evolcore 0.0.11 → 0.0.13

package/dist/index.js

@@ -1,7 +1,7 @@
 // 【重要】最先加载环境变量，确保后续模块初始化时可用
 import dotenv from 'dotenv';
 import path from 'path';
-import { ensureDataDirs, resolvePaths, getPackageRoot, agentMdPath, eckDebugDir, daemonControlDir, daemonQueuePath } from './paths.js';
+import { ensureDataDirs, resolvePaths, getPackageRoot, agentMdPath, eckDebugDir, daemonControlDir, daemonQueuePath, daemonMessageDedupPath } from './paths.js';
 // 立即加载 .env 文件（在其他模块导入之前）
 try {
     dotenv.config({ path: path.join(resolvePaths().root, '.env') });
@@ -14,16 +14,13 @@ import { CodexSessionFileAdapter } from './core/session/adapters/codex-session-f
 import { GeminiSessionFileAdapter } from './core/session/adapters/gemini-session-file-adapter.js';
 import { EcagentSessionFileAdapter } from './core/session/adapters/ecagent-session-file-adapter.js';
 import { loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfig, initializeEckSnapshotsConfig } from './config-store.js';
-import { ConfigTarget, initConfigManager, onConfigWrite, read as readConfig } from './config/config-manager.js';
-import { ensureRoleConfigV4OnStartup } from './config/role-config-v4-startup.js';
-import { ensureRoleConfigV5OnStartup } from './config/role-config-v5-startup.js';
+import { ConfigTarget, initConfigManager, onConfigWrite, read as readConfig, shouldFailFastForMissingOwners } from './config/config-manager.js';
+import { ensureRoleConfigV4OnStartup, ensureRoleConfigV5OnStartup } from './config/role-migration-startup.js';
 import { ensureContactBookV2OnStartup } from './config/contact-book-v2-startup.js';
 import { resolvePeerDisplayLabel } from './config/contact-book.js';
 import { expirePendingContactRequests } from './config/contact-request-service.js';
-import { shouldFailFastForMissingOwners } from './config/owner-policy.js';
 import { isManagementRole } from './config/builtin-roles.js';
 import { checkRoleAccess, getFirstStaticAgentOwner, resolvePeerRoleDetail, roleToSessionIdentity } from './config/peer-role-resolver.js';
-import { isCrossAgentTriggerOperationAllowed, isCrossAgentTriggerReadOperation } from './core/auth/trigger-authorization.js';
 import { ensureStartupConfigSnapshot, isConfigSnapshotsEnabled, retentionCleanup, readCurrent, readWVersion, diffWorkingVsVersion, paramDiff, incrementSuccessCount } from './config/snapshot.js';
 import { appendBootLog, selfDiagnose } from './config/boot-log.js';
 import { CONFIG_SCHEMA_VERSION } from './types.js';
@@ -41,16 +38,16 @@ import { BindService } from './utils/aid-bind.js';
 import { DingtalkChannelPlugin, registerPendingDingtalkContactBind } from './channels/dingtalk.js';
 import { QQBotChannelPlugin, registerPendingQQBotContactBind } from './channels/qqbot.js';
 import { WecomChannelPlugin, registerPendingWecomContactBind } from './channels/wecom.js';
-import { buildEnvelope } from './core/message/message-utils.js';
+import { buildEnvelope, isDeliveryTargetForChannel, replyContextFromSession } from './core/message/message-utils.js';
 import { ResponseEngine } from './core/message/response-engine.js';
 import { MessageQueue } from './core/message/message-queue.js';
 import { MessageBridge } from './core/message/message-bridge.js';
-import { MenuRequestDeduper, hasValidMenuId, menuFailure, menuPayloadFingerprint, parseMenuControl, validateMenuRequest } from './core/command/menu-protocol.js';
-import { evaluateEvolMenuVersionGate, evolMenuResponseTransportMetadata } from './core/command/evol-menu-version-gate.js';
+import { evaluateEvolMenuVersionGate, evolMenuResponseTransportMetadata, MenuRequestDeduper, hasValidMenuId, menuFailure, menuPayloadFingerprint, parseMenuControl, validateMenuRequest } from './core/command/menu-protocol.js';
 import { readInstalledEvolcoreVersion } from './utils/evolcore-version.js';
 import { recoverAllRoleMutationsSync } from './core/command/role-menu.js';
 import { HandoffRuntime } from './core/handoff/runtime.js';
 import { BootstrapService, completeBootstrapWithWelcome } from './core/bootstrap-service.js';
+import { postBootstrapWelcomeOperationId } from './core/bootstrap-messages.js';
 import { MessageCache } from './core/message/message-cache.js';
 import { CommandHandler, isProcessLevelOwner } from './core/command/command-handler.js';
 import { EventBus } from './core/event-bus.js';
@@ -58,10 +55,10 @@ import { getEventCatalog } from './core/event-catalog.js';
 import { StatsCollector } from './utils/stats.js';
 import { AidStatsCollector } from './utils/stats.js';
 import { PermissionGateway } from './core/permission/approval-gateway.js';
-import { InteractionRouter } from './core/interaction-router.js';
-import { registerAdapterInteractions } from './core/interaction-registration.js';
+import { InteractionRouter, registerAdapterInteractions } from './core/interaction-router.js';
 import { AgentDelegationRegistry, authorizeDelegatedAunMsgSend } from './core/auth/agent-delegation.js';
-import { authorizeOperation, buildAuthSubject } from './core/auth/auth-gateway.js';
+import { authorizeOperation, buildAuthSubject, isCrossAgentTriggerOperationAllowed, isCrossAgentTriggerReadOperation, } from './core/auth/auth-gateway.js';
+import { parsePeerKey } from './core/relation/peer-identity.js';
 import { isHClassPath } from './core/protected-paths.js';
 import { ChannelLoader, tryParseChannelKey } from './core/channel-loader.js';
 import { AgentLoader } from './core/baseagent-loader.js';
@@ -71,7 +68,8 @@ import { AgentReloadBusyError, AgentReloadCoordinator } from './core/agent-reloa
 import { buildReloadHooks } from './core/channel-loader.js';
 import { IpcServer } from './ipc.js';
 import { logger, setLogLevel } from './utils/logger.js';
-import { ecwebVersionRequirementError, fetchEcwebPairCode } from './utils/ecweb-utils.js';
+import { fetchEcwebPairCode } from './utils/ecweb-utils.js';
+import { createEcwebSupervisor } from './utils/ecweb-supervisor.js';
 import { writeMain, removeAll, isMainWinner, scanInstances } from './utils/instance-registry.js';
 import { detectDuplicates } from './core/evolagent-registry.js';
 import { loadKitManifest, cleanEckDebug, invalidateKitCache } from './eck/kit-renderer.js';
@@ -90,12 +88,11 @@ import { validateModelSelectionForRole } from './core/model/model-permission.js'
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride, } from './core/role/runtime-policy.js';
 import { atomicWriteJson } from './core/session/session-fs-store.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from './core/message/message-log.js';
+import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 import { MAIN_PACKAGE_NAME } from './product.js';
 import fs from 'fs';
 import crypto from 'crypto';
 import { fileURLToPath } from 'url';
-import { spawn } from 'child_process';
-import * as platform from './utils/cross-platform.js';
 const controlMenuDeduper = new MenuRequestDeduper();
 /** 出站 payload 摘要（用于 channel-out.log） */
 function summarizeOutboundPayload(payload) {
@@ -174,6 +171,61 @@ function normalizeMessageSource(value) {
         ? value
         : 'daemon';
 }
+/**
+ * Preserve the authenticated AUN inbound route for control-plane replies.
