evolcore 0.0.11 → 0.0.13

package/dist/core/command/command-handler.js

@@ -1,6 +1,6 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../message/message-utils.js';
+import { buildEnvelope, deliveryTargetFromSession, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
 import { loadDaemonConfig } from '../../config-store.js';
 import { logger } from '../../utils/logger.js';
@@ -9,6 +9,7 @@ import { isManagementRole } from '../../config/builtin-roles.js';
 import { formatPeerKey } from '../relation/peer-identity.js';
 import crypto from 'crypto';
 import path from 'path';
+import fs from 'fs';
 import { parseDuration, parseTriggerSet, parseTriggerUpdate } from '../../trigger/parser.js';
 import { applyTriggerPatch, replaceEditableTriggerDefinition } from '../../trigger/patch.js';
 import { definitionRevision } from '../../trigger/validation.js';
@@ -17,16 +18,22 @@ import { displaySessionTitle } from '../session/session-title.js';
 import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
+import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
+import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
+import { executeManagedGroupOperation, isManagedGroupRelationRead, ManagedGroupOperationError, resolveManagedGroupOperation, executeManagedMsgOperation, ManagedMsgOperationError, resolveManagedMsgOperation, executeManagedFsOperation, ManagedFsOperationError, resolveManagedFsOperation, } from '../../aun/msg/managed-operation.js';
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
+import { isHClassPath, isLClassPath, isSameOrDescendant } from '../protected-paths.js';
 import { validateModelSelectionForRole } from '../model/model-permission.js';
+import { getModelInfo } from '../model/model-catalog.js';
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride } from '../role/runtime-policy.js';
 import { parsePeerKey } from '../relation/peer-identity.js';
 import { isQuickCommand } from './slash-gate.js';
 import { handleSlashCommand } from './slash-handler.js';
 import { resolveChatMode } from '../message/peer-mode.js';
 import { execMenuAction as menuExecMenuAction, execMenuForEcweb as menuExecMenuForEcweb, execMenuForControl as menuExecMenuForControl, execMenuQuery as menuExecMenuQuery, execMenuUpdate as menuExecMenuUpdate, getMenuItems as menuGetMenuItems, getSubMenuItems as menuGetSubMenuItems, } from './menu-handler.js';
+import { getMenuCatalog, execMenuValueBatch, validateMenuValueBatchArgs } from './menu-catalog.js';
 export { isProcessLevelOwner } from './menu-handler.js';
 const CLI_EXEC_TIMEOUT_MS = 15_000;
 const CLI_EXEC_MAX_OUTPUT = 128 * 1024;
@@ -93,6 +100,7 @@ export class CommandHandler {
     triggerSchedulerFallbackAid;
     daemonStatusProvider;
     agentDelegationRegistry;
+    handoffRuntime;
     /**
      * Get the runner for a (channel, baseagent) pair.
      *
@@ -125,6 +133,15 @@ export class CommandHandler {
             .filter(key => key.startsWith(prefix))
             .map(key => key.slice(prefix.length));
     }
+    /** Return the runner-owned temporary root for a managed session, if any. */
+    getManagedSessionTempDir(session) {
+        try {
+            return this.getAgent(session.channel, session.baseagent).getManagedTempDir?.(session.id);
+        }
+        catch {
+            return undefined;
+        }
+    }
     formatBaseagentUnavailable(error) {
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         return `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
@@ -314,6 +331,7 @@ export class CommandHandler {
             channelId: definition.origin.channelId,
             session: definition.origin.session,
             threadId: definition.origin.threadId,
+            chatType: definition.origin.delivery?.chatType,
         };
     }
     canAccessTriggerDefinition(definition, peerId, channel, isAdmin) {
@@ -396,9 +414,6 @@ export class CommandHandler {
         }
         const targetChannelType = this.resolveChannelType(feedbackChannel);
         const feedbackChannelId = parsed.targetChannelId ?? peerId;
-        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChannelId.includes('.')) {
-            return { error: `AUN 渠道的 --target-channel-id 必须是 AID 格式（如 user.agentid.pub），收到："${parsed.targetChannelId}"` };
-        }
         const schedulerAid = parsed.agentId
             ?? this.getOwningAgent(feedbackChannel)?.aid
             ?? tryParseChannelKey(feedbackChannel)?.selfAID
@@ -407,11 +422,22 @@ export class CommandHandler {
         if (!schedulerAid || !scheduler) {
             return { error: `目标 agent 不存在或未就绪：${schedulerAid ?? feedbackChannel}` };
         }
+        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChatType) {
+            return { error: 'AUN 目标必须显式指定 --target-chat-type private 或 group' };
+        }
+        const targetDelivery = targetChannelType === 'aun'
+            ? parsed.targetChatType === 'group'
