evolcore 0.0.12 → 0.0.13

package/dist/aun/aid/control-aid.js

@@ -62,7 +62,8 @@ async function candidateExists(store, candidate) {
     throw new Error(`Gateway 不可达，无法查重控制 AID：${r.error?.message ?? 'unknown'}`);
 }
 /**
- * 生成控制 AID：循环候选 → candidateExists 查重（权威 PKI 判据）→ 不冲突则 aidCreate。
+ * 生成控制 AID：循环候选 → candidateExists 查重（权威 PKI 判据）→ 不冲突则 aidCreate；
+ * 查重通过但注册失败时也换候选重试，覆盖查重与注册之间的竞态。
  * - 查重走 GET 证书（见 candidateExists；不拉 agent.md，控制 AID 本就不传 agent.md）
  * - fail-fast：查重探测失败（网关不可达）立即抛错，不掩盖成"均冲突"
  * - agent.md 不上传：aidCreate 仅注册身份 + 写私钥，不调 agentmdPut
@@ -72,6 +73,7 @@ export async function generateControlAid(aidDomain) {
         ? resolveControlAidDomain()
         : normalizeAidDomain(aidDomain, 'aidDomain');
     const store = await getAidStore({ slotId: SLOT.cli });
+    let lastRegistrationError;
     try {
         for (let i = 0; i < MAX_ATTEMPTS; i++) {
             const candidate = candidateAid(finalAidDomain);
@@ -79,22 +81,43 @@ export async function generateControlAid(aidDomain) {
                 logger.info(`[control-aid] ${candidate} 已注册，重试 (${i + 1}/${MAX_ATTEMPTS})`);
                 continue;
             }
-            const created = await aidCreate(candidate);
-            // 清理 aidCreate 内部另开的 client/store——关闭失败不可丢弃已注册的 AID（否则下次 init
-            // 会把它当冲突，白白消耗一次重试）。close 异常降级为 warn。
             try {
-                await created.client?.close?.();
+                const created = await aidCreate(candidate);
+                // 清理 aidCreate 内部另开的 client/store——关闭失败不可丢弃已注册的 AID（否则下次 init
+                // 会把它当冲突，白白消耗一次重试）。close 异常降级为 warn。
+                try {
+                    await created.client?.close?.();
+                }
+                catch (e) {
+                    logger.warn(`[control-aid] client.close() 失败（非致命）: ${e}`);
+                }
+                try {
+                    await created.store?.close?.();
+                }
+                catch (e) {
+                    logger.warn(`[control-aid] store.close() 失败（非致命）: ${e}`);
+                }
+                return { aid: created.aid, gateway: created.gateway };
             }
             catch (e) {
-                logger.warn(`[control-aid] client.close() 失败（非致命）: ${e}`);
+                // 查重与实际注册之间存在 TOCTOU 竞态；注册接口也可能因服务端暂时失败而拒绝，
+                // 这些情况都换一个候选继续尝试。查重阶段的网关错误仍在 candidateExists 中 fail-fast。
+                lastRegistrationError = e;
+                const reason = e instanceof Error ? e.message : String(e);
+                logger.warn(`[control-aid] ${candidate} 注册失败: ${reason}，重试 (${i + 1}/${MAX_ATTEMPTS})`);
             }
-            try {
-                await created.store?.close?.();
-            }
-            catch (e) {
-                logger.warn(`[control-aid] store.close() 失败（非致命）: ${e}`);
-            }
-            return { aid: created.aid, gateway: created.gateway };
+        }
+        if (lastRegistrationError !== undefined) {
+            const reason = lastRegistrationError instanceof Error
+                ? lastRegistrationError.message
+                : String(lastRegistrationError);
+            const error = new Error(`无法生成控制 AID：连续 ${MAX_ATTEMPTS} 次注册尝试失败；最后错误：${reason}`, {
+                cause: lastRegistrationError,
+            });
+            const code = lastRegistrationError?.code;
+            if (typeof code === 'string')
+                error.code = code;
+            throw error;
         }
         throw new Error(`无法生成控制 AID：连续 ${MAX_ATTEMPTS} 次候选均冲突`);
     }