+ * Control callbacks must not reconstruct group/private semantics from an AID.
+ */
+function controlReplyContext(opts, metadata) {
+    const supplied = opts.replyContext?.delivery;
+    if (supplied) {
+        const matchesInbound = opts.chatType === 'group'
+            ? supplied.chatType === 'group' && supplied.groupId === opts.groupId
+            : supplied.chatType === 'private';
+        if (!matchesInbound) {
+            throw Object.assign(new Error('AUN control reply route does not match its authenticated inbound context'), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+    }
+    const delivery = supplied
+        ?? (opts.chatType === 'group'
+            ? (opts.groupId ? { chatType: 'group', groupId: opts.groupId } : undefined)
+            : { chatType: 'private' });
+    if (!delivery)
+        throw Object.assign(new Error('AUN control reply is missing a trusted groupId'), { code: 'AUN_OUTBOUND_ROUTE_REQUIRED' });
+    return {
+        ...(opts.replyContext ?? {}),
+        delivery,
+        metadata: {
+            ...(opts.replyContext?.metadata ?? {}),
+            ...(opts.encrypted === undefined ? {} : { encrypted: opts.encrypted }),
+            ...(opts.protectedHeaders ? { protectedHeaders: opts.protectedHeaders } : {}),
+            ...(metadata ?? {}),
+        },
+    };
+}
+function isValidAunDeliveryForChannel(delivery, channelId) {
+    return isDeliveryTargetForChannel(delivery, channelId);
+}
+function restartChannelType(channel) {
+    return channel?.split('#', 1)[0].toLowerCase();
+}
+/**
+ * Restore a persisted restart route without inferring AUN group semantics from
+ * an address. Legacy non-AUN entries may remain route-less; AUN entries do not.
+ */
+export function resolvePersistedRestartDelivery(opts) {
+    const requiresAunRoute = restartChannelType(opts.channel) === 'aun'
+        || restartChannelType(opts.adapterChannel) === 'aun';
+    if (!requiresAunRoute) {
+        return isDeliveryTargetForChannel(opts.delivery, opts.channelId)
+            ? { valid: true, delivery: opts.delivery }
+            : { valid: true };
+    }
+    return isDeliveryTargetForChannel(opts.delivery, opts.channelId)
+        ? { valid: true, delivery: opts.delivery }
+        : { valid: false };
+}
 function daemonConversationWatchdogMs(settings) {
     const idleTimeoutSec = settings.idleMonitor?.timeout;
     const idleMs = typeof idleTimeoutSec === 'number' && Number.isFinite(idleTimeoutSec) && idleTimeoutSec > 0
@@ -203,11 +255,15 @@ function originFromActorSession(session, authenticatedPeerId, authenticatedChann
         threadId: sameConversation && !isGroup ? (session.threadId || undefined) : undefined,
         peerId,
         sessionKey: sameConversation && !isGroup ? session.sessionKey : undefined,
+        // A group-created trigger intentionally feeds back to the authenticated
+        // actor's private conversation (the origin channelId is peerId), so the
+        // route remains explicit even though the source session was a group.
+        delivery: { chatType: 'private' },
     };
 }
 function seedUpgradeCheckTrigger(manager, owner) {
     const now = Date.now();
-    const scriptName = 'upgrade-check.sh';
+    const scriptName = 'upgrade-check.cjs';
     const definition = normalizeTriggerDefinition({
         $schema_version: 3.1,
         id: '__upgrade-check',
@@ -234,7 +290,7 @@ function seedUpgradeCheckTrigger(manager, owner) {
             type: 'script',
             script: {
                 path: scriptName,
-                runtime: 'bash',
+                runtime: 'node',
                 timeoutMs: 60_000,
             },
             permissionMode: 'bypass',
@@ -260,67 +316,107 @@ function seedUpgradeCheckTrigger(manager, owner) {
     const cliPath = path.join(packageRoot, 'dist', 'cli', 'index.js');
     const packageJsonPath = path.join(packageRoot, 'package.json');
     const devMode = fs.existsSync(path.join(packageRoot, 'src', 'index.ts'));
-    fs.writeFileSync(scriptPath, [
-        '#!/usr/bin/env bash',
-        'set -euo pipefail',
-        '',
-        `CLI_PATH=${JSON.stringify(cliPath)}`,
-        `PACKAGE_JSON=${JSON.stringify(packageJsonPath)}`,
-        `DEV_MODE=${devMode ? '1' : '0'}`,
-        '',
-        'json() {',
-        '  local outcome="$1"',
-        '  local text="$2"',
-        '  node -e \'console.log(JSON.stringify({ outcome: process.argv[1], text: process.argv[2], files: [] }))\' "$outcome" "$text"',
-        '}',
-        '',
-        'if [ "$DEV_MODE" = "1" ]; then',
-        '  json "noop" "upgrade check skipped in dev mode"',
-        '  exit 0',
-        'fi',
-        '',
-        'local_version="$(node -e \'try { console.log(require(process.argv[1]).version || "") } catch { process.exit(0) }\' "$PACKAGE_JSON")"',
-        `remote_version="$(npm view ${MAIN_PACKAGE_NAME} version 2>/dev/null || true)"`,
-        '',
-        'if [ -z "$remote_version" ]; then',
-        '  json "error" "failed to check evolcore latest version"',
-        '  exit 0',
-        'fi',
-        '',
-        'if [ -z "$local_version" ]; then',
-        '  json "error" "failed to read local ec version"',
-        '  exit 0',
-        'fi',
-        '',
-        'version_cmp="$(node -e \'',
-        'const [a, b] = process.argv.slice(1);',
-        'const pa = a.split("-")[0].split(".").map(Number);',
-        'const pb = b.split("-")[0].split(".").map(Number);',
-        'const n = Math.max(pa.length, pb.length);',
-        'let out = 0;',
-        'for (let i = 0; i < n; i++) {',
-        '  const av = Number.isFinite(pa[i]) ? pa[i] : 0;',
-        '  const bv = Number.isFinite(pb[i]) ? pb[i] : 0;',
-        '  if (av < bv) { out = -1; break; }',
-        '  if (av > bv) { out = 1; break; }',
-        '}',
-        'console.log(out);',
-        '\' "$local_version" "$remote_version")"',
-        '',
-        'if [ "$version_cmp" != "-1" ]; then',
-        '  json "noop" "evolcore is already up to date ($local_version; latest $remote_version)"',
-        '  exit 0',
-        'fi',
-        '',
-        'if [ ! -f "$CLI_PATH" ]; then',
