evolcore 0.0.11 → 0.0.12

package/dist/cli/index.js

@@ -3,7 +3,9 @@
 process.env.AUN_LOG_INI_DISABLE = '1';
 import fs from 'fs';
 import path from 'path';
-import { getPackageRoot } from '../paths.js';
+import { getPackageRoot, resolvePaths } from '../paths.js';
+import { ipcQuery } from '../ipc.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 import { cmdInit } from './init.js';
 import { cmdInitWechat, cmdInitFeishu, cmdInitDingtalk, cmdInitQQBot, cmdInitWecom, cmdInitAun } from './init-channel.js';
 import { isHelpFlag, wantsHelp, getArgValue } from './help.js';
@@ -16,6 +18,7 @@ import { cmdQueue } from './queue-command.js';
 import { cmdStart, cmdStop, cmdRestart, cmdStatus, cmdLogs, cmdWatchCommand, cmdMv, cmdDiagnose } from './daemon-commands.js';
 import { logCliCommand } from './command-log.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
+import { assertManagedTopLevelCommandAllowed, ManagedCommandNotAllowedError } from './managed-command-guard.js';
 const MAIN_HELP = `用法: ec <command> [选项]
 
 服务:
@@ -87,6 +90,16 @@ process.on('warning', (w) => { if (w.name === 'ExperimentalWarning')
     return; process.stderr.write((w.stack ?? String(w)) + '\n'); });
 export async function main(args) {
     const cmd = args[0] || 'start';
+    try {
+        assertManagedTopLevelCommandAllowed(cmd, args);
+    }
+    catch (error) {
+        if (!(error instanceof ManagedCommandNotAllowedError))
+            throw error;
+        console.error(`❌ [${error.code}] ${error.message}`);
+        process.exitCode = 1;
+        return;
+    }
     logCliCommand(cmd, args);
     if (cmd === '--version' || cmd === '-v' || cmd === '-V') {
         const pkg = JSON.parse(fs.readFileSync(path.join(getPackageRoot(), 'package.json'), 'utf-8'));
@@ -229,7 +242,22 @@ export async function main(args) {
                 printLifecycleHelp('status');
                 break;
             }
-            await cmdStatus();
+            if (process.env.EVOLCORE_SESSION_ID) {
+                const sessionId = process.env.EVOLCORE_SESSION_ID;
+                const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+                const result = await ipcQuery(resolvePaths().socket, {
+                    type: 'status.auth', sessionId, delegationToken,
+                });
+                if (!result?.ok) {
+                    console.error(`❌ ${result?.error || 'status is not allowed in this task'}`);
+                    process.exitCode = 1;
+                    break;
+                }
+                await cmdStatus();
+            }
+            else {
+                await cmdStatus();
+            }
             break;
         case 'logs':
             if (wantsHelp(args.slice(1))) {

package/dist/cli/managed-command-guard.js

@@ -0,0 +1,41 @@
+import { wantsHelp } from './help.js';
+const MANAGED_TASK_COMMANDS = new Set([
+    'aid',
+    'agent',
+    'config',
+    'contact',
+    'ctl',
+    'fs',
+    'group',
+    'handoff',
+    'model',
+    'msg',
+    'queue',
+    'response',
+    'status',
+    'storage',
+    'trigger',
+    'version',
+    '-v',
+    '-V',
+    '--version',
+]);
+export class ManagedCommandNotAllowedError extends Error {
+    command;
+    code = 'NOT_ALLOWED';
+    constructor(command) {
+        super(`Command ${command} is not available in a managed Agent task`);
+        this.command = command;
+        this.name = 'ManagedCommandNotAllowedError';
+    }
+}
+/**
+ * Local maintenance commands do not have daemon authorization entrypoints.
+ * Keep them outside managed tasks so they cannot read or mutate host state.
+ */
+export function assertManagedTopLevelCommandAllowed(command, args, env = process.env) {
+    if (!env.EVOLCORE_SESSION_ID || wantsHelp(args.slice(1)) || command === '--help' || command === '-h')
+        return;
+    if (!MANAGED_TASK_COMMANDS.has(command))
+        throw new ManagedCommandNotAllowedError(command);
+}