+                ? { chatType: 'group', groupId: feedbackChannelId }
+                : parsed.targetChatType === 'private'
+                    ? { chatType: 'private' }
+                    : { chatType: 'private' }
+            : undefined;
         const target = {
             channelKey: feedbackChannel,
             channelId: feedbackChannelId,
             session: parsed.targetSession,
             threadId: parsed.targetSession === 'thread' ? parsed.targetThreadId : undefined,
+            chatType: targetDelivery?.chatType,
         };
         if (target.session === 'thread') {
             const adapter = this.adapters.get(feedbackChannel);
@@ -432,6 +458,7 @@ export class CommandHandler {
             threadId: !originIsGroup ? threadId : undefined,
             peerId,
             sessionKey: activeSession?.sessionKey,
+            delivery: { chatType: 'private' },
         };
         if (!isAdmin && parsed.feedbackStrategy === 'target' && !sameFeedbackTarget(target, origin)) {
             return { error: '无权限：非 admin 只能把 trigger 投递到来源会话' };
@@ -611,7 +638,7 @@ export class CommandHandler {
     }
     /** 从 session 提取渠道预构建的回复上下文 */
     getReplyContext(session) {
-        return session.metadata?.replyContext;
+        return replyContextFromSession(session);
     }
     /**
      * 发送 CommandCard 卡片。卡片成功返回 null（调用方直接 return），失败返回降级文本。
@@ -675,6 +702,9 @@ export class CommandHandler {
     setMessageQueue(messageQueue) {
         this.messageQueue = messageQueue;
     }
+    setHandoffRuntime(handoffRuntime) {
+        this.handoffRuntime = handoffRuntime;
+    }
     setPermissionGateway(gateway) {
         this.permissionGateway = gateway;
     }
@@ -818,6 +848,29 @@ export class CommandHandler {
     getMenuItems(role, chatType = 'private', scope = 'agent', authSubject) {
         return menuGetMenuItems.call(this, role, chatType, scope, authSubject);
     }
+    async getMenuCatalog(channel, channelId, subject, request, channelScope = 'agent') {
+        return await getMenuCatalog({
+            subject,
+            channelType: this.resolveChannelType(channel),
+            channelScope,
+            channelId,
+            request,
+        });
+    }
+    async execMenuValueBatch(channel, channelId, subject, args, request, channelScope = 'agent') {
+        validateMenuValueBatchArgs(args);
+        return await execMenuValueBatch({
+            subject,
+            channelType: this.resolveChannelType(channel),
+            channelScope,
+            channelId,
+            request,
+            items: args?.items,
+            schemaVersion: args?.schemaVersion,
+            consistency: args?.consistency,
+            execQuery: async (cmd, resolvedChannelId, queryArgs, context) => this.execMenuQuery(cmd, channel, resolvedChannelId, context.subject.actorId, queryArgs, context.subject.chatType, context.subject.fromControlChannel, context.subject.identity, context.subject, channelScope === 'control' ? 'control' : 'menu'),
+        });
+    }
     /** 动态子菜单：根据 cmd 路径返回选项列表（供 menu.query + cmd 使用） */
     async getSubMenuItems(cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel = false, authSubject, source = 'menu') {
         return await menuGetSubMenuItems.call(this, cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel, authSubject, source);
@@ -1393,7 +1446,7 @@ export class CommandHandler {
      * - taskId/chatmode：从 processing_state 和 effective chatmode 注入
      */
     buildCtlReplyContext(session) {
-        const ctx = {};
+        const ctx = { delivery: deliveryTargetFromSession(session) };
         const meta = session.metadata;
         if (meta?.replyContext?.threadId)
             ctx.threadId = meta.replyContext.threadId;
@@ -1421,7 +1474,7 @@ export class CommandHandler {
             if (encrypted != null)
                 ctx.metadata.encrypted = encrypted;
         }
-        return Object.keys(ctx).length > 0 ? ctx : undefined;
+        return ctx;
     }
     resolveEffectiveChatmodeForSession(session) {
         const peerType = session.metadata?.peerType;
@@ -1476,35 +1529,51 @@ export class CommandHandler {
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
         });
-        const resolved = resolveConfigCommand(argv, {
-            defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
-        });
-        if (!resolved.ok)
-            return { ok: false, code: resolved.code, error: resolved.reason };
-        const decision = authorizeOperation({
-            source: 'agent-tool',
-            subject,
-            intent: {
-                operation: resolved.command.operationId,
-                scope: resolved.command.commandScope,
+        const executeOne = (fieldArgv) => {
+            const resolved = resolveConfigCommand(fieldArgv, {
+                defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
+            });
+            if (!resolved.ok)