-        '  json "error" "restart-monitor entry not found: $CLI_PATH"',
-        '  exit 0',
-        'fi',
-        '',
-        'nohup node "$CLI_PATH" restart-monitor >/dev/null 2>&1 &',
-        'json "success" "evolcore upgrade available: ${local_version:-unknown} -> $remote_version; restart-monitor started"',
-        '',
-    ].join('\n'));
+    fs.writeFileSync(scriptPath, `#!/usr/bin/env node
+const { existsSync, readFileSync } = require('node:fs');
+const { spawn } = require('node:child_process');
+
+const CLI_PATH = ${JSON.stringify(cliPath)};
+const PACKAGE_JSON = ${JSON.stringify(packageJsonPath)};
+const PACKAGE_NAME = ${JSON.stringify(MAIN_PACKAGE_NAME)};
+const DEV_MODE = ${devMode ? 'true' : 'false'};
+
+function emit(outcome, text) {
+  process.stdout.write(JSON.stringify({ outcome, text, files: [] }));
+}
+
+function compareVersions(a, b) {
+  const pa = a.split('-')[0].split('.').map(Number);
+  const pb = b.split('-')[0].split('.').map(Number);
+  const count = Math.max(pa.length, pb.length);
+  for (let i = 0; i < count; i += 1) {
+    const av = Number.isFinite(pa[i]) ? pa[i] : 0;
+    const bv = Number.isFinite(pb[i]) ? pb[i] : 0;
+    if (av < bv) return -1;
+    if (av > bv) return 1;
+  }
+  return 0;
+}
+
+async function latestVersion() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 10_000);
+  try {
+    const response = await fetch('https://registry.npmjs.org/' + encodeURIComponent(PACKAGE_NAME) + '/latest', {
+      signal: controller.signal,
+      headers: { Accept: 'application/json' },
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return typeof data.version === 'string' ? data.version : null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function main() {
+  if (DEV_MODE) {
+    emit('noop', 'upgrade check skipped in dev mode');
+    return;
+  }
+
+  let localVersion;
+  try {
+    localVersion = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version;
+  } catch {
+    emit('error', 'failed to read local ec version');
+    return;
+  }
+  if (typeof localVersion !== 'string' || !localVersion) {
+    emit('error', 'failed to read local ec version');
+    return;
+  }
+
+  let remoteVersion;
+  try {
+    remoteVersion = await latestVersion();
+  } catch {
+    remoteVersion = null;
+  }
+  if (!remoteVersion) {
+    emit('error', 'failed to check evolcore latest version');
+    return;
+  }
+  if (compareVersions(localVersion, remoteVersion) >= 0) {
+    emit('noop', 'evolcore is already up to date (' + localVersion + '; latest ' + remoteVersion + ')');
+    return;
+  }
+  if (!existsSync(CLI_PATH)) {
+    emit('error', 'restart-monitor entry not found: ' + CLI_PATH);
+    return;
+  }
+
+  try {
+    const child = spawn(process.execPath, [CLI_PATH, 'restart-monitor'], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: process.platform === 'win32',
+      env: { ...process.env },
+    });
+    child.unref();
+    emit('success', 'evolcore upgrade available: ' + localVersion + ' -> ' + remoteVersion + '; restart-monitor started');
+  } catch (error) {
+    emit('error', 'failed to start restart-monitor: ' + (error && error.message ? error.message : String(error)));
+  }
+}
+
+main().catch((error) => {
+  emit('error', 'upgrade check failed: ' + (error && error.message ? error.message : String(error)));
+});
+`);
+    // Remove the pre-Node script left by older installations so it cannot be
+    // selected by a stale trigger definition or run manually by accident.
+    fs.rmSync(path.join(dir, 'upgrade-check.sh'), { force: true });
+    fs.rmSync(path.join(dir, 'upgrade-check.js'), { force: true });
     fs.chmodSync(scriptPath, 0o755);
     atomicWriteJson(manager.definitionPath(definition.id), definition);
     fs.rmSync(manager.activePath(definition.id), { force: true });
@@ -338,7 +434,9 @@ function removeLegacyAgentUpgradeCheck(manager) {
         return;
     const isLegacySystemOrigin = existing.origin?.channelKey === '__system__' || existing.origin?.channelKey === 'daemon';
     const isUpgradeScript = existing.execution.type === 'script'
-        && existing.execution.script?.path === 'upgrade-check.sh';
+        && (existing.execution.script?.path === 'upgrade-check.sh'
+            || existing.execution.script?.path === 'upgrade-check.js'
+            || existing.execution.script?.path === 'upgrade-check.cjs');
     if (!isLegacySystemOrigin || !isUpgradeScript)
         return;
     fs.rmSync(manager.triggerDir('__upgrade-check'), { recursive: true, force: true });
@@ -393,9 +491,16 @@ async function runBindBootstrapDaemon(daemonCfg) {
         }
         const response = parsed ? await bindService.handleRequest(parsed, opts.peerId) : null;
         if (response) {
-            await controlChannel.sendMessage(opts.channelId, JSON.stringify(response));
+            await controlChannel.sendMessage(opts.channelId, JSON.stringify(response), controlReplyContext(opts));
         }
     });
+    const controlToken = crypto.randomBytes(32).toString('base64url');
+    fs.mkdirSync(path.dirname(resolvePaths().controlToken), { recursive: true });
+    fs.writeFileSync(resolvePaths().controlToken, controlToken, { mode: 0o600 });
+    try {
+        fs.chmodSync(resolvePaths().controlToken, 0o600);
+    }
+    catch { }
     const ipcServer = new IpcServer(resolvePaths().socket, () => ({
         pid: process.pid,
         uptime: Math.round(process.uptime() * 1000),
@@ -417,6 +522,7 @@ async function runBindBootstrapDaemon(daemonCfg) {
             };
         })(),
     }));
+    ipcServer.setControlToken(controlToken);
     ipcServer.setBindExecutor({
         begin: (cmd) => bindService.begin(cmd),
         status: (taskId) => bindService.status(taskId),
@@ -737,6 +843,23 @@ async function main() {
             '如需远程管理，请在 daemon.json 配置 owners: [<你的 AID>]');
     }
     const paths = resolvePaths();
+    // ECWeb has one lifecycle owner: the daemon.  The CLI may have started an
+    // instance just before spawning us; the supervisor adopts it when healthy,
+    // otherwise starts one and keeps it alive for the daemon's lifetime.