package/dist/aun/aid/store.js

@@ -7,21 +7,27 @@ import { AUN_KEYSTORE_ENCRYPTION_SEED } from './encryption-seed-policy.js';
  * slotIsolationKey 取第一个分隔符（空格/'/'/':'）之前的部分作为隔离键，
  * 隔离键相同 = 共享消费通道（token / seq 游标 / 消息过滤）。
  *
- *   'evolcore daemon'   → 隔离键 'evolcore'   ┐
- *   'evolcore cli'      → 隔离键 'evolcore'   ├ 共享 evolcore 消费通道
- *   'evolcore netcheck' → 隔离键 'evolcore'   ┘
+ *   'evolcore daemon'   → 隔离键 'evolcore'
+ *   'evolcore-cli'      → 隔离键 'evolcore-cli'
+ *   'evolcore-netcheck' → 隔离键 'evolcore-netcheck'
+ *   'evolcore-group-rules' → 隔离键 'evolcore-group-rules'
  *   'evolcore-bench'    → 隔离键 'evolcore-bench'（连字符非分隔符）→ 独立通道
  *
  * 设计意图：
- *  - daemon 长连接 + cli 短连接共存于 evolcore 通道（1 长 + N 短，短连接不踢长连接）
- *  - netcheck 长连接抢 evolcore 长连接位 → 踢掉 daemon（用于踢人/extra_info 测试）
+ *  - daemon 保留历史 slot 值；slot_id 是网关上的消费游标身份，不可改名。
+ *  - CLI / ecweb 查询使用新的独立 slot，不能共享 daemon 的 token 或 seq 游标。
+ *  - netcheck 使用独立消费者，不得因诊断连接影响 daemon 的入站顺序。
+ *  - 群规则同步是短连接 RPC，也必须使用独立 slot，避免触碰 daemon 消费游标。
  *  - bench 各并发单元用 evolcore-bench-<N>，各自独立隔离键，互不干扰
  */
 export const SLOT = {
+    // Wire-compatibility contract: changing this creates a new gateway cursor
+    // and can replay retained history into the daemon.
     daemon: 'evolcore daemon',
-    cli: 'evolcore cli',
+    cli: 'evolcore-cli',
+    groupRules: 'evolcore-group-rules',
     bench: 'evolcore-bench',
-    netcheck: 'evolcore netcheck',
+    netcheck: 'evolcore-netcheck',
 };
 /** 加载身份失败时抛出，携带 SDK 的错误码与消息。 */
 export class AidLoadError extends Error {

package/dist/aun/group-fs-download.js

@@ -0,0 +1,56 @@
+import { createHash } from 'node:crypto';
+export class GroupFsDownloadError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'GroupFsDownloadError';
+    }
+}
+/** Download a group file into memory through the ticket/data plane. */
+export async function downloadGroupFsBytes(client, path) {
+    const ticketValue = await client.call('group.fs.create_download_ticket', { path });
+    if (!isRecord(ticketValue)) {
+        throw new GroupFsDownloadError('INVALID_TICKET', 'group.fs.create_download_ticket returned invalid response');
+    }
+    const downloadUrl = stringField(ticketValue, ['download_url', 'url']);
+    if (!downloadUrl) {
+        throw new GroupFsDownloadError('MISSING_DOWNLOAD_URL', 'group.fs.create_download_ticket did not return download_url');
+    }
+    const bytes = await client.group.fs.lowlevel.httpGet(downloadUrl, bearerHeaders(client));
+    const expectedSha = stringField(ticketValue, ['sha256']);
+    if (expectedSha && sha256Hex(bytes).toLowerCase() !== expectedSha.toLowerCase()) {
+        throw new GroupFsDownloadError('HASH_MISMATCH', 'download hash verification failed');
+    }
+    return { bytes, ticket: ticketValue };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function stringField(value, keys) {
+    for (const key of keys) {
+        const field = value[key];
+        if (typeof field === 'string' && field.trim())
+            return field;
+    }
+    return undefined;
+}
+function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+function bearerHeaders(client) {
+    const anyClient = client;
+    if (typeof anyClient.getAccessToken === 'function') {
+        const token = stringValue(anyClient.getAccessToken());
+        if (token)
+            return { Authorization: `Bearer ${token}` };
+    }
+    const token = stringValue(anyClient.accessToken)
+        || stringValue(anyClient.access_token)
+        || stringValue(anyClient._identity?.access_token)
+        || stringValue(anyClient._sessionParams?.access_token);
+    return token ? { Authorization: `Bearer ${token}` } : undefined;
+}
+function stringValue(value) {
+    return value === undefined || value === null ? '' : String(value).trim();
+}