package/dist/cli/model.js

@@ -46,10 +46,8 @@ function fail(formatJson, code, message, data) {
     process.exit(1);
 }
 function isManagedSessionEnv(args) {
-    return !!process.env.EVOLCORE_SESSION_ID
-        && !getArgValue(args, '--self')
-        && !getArgValue(args, '--peer')
-        && !getArgValue(args, '--role');
+    void args;
+    return !!process.env.EVOLCORE_SESSION_ID;
 }
 function isManagedTargetedWriteEnv(args) {
     return !!process.env.EVOLCORE_SESSION_ID
@@ -368,6 +366,11 @@ async function cmdInfo(args, formatJson) {
     const modelId = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
     if (!modelId)
         fail(formatJson, 'MISSING_MODEL_ID', 'info 需要 <model-id>');
+    if (isManagedSessionEnv(args)) {
+        const out = await runCtlCommand(`/model info ${modelId}`, formatJson);
+        printCtlResult(out, formatJson);
+        return;
+    }
     const sel = parseSelector(args, formatJson);
     const self = getArgValue(args, '--self');
     const info = await getModelInfo(modelId, self);
@@ -587,5 +590,9 @@ export async function cmdModel(args) {
         console.log(HELP);
         return;
     }
+    if (process.env.EVOLCORE_SESSION_ID
+        && (getArgValue(args, '--self') || getArgValue(args, '--peer') || getArgValue(args, '--role'))) {
+        fail(formatJson, 'NOT_ALLOWED', 'Managed model commands cannot select --self, --peer, or --role; they always use the authenticated current relation');
+    }
     await dispatch(sub, args, formatJson);
 }

package/dist/cli/queue-command.js

@@ -1,5 +1,6 @@
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 export async function cmdQueue(args) {
     if (args.length === 0 || isHelpFlag(args[0]) || wantsHelp(args)) {
@@ -72,7 +73,16 @@ export async function cmdQueue(args) {
             : interrupt ? 'interrupt'
                 : undefined;
     const socketPath = resolvePaths().socket;
-    const result = await ipcQuery(socketPath, {
+    const managed = process.env.EVOLCORE_SESSION_ID;
+    const result = await ipcQuery(socketPath, managed ? {
+        type: 'queue.op',
+        agent,
+        action,
+        messageId: cancelMsgId,
+        sessionKey,
+        sessionId: managed,
+        delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
+    } : {
         type: 'queue-snapshot',
         agent,
         action,