+    let ecwebSupervisor = null;
+    if (daemonCfg.ecweb?.enabled) {
+        ecwebSupervisor = createEcwebSupervisor({
+            port: daemonCfg.ecweb.port ?? 42705,
+            logger,
+        });
+        try {
+            await ecwebSupervisor.start();
+            onShutdown(() => ecwebSupervisor?.stop());
+        }
+        catch (error) {
+            logger.warn(`ECWeb supervisor 启动失败（不影响 daemon 主流程）: ${error?.message || error}`);
+        }
+    }
     if (bindBootstrapMode && daemonCfg.aid && loadAllAgents().agents.length === 0) {
         await runBindBootstrapDaemon(daemonCfg);
         return;
@@ -1039,7 +1162,7 @@ async function main() {
             if (!adapter)
                 return;
             if (text) {
-                await adapter.send(buildEnvelope({ channel: adapter.channelName, channelId: id, replyContext: opts }), { kind: 'system.notice', text, subtype: 'health' });
+                await adapter.send(buildEnvelope({ channel: adapter.channelName, channelId: id, delivery: opts?.delivery, replyContext: opts }), { kind: 'system.notice', text, subtype: 'health' });
             }
         };
         return cmdHandler.handle(content, channel, channelId, sendFn, userId, threadId);
@@ -1068,6 +1191,7 @@ async function main() {
         await processor.processMessage(message);
     }, {
         persistencePath: daemonQueuePath(),
+        dedupPath: daemonMessageDedupPath(),
     });
     // 设置中断回调（精确中断正在处理的 agent）
     messageQueue.setInterruptCallback(async (sessionKey, baseagent, evolagentName, reason = 'new_message') => {
@@ -1108,12 +1232,20 @@ async function main() {
             source: 'msg',
             handoffTrace: { version: 2, handoff_id: handoff.handoff_id },
         };
-        const result = targetSession.chatType === 'group'
+        const delivery = handoff.request.delivery;
+        if (!isValidAunDeliveryForChannel(delivery, targetSession.channelId)) {
+            return {
+                ok: false,
+                error: 'handoff is missing a valid immutable AUN delivery route',
+            };
+        }
+        const result = delivery.chatType === 'group'
             ? typeof channel.sendDaemonGroupMsg === 'function'
                 ? await channel.sendDaemonGroupMsg({
-                    groupId: targetSession.channelId,
+                    groupId: delivery.groupId,
                     payload: { ...handoff.request.payload, [AUN_HANDOFF_MARKER_FIELD]: handoff.handoff_id },
                     encrypt: handoff.request.encrypt,
+                    causation: handoff.causation,
                     log,
                 })
                 : { ok: false, error: 'AUN channel does not support daemon group sends' }
@@ -1129,6 +1261,7 @@ async function main() {
         return { ok: result.ok, message_id: result.message_id, error: result.error };
     }, undefined, { queueTtlMs: taskExecutionTtlMs });
     responseEngine.setHandoffRuntime(handoffRuntime);
+    cmdHandler.setHandoffRuntime(handoffRuntime);
     // Trigger runtime: daemon-level script + feedback scheduler.
     const triggerSchedulers = new Map();
     const targetSessionLocks = new TargetSessionLockRegistry();
@@ -1226,6 +1359,14 @@ async function main() {
         if (target && !getTriggerChannel(definition.agentAid, target.channelKey)) {
             throw new Error(`agent ${definition.agentAid} has no configured channel ${target.channelKey}`);
         }
+        const channelType = tryParseChannelKey(target?.channelKey ?? '')?.type
+            ?? (target?.channelKey?.split('#', 1)[0] || undefined);
+        const validAunRoute = definition.feedback.strategy === 'target'
+            ? definition.feedback.target?.chatType === 'private' || definition.feedback.target?.chatType === 'group'
+            : !!definition.origin && isValidAunDeliveryForChannel(definition.origin.delivery, definition.origin.channelId);
+        if (target && channelType === 'aun' && !validAunRoute) {
+            throw Object.assign(new Error('AUN trigger feedback target requires a valid explicit delivery route'), { code: 'AUN_OUTBOUND_ROUTE_REQUIRED' });
+        }
     };
     const validateTriggerDefinitionForActor = (definition, actor) => {
         if (definition.execution.type === 'script' && !actor.management) {
@@ -1467,9 +1608,13 @@ async function main() {
                     && (candidate.adapter.channelKey === target.channelKey || candidate.adapter.channelName === target.channelKey)
                     && tryParseChannelKey(candidate.adapter.channelKey)?.selfAID === input.trigger.agentAid));
                 const channel = inst?.channel;
-                if (!channel || typeof channel.isGroupId !== 'function')
+                if (!channel)
+                    return null;
+                // Trigger targets carry their transport classification explicitly. A
+                // channelId is only an address and is never parsed to choose the RPC.