package/dist/aun/group-identity.js

@@ -5,6 +5,5 @@ export function isExplicitGroupId(value) {
     return (id.startsWith('group.') && id.includes('/'))
         || /^\d+\.[a-z0-9.-]+$/i.test(id)
         || /^grp_[a-z0-9_-]+$/i.test(id)
-        || /^g-[a-z0-9_-]+(?:[.@][a-z0-9.-]+)?$/i.test(id)
-        || /(?:^|\.)groupid\.pub$/i.test(id);
+        || /^g-[a-z0-9_-]+(?:[.@][a-z0-9.-]+)?$/i.test(id);
 }

package/dist/aun/msg/group.js

@@ -14,6 +14,7 @@ import { ipcQuery } from '../../ipc.js';
 import { resolvePaths } from '../../paths.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../../core/auth/agent-delegation.js';
 import { normalizeAunMentionEntries } from './mention-schema.js';
+import { downloadGroupFsBytes } from '../group-fs-download.js';
 function buildGroupPayload(body) {
     return body.mode === 'text' ? { type: 'text', text: body.text } : { ...body.payload };
 }
@@ -130,17 +131,18 @@ async function daemonGroupSendResult(args, payload, runtimeContext, result) {
             status: result.status,
         };
     }
-    if (!result.group_id || !result.message) {
+    const messageId = result.message_id
+        ?? (typeof result.message?.message_id === 'string' ? result.message.message_id : undefined);
+    if (!result.group_id || !messageId) {
         return { ok: false, error: 'daemon AUN group send returned no group message' };
     }
-    const messageId = result.message_id
-        ?? (typeof result.message.message_id === 'string' ? result.message.message_id : undefined);
     if (messageId && !result.log_written) {
         appendGroupSendOutboundLog(args, messageId, payload, runtimeContext, result.encrypt ?? resolveAunMessageEncrypt(args.encrypt));
     }
     return {
         ok: true,
         group_id: result.group_id || args.groupId,
+        message_id: messageId,
         message: result.message,
         event: result.event,
     };
@@ -1055,20 +1057,7 @@ async function uploadGroupRulesBytes(client, groupId, bytes) {
 }
 async function readGroupRulesBytes(client, groupId) {
     const remoteRef = `${groupId}:${GROUP_RULES_FILE_PATH}`;
-    const ticket = await client.call('group.fs.create_download_ticket', { path: remoteRef });
-    if (!isRecord(ticket)) {
-        throw new Error('group.fs.create_download_ticket returned invalid response');
-    }
-    const downloadUrl = stringField(ticket, ['download_url', 'url']);
-    if (!downloadUrl) {
-        throw new Error('group.fs.create_download_ticket did not return download_url');
-    }
-    const bytes = await client.group.fs.lowlevel.httpGet(downloadUrl, bearerHeaders(client));
-    const expectedSha = stringField(ticket, ['sha256']);
-    if (expectedSha && sha256Hex(bytes).toLowerCase() !== expectedSha.toLowerCase()) {
-        throw new Error('download hash verification failed');
-    }
-    return bytes;
+    return (await downloadGroupFsBytes(client, remoteRef)).bytes;
 }
 function decodeRulesText(bytes) {
     return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
@@ -1126,22 +1115,6 @@ function groupIndexEtagFromUpdate(result, groupId) {
 function sha256Hex(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
-function bearerHeaders(client) {
-    const token = accessTokenFromClient(client);
-    return token ? { Authorization: `Bearer ${token}` } : undefined;
-}
-function accessTokenFromClient(client) {
-    const anyClient = client;
-    if (typeof anyClient.getAccessToken === 'function') {
-        const token = stringValue(anyClient.getAccessToken());
-        if (token)
-            return token;
-    }
-    return stringValue(anyClient.accessToken)
-        || stringValue(anyClient.access_token)
-        || stringValue(anyClient._identity?.access_token)
-        || stringValue(anyClient._sessionParams?.access_token);
-}
 function stringField(obj, keys) {
     for (const key of keys) {
         const value = obj[key];
@@ -1189,6 +1162,11 @@ function rulesFileStatusFromError(error) {
     if (tagged)
         return tagged;
     const haystack = errorHaystack(error);
+    // A peer cache miss means signer discovery failed; it does not establish
+    // that the group's rules file is absent.
+    if (/peer\s+not\s+found\s+in\s+cache/i.test(haystack)) {
+        return 'unreadable';
+    }
     if (/(forbidden|unauthorized|permission|denied|no_permission|permission_denied|无权限|权限|拒绝|\b401\b|\b403\b)/i.test(haystack)) {
         return 'forbidden';
     }

