是否参与。这不是叫你每条都回，而是你可以像真人一样：感兴趣的接话，不感兴趣的就跳过。回得短一点、快一点，让对话流动起来，不要一个人长篇大论堵住别人的空间
-- 查看 venue 档案（venue-group-profile）了解本群文化与策略
+- 查看关系档案（peer-profile）了解本群文化与策略
 - 如果上下文中出现“群规则”，它来自当前群资源空间的本地同步缓存；群规则优先于通用群聊指引
 - 群发言会被多人看到，谨言慎行
 - 具体渠道（AUN/飞书/微信等）的群聊特有指引见对应渠道文档

package/kits/eck_manifest.json

@@ -127,18 +127,6 @@
       ] },
       "description": "渠道+场景文档（如 feishu-group）"
     },
-    {
-      "id": "relation-group-profile",
-      "type": "file",
-      "file": "$RELATIONS_DIR/{{peerKey}}/profile.md",
-      "order": 43,
-      "needsInjection": false,
-      "when": { "and": [
-        { "var": "groupId", "neq": null },
-        { "var": "lifecycle", "neq": "bootstrapping" }
-      ] },
-      "description": "具体群关系文档"
-    },
     {
       "id": "relation-group-rules",
       "type": "file",

package/kits/rules/04-relation.md

@@ -39,7 +39,7 @@ relations/
 
 | 条目 | 真实状态 |
 |------|----------|
-| `<peerKey>/profile.md` | manifest 声明了加载槽（`peer-profile`、`relation-group-profile`，缺失即跳过），但**没有任何代码写它**，磁盘上零文件。你可以手写一份，它会被加载 |
+| `<peerKey>/profile.md` | manifest 通过统一的 `peer-profile` 槽加载（缺失即跳过），群聊和私聊不再重复声明；目前**没有任何代码写它**，可以手写一份供上下文加载 |
 | `_index/name_<name>.json` 名字反查索引 | 目录会被创建，但**无任何读写代码**，磁盘上全是空目录。"已知 name 反查 peerKey" 这条路走不通 |
 | `<peerKey>/history.jsonl` | 关系层无此实现（同名文件都属于 handoff / trigger / CC 自己的历史） |
 | `_trash/` | 只创建目录，没有 merge/split 重定向逻辑 |

package/kits/rules/05-venue.md

@@ -5,7 +5,7 @@
 | 变量 | 取值 | 说明 |
 |------|------|------|
 | `chatType` | `private` / `group` / null | null = 无渠道的本地 coding 会话 |
-| `mentionMode` | `mention-only` / `disabled` | 群内响应策略；取 agent/relation 配置，缺省时由服务器 `dispatchMode` 翻译（mention→mention-only，broadcast→disabled） |
+| `mentionMode` | `mention-only` / `disabled` | 群内响应策略；取 agent/relation 配置，缺省时使用群服务器下发的 `mention_mode` |
 | `clientType` | `desktop` / `web` / `mobile` | 有值时额外加载客户端场景文档 |
 | `permissionMode` | readonly/auto/request/bypass | 当前生效权限模式 |
 | `venueUid` | 恒为 undefined | 声明了但源码固定不填，模板有 `{{?}}` 守卫所以永不渲染——**不要依赖它** |
@@ -39,7 +39,7 @@
 ## Venue 类型抽象
 
 环境层关注的是**类型**，而非具体实例。类型只有 `private` 和 `group` 两种（即 `chatType` 的两个非空取值）——
-没有 `broadcast` 这个 venue 类型，`broadcast` 是**群分发模式** `dispatchMode` 的取值之一（另一个是 `mention`）。
+没有 `broadcast` 这个 venue 类型；群响应策略统一由 `mentionMode` 表达。
 