+                const targetChatType = target.chatType;
+                if (!targetChatType)
                     return null;
-                const targetChatType = channel.isGroupId(target.channelId) ? 'group' : 'private';
                 if (targetChatType === 'group' && typeof channel.sendDaemonGroupMsg !== 'function')
                     return null;
                 if (targetChatType === 'private' && typeof channel.sendDaemonMsg !== 'function')
@@ -1695,8 +1840,8 @@ async function main() {
             });
         }
         // 5. 撤回消息 → 中断执行中任务
-        inst.channel.onRecall?.((messageId) => {
-            msgBridge.cancel(messageId);
+        inst.channel.onRecall?.((messageId, selfAID) => {
+            msgBridge.cancel(messageId, selfAID);
         });
     }
     // ── 注册所有渠道实例 ──
@@ -1805,6 +1950,7 @@ async function main() {
                 channel: adapter.channelName,
                 channelId: ownerAid,
                 agentName,
+                delivery: { chatType: 'private' },
             });
             sendSystemPayload(adapter, envelope, {
                 kind: 'system.notice',
@@ -1843,16 +1989,31 @@ async function main() {
                 logger.info(`[Restart] Pending notification waits for channel connection: ${pending.channel}`);
                 return;
             }
-            const replyContext = pending.rootId
-                ? { replyToMessageId: pending.rootId, replyInThread: !!pending.threadId }
-                : undefined;
+            const pendingDelivery = pending.delivery;
+            const restartDelivery = resolvePersistedRestartDelivery({
+                channel: pending.channel,
+                adapterChannel: adapter.channelName,
+                channelId: pending.channelId,
+                delivery: pendingDelivery,
+            });
+            if (!restartDelivery.valid) {
+                logger.warn(`[Restart] Discarding pending notification without a valid persisted delivery route: channel=${pending.channel} channelId=${pending.channelId}`);
+                fs.rmSync(pendingFile, { force: true });
+                return;
+            }
+            const pendingRouteContext = restartDelivery.delivery ? { delivery: restartDelivery.delivery } : {};
+            const replyContext = {
+                ...(pendingRouteContext ?? {}),
+                ...(pending.rootId ? { replyToMessageId: pending.rootId, replyInThread: !!pending.threadId } : {}),
+            };
             const owningAgent = agentRegistry.resolveByChannel(adapter.channelKey);
             const envelope = buildEnvelope({
                 taskId: `system-restart-${process.pid}`,
                 channel: adapter.channelKey,
                 channelId: pending.channelId,
                 agentName: owningAgent?.aid || 'evolcore',
-                replyContext,
+                ...(restartDelivery.delivery ? { delivery: restartDelivery.delivery } : {}),
+                replyContext: Object.keys(replyContext).length > 0 ? replyContext : undefined,
             });
             await sendSystemPayload(adapter, envelope, {
                 kind: 'system.notice',
@@ -1993,7 +2154,7 @@ async function main() {
         const delegation = agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
-        return cmdHandler.handleCtl(cmd, sessionId);
+        return cmdHandler.handleCtl(cmd, sessionId, delegation.grant);
     });
     // Register every IPC executor/provider before exposing the endpoint. The
     // function declaration is hoisted, while its invocation remains here so a
@@ -2062,52 +2223,6 @@ async function main() {
         catch (e) {
             logger.warn(`控制 AID 首连失败（后台自动重连，不影响 daemon 主流程）: ${e?.message || e}`);
         }
-        // ── ECWeb 自动启动 ──
-        // 如果 config.ecweb.enabled，自动拉起 ecweb 服务
-        if (daemonCfg.ecweb?.enabled) {
-            const ecwebPath = path.join(resolvePaths().root, 'ecweb');
-            const ecwebEntry = path.join(ecwebPath, 'dist', 'index.js');
-            if (fs.existsSync(ecwebEntry)) {
-                let ecwebVersion;
-                try {
-                    const pkg = JSON.parse(fs.readFileSync(path.join(ecwebPath, 'package.json'), 'utf-8'));
-                    ecwebVersion = pkg.version;
-                }
-                catch { }
-                const versionError = ecwebVersionRequirementError(ecwebVersion);
-                if (versionError) {
-                    logger.error(`ECWeb 未启动: ${versionError}`);
-                }
-                else {
-                    try {
-                        const ecwebProc = spawn('node', [ecwebEntry], {
-                            cwd: ecwebPath,
-                            detached: true,
-                            stdio: 'ignore',
-                            env: { ...process.env, EVOLCORE_HOME: resolvePaths().root }
-                        });
-                        ecwebProc.unref();
-                        logger.info(`✓ ECWeb 已启动 (PID: ${ecwebProc.pid})`);
-                        onShutdown(() => {
-                            try {
-                                if (ecwebProc.pid)
-                                    platform.killProcess(ecwebProc.pid, true);
-                                logger.info(`✓ ECWeb 已停止`);
-                            }
-                            catch { }
-                        });
-                    }
-                    catch (e) {
-                        logger.warn(`ECWeb 启动失败: ${e?.message || e}`);
-                    }
-                }
-            }
-            else {
-                // 正式安装时 ECWeb 是独立的全局 ec-web 包，由 ec start/restart 的
-                // 启动链路管理；runtime 目录没有内嵌构建产物是正常状态。
-                logger.debug(`ECWeb runtime entry absent (managed externally): ${ecwebEntry}`);
-            }
-        }
         // 控制 AID 接收 owner 指令：
         // 1. /pair — ECWeb 配对码（文本快路径）
         // 2. menu.* JSON — 路由到 cmdHandler.execMenuForControl（进程级 + 全量权限）
@@ -2122,22 +2237,20 @@ async function main() {
                 catch {
                     parsed = null;
                 }
+                const menuResponseContext = () => controlReplyContext(opts, evolMenuResponseTransportMetadata());
                 if (bindService && parsed?.type === 'bind.request') {
                     const response = await bindService.handleRequest(parsed, opts.peerId);
                     if (response) {
                         // 用 sendStructured 直发 typed payload（payload.type='bind.response'），
                         // 不能用 sendMessage——它会把内容包成 {type:'text', text:...}，App 无法识别。
                         // encrypted 跟随入站请求：bind.response 与 bind.request 的加密/明文对称。
-                        await controlChannel.sendStructured(opts.channelId, response, { metadata: { encrypted: opts.encrypted } });
+                        await controlChannel.sendStructured(opts.channelId, response, controlReplyContext(opts));
                     }
                     return;
                 }
                 const menuControl = parseMenuControl(text);
                 const isRoleMenu = menuControl.isMenu
                     && (menuControl.name === 'role' || menuControl.request.cmd === '/role');
-                const menuResponseContext = () => ({
-                    metadata: evolMenuResponseTransportMetadata(),
-                });
                 if (menuControl.isMenu && !hasValidMenuId(menuControl)) {
                     logger.warn(`[ControlMenu] dropped malformed request without id type=${menuControl.type}`);
                     return;
@@ -2162,7 +2275,7 @@ async function main() {
                     else {
                         reply = 'ECWeb 未运行或暂不可达。请在主机运行 ec watch web 启动后重试。';
                     }
-                    await controlChannel.sendMessage(opts.channelId, reply);
+                    await controlChannel.sendMessage(opts.channelId, reply, controlReplyContext(opts));
                     return;
                 }
                 // menu.* JSON 路由：owner 已在上方校验，转交 execMenuForControl（fromControlChannel=true）
@@ -2181,6 +2294,16 @@ async function main() {
                         return;
                     }
                     const deduped = await controlMenuDeduper.execute([opts.channelId, opts.peerId, menuControl.id].join('\u001f'), menuPayloadFingerprint(menuControl.raw), () => cmdHandler.execMenuForControl(parsed, opts.peerId));
+                    if ('retry' in deduped) {
+                        if (deduped.replayed) {
+                            logger.warn(`[MenuControl] category=request-replay request=${menuControl.id}`
+                                + ` sender=${opts.peerId} replay=true`);