package/dist/aun/msg/index.js

@@ -1,5 +1,4 @@
 export { msgSend, msgPull, msgAck, msgRecall, msgOnline, } from './p2p.js';
 export { msgHistory, MAX_MSG_HISTORY_LIMIT } from './history.js';
 export { groupSend, groupPull, groupAck, groupCreate, groupInfo, groupList, groupUpdate, groupDissolve, groupSuspend, groupResume, groupJoin, groupLeave, groupInvite, groupKick, groupMembers, groupOnline, groupSetRole, groupTransferOwner, groupBan, groupUnban, groupBanlist, groupRules, groupUpdateRules, groupRulesFileGet, groupRulesFileSet, groupRulesFilePublish, } from './group.js';
-export { uploadFileAndBuildPayload } from './upload.js';
-export { inferPayloadType, isValidPayloadType } from './payload-type.js';
+export { uploadFileAndBuildPayload, inferPayloadType, isValidPayloadType } from './upload.js';

package/dist/aun/msg/managed-operation.js

@@ -5,6 +5,7 @@ import { msgOnline } from './p2p.js';
 import { resolveRoot } from '../../paths.js';
 import { isExplicitGroupId } from '../group-identity.js';
 import { isValidAid } from '../aid/validation.js';
+import { downloadGroupFsBytes } from '../group-fs-download.js';
 import { groupBan, groupBanlist, groupCreate, groupDissolve, groupInfo, groupInvite, groupJoin, groupKick, groupLeave, groupList, groupMembers, groupOnline, groupPull, groupAck, groupResume, groupRules, groupRulesFileGet, groupRulesFilePublish, groupRulesFileSet, groupSetRole, groupSuspend, groupTransferOwner, groupUnban, groupUpdate, groupUpdateRules, } from './group.js';
 /** Rules uploaded by a managed task are carried as bounded UTF-8 content. */
 export const MAX_MANAGED_GROUP_RULES_BYTES = 4 * 1024;
@@ -562,6 +563,7 @@ const FS_VALUE_FLAGS = new Set([
     '--as', '--format', '--max-bytes', '--head-bytes', '--name', '--pattern', '--type', '--node-type',
     '--size', '--mtime', '--page', '--page-size',
 ]);
+const FS_BOOLEAN_FLAGS = new Set(['-p', '--parents', '-r', '--recursive', '-f', '--force', '--overwrite']);
 function failFs(code, reason) {
     return { ok: false, code, reason };
 }
@@ -587,29 +589,37 @@ function parseRemote(value, allowEmpty) {
     }
     if (remotePath === '' && allowEmpty)
         return { groupId, remotePath: '' };
-    if (!remotePath.startsWith('/') || remotePath.length > MAX_REMOTE_PATH_LENGTH || /[\u0000-\u001f\u007f]/.test(remotePath)) {
+    if (!remotePath.startsWith('/') || remotePath.length > MAX_REMOTE_PATH_LENGTH || /[\u0000-\u001f\u007f]/.test(remotePath)
+        || remotePath.split('/').includes('..')) {
         return failFs('INVALID_PATH', 'remote group path must be a bounded absolute path');
     }
     return { groupId, remotePath };
 }
-/** Parse the daemon-owned, current-group read-only filesystem grammar. */
+/** Parse the daemon-owned, current-group filesystem grammar. */
 export function resolveManagedFsOperation(argv) {
     const raw = argv[0] === 'fs' ? argv.slice(1) : argv;
-    const kind = raw[0];
-    if (!kind || !['ls', 'stat', 'lstat', 'cat', 'find', 'df'].includes(kind)) {
-        return failFs('NOT_ALLOWED', `unsupported managed fs command: ${kind || '<missing>'}`);
+    const rawKind = raw[0];
+    if (!rawKind || !['ls', 'stat', 'lstat', 'cat', 'find', 'df', 'mkdir', 'cp', 'mv', 'rm'].includes(rawKind)) {
+        return failFs('NOT_ALLOWED', `unsupported managed fs command: ${rawKind || '<missing>'}`);