+                return { ok: false, code: resolved.code, error: resolved.reason };
+            const decision = authorizeOperation({
                 source: 'agent-tool',
-                args: {
-                    ...(resolved.command.self ? { self: resolved.command.self } : {}),
-                    ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
-                    ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                subject,
+                intent: {
+                    operation: resolved.command.operationId,
+                    scope: resolved.command.commandScope,
+                    source: 'agent-tool',
+                    args: {
+                        ...(resolved.command.self ? { self: resolved.command.self } : {}),
+                        ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
+                        ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                    },
+                    dangerous: resolved.command.dangerous,
                 },
-                dangerous: resolved.command.dangerous,
-            },
-            resolvedConfigCommand: resolved.command,
-            auditMetadata: {
-                argvHash: hashArgv(resolved.command.canonicalArgv),
-                taskId: grant.taskId,
-                messageId: grant.messageId,
-            },
-        });
-        if (!decision.allow)
-            return { ok: false, code: decision.code, error: decision.reason };
-        const result = executeResolvedConfigCommand(resolved.command, { role: subject.role });
+                resolvedConfigCommand: resolved.command,
+                auditMetadata: {
+                    argvHash: hashArgv(resolved.command.canonicalArgv),
+                    taskId: grant.taskId,
+                    messageId: grant.messageId,
+                },
+            });
+            if (!decision.allow)
+                return { ok: false, code: decision.code, error: decision.reason };
+            return executeResolvedConfigCommand(resolved.command, { role: subject.role });
+        };
+        const batch = splitConfigBatchGetArgv(argv);
+        if (batch && batch.fields.length > 1) {
+            const results = batch.fields.map(field => {
+                const result = executeOne(['config', 'get', field, ...batch.rest]);
+                if (!result.ok)
+                    return { ok: false, field, code: result.code, error: result.error };
+                if (result.subcommand !== 'get') {
+                    return { ok: false, field, code: 'UNEXPECTED_RESULT', error: `config get ${field} produced a non-get result` };
+                }
+                return result;
+            });
+            return { ok: true, result: { ok: true, subcommand: 'batch-get', results } };
+        }
+        const result = executeOne(argv);
         return result.ok
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
@@ -1569,6 +1638,415 @@ export class CommandHandler {
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data ? { data: result.data } : {}) };
     }
+    /** Agent-managed AID CLI entrypoint. Private key and CA access stay inside the daemon. */
+    async handleAidOperation(argv, sessionId, delegationToken, delegationCommandHash) {
+        if (!this.agentDelegationRegistry) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
+        }
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!delegation.ok)
+            return { ok: false, code: delegation.code, error: delegation.reason };
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
+        const parsed = resolveManagedAidOperation(argv);
+        if (!parsed.ok)
+            return { ok: false, code: parsed.code, error: parsed.reason };
+        const grantSelfAid = delegation.grant.selfAid.replace(/^@/, '');
+        const sessionSelfAid = session.selfAID?.replace(/^@/, '');
+        if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
+        }
+        if (parsed.command.aid !== grantSelfAid) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can be targeted' };
+        }
+        let conversationId;
+        try {
+            conversationId = parsePeerKey(delegation.grant.peerKey).channelId;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        const subject = buildAuthSubject({
+            selfAid: delegation.grant.selfAid,
+            actorId: delegation.grant.actorId,
+            channel: delegation.grant.channel,
+            channelType: delegation.grant.channelType,
+            channelId: conversationId,
+            chatType: delegation.grant.chatType,
+            conversationId,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const managementRole = isManagementRole(subject.role);
+        const decision = authorizeOperation({
+            source: 'agent-tool',
+            subject,
+            intent: {
+                operation: parsed.command.operationId,
+                scope: managementRole ? 'agent' : 'relation',