+                        }
+                        if (deduped.retry) {
+                            logger.warn(`[MenuControl] category=request-retry request=${menuControl.id}`
+                                + ` sender=${opts.peerId} retry=true`);
+                        }
+                    }
                     const response = 'conflict' in deduped
                         ? menuFailure({ id: menuControl.id, ...(menuControl.name?.trim() ? { name: menuControl.name } : {}) }, { code: 'CONFLICT', message: 'Request ID was already used with a different payload' })
                         : deduped.value;
@@ -2190,7 +2313,7 @@ async function main() {
                     return;
                 }
                 // owner 发的其他内容：提示可用指令
-                await controlChannel.sendMessage(opts.channelId, '可用指令：/pair（获取 ECWeb 登录配对码）');
+                await controlChannel.sendMessage(opts.channelId, '可用指令：/pair（获取 ECWeb 登录配对码）', controlReplyContext(opts));
             }
             catch (e) {
                 logger.warn(`控制 AID 消息处理失败: ${e?.message || e}`);
@@ -2242,6 +2365,7 @@ async function main() {
                 channel: other.adapter.channelKey,
                 channelId: ownerId,
                 agentName: owningAgent?.aid || 'evolcore',
+                delivery: { chatType: 'private' },
             });
             sendSystemPayload(other.adapter, envelope, {
                 kind: 'system.error',
@@ -2259,6 +2383,9 @@ async function main() {
     const recoveryAids = triggerStartupAgents.map(agent => agent.aid);
     for (const aid of recoveryAids) {
         try {
+            const discarded = await handoffRuntime.discardExpired([aid]);
+            if (discarded > 0)
+                logger.info(`[Handoff] discarded ${discarded} expired handoff(s) for ${aid}`);
             const expired = handoffRuntime.expireQueued([aid]);
             if (expired > 0)
                 logger.info(`[Handoff] expired ${expired} stale queued delivery item(s) for ${aid}`);
@@ -2328,11 +2455,13 @@ async function main() {
                 channelType: session.channelType || parsedResumeKey?.type,
                 selfAID: resumeSelfAID,
                 channelId: session.channelId,
+                groupId: session.chatType === 'group' ? (session.metadata?.groupId || session.channelId) : undefined,
+                chatType: session.chatType === 'group' ? 'group' : 'private',
                 content: '服务已重启，请继续之前未完成的任务。',
                 timestamp: Date.now(),
                 peerId: '',
                 threadId: session.threadId || undefined,
-                replyContext: session.metadata?.replyContext,
+                replyContext: replyContextFromSession(session),
             };
             // 清除状态后入队（processMessage 会重新标记）
             sessionManager.clearProcessing(session.id);
@@ -2344,7 +2473,27 @@ async function main() {
     function configureIpc() {
         // M3: direct call (not cast) — wire EvolAgentRegistry into IPC for evolagent.* handlers
         ipcServer.setAgentRegistry(agentRegistry);
-        ipcServer.setBootstrapCompleteExecutor(async (aid) => {
+        ipcServer.setControlToken(triggerControlToken);
+        ipcServer.setBootstrapCompleteExecutor(async (aid, auth) => {
+            if (auth?.sessionId) {
+                const authorization = await authorizeManagedAgentOperation({
+                    sessionId: auth.sessionId,
+                    delegationToken: auth.delegationToken,
+                    delegationCommandHash: auth.delegationCommandHash,
+                    targetAid: aid,
+                }, 'agent.bootstrapComplete');
+                if (!authorization.ok)
+                    return authorization;
+            }
+            else {
+                const providedToken = typeof auth?.controlToken === 'string' ? Buffer.from(auth.controlToken) : undefined;
+                const expectedToken = Buffer.from(triggerControlToken);
+                if (!providedToken
+                    || providedToken.length !== expectedToken.length
+                    || !crypto.timingSafeEqual(providedToken, expectedToken)) {
+                    return { ok: false, code: 'INVALID_CONTROL_TOKEN', error: 'valid local control token is required' };
+                }
+            }
             const aunInstance = channelInstances.find(candidate => {
                 if (candidate.channelType !== 'aun')
                     return false;
@@ -2353,7 +2502,30 @@ async function main() {
                 return owner?.aid === aid;
             });
             const welcome = aunInstance?.channel;
-            return completeBootstrapWithWelcome(bootstrapService, aid, welcome);
+            const ownerAid = getFirstStaticAgentOwner(aid);
+            const owningAgent = agentRegistry.get(aid);
+            const sessions = aunInstance && ownerAid && owningAgent
+                ? {
+                    ensurePostBootstrapMainSession: async () => {
+                        const channel = aunInstance.adapter.channelName;
+                        const active = await sessionManager.getActiveSession(channel, ownerAid);
+                        const ensured = await sessionManager.ensureNewMainSessionForOperation({
+                            channel,
+                            channelId: ownerAid,
+                            projectPath: active?.projectPath || owningAgent.projectPath || defaultProjectPath,
+                            baseagent: owningAgent.baseagent || active?.baseagent || primaryBaseagent,
+                            operationId: postBootstrapWelcomeOperationId(aid),
+                            identityMetadata: {
+                                ...(active?.metadata ?? {}),
+                                channelKey: aunInstance.adapter.channelKey,
+                                peerId: ownerAid,
+                            },
+                        });
+                        return { sessionId: ensured.session.id, created: ensured.created };
+                    },
+                }
+                : undefined;
+            return completeBootstrapWithWelcome(bootstrapService, aid, welcome, sessions);
         });
         ipcServer.setDingtalkContactBindExecutor({
             register: (cmd) => registerPendingDingtalkContactBind(cmd),
@@ -2378,6 +2550,10 @@ async function main() {
         ipcServer.setMenuExecutor((payload, auth) => cmdHandler.execMenuForEcweb(payload, auth));
         ipcServer.setConfigOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleConfigOperation(argv, sessionId, delegationToken, delegationCommandHash));
         ipcServer.setContactOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleContactOperation(argv, sessionId, delegationToken, delegationCommandHash));
+        ipcServer.setAidOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleAidOperation(argv, sessionId, delegationToken, delegationCommandHash));
+        ipcServer.setGroupOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleGroupOperation(argv, sessionId, delegationToken, delegationCommandHash));
+        ipcServer.setMsgOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleMsgOperation(argv, sessionId, delegationToken, delegationCommandHash));
+        ipcServer.setFsOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleFsOperation(argv, sessionId, delegationToken, delegationCommandHash));
         cmdHandler.setDaemonStatusProvider(() => {
             const aidState = controlChannel?.getAidState?.();
             return {
@@ -2446,30 +2622,82 @@ async function main() {
             aidStatsCollector.recordOutbound(params.aid, params.toPeer, Buffer.byteLength(params.text || '', 'utf-8'), params.text, false, params.encrypt, params.chatmode, 'send');
         });
         ipcServer.setTaskRuntimeContextProvider(({ sessionId }) => responseEngine.getTaskRuntimeContext(sessionId));
-        ipcServer.setHandoffReturnExecutor((params) => responseEngine.returnHandoffResult(params));
-        ipcServer.setHandoffStatusExecutor(async (params) => {
-            if (!params.sessionId)
-                return { ok: false, code: 'HANDOFF_CALL_SESSION_REQUIRED', error: 'current session is required' };
+        ipcServer.setCodexPreToolUseExecutor(async (params) => {
+            for (const runner of new Set(agentMap.values())) {
+                if (typeof runner?.evaluatePreToolUse !== 'function')
+                    continue;
+                const result = await runner.evaluatePreToolUse(params.threadId, params.toolName, params.toolInput);
+                if (result.applicable)
+                    return result;
+            }