package/dist/cli/response.js

@@ -15,6 +15,9 @@ import { readField, writeField, determineFieldScope, normalizePeer, ModelScopeEr
 import { readFieldWithSource, resolveAgentConfig, ConfigTarget } from '../config/config-manager.js';
 import { ResponseModeRegistry } from '../response-system/registry.js';
 import { registerBuiltinModes } from '../response-system/modes/index.js';
+import { ipcQuery } from '../ipc.js';
+import { resolvePaths } from '../paths.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 const RESPONSE_MODE_FIELD = 'responseMode';
 const RESPONSE_MODE_PARAMS_FIELD = 'responseModeParams';
 /**
@@ -54,6 +57,71 @@ function fail(formatJson, code, message) {
     }
     process.exit(1);
 }
+async function managedConfig(fieldArgs, formatJson) {
+    const sessionId = process.env.EVOLCORE_SESSION_ID;
+    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    if (!sessionId)
+        fail(formatJson, 'NO_SESSION', 'EVOLCORE_SESSION_ID is not set');
+    if (!delegationToken)
+        fail(formatJson, 'DELEGATION_REQUIRED', `${AGENT_DELEGATION_TOKEN_ENV} is not set`);
+    const response = await ipcQuery(resolvePaths().socket, {
+        type: 'config.op',
+        argv: ['config', ...fieldArgs],
+        sessionId,
+        delegationToken,
+    }, 10_000);
+    if (!response)
+        fail(formatJson, 'DAEMON_UNAVAILABLE', 'Unable to connect to the evolcore daemon');
+    if (!response.ok || !response.result?.ok) {
+        fail(formatJson, response.code || 'CONFIG_AUTH_FAILED', response.error || 'response config operation failed');
+    }
+    return response.result;
+}
+async function runManagedResponse(args, formatJson) {
+    if (getArgValue(args, '--self') || getArgValue(args, '--peer')) {
+        fail(formatJson, 'NOT_ALLOWED', 'Managed response commands always use the authenticated current relation');
+    }
+    const sub = args[0];
+    if (sub === 'set') {
+        const id = args[1];
+        if (!id)
+            fail(formatJson, 'MISSING_ID', 'set requires a mode id');
+        if (!buildRegistry().has(id))
+            fail(formatJson, 'UNKNOWN_MODE', `Unknown mode: ${id}`);
+        await managedConfig(['set', RESPONSE_MODE_FIELD, id], formatJson);
+        return emit(formatJson, { ok: true, scope: 'relation', mode: id }, () => `✓ 已设置响应模式为 ${id}（作用域: relation）`);
+    }
+    if (sub === 'reset') {
+        await managedConfig(['unset', RESPONSE_MODE_FIELD], formatJson);
+        return emit(formatJson, { ok: true, scope: 'relation' }, () => '✓ 已清除当前关系的响应模式设置');
+    }
+    if (sub === 'current') {
+        const modeResult = await managedConfig(['get', RESPONSE_MODE_FIELD], formatJson);
+        const paramsResult = await managedConfig(['get', RESPONSE_MODE_PARAMS_FIELD], formatJson);
+        const configuredMode = typeof modeResult.value === 'string' ? modeResult.value : undefined;
+        const mode = configuredMode ?? buildRegistry().getPreferredId();
+        return emit(formatJson, {
+            ok: true,
+            scope: 'relation',
+            responseMode: mode ?? null,
+            source: configuredMode ? 'config' : 'preferred',
+            sourceTarget: modeResult.source?.target ?? null,
+            responseModeParams: paramsResult.value ?? null,
+        }, () => `当前响应模式: ${mode ?? '(无)'}`);
+    }
+    if (sub === 'config') {
+        if (args[1] === 'set') {
+            fail(formatJson, 'NOT_ALLOWED', 'responseModeParams cannot be modified as an opaque object from a managed task');
+        }
+        const result = await managedConfig(['get', RESPONSE_MODE_PARAMS_FIELD], formatJson);
+        const params = result.value ?? {};
+        const modeId = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+        if (modeId)
+            return emit(formatJson, { ok: true, mode: modeId, config: params[modeId] ?? {} }, () => `${modeId} 配置: ${JSON.stringify(params[modeId] ?? {}, null, 2)}`);
+        return emit(formatJson, { ok: true, responseModeParams: params }, () => `所有模式配置: ${JSON.stringify(params, null, 2)}`);
+    }
+    fail(formatJson, 'NOT_ALLOWED', `response ${sub} is not available in a managed task`);
+}
 /** 解析 --self / --peer 为作用域选择器 */
 function parseSelector(args, formatJson) {
     const self = getArgValue(args, '--self');
@@ -331,6 +399,9 @@ export async function cmdResponse(args) {
         console.log(HELP);
         return;
     }
+    if (process.env.EVOLCORE_SESSION_ID && sub !== 'list' && sub !== 'info') {
+        return runManagedResponse(args, formatJson);
+    }
     switch (sub) {
         case 'list': return cmdList(args, formatJson);
         case 'current': return cmdCurrent(args, formatJson);