+                source: 'agent-tool',
+                args: { self: parsed.command.aid, targetId: parsed.command.aid },
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv),
+                taskId: delegation.grant.taskId,
+                messageId: delegation.grant.messageId,
+            },
+        });
+        if (!decision.allow)
+            return { ok: false, code: decision.code, error: decision.reason };
+        try {
+            return { ok: true, result: await executeManagedAidOperation(parsed.command) };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                ok: false,
+                code: error instanceof ManagedAidOperationError ? error.code : 'AID_OPERATION_FAILED',
+                error: message,
+            };
+        }
+    }
+    /** Agent-managed group CLI entrypoint. AUN private material remains daemon-owned. */
+    async handleGroupOperation(argv, sessionId, delegationToken, delegationCommandHash) {
+        if (!this.agentDelegationRegistry) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
+        }
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!delegation.ok)
+            return { ok: false, code: delegation.code, error: delegation.reason };
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
+        const parsed = resolveManagedGroupOperation(argv);
+        if (!parsed.ok)
+            return { ok: false, code: parsed.code, error: parsed.reason };
+        const grant = delegation.grant;
+        const grantSelfAid = grant.selfAid.replace(/^@/, '');
+        const sessionSelfAid = session.selfAID?.replace(/^@/, '');
+        if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
+        }
+        if (parsed.command.from !== grantSelfAid) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can perform managed group operations' };
+        }
+        let conversationId;
+        try {
+            conversationId = parsePeerKey(grant.peerKey).channelId;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        const subject = buildAuthSubject({
+            selfAid: grant.selfAid,
+            actorId: grant.actorId,
+            channel: grant.channel,
+            channelType: grant.channelType,
+            channelId: conversationId,
+            chatType: grant.chatType,
+            conversationId,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const managementRole = isManagementRole(subject.role);
+        if (!managementRole && (grant.channelType !== 'aun' || !isManagedGroupRelationRead(parsed.command))) {
+            return { ok: false, code: 'ROLE_ACCESS_DENIED', error: `Role ${subject.role} cannot manage Agent group membership or settings` };
+        }
+        if ((parsed.command.kind === 'dissolve' || parsed.command.kind === 'owner') && subject.role !== 'owner') {
+            return { ok: false, code: 'ROLE_ACCESS_DENIED', error: `${parsed.command.kind} requires Agent owner permission` };
+        }
+        const decision = authorizeOperation({
+            source: 'agent-tool',
+            subject,
+            intent: {
+                operation: parsed.command.operationId,
+                scope: managementRole ? 'agent' : 'relation',
+                source: 'agent-tool',
+                args: {
+                    self: parsed.command.from,
+                    ...(parsed.command.groupId ? {
+                        targetId: parsed.command.groupId,
+                        peer: parsed.command.groupId,
+                        peerKey: formatPeerKey(grant.channelType, parsed.command.groupId),
+                    } : {}),
+                },
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv),
+                taskId: grant.taskId,
+                messageId: grant.messageId,
+            },
+        });
+        if (!decision.allow)
+            return { ok: false, code: decision.code, error: decision.reason };
+        let rulesContent;
+        if (parsed.command.kind === 'rules.set') {
+            const filePath = String(parsed.command.filePath || '');
+            const projectPath = path.resolve(session.projectPath);
+            const resolvedPath = path.resolve(projectPath, filePath);
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedPaths = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!filePath || !allowedPaths.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file must be inside the current session project or managed TMPDIR' };
+            }
+            if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
+                return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
+            }
+            let rulesFd;
+            try {
+                const realProjectPath = fs.realpathSync(projectPath);
+                const realPath = fs.realpathSync(resolvedPath);
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // The session may have closed and removed its temporary directory.