     }
     const values = new Map();
+    const booleanFlags = new Set();
     const positionals = [];
     let follow = false;
     for (let index = 1; index < raw.length; index++) {
         const token = raw[index];
         if (token === '-L' || token === '--follow') {
-            if (kind !== 'stat')
+            if (rawKind !== 'stat')
                 return failFs('NOT_ALLOWED', `${token} is only allowed for stat`);
             follow = true;
             continue;
         }
+        if (FS_BOOLEAN_FLAGS.has(token)) {
+            if (booleanFlags.has(token))
+                return failFs('INVALID_ARGUMENT', `${token} may only be specified once`);
+            booleanFlags.add(token);
+            continue;
+        }
         if (!token.startsWith('-')) {
             positionals.push(token);
             continue;
@@ -622,12 +632,10 @@ export function resolveManagedFsOperation(argv) {
         if (values.has(token))
             return failFs('INVALID_ARGUMENT', `${token} may only be specified once`);
         const value = raw[++index];
-        if (!value || value.startsWith('--'))
+        if (!value || value.startsWith('-'))
             return failFs('INVALID_ARGUMENT', `${token} requires a value`);
         values.set(token, value);
     }
-    if (positionals.length !== 1)
-        return failFs('INVALID_ARGUMENT', `${kind} accepts exactly one remote group path`);
     const actorAidValue = values.get('--as');
     const actorAid = actorAidValue === undefined ? undefined : actorAidValue.replace(/^@/, '');
     if (actorAid !== undefined && !isValidAid(actorAid))
@@ -635,22 +643,77 @@ export function resolveManagedFsOperation(argv) {
     const format = values.get('--format');
     if (format !== undefined && format !== 'json')
         return failFs('INVALID_ARGUMENT', '--format only supports json');
-    const allowedByKind = {
-        ls: new Set(['--as', '--format']),
-        stat: new Set(['--as', '--format']),
-        lstat: new Set(['--as', '--format']),
+    const expected = rawKind === 'cp' || rawKind === 'mv' ? 2 : 1;
+    if (positionals.length !== expected)
+        return failFs('INVALID_ARGUMENT', `${rawKind} accepts ${expected} positional argument${expected === 1 ? '' : 's'}`);
+    const allowedValues = {
+        ls: new Set(['--as', '--format']), stat: new Set(['--as', '--format']), lstat: new Set(['--as', '--format']),
         cat: new Set(['--as', '--format', '--max-bytes', '--head-bytes']),
         find: new Set(['--as', '--format', '--name', '--pattern', '--type', '--node-type', '--size', '--mtime', '--page', '--page-size']),
-        df: new Set(['--as', '--format']),
+        df: new Set(['--as', '--format']), mkdir: new Set(['--as', '--format']), cp: new Set(['--as', '--format']),
+        mv: new Set(['--as', '--format']), rm: new Set(['--as', '--format']),
     };
-    for (const flag of values.keys()) {
-        if (!allowedByKind[kind].has(flag))
-            return failFs('NOT_ALLOWED', `${flag} is not allowed for managed fs ${kind}`);
-    }
-    const remote = parseRemote(positionals[0], kind === 'df');
+    const allowedBoolean = {
+        ls: new Set(), stat: new Set(), lstat: new Set(), cat: new Set(), find: new Set(), df: new Set(),
+        mkdir: new Set(['-p', '--parents']), cp: new Set(['-r', '--recursive', '-f', '--force', '--overwrite']),