 "张三所在的 team-alpha 这个**具体群**"不属于环境层，它是关系层的对端实例，数据落 `relations/<peerKey>/`。
 

package/kits/schemas/single-session.schema.1.json

@@ -11,10 +11,10 @@
       "type": "boolean",
       "enum": [true, false],
       "default": true,
-      "description": "proactive 首工具表态检查（仅 chatmode=proactive 生效）：首个工具调用前必须先向对端表态，否则拦截。",
+      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
       "x-enumDescriptions": {
-        "true": "启用：首工具前必须先发送消息或文件",
-        "false": "禁用：允许直接调用工具"
+        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
+        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
       }
     },
     "tool_use_reminder": {

package/kits/schemas/single-session.schema.2.json

@@ -34,10 +34,10 @@
       "type": "boolean",
       "enum": [true, false],
       "default": true,
-      "description": "proactive 首工具表态检查（仅 chatmode=proactive 生效）：首个工具调用前必须先向对端表态，否则拦截。",
+      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
       "x-enumDescriptions": {
-        "true": "启用：首工具前必须先发送消息或文件",
-        "false": "禁用：允许直接调用工具"
+        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
+        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
       }
     },
     "tool_use_reminder": {

package/kits/templates/roles/admin.json

@@ -27,11 +27,21 @@
     "role.revoke": { "allow": true, "scopes": ["agent"] },
     "role.policy.read": { "allow": true, "scopes": ["agent"] },
     "role.relation.read": { "allow": true, "scopes": ["agent"] },
+    "agent.baseagent.update": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
+    },
     "observable.current": {
       "allow": true,
       "scopes": ["agent"],
       "constraints": { "requireAgentOwner": true }
     },
+    "observable.update": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
+    },
     "config.get": { "allow": true, "scopes": ["agent", "relation"] },
     "config.set": { "allow": true, "scopes": ["agent", "relation"] },
     "config.unset": { "allow": true, "scopes": ["agent", "relation"] },
@@ -41,6 +51,18 @@
       "scopes": ["agent"],
       "constraints": { "requireAgentAdmin": true }
     },
+    "ec.aid.show": {
+      "allow": true,
+      "dangerous": true,
+      "scopes": ["agent"],
+      "constraints": { "targetCurrentAgentOnly": true, "requireAgentAdmin": true }
+    },
+    "ec.aid.agentmd.put": {
+      "allow": true,
+      "dangerous": true,
+      "scopes": ["agent"],
+      "constraints": { "targetCurrentAgentOnly": true, "requireAgentAdmin": true }
+    },
     "*": { "allow": true },
     "agent.reload": {
       "allow": true,

package/kits/templates/roles/member.json

@@ -53,8 +53,35 @@
     "trigger.*": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "ec.msg.send": { "allow": true, "constraints": { "ownPeerOnly": true } },
     "ec.msg.file": { "allow": true, "constraints": { "ownPeerOnly": true } },
+    "ec.msg.history": { "allow": true, "scopes": ["relation"], "constraints": { "privateOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.msg.online": { "allow": true, "scopes": ["relation"], "constraints": { "privateOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.version": { "allow": true },
+    "ec.aid.show": { "allow": true, "dangerous": true, "scopes": ["relation"], "constraints": { "targetCurrentAgentOnly": true } },
+    "ec.aid.lookup": { "allow": true, "scopes": ["relation"], "constraints": { "targetCurrentAgentOnly": true } },
+    "ec.aid.agentmd.get": { "allow": true, "scopes": ["relation"], "constraints": { "targetCurrentAgentOnly": true } },
+    "ec.aid.agentmd.put": { "allow": false },
+    "ec.fs.ls": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.stat": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.lstat": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.cat": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.find": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.df": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.handoff.status": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.handoff.list": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.handoff.trace": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.handoff.return": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.queue.*": { "allow": false },
     "ec.group.send": { "allow": true, "constraints": { "groupOnly": true, "currentRelationOnly": true } },
     "ec.group.file": { "allow": true, "constraints": { "groupOnly": true, "currentRelationOnly": true } },
+    "ec.group.info": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.pull": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.members": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.online": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.rules.get": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.rules.read": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.ctl.send": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.ctl.file": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.ctl.queue.*": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.ctl.*": { "allow": false },
     "cli.exec.raw": { "allow": false, "dangerous": true },
     "dangerous:*": { "allow": false, "dangerous": true }