+                }
+                const realAllowedPaths = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedPaths.some(root => isSameOrDescendant(realPath, root))) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file resolves outside the current session project or managed TMPDIR' };
+                }
+                if (isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
+                }
+                rulesFd = fs.openSync(realPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+                const stat = fs.fstatSync(rulesFd);
+                if (!stat.isFile() || stat.size < 1 || stat.size > 4 * 1024) {
+                    return { ok: false, code: 'INVALID_RULES_CONTENT', error: 'Rules file must be a regular file from 1 to 4096 bytes' };
+                }
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file cannot be a hard link' };
+                }
+                rulesContent = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(rulesFd));
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    code: 'INVALID_RULES_CONTENT',
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+            finally {
+                if (rulesFd !== undefined)
+                    fs.closeSync(rulesFd);
+            }
+        }
+        try {
+            return { ok: true, result: await executeManagedGroupOperation(parsed.command, rulesContent) };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: error instanceof ManagedGroupOperationError ? error.code : 'GROUP_OPERATION_FAILED',
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /** Agent-managed private msg read entrypoint. AUN credentials and history roots remain daemon-owned. */
+    async handleMsgOperation(argv, sessionId, delegationToken, delegationCommandHash) {
+        if (!this.agentDelegationRegistry) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
+        }
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!delegation.ok)
+            return { ok: false, code: delegation.code, error: delegation.reason };
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
+        const parsed = resolveManagedMsgOperation(argv);
+        if (!parsed.ok)
+            return { ok: false, code: parsed.code, error: parsed.reason };
+        const grant = delegation.grant;
+        const grantSelfAid = grant.selfAid.replace(/^@/, '');
+        const sessionSelfAid = session.selfAID?.replace(/^@/, '');
+        if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
+        }
+        if (grant.channelType !== 'aun' || grant.chatType !== 'private') {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed msg reads require the current AUN private relation' };
+        }
+        let peerAid;
+        try {
+            peerAid = parsePeerKey(grant.peerKey).channelId.replace(/^@/, '');
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        if (parsed.command.from !== grantSelfAid || parsed.command.target !== peerAid) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN private relation can be targeted' };
+        }
+        const subject = buildAuthSubject({
+            selfAid: grant.selfAid,
+            actorId: grant.actorId,
+            channel: grant.channel,
+            channelType: grant.channelType,
+            channelId: peerAid,
+            chatType: grant.chatType,
+            conversationId: peerAid,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const decision = authorizeOperation({
+            source: 'agent-tool',
+            subject,
+            intent: {
+                operation: parsed.command.operationId,
+                scope: 'relation',
+                source: 'agent-tool',
+                args: {
+                    self: parsed.command.from,
+                    targetId: parsed.command.target,
+                    peer: parsed.command.target,
+                    peerKey: formatPeerKey('aun', parsed.command.target),
+                },
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv),
+                taskId: grant.taskId,
+                messageId: grant.messageId,
+            },
+        });
+        if (!decision.allow)
+            return { ok: false, code: decision.code, error: decision.reason };
+        try {
+            return { ok: true, result: await executeManagedMsgOperation(parsed.command) };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: error instanceof ManagedMsgOperationError ? error.code : 'MSG_OPERATION_FAILED',
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /** Agent-managed current-group filesystem entrypoint. */
+    async handleFsOperation(argv, sessionId, delegationToken, delegationCommandHash) {
+        if (!this.agentDelegationRegistry) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
+        }
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!delegation.ok)
+            return { ok: false, code: delegation.code, error: delegation.reason };
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
+        const parsed = resolveManagedFsOperation(argv);
+        if (!parsed.ok)
+            return { ok: false, code: parsed.code, error: parsed.reason };
+        const grant = delegation.grant;