+        mv: new Set(['-f', '--force', '--overwrite']), rm: new Set(['-r', '--recursive', '-f', '--force', '--overwrite']),
+    };
+    for (const flag of values.keys())
+        if (!allowedValues[rawKind].has(flag))
+            return failFs('NOT_ALLOWED', `${flag} is not allowed for managed fs ${rawKind}`);
+    for (const flag of booleanFlags)
+        if (!allowedBoolean[rawKind].has(flag))
+            return failFs('NOT_ALLOWED', `${flag} is not allowed for managed fs ${rawKind}`);
+    const overwrite = booleanFlags.has('-f') || booleanFlags.has('--force') || booleanFlags.has('--overwrite');
+    const recursive = booleanFlags.has('-r') || booleanFlags.has('--recursive');
+    const remoteOrError = (value, allowEmpty = false) => parseRemote(value, allowEmpty);
+    if (rawKind === 'cp') {
+        const destination = remoteOrError(positionals[1]);
+        if (!('groupId' in destination))
+            return destination;
+        const source = positionals[0].includes(':') ? remoteOrError(positionals[0]) : undefined;
+        if (source && !('groupId' in source))
+            return source;
+        if (source && source.groupId !== destination.groupId)
+            return failFs('INVALID_GROUP', 'managed cp cannot cross groups');
+        const kind = source ? 'copy' : 'upload';
+        return { ok: true, command: {
+                kind, operationId: `ec.fs.${kind}`, canonicalArgv: ['fs', 'cp', positionals[0], positionals[1], ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: destination.groupId, remotePath: destination.remotePath, destinationPath: destination.remotePath,
+                ...(source ? { remoteSourcePath: source.remotePath } : { localPath: positionals[0] }), overwrite, recursive,
+            } };
+    }
+    if (rawKind === 'mv') {
+        const source = remoteOrError(positionals[0]);
+        const destination = remoteOrError(positionals[1]);
+        if (!('groupId' in source))
+            return source;
+        if (!('groupId' in destination))
+            return destination;
+        if (source.groupId !== destination.groupId)
+            return failFs('INVALID_GROUP', 'managed mv cannot cross groups');
+        return { ok: true, command: {
+                kind: 'move', operationId: 'ec.fs.move', canonicalArgv: ['fs', 'mv', positionals[0], positionals[1], ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: destination.groupId, remotePath: destination.remotePath, destinationPath: destination.remotePath,
+                remoteSourcePath: source.remotePath, overwrite,
+            } };
+    }
+    const remote = remoteOrError(positionals[0], rawKind === 'df');
     if (!('groupId' in remote))
         return remote;
-    const effectiveKind = kind === 'stat' && !follow ? 'lstat' : kind;
+    if (rawKind === 'mkdir')
+        return { ok: true, command: {
+                kind: 'mkdir', operationId: 'ec.fs.mkdir', canonicalArgv: ['fs', 'mkdir', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: remote.groupId, remotePath: remote.remotePath, parents: booleanFlags.has('-p') || booleanFlags.has('--parents'),
+            } };
+    if (rawKind === 'rm' && remote.remotePath === '/')
+        return failFs('INVALID_PATH', 'managed rm cannot target the group root');
+    if (rawKind === 'rm')