package/dist/cli/restart-monitor.js

@@ -6,8 +6,7 @@ import { resolvePaths, getPackageRoot, daemonControlDir } from '../paths.js';
 import { loadDaemonConfig } from '../config-store.js';
 import * as platform from '../utils/cross-platform.js';
 import { EventBus } from '../core/event-bus.js';
-import { tryUpgrade, tryUpgradeAunSdk, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
-import { resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG } from '../aun/aid/client.js';
+import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-ops.js';
 import { isValidAid } from '../aun/aid/index.js';
 import { msgSend } from '../aun/msg/index.js';
 import { scanInstances, cleanupInstances, writeRestartMonitor, removeRestartMonitor, isRestartMonitorWinner, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
@@ -181,21 +180,7 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ evolcore 升级失败，使用当前版本继续\n${upgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // AUN SDK 版本检查与升级
-    const aunUpgrade = await tryUpgradeAunSdk(resolveAunCoreSdkPkg, AUN_CORE_SDK_PKG);
-    switch (aunUpgrade.status) {
-        case 'upgraded':
-            log(`✅ AUN SDK upgraded: ${aunUpgrade.from} → ${aunUpgrade.to}`);
-            await notifyDaemonOwners(p, `📦 AUN SDK 已升级 ${aunUpgrade.from} → ${aunUpgrade.to}`, log);
-            break;
-        case 'no-update':
-            break;
-        case 'failed':
-            log(`⚠ AUN SDK upgrade failed (${aunUpgrade.from} → ${aunUpgrade.to}): ${aunUpgrade.error}`);
-            await notifyDaemonOwners(p, `⚠️ AUN SDK 升级失败，使用当前版本继续\n${aunUpgrade.error ?? ''}`.trim(), log);
-            break;
-    }
-    // EC Web 版本检查与升级（已安装才检查）
+    // EC Web 是独立全局包，已安装时单独检查升级。
     const ecwebUpgrade = await tryUpgradeGlobalPkg(() => resolveGlobalPkg(WEB_PACKAGE_NAME), WEB_PACKAGE_NAME);
     switch (ecwebUpgrade.status) {
         case 'upgraded':
@@ -392,7 +377,7 @@ async function spawnAndWaitReady(p, log, timeout) {
     const out = fs.openSync(stdoutLog, 'a');
     const err = fs.openSync(stdoutLog, 'a');
     const appMain = path.join(getPackageRoot(), 'dist', 'index.js');
-    const child = spawn('node', ['--no-warnings=ExperimentalWarning', appMain], {
+    const child = spawn(process.execPath, ['--no-warnings=ExperimentalWarning', appMain], {
         detached: true,
         stdio: ['ignore', out, err],
         windowsHide: true,
@@ -489,6 +474,7 @@ async function invokeClaude(claudePath, p, attempt, maxAttempts, timeout, log) {
             timeout,
             // Windows npm CLIs are .cmd shims; execFile needs a shell to run them.
             shell: platform.isWindows,
+            windowsHide: platform.isWindows,
             env: { ...process.env, CLAUDE_CODE_ENTRYPOINT: 'cli' },
             maxBuffer: 10 * 1024 * 1024,
         });

package/dist/cli/trigger-command.js

@@ -31,6 +31,10 @@ export async function cmdTrigger(args) {
         }
         return;
     }
+    if (process.env.EVOLCORE_SESSION_ID
+        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path'))) {
+        throw new Error('Managed tasks cannot read trigger definitions, prompts, or scripts from local files; use inline prompt content');
+    }
     try {
         switch (sub) {
             case 'list':