+            return {
+                ok: false,
+                applicable: true,
+                decision: 'deny',
+                reason: 'No active EvolCore Codex runner accepted this managed hook request',
+            };
+        });
+        const resolveManagedHandoffScope = async (params, operation) => {
+            const delegation = agentDelegationRegistry.validate(params.delegationToken, params.sessionId, params.delegationCommandHash);
+            if (!delegation.ok)
+                return { ok: false, code: delegation.code, error: delegation.reason };
             const runtime = responseEngine.getTaskRuntimeContext(params.sessionId);
             const session = await sessionManager.getSessionById(params.sessionId);
             const selfAid = runtime?.selfAid || session?.selfAID;
-            if (!selfAid)
-                return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found' };
-            return handoffRuntime.status(selfAid, params.handoffId)
-                ?? { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found' };
-        });
-        const resolveHandoffQueryAid = async (params) => {
+            if (!selfAid || !session) {
+                return { ok: false, code: 'HANDOFF_CALL_SESSION_INVALID', error: 'current session is invalid' };
+            }
+            if (delegation.grant.selfAid !== selfAid) {
+                return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation self agent does not match current session' };
+            }
+            if (params.agent && params.agent !== selfAid) {
+                return { ok: false, code: 'HANDOFF_AGENT_SCOPE_MISMATCH', error: 'agent does not match the current session' };
+            }
+            let conversationId;
+            try {
+                conversationId = parsePeerKey(delegation.grant.peerKey).channelId;
+            }
+            catch {
+                return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation contains an invalid relation key' };
+            }
+            const subject = buildAuthSubject({
+                selfAid,
+                actorId: delegation.grant.actorId,
+                channel: delegation.grant.channel,
+                channelType: delegation.grant.channelType,
+                channelId: conversationId,
+                chatType: delegation.grant.chatType,
+                conversationId,
+                processOwners: daemonCfg.owners ?? [],
+            });
+            const managementRole = isManagementRole(subject.role);
+            const decision = authorizeOperation({
+                source: 'agent-tool',
+                subject,
+                intent: {
+                    operation,
+                    scope: managementRole ? 'agent' : 'relation',
+                    source: 'agent-tool',
+                    args: {
+                        self: selfAid,
+                        peer: conversationId,
+                        peerKey: delegation.grant.peerKey,
+                    },
+                },
+                auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
+            });
+            if (!decision.allow) {
+                return {
+                    ok: false,
+                    code: decision.command?.code ?? 'ROLE_ACCESS_DENIED',
+                    error: decision.reason,
+                };
+            }
+            return { ok: true, aid: selfAid, currentSessionId: params.sessionId, managementRole };
+        };
+        const resolveHandoffQueryScope = async (params, operation) => {
             if (params.sessionId) {
-                const runtime = responseEngine.getTaskRuntimeContext(params.sessionId);
-                const session = await sessionManager.getSessionById(params.sessionId);
-                const selfAid = runtime?.selfAid || session?.selfAID;
-                if (!selfAid) {
-                    return { ok: false, code: 'HANDOFF_CALL_SESSION_INVALID', error: 'current session is invalid' };
-                }
-                if (params.agent && params.agent !== selfAid) {
-                    return { ok: false, code: 'HANDOFF_AGENT_SCOPE_MISMATCH', error: 'agent does not match the current session' };
-                }
-                return { ok: true, aid: selfAid };
+                return resolveManagedHandoffScope({ ...params, sessionId: params.sessionId }, operation);
             }
             if (!params.agent) {
                 return { ok: false, code: 'HANDOFF_AGENT_REQUIRED', error: '--agent is required outside a task context' };
@@ -2477,23 +2705,56 @@ async function main() {
             if (!agentRegistry.get(params.agent)) {
                 return { ok: false, code: 'HANDOFF_AGENT_NOT_FOUND', error: `agent not found: ${params.agent}` };
             }
-            return { ok: true, aid: params.agent };
+            return { ok: true, aid: params.agent, currentSessionId: undefined, managementRole: true };
         };
+        ipcServer.setHandoffReturnExecutor(async (params) => {
+            if (!params.sessionId)
+                return responseEngine.returnHandoffResult(params);
+            const scope = await resolveManagedHandoffScope({ ...params, sessionId: params.sessionId }, 'ec.handoff.return');
+            if (!scope.ok)
+                return scope;
+            return responseEngine.returnAuthorizedHandoffResult({ sessionId: params.sessionId, handoffId: params.handoffId, content: params.content }, scope.aid);
+        });
+        ipcServer.setHandoffStatusExecutor(async (params) => {
+            const scope = await resolveHandoffQueryScope(params, 'ec.handoff.status');
+            if (!scope.ok)
+                return scope;
+            const status = handoffRuntime.status(scope.aid, params.handoffId);
+            if (!status)
+                return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found' };
+            if (!scope.managementRole
+                && status.origin_session_id !== scope.currentSessionId
+                && status.target_session_id !== scope.currentSessionId) {
+                return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found in the current session' };
+            }
+            return status;
+        });
         ipcServer.setHandoffListExecutor(async (params) => {
-            const scope = await resolveHandoffQueryAid(params);
+            const scope = await resolveHandoffQueryScope(params, 'ec.handoff.list');
             if (!scope.ok)
                 return scope;
+            if (!scope.managementRole && params.filterSessionId && params.filterSessionId !== scope.currentSessionId) {
+                return { ok: false, code: 'HANDOFF_SESSION_SCOPE_MISMATCH', error: 'only the current session can be queried' };
+            }
             return handoffRuntime.listHandoffs({
                 selfAid: scope.aid,
                 state: params.state,
-                sessionId: params.filterSessionId,
+                sessionId: scope.managementRole ? params.filterSessionId : scope.currentSessionId,
                 limit: params.limit,
             });
         });
         ipcServer.setHandoffTraceExecutor(async (params) => {
-            const scope = await resolveHandoffQueryAid(params);
+            const scope = await resolveHandoffQueryScope(params, 'ec.handoff.trace');
             if (!scope.ok)
                 return scope;
+            if (!scope.managementRole) {
+                const status = handoffRuntime.status(scope.aid, params.handoffId);
+                if (!status
+                    || (status.origin_session_id !== scope.currentSessionId
+                        && status.target_session_id !== scope.currentSessionId)) {
+                    return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found in the current session' };
+                }
+            }
             return handoffRuntime.traceHandoff(scope.aid, params.handoffId, params.limit)
                 ?? { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff not found' };
         });
@@ -2532,10 +2793,9 @@ async function main() {
             if (!ch) {
                 return { ok: false, error: `AUN channel not found for ${params.aid}`, code: 'AUN_CHANNEL_NOT_FOUND' };
             }
-            const targetIsGroup = typeof ch.isGroupId === 'function' && ch.isGroupId(params.to);
-            if ((params.scope === 'group') !== targetIsGroup) {
-                return { ok: false, error: 'AUN target does not match the delegated send scope', code: 'UNSUPPORTED_TARGET' };
-            }
+            // The IPC command already carries the caller-selected transport scope.