package/kits/templates/roles/visitor.json

@@ -20,7 +20,11 @@
     "config.get": { "allow": true, "scopes": ["relation"], "constraints": { "currentRelationOnly": true, "targetCurrentAgentOnly": true, "configFieldPolicy": "behavior-read" } },
     "model.list": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "model.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
-    "model.use": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "model.info": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "model.use": { "allow": false },
+    "model.effort": { "allow": false },
+    "model.reset": { "allow": false },
+    "model.check": { "allow": false },
     "permission.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "permission.answer": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "chatmode.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
@@ -32,9 +36,18 @@
     "group.mentionmode.update": { "allow": false },
     "group.rulespolicy.current": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "group.rulespolicy.update": { "allow": false },
-    "trigger.*": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "trigger.list": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "trigger.show": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "trigger.history": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "trigger.eventCatalog": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
+    "trigger.create": { "allow": false },
+    "trigger.update": { "allow": false },
+    "trigger.setEnabled": { "allow": false },
+    "trigger.cancel": { "allow": false },
+    "trigger.delete": { "allow": false },
+    "trigger.run": { "allow": false },
     "session.list": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true } },
-    "session.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true } },
+    "session.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
     "session.topic.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true } },
     "session.topic.list": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true } },
     "project.current": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "targetCurrentAgentOnly": true } },
@@ -43,8 +56,25 @@
     "capability.read": { "allow": true, "scopes": ["agent"], "constraints": { "targetCurrentAgentOnly": true } },
     "ec.msg.send": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "privateOnly": true } },
     "ec.msg.file": { "allow": false },
+    "ec.msg.history": { "allow": false },
+    "ec.msg.online": { "allow": false },
+    "ec.version": { "allow": true },
+    "ec.aid.show": { "allow": false },
+    "ec.aid.lookup": { "allow": true, "scopes": ["relation"], "constraints": { "targetCurrentAgentOnly": true } },
+    "ec.aid.agentmd.get": { "allow": false },
+    "ec.aid.agentmd.put": { "allow": false },
+    "ec.fs.*": { "allow": false },
+    "ec.handoff.*": { "allow": false },
+    "ec.queue.*": { "allow": false },
+    "storage.*": { "allow": false },
     "ec.group.send": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true } },
     "ec.group.file": { "allow": false },
+    "ec.group.info": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.pull": { "allow": false },
+    "ec.group.members": { "allow": false },
+    "ec.group.online": { "allow": false },
+    "ec.group.rules.get": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.group.rules.read": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
     "ec.ctl.*": { "allow": false },
     "cli.exec.raw": { "allow": false, "dangerous": true },
     "dangerous:*": { "allow": false, "dangerous": true }

package/kits/templates/system-fragments/bootstrap.md

@@ -17,6 +17,6 @@ phase: bootstrapping
 5. owner 明确确认后，只编辑本地 agent.md（`$EVOLCORE_HOME/AIDs/{{selfAid}}/agent.md`）YAML frontmatter 中的 `name`、`description`、`tags`，保留其它字段和正文，并检查 YAML 与字段格式有效。
 6. 调用 `ec aid agentmd put {{selfAid}}` 签名并发布 agent.md。只有命令明确成功后，才调用 `ec agent ready {{selfAid}}` 完成 bootstrap。
 7. 任一步骤失败时，不调用 ready，不盲目重复尝试；说明具体失败原因并在修正后继续。
-8. `ec agent ready {{selfAid}}` 必须是 bootstrap 的最后一个操作。成功后不要再生成一段完成说明，系统会发送正式欢迎消息。
+8. `ec agent ready {{selfAid}}` 必须是 bootstrap 的最后一个操作。成功后系统会结束当前 bootstrap 上下文、创建全新的主会话并发送正式欢迎消息；不要再生成一段完成说明，也不要在旧上下文中继续处理任务。
 