package/dist/config/builtin-roles.js

@@ -35,11 +35,15 @@ export function getManagementCommandPermissions(role) {
         'role.revoke': { allow: true, scopes: ['agent'] },
         'role.policy.read': { allow: true, scopes: ['agent'] },
         'role.relation.read': { allow: true, scopes: ['agent'] },
+        'agent.baseagent.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'observable.current': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
+        'observable.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'config.get': { allow: true, scopes: ['agent', 'relation'] },
         'config.set': { allow: true, scopes: ['agent', 'relation'] },
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },
         'role.policy.write': { allow: true, dangerous: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
+        'ec.aid.show': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.aid.agentmd.put': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
         '*': { allow: true },
         // Reload is valid from an Agent's own channel and the daemon control plane.
         // The control-channel gate still requires a daemon owner for cross-Agent reloads.

package/dist/config/contact-book-store.js

@@ -184,17 +184,25 @@ function mutateContactBookPreparedSyncInternal(selfAid, prepare) {
                 value: prepared.value,
             };
         }
-        prepared.beforeCommit?.({
+        const preparedChanges = prepared.beforeCommit?.({
             contact: next,
             previousContactRevision: previousRevision,
             contactRevision: nextRevision,
         });
         const before = readTextOrNull(file);
         const after = `${JSON.stringify(next, null, 2)}\n`;
-        const changes = [{ file, before, after }];
+        const additionalChanges = preparedChanges === undefined
+            ? []
+            : Array.isArray(preparedChanges) ? preparedChanges : [preparedChanges];
+        const changes = [
+            { file, before, after },
+            ...additionalChanges,
+        ];
+        validateTransactionChanges(selfAid, changes);
         writeJournal(selfAid, { schemaVersion: 1, state: 'prepared', selfAid, changes });
         try {
-            applyTransactionChange(changes[0]);
+            for (const change of changes)
+                applyTransactionChange(change);
             writeJournal(selfAid, { schemaVersion: 1, state: 'committed', selfAid, changes });
             removeJournal(selfAid);
         }