+            // Never reclassify the target by parsing its AID string: a private AID may
+            // look group-like and a group identifier may use a future format.
             const encrypt = typeof params.encrypt === 'boolean'
                 ? params.encrypt
                 : (typeof ch.getDefaultEncrypt === 'function' ? ch.getDefaultEncrypt() : true);
@@ -2565,12 +2825,27 @@ async function main() {
             if (!payload) {
                 return { ok: false, error: 'message payload is required', code: 'INVALID_PAYLOAD' };
             }
+            try {
+                if (Object.prototype.hasOwnProperty.call(payload, 'mentions')) {
+                    payload = { ...payload, mentions: normalizeAunMentionEntries(payload.mentions) };
+                }
+                if (params.scope === 'group' && params.mentions !== undefined) {
+                    const normalizedMentions = normalizeAunMentionEntries(params.mentions);
+                    if (normalizedMentions.length > 0) {
+                        payload = { ...payload, mentions: normalizedMentions };
+                    }
+                }
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                    code: error?.code ?? 'INVALID_MENTION_SCHEMA',
+                };
+            }
             if (params.thread && typeof payload.thread_id !== 'string') {
                 payload = { ...payload, thread_id: params.thread };
             }
-            if (params.scope === 'group' && params.mentions?.length) {
-                payload = { ...payload, mentions: params.mentions };
-            }
             let targetSessionId;
             if (params.originSessionId && params.originMessageId) {
                 try {
@@ -2824,7 +3099,7 @@ async function main() {
                 agent.status = 'running';
                 // 连接
                 await channelLoader.connectAll(instances, { onConnected: markChannelConnected });
-                await handoffRuntime.recover([aid]);
+                await handoffRuntime.recover([aid], { discardExpired: false });
                 await ensureTriggerSchedulerStarted(agent);
                 handoffRuntime.resumeAgent(aid);
                 resumed = true;
@@ -2976,7 +3251,7 @@ async function main() {
             const agentName = handle?.name;
             if (!agentName)
                 return [];
-            return messageQueue.getQueueItemsByAgent(agentName);
+            return messageQueue.getQueueItemsByAgent(agentName, { after: params.after, before: params.before });
         });
         ipcServer.setQueueActionExecutor(async (params) => {
             const handle = agentRegistry.get(params.agent);
@@ -3003,6 +3278,92 @@ async function main() {
                     return { ok: false, error: `unknown action: ${params.action}` };
             }
         });
+        async function authorizeManagedAgentOperation(params, operation) {
+            const delegation = agentDelegationRegistry.validate(params.delegationToken, params.sessionId, params.delegationCommandHash);
+            if (!delegation.ok)
+                return { ok: false, code: delegation.code, error: delegation.reason };
+            const session = await sessionManager.getSessionById(params.sessionId);
+            if (!session || session.selfAID !== delegation.grant.selfAid) {
+                return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation does not match the current session' };
+            }
+            if (params.targetAid && params.targetAid !== delegation.grant.selfAid) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'only the current Agent can be targeted' };
+            }
+            let conversationId;
+            try {
+                conversationId = parsePeerKey(delegation.grant.peerKey).channelId;
+            }
+            catch {
+                return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation contains an invalid relation key' };
+            }
+            const subject = buildAuthSubject({
+                selfAid: delegation.grant.selfAid,
+                actorId: delegation.grant.actorId,
+                channel: delegation.grant.channel,
+                channelType: delegation.grant.channelType,
+                channelId: conversationId,
+                chatType: delegation.grant.chatType,
+                conversationId,
+                processOwners: daemonCfg.owners ?? [],
+            });
+            if (!isManagementRole(subject.role)) {
+                return { ok: false, code: 'ROLE_ACCESS_DENIED', error: `${operation} requires Agent admin permission` };
+            }
+            const decision = authorizeOperation({
+                source: 'agent-tool',
+                subject,
+                intent: {
+                    operation,
+                    scope: operation === 'system.status' ? 'process' : 'agent',
+                    source: 'agent-tool',
+                    args: { self: delegation.grant.selfAid, aid: params.targetAid ?? delegation.grant.selfAid },
+                },
+                auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
+            });
+            return decision.allow
+                ? { ok: true, aid: delegation.grant.selfAid }
+                : { ok: false, code: decision.code, error: decision.reason };
+        }
+        ipcServer.setQueueOperationExecutor(async (params) => {
+            const operation = `ec.queue.${params.action ?? 'read'}`;
+            const authorization = await authorizeManagedAgentOperation(params, operation);
+            if (!authorization.ok)
+                return authorization;
+            const handle = agentRegistry.get(authorization.aid);
+            if (!handle?.name)
+                return { ok: false, code: 'AGENT_NOT_FOUND', error: 'current Agent not found' };
+            if (!params.action) {
+                return { ok: true, items: messageQueue.getQueueItemsByAgent(handle.name, {
+                        after: params.after,
+                        before: params.before,
+                    }) };
+            }
+            if (params.action === 'clear')
+                return { ok: true, cleared: messageQueue.clearByAgent(handle.name) };
+            if (params.action === 'cancel') {
+                if (!params.messageId)
+                    return { ok: false, code: 'INVALID_ARGUMENT', error: 'missing messageId' };
+                return { ok: true, cancelled: messageQueue.cancelMessageById(handle.name, params.messageId) };
+            }
+            if (!params.sessionKey)
+                return { ok: false, code: 'INVALID_ARGUMENT', error: 'missing sessionKey' };
+            const targetSessionId = messageQueue.findSessionIdBySessionKey(params.sessionKey);
+            if (!targetSessionId)
+                return { ok: false, code: 'SESSION_NOT_FOUND', error: `session not found: ${params.sessionKey}` };
+            const targetSession = await sessionManager.getSessionById(targetSessionId);
+            if (!targetSession || targetSession.selfAID !== authorization.aid) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'session does not belong to the current Agent' };
+            }
+            return { ok: true, interrupted: await messageQueue.interruptBySession(targetSessionId) };
+        });
+        ipcServer.setStatusAuthorizationExecutor(async (params) => {
+            const authorization = await authorizeManagedAgentOperation(params, 'system.status');
+            return authorization.ok ? { ok: true } : authorization;
+        });
+        ipcServer.setStorageAuthorizationExecutor(async (params) => {
+            const authorization = await authorizeManagedAgentOperation({ ...params, targetAid: params.aid }, params.operation);
+            return authorization.ok ? { ok: true } : authorization;
+        });
         ipcServer.setTriggerExecutor(async (cmd) => {
             const schedulerFor = (agentAid) => {
                 const scheduler = triggerSchedulers.get(agentAid);