 完成前不要承诺已经进入正常工作状态，也不要尝试与上述流程无关的文件修改、网络通信或系统配置操作。

package/kits/templates/system-fragments/channel.md

@@ -22,7 +22,7 @@ chatMode: {{chatMode}} # interactive=同步对话 / proactive=主动推送
 # 设计意图：避免 agent↔agent 无限循环；某一方不再发送 → 对话自然终止。
 # 拿不到 self-aid 时可用 ec ctl send "<text>"（自动继承当前 AID 和对端）。
 # Shell 调用边界：每次工具调用只能执行一条完整的 ec 命令。
-# 禁止拼接 command -v、ec aid、&&、||、;、|、重定向、子 shell、bash -lc/sh -c 或其它脚本。
+# 禁止拼接 command -v。`ec aid` 仅允许对 {{selfAid}} 精确执行 show、lookup、agentmd get；仅 request/bypass 可执行 agentmd put。可选后缀仅限 --format json；禁止 &&、||、;、|、重定向、子 shell、bash -lc/sh -c 或其它脚本。
 # 不要先做 CLI 探测；直接执行下方的单条 ec 命令，读取 JSON/回执后再决定下一步。
 # 工具审批拒绝时原样报告并停止，不要通过追加其它命令或提权重试绕过审批。
 {{/}}

package/kits/templates/system-fragments/session.md

@@ -44,7 +44,7 @@ readonly: true — 禁止写入项目目录及临时目录；如需生成文件
 #   - 每 {{proactiveToolReportInterval}} 次非发送工具调用后，必须先用发送命令汇报当前进展和下一步，否则后续非发送工具会被拒绝
 {{/}}
 # 命令速查：
-# 每次工具调用只执行一条完整的 ec 命令；禁止 command -v、ec aid、&&、||、;、|、重定向、子 shell、bash -lc/sh -c 或其它脚本与其串联。
+# 每次工具调用只执行一条完整的 ec 命令；禁止 command -v。`ec aid` 仅允许对 {{selfAid}} 精确执行 show、lookup、agentmd get；仅 request/bypass 可执行 agentmd put。可选后缀仅限 --format json；禁止 &&、||、;、|、重定向、子 shell、bash -lc/sh -c 或其它脚本与其串联。
 # 审批拒绝时原样报告并停止；必须收到包含 message_id/status 的成功回执后才能声称已发送。
 {{?chatType=group}}
 #   ec group send {{selfAid}} {{groupId}} "<text>" [--return none|required] [--file <path>] [--mention <aid>]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",
@@ -44,7 +44,7 @@
     "prepublishOnly": "npm test"
   },
   "dependencies": {
-    "@agentunion/fastaun": "^0.5.4",
+    "@agentunion/fastaun": "0.5.6",
     "@anthropic-ai/claude-agent-sdk": "0.3.220",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ajv": "^8.20.0",

package/dist/core/command/evol-menu-version-gate.js

@@ -1,39 +0,0 @@
-import { loadDaemonConfig } from '../../config-store.js';
-import { readInstalledEvolcoreVersion } from '../../utils/evolcore-version.js';
-import { compareStableSemver, parseStableSemver } from '../../utils/stable-semver.js';
-export function evaluateEvolMenuVersionGate(input) {
-    const minimum = loadDaemonConfig().aun?.minEvolVersion;
-    if (!minimum)
-        return null;
-    const minimumVersion = parseStableSemver(minimum);
-    if (!minimumVersion) {
-        throw new Error('daemon.json.aun.minEvolVersion must use stable X.Y.Z format');
-    }
-    const received = input.protectedHeaders?.evol_version;
-    const receivedVersion = input.encrypted ? parseStableSemver(received) : null;
-    if (!receivedVersion || compareStableSemver(receivedVersion, minimumVersion) < 0) {
-        return {
-            code: 'UPGRADE_REQUIRED',
-            message: `Evol ${minimum} or later is required`,
-            data: {
-                minimum,
-                received: receivedVersion ? received : null,
-            },
-        };
-    }
-    return null;
-}
-export function isEvolMenuVersionGateEnabled() {
-    return loadDaemonConfig().aun?.minEvolVersion !== undefined;
-}
-/** Token may be issued while disabled, but only this flag makes it an access requirement. */
-export function isAunMenuTokenRequired() {
-    return loadDaemonConfig().aun?.menuTokenRequired === true;
-}
-export function evolMenuResponseTransportMetadata() {
-    return {
-        // Clear inherited request state so AUNChannel applies daemon aun.defaultEncrypt.
-        encrypted: undefined,
-        protectedHeaders: { ec_version: readInstalledEvolcoreVersion() },
-    };
-}