package/dist/config/contact-request-service.js

@@ -1,6 +1,5 @@
 import crypto from 'crypto';
 import fs from 'fs';
-import path from 'path';
 import { isValidAid } from '../aun/aid/validation.js';
 import { agentContactOperations } from '../paths.js';
 import { listStaticAgentAdmins, listStaticAgentOwners } from './peer-role-resolver.js';
@@ -12,6 +11,7 @@ export const CONTACT_REQUEST_MAX_PER_WINDOW = 3;
 export const CONTACT_REQUEST_MAX_PENDING = 100;
 export const CONTACT_REQUEST_MAX_RETAINED = 1000;
 export const CONTACT_REQUEST_NOTE_MAX_LENGTH = 500;
+export const CONTACT_REQUEST_ID_MAX_LENGTH = 128;
 export async function mutateContactWithOperation(input) {
     const at = new Date(input.now ?? Date.now()).toISOString();
     const logFile = agentContactOperations(input.selfAid);
@@ -26,7 +26,7 @@ export async function mutateContactWithOperation(input) {
             mutation: input.mutation,
             actor: input.actorId,
             value: undefined,
-            beforeCommit: ({ contactRevision: nextRevision }) => appendOperationRecords(logFile, [operationRecord({
+            beforeCommit: ({ contactRevision: nextRevision }) => operationLogChange(logFile, [operationRecord({
                     at,
                     op: input.operation,
                     primaryId: input.primaryId,
@@ -73,7 +73,17 @@ export async function submitContactRequest(input) {
             && Date.parse(record.at) > windowStart
             && Date.parse(record.at) <= nowMs)).length;
         if (recentCount >= CONTACT_REQUEST_MAX_PER_WINDOW) {
-            return preparedWithExpirations(expiration, { code: 'rate-limited', contactRevision: '' }, logFile);
+            return preparedWithExpirations(expiration, {
+                code: 'rate-limited',
+                ...(effectiveEntry?.status === 'pending' && effectiveEntry.pendingRequest
+                    ? {
+                        requestId: effectiveEntry.pendingRequest.id,
+                        submittedAt: effectiveEntry.pendingRequest.submittedAt,
+                        expiresAt: effectiveEntry.pendingRequest.expiresAt,
+                    }
+                    : {}),
+                contactRevision: '',
+            }, logFile);
         }
         const counts = countRequestRecordsAfterExpirations(contact, nowMs);
         const isExistingPending = effectiveEntry?.status === 'pending';
@@ -103,13 +113,14 @@ export async function submitContactRequest(input) {
             mutation: { type: 'batch', mutations },
             actor: applicantAid,
             value,
-            beforeCommit: ({ contactRevision }) => appendOperationRecords(logFile, [
+            beforeCommit: ({ contactRevision }) => operationLogChange(logFile, [
                 ...expiration.events.map(event => ({ ...event, contactRevision })),
                 operationRecord({
                     at: nowIso,
                     op,
                     primaryId: applicantAid,
                     requestId,
+                    expiresAt,
                     sourceChannelKey: input.sourceChannelKey,
                     ...(note ? { note } : {}),
                     contactRevision,
@@ -143,6 +154,10 @@ export async function reviewContactRequest(input) {
             if (!entry || entry.status !== 'pending' || entry.pendingRequest?.id !== input.requestId) {
                 return preparedNoop({ code: 'request-stale', contactRevision });
             }
+            const requestMetadata = {
+                requestId: entry.pendingRequest.id,
+                expiresAt: entry.pendingRequest.expiresAt,
+            };
             if (Date.parse(entry.pendingRequest.expiresAt) <= nowMs) {
                 const mutation = {
                     type: 'expire-request',
@@ -153,8 +168,8 @@ export async function reviewContactRequest(input) {
                 return {
                     mutation,
                     actor: input.actorId,
-                    value: { code: 'request-expired', contactRevision },
-                    beforeCommit: ({ contactRevision: nextRevision }) => appendOperationRecords(logFile, [operationRecord({
+                    value: { code: 'request-expired', contactRevision, ...requestMetadata },
+                    beforeCommit: ({ contactRevision: nextRevision }) => operationLogChange(logFile, [operationRecord({
                             at: nowIso,
                             op: 'expire',
                             primaryId: input.primaryId,
@@ -177,8 +192,8 @@ export async function reviewContactRequest(input) {
                     now: nowIso,
                 },
                 actor: input.actorId,
-                value: { code, contactRevision },
-                beforeCommit: ({ contactRevision: nextRevision }) => appendOperationRecords(logFile, [operationRecord({