+        const actorAid = grant.selfAid.replace(/^@/, '');
+        const sessionSelfAid = session.selfAID?.replace(/^@/, '');
+        if (sessionSelfAid && sessionSelfAid !== actorAid) {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
+        }
+        if (grant.channelType !== 'aun' || grant.chatType !== 'group') {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs operations require the current AUN group relation' };
+        }
+        let currentGroup;
+        try {
+            currentGroup = parsePeerKey(grant.peerKey).channelId;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        if ((parsed.command.actorAid && parsed.command.actorAid !== actorAid) || parsed.command.groupId !== currentGroup) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN group can be targeted' };
+        }
+        parsed.command.actorAid = actorAid;
+        const subject = buildAuthSubject({
+            selfAid: grant.selfAid,
+            actorId: grant.actorId,
+            channel: grant.channel,
+            channelType: grant.channelType,
+            channelId: currentGroup,
+            chatType: grant.chatType,
+            conversationId: currentGroup,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const intentArgs = {
+            self: actorAid,
+            targetId: currentGroup,
+            peer: currentGroup,
+            peerKey: formatPeerKey('aun', currentGroup),
+            path: parsed.command.remotePath,
+            targetPath: parsed.command.remotePath,
+            ...(parsed.command.remoteSourcePath ? { sourcePath: parsed.command.remoteSourcePath } : {}),
+            ...(parsed.command.localPath ? { localPath: parsed.command.localPath } : {}),
+            ...(parsed.command.recursive !== undefined ? { recursive: parsed.command.recursive } : {}),
+            ...(parsed.command.parents !== undefined ? { parents: parsed.command.parents } : {}),
+            ...(parsed.command.overwrite !== undefined ? { overwrite: parsed.command.overwrite } : {}),
+        };
+        const decision = authorizeOperation({
+            source: 'agent-tool',
+            subject,
+            intent: {
+                operation: parsed.command.operationId,
+                scope: 'relation',
+                source: 'agent-tool',
+                args: intentArgs,
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv), taskId: grant.taskId, messageId: grant.messageId,
+                sessionId, agentAid: actorAid, toolName: 'ec.fs',
+            },
+        });
+        if (!decision.allow)
+            return { ok: false, code: decision.code, error: decision.reason };
+        if (parsed.command.kind === 'upload') {
+            const localPath = String(parsed.command.localPath || '').trim();
+            const projectPath = path.resolve(session.projectPath);
+            if (!localPath)
+                return { ok: false, code: 'INVALID_ARGUMENT', error: 'Managed upload source is required' };
+            const resolvedPath = path.resolve(projectPath, localPath);
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedRoots = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!allowedRoots.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source must be inside the current session project or managed TMPDIR' };
+            }
+            if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
+                return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source cannot be a protected EvolCore path' };
+            }
+            try {
+                const realProjectPath = fs.realpathSync(projectPath);
+                const stat = fs.lstatSync(resolvedPath);
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    return { ok: false, code: 'INVALID_LOCAL_FILE', error: 'Upload source must be a regular non-symlink file' };
+                }
+                const realPath = fs.realpathSync(resolvedPath);
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // A removed or invalid session temp root is not an upload root.
+                }
+                const realAllowedRoots = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedRoots.some(root => isSameOrDescendant(realPath, root))
+                    || isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source resolves outside the allowed project or managed TMPDIR path' };
+                }
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source cannot be a hard link inside managed TMPDIR' };
+                }
+                if (stat.size > 16 * 1024 * 1024) {
+                    return { ok: false, code: 'LOCAL_FILE_TOO_LARGE', error: 'Managed upload is limited to 16 MiB' };
+                }
+                parsed.command.localPath = realPath;
+            }
+            catch (error) {
+                return { ok: false, code: 'INVALID_LOCAL_FILE', error: error instanceof Error ? error.message : String(error) };
+            }
+        }
+        try {
+            return { ok: true, result: await executeManagedFsOperation(parsed.command) };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: error instanceof ManagedFsOperationError ? error.code : 'FS_OPERATION_FAILED',