+                value: { code, contactRevision, ...requestMetadata },
+                beforeCommit: ({ contactRevision: nextRevision }) => operationLogChange(logFile, [operationRecord({
                         at: nowIso,
                         op: input.decision === 'approve' ? 'approve' : input.decision === 'reject' ? 'reject' : 'block',
                         primaryId: input.primaryId,
@@ -208,7 +223,7 @@ export async function expirePendingContactRequests(selfAid, now = Date.now()) {
             mutation: { type: 'batch', mutations: expiration.mutations },
             actor: 'contact-request-expiry',
             value: expiration.mutations.length,
-            beforeCommit: ({ contactRevision }) => appendOperationRecords(logFile, expiration.events.map(event => ({ ...event, contactRevision }))),
+            beforeCommit: ({ contactRevision }) => operationLogChange(logFile, expiration.events.map(event => ({ ...event, contactRevision }))),
         };
     });
     return result.value;
@@ -226,6 +241,91 @@ export async function listPendingContactRequests(selfAid, now = Date.now()) {
     }))));
     return result.value;
 }
+/** Return only the authenticated applicant's own admission/request state. */
+export async function queryOwnContactRequestStatus(input) {
+    const applicantAid = String(input.applicantAid || '').trim();
+    if (!isValidAid(applicantAid))
+        return protocolResult('NOT_ALLOWED');
+    const now = input.now ?? Date.now();
+    const rawRequestId = input.requestId;
+    if (rawRequestId !== undefined && typeof rawRequestId !== 'string')
+        return protocolResult('NOT_ALLOWED');
+    const requestedRequestId = rawRequestId?.trim();
+    if (requestedRequestId !== undefined
+        && (!requestedRequestId || requestedRequestId.length > CONTACT_REQUEST_ID_MAX_LENGTH)) {
+        return protocolResult('NOT_ALLOWED');
+    }
+    const owners = listAgentOwners(input.selfAid);
+    const result = await mutateContactBookPrepared(input.selfAid, ({ contact }) => {
+        const logFile = agentContactOperations(input.selfAid);
+        const expiration = collectExpiredMutations(contact, now);
+        const entry = effectiveEntryAfterExpirations(contact.contacts[applicantAid], now);
+        const operations = readOperationLog(logFile).filter(record => record.primaryId === applicantAid);
+        const latestRequestOperation = [...operations].reverse().find(record => (!!record.requestId
+            && (record.op === 'request' || record.op === 'resubmit' || record.op === 'approve'
+                || record.op === 'reject' || record.op === 'expire' || record.op === 'block')));
+        if (requestedRequestId !== undefined && latestRequestOperation?.requestId !== requestedRequestId) {
+            return preparedNoop(protocolResult('NOT_ALLOWED'));
+        }
+        const requestMetadata = requestMetadataFor(operations, latestRequestOperation?.requestId);
+        let value;
+        if (owners.includes(applicantAid)
+            || (entry && (entry.status === undefined || entry.status === 'active'))) {
+            value = protocolResult('APPROVED', requestMetadata);
+        }
+        else if (entry?.status === 'blocked') {
+            value = protocolResult('NOT_ALLOWED');
+        }
+        else if (entry?.status === 'pending' && entry.pendingRequest) {
+            value = protocolResult('PENDING', {
+                requestId: entry.pendingRequest.id,
+                expiresAt: entry.pendingRequest.expiresAt,
+            });
+        }
+        else if (entry?.status === 'declined') {
+            value = protocolResult('EXPIRED', {
+                requestId: latestRequestOperation?.op === 'expire' ? latestRequestOperation.requestId : requestMetadata.requestId,
+                expiresAt: entry.declinedAt ?? requestMetadata.expiresAt,
+            });
+        }
+        else if (latestRequestOperation?.op === 'reject') {
+            value = protocolResult('REJECTED', requestMetadata);
+        }
+        else if (latestRequestOperation?.op === 'expire') {
+            value = protocolResult('EXPIRED', requestMetadata);
+        }
+        else if (owners.length === 0) {
+            value = protocolResult('NOT_ALLOWED');
+        }
+        else {
+            value = protocolResult('CONTACT_REQUIRED');
+        }
+        if (expiration.mutations.length === 0)
+            return preparedNoop(value);
+        return {
+            mutation: { type: 'batch', mutations: expiration.mutations },
+            actor: 'contact-request-expiry',
+            value,
+            beforeCommit: ({ contactRevision }) => operationLogChange(logFile, expiration.events.map(event => ({ ...event, contactRevision }))),
+        };
+    });
+    return result.value;
+}
+export function contactRequestSubmissionProtocolResult(result) {
+    const metadata = { requestId: result.requestId, expiresAt: result.expiresAt };
+    switch (result.code) {
+        case 'submitted':
+        case 'resubmitted':
+            return protocolResult('SUBMITTED', metadata);
+        case 'already-contact':
+        case 'owner':
+            return protocolResult('APPROVED', metadata);
+        case 'rate-limited':
+            return protocolResult('RATE_LIMITED', metadata);
+        default:
+            return protocolResult('NOT_ALLOWED', metadata);
+    }
+}
 export function findContactRequestNote(selfAid, requestId) {
     const records = readOperationLog(agentContactOperations(selfAid));
     return [...records].reverse().find(record => (record.requestId === requestId
@@ -237,6 +337,24 @@ function normalizeNote(value) {
         return null;
     return note;
 }
+function requestMetadataFor(operations, requestId) {
+    if (!requestId)
+        return {};
+    const submitted = [...operations].reverse().find(record => (record.requestId === requestId && (record.op === 'request' || record.op === 'resubmit')));
+    const submittedAt = submitted ? Date.parse(submitted.at) : Number.NaN;
+    return {
+        requestId,
+        expiresAt: submitted?.expiresAt
+            ?? (Number.isFinite(submittedAt) ? new Date(submittedAt + CONTACT_REQUEST_TTL_MS).toISOString() : undefined),
+    };
+}
+function protocolResult(status, metadata = {}) {
+    return {
+        status,
+        requestId: metadata.requestId ?? null,
+        expiresAt: metadata.expiresAt ?? null,
+    };
+}
 function collectExpiredMutations(book, now) {
     const mutations = [];
     const events = [];
@@ -286,7 +404,7 @@ function preparedWithExpirations(expiration, value, logFile) {
         mutation: { type: 'batch', mutations: expiration.mutations },
         actor: 'contact-request-expiry',
         value,
-        beforeCommit: ({ contactRevision }) => appendOperationRecords(logFile, expiration.events.map(event => ({ ...event, contactRevision }))),
+        beforeCommit: ({ contactRevision }) => operationLogChange(logFile, expiration.events.map(event => ({ ...event, contactRevision }))),
     };
 }
 function preparedNoop(value) {
@@ -310,7 +428,14 @@ function readOperationLog(file) {
             const record = JSON.parse(line);
             if (!record || typeof record !== 'object' || typeof record.at !== 'string'
                 || !Number.isFinite(Date.parse(record.at)) || typeof record.op !== 'string'
-                || typeof record.primaryId !== 'string')
+                || !['request', 'resubmit', 'approve', 'reject', 'expire', 'block', 'unblock', 'manual-add'].includes(record.op)
+                || typeof record.primaryId !== 'string' || !isValidAid(record.primaryId)
+                || (record.requestId !== undefined && typeof record.requestId !== 'string')
+                || (record.expiresAt !== undefined && (!isValidIsoDate(record.expiresAt)))
+                || (record.actorId !== undefined && typeof record.actorId !== 'string')
+                || (record.sourceChannelKey !== undefined && typeof record.sourceChannelKey !== 'string')
+                || (record.note !== undefined && (typeof record.note !== 'string' || record.note.length > CONTACT_REQUEST_NOTE_MAX_LENGTH))
+                || typeof record.contactRevision !== 'string')
                 throw new Error('invalid record');
             records.push(record);
         }
@@ -320,11 +445,32 @@ function readOperationLog(file) {
     }
     return records;
 }
-function appendOperationRecords(file, records) {
+function isValidIsoDate(value) {
+    return Number.isFinite(Date.parse(value));
+}
+function operationLogChange(file, records) {
     if (records.length === 0)
-        return;
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    fs.appendFileSync(file, `${records.map(record => JSON.stringify(record)).join('\n')}\n`, 'utf8');
+        return undefined;
+    // Validate the existing log while the Contact Book lock is held. The log is
+    // part of the same journal transaction as contact.json, so a malformed log
+    // must fail closed before either file is changed.
+    readOperationLog(file);
+    let before;
+    try {
+        before = fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            before = null;
+        else
+            throw error;
+    }
+    const prefix = before && !before.endsWith('\n') ? `${before}\n` : (before ?? '');
+    return {
+        file,
+        before,
+        after: `${prefix}${records.map(record => JSON.stringify(record)).join('\n')}\n`,
+    };
 }
 function operationRecord(input) {
     return { id: `evt_${crypto.randomUUID().replace(/-/g, '')}`, ...input };