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
     setAgentDelegationRegistry(registry) {
         this.agentDelegationRegistry = registry;
     }
@@ -1576,7 +2054,7 @@ export class CommandHandler {
      * Agent ctl 入口：通过 IPC 接收 Agent 自主管理指令
      * 复用现有 slash cmd 逻辑，权限继承 session 用户角色
      */
-    async handleCtl(cmd, sessionId) {
+    async handleCtl(cmd, sessionId, grant) {
         logger.info(`[ctl] cmd="${cmd}" sessionId=${sessionId}`);
         // 1. 白名单检查
         const inputCmd = cmd.split(' ')[0];
@@ -1588,9 +2066,56 @@ export class CommandHandler {
         if (!session) {
             return { ok: false, error: '无效的 session' };
         }
+        if (!grant || grant.sessionId !== sessionId) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'An active task delegation grant is required' };
+        }
+        const sessionSelfAid = session.selfAID?.replace(/^@/, '');
+        const grantSelfAid = grant.selfAid.replace(/^@/, '');
+        if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
+        }
+        let conversationId;
+        try {
+            conversationId = parsePeerKey(grant.peerKey).channelId;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        const ctlSubject = buildAuthSubject({
+            selfAid: grant.selfAid,
+            actorId: grant.actorId,
+            channel: grant.channel,
+            channelType: grant.channelType,
+            channelId: conversationId,
+            chatType: grant.chatType,
+            conversationId,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const ctlIntent = this.resolveCtlIntent(cmd, grantSelfAid, grant.peerKey);
+        if (!ctlIntent)
+            return { ok: false, code: 'NOT_ALLOWED', error: `不允许的指令: ${inputCmd}` };
+        const ctlDecision = authorizeOperation({
+            source: 'agent-tool',
+            subject: ctlSubject,
+            intent: ctlIntent,
+            auditMetadata: {
+                argvHash: hashArgv(['ctl', ...cmd.slice(1).split(/\s+/).filter(Boolean)]),
+                taskId: grant.taskId,
+                messageId: grant.messageId,
+            },
+        });
+        if (!ctlDecision.allow)
+            return { ok: false, code: ctlDecision.code, error: ctlDecision.reason };
+        if (cmd.startsWith('/model info ')) {
+            const modelId = cmd.slice('/model info '.length).trim();
+            if (!modelId || /\s/.test(modelId))
+                return { ok: false, code: 'INVALID_ARGUMENT', error: 'model info requires one model id' };
+            const info = await getModelInfo(modelId, grantSelfAid, session.baseagent);
+            return { ok: true, result: JSON.stringify(info, null, 2), data: { ok: true, ...info } };
+        }
         // 3. 从 session.metadata.peerId 获取 userId（用于权限判断）
         const userId = session.metadata?.peerId;
-        const ctlIdentity = this.resolveCtlIdentity(session, userId);
+        const ctlIdentity = ctlSubject.identity;
         // 4. /send 文本消息：直接通过 adapter 主动发送，不走 handle()
         if (cmd.startsWith('/send ') || cmd === '/send') {
             // 解析 --encrypt 标志和消息文本
@@ -1625,9 +2150,9 @@ export class CommandHandler {
             const parts = sendArgs.split(/\s+/);
             const filePath = parts[parts.length - 1];
             if (filePath) {
-                const resolved = path.resolve(session.projectPath, filePath).replace(/\\/g, '/');
-                const projectPath = session.projectPath.replace(/\\/g, '/');
-                if (!resolved.startsWith(projectPath)) {
+                const resolved = path.resolve(session.projectPath, filePath);
+                const relative = path.relative(path.resolve(session.projectPath), resolved);
+                if (relative.startsWith('..') || path.isAbsolute(relative)) {
                     return { ok: false, error: '路径越界：只能发送项目目录下的文件' };
                 }
             }
@@ -1640,7 +2165,7 @@ export class CommandHandler {
         // 6. 调用现有 handle()，不传 sendMessage 回调（结果直接返回）
         try {
             const result = await this._handleInternal(cmd, session.channel, session.channelId, undefined, // 不发送消息
-            userId, session.threadId || undefined, session.chatType, undefined, undefined, session.selfAID, ctlIdentity);
+            userId, session.threadId || undefined, session.chatType, undefined, undefined, session.selfAID, ctlIdentity, ctlSubject);
             const text = typeof result === 'string' ? result : (result && 'text' in result ? result.text : '(无输出)');
             if (result && typeof result === 'object' && 'kind' in result && result.kind === 'command.error') {
                 return { ok: false, error: text || '执行失败' };
@@ -1651,6 +2176,56 @@ export class CommandHandler {
             return { ok: false, error: err.message };
         }
     }
+    resolveCtlIntent(cmd, selfAid, peerKey) {
+        const [name = '', ...args] = cmd.trim().slice(1).trim().split(/\s+/);
+        const relationArgs = { self: selfAid, peer: peerKey, peerKey };
+        const intent = (operation, extra = {}) => ({
+            operation,
+            scope: 'relation',
+            source: 'agent-tool',
+            args: { ...relationArgs, ...extra },
+        });
+        if (name === 'send')
+            return intent('ec.ctl.send');
+        if (name === 'file')
+            return intent('ec.ctl.file');
+        if (name === 'status')
+            return intent('session.current');
+        if (name === 'pwd')
+            return intent('project.current');
+        if (name === 'name' || name === 'rename')
+            return intent('session.rename');
+        if (name === 'queue') {
+            const action = args.includes('--clear') ? 'clear'
+                : args.includes('--cancel') ? 'cancel'
+                    : args.includes('--interrupt') ? 'interrupt'
+                        : 'read';
+            return intent(`ec.ctl.queue.${action}`);
+        }
+        if (name === 'model') {
+            if (args.length === 0 || args[0] === 'list')
+                return intent('model.list');
+            if (args[0] === 'current')
+                return intent('model.current');
+            if (args[0] === 'info')
+                return intent('model.info', { model: args[1] });
+            if (args[0] === 'reset')
+                return intent('model.reset');
+            if (args[0] === 'check') {
+                return { operation: 'model.check', scope: 'agent', source: 'agent-tool', args: { self: selfAid } };
+            }
+            return intent('model.use', { model: args[0] });
+        }
+        if (name === 'effort') {
+            return args.length === 0
+                ? intent('model.effort.current')
+                : intent('model.effort', { effort: args[0] });
+        }
+        if (name === 'restart') {
+            return { operation: 'system.restart', scope: 'process', source: 'agent-tool', args: { self: selfAid } };
+        }
+        return null;
+    }
     // ── Queue command ──
     /** 提取命名参数值（如 --cancel msg123 → "msg123"） */
     extractArg(args, flag) {
@@ -1665,6 +2240,14 @@ export class CommandHandler {
         const showId = args.includes('--showid');
         const formatJson = args.includes('--format json');
         const full = args.includes('--full');
+        const after = parseQueueTimeArg(this.extractArg(args, '--after'));
+        const before = parseQueueTimeArg(this.extractArg(args, '--before'));
+        if (this.extractArg(args, '--after') && after === undefined)
+            return { ok: false, error: '❌ --after 必须是 epoch 毫秒或 ISO 时间' };
+        if (this.extractArg(args, '--before') && before === undefined)
+            return { ok: false, error: '❌ --before 必须是 epoch 毫秒或 ISO 时间' };
+        if (after !== undefined && before !== undefined && after >= before)
+            return { ok: false, error: '❌ --after 必须早于 --before' };
         // 操作分支
         if (args.includes('--clear')) {
             const count = this.messageQueue.clearBySession(sessionId);
@@ -1686,13 +2269,19 @@ export class CommandHandler {
                 : { ok: false, error: `❌ 当前无处理中任务` };
         }
         // 查询
-        const items = this.messageQueue.getQueueItemsBySession(sessionId);
+        const items = this.messageQueue.getQueueItemsBySession(sessionId, { after, before });
         if (formatJson) {
             return { ok: true, result: JSON.stringify({ items }, null, 2) };
         }
         return { ok: true, result: renderQueueItemsCtl(items, showId, full) };
     }
 }
+function parseQueueTimeArg(value) {
+    if (!value)
+        return undefined;
+    const parsed = /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 /**
  * ctl 专用渲染：不显示 session 标识列（因为只有一个 session）
  */
@@ -1715,14 +2304,33 @@ function renderQueueItemsCtl(items, showId, full) {
             parts.push(` ${name}  `);
         }
         const content = full ? item.preview.replace('...', '') : item.preview;
-        parts.push(`"${content}"`);
+        const timing = [
+            item.receivedAt != null ? `recv=${new Date(item.receivedAt).toISOString()}` : undefined,
+            item.enqueuedAt != null ? `enq=${new Date(item.enqueuedAt).toISOString()}` : undefined,
+            item.queueWaitMs != null ? `wait=${formatQueueDuration(item.queueWaitMs)}` : undefined,
+        ].filter(Boolean).join(' ');
+        parts.push(`${timing ? `${timing}  ` : ''}"${content}"`);
         lines.push(parts.join(''));
     }
     return lines.join('\n');
 }
+function formatQueueDuration(ms) {
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
+}
 function sameFeedbackTarget(target, origin) {
     if (!origin)
         return false;
+    const targetChannelType = tryParseChannelKey(target.channelKey)?.type
+        ?? target.channelKey.split('#', 1)[0];
+    const targetChatType = target.chatType
+        ?? (targetChannelType === 'aun' ? undefined : 'private');
+    if (!targetChatType)
+        return false;
+    const originDelivery = origin.delivery;
+    const originChatType = originDelivery?.chatType ?? 'private';
+    if (targetChatType !== originChatType)
+        return false;
     return target.channelKey === origin.channelKey
         && target.channelId === origin.channelId
         && target.session === origin.session