+        return { ok: true, command: {
+                kind: 'remove', operationId: 'ec.fs.remove', canonicalArgv: ['fs', 'rm', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: remote.groupId, remotePath: remote.remotePath, recursive, overwrite,
+            } };
+    const effectiveKind = rawKind === 'stat' && !follow ? 'lstat' : rawKind;
     const maxBytes = positiveInteger(values.get('--max-bytes'), '--max-bytes', MAX_MANAGED_FS_CAT_BYTES);
     if (typeof maxBytes !== 'number' && maxBytes !== undefined)
         return maxBytes;
@@ -664,28 +727,13 @@ export function resolveManagedFsOperation(argv) {
     if (typeof pageSize !== 'number' && pageSize !== undefined)
         return pageSize;
     const nodeType = values.get('--type') ?? values.get('--node-type');
-    if (nodeType !== undefined && !['f', 'd', 'l'].includes(nodeType)) {
+    if (nodeType !== undefined && !['f', 'd', 'l'].includes(nodeType))
         return failFs('INVALID_ARGUMENT', '--type only supports f|d|l');
-    }
-    return {
-        ok: true,
-        command: {
-            kind: effectiveKind,
-            operationId: `ec.fs.${effectiveKind}`,
-            canonicalArgv: ['fs', effectiveKind, `${remote.groupId}:${remote.remotePath}`, ...(actorAid ? ['--as', actorAid] : [])],
-            actorAid,
-            groupId: remote.groupId,
-            remotePath: remote.remotePath,
-            maxBytes,
-            headBytes,
-            name: values.get('--name') ?? values.get('--pattern'),
-            nodeType,
-            size: values.get('--size'),
-            mtime: values.get('--mtime'),
-            page,
-            pageSize,
-        },
-    };
+    return { ok: true, command: {
+            kind: effectiveKind, operationId: `ec.fs.${effectiveKind}`, canonicalArgv: ['fs', effectiveKind, positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
+            actorAid, groupId: remote.groupId, remotePath: remote.remotePath, maxBytes, headBytes,
+            name: values.get('--name') ?? values.get('--pattern'), nodeType, size: values.get('--size'), mtime: values.get('--mtime'), page, pageSize,
+        } };
 }
 function numberFrom(value, keys) {
     for (const key of keys) {
@@ -695,18 +743,6 @@ function numberFrom(value, keys) {
     }
     return undefined;
 }
-function bytesFromDownload(value) {
-    const candidate = value?.bytes ?? value?.data ?? value?.content ?? value?.blob ?? value;
-    if (candidate instanceof Uint8Array)
-        return candidate;
-    if (Buffer.isBuffer(candidate))
-        return new Uint8Array(candidate);
-    if (typeof candidate === 'string')
-        return new Uint8Array(Buffer.from(candidate, 'base64'));
-    if (Array.isArray(candidate))
-        return new Uint8Array(candidate);
-    throw new ManagedFsOperationError('FS_DOWNLOAD_INVALID', 'group filesystem returned an unsupported blob');
-}
 async function withClient(actorAid, fn) {
     const store = await getAidStore({ slotId: SLOT.cli, aunPath: resolveRoot() });
     let client;
@@ -728,7 +764,7 @@ async function withClient(actorAid, fn) {
         catch { /* best effort */ }
     }
 }
-/** Execute a parsed read against the current group using daemon-owned credentials. */
+/** Execute a parsed operation against the current group using daemon-owned credentials. */
 export async function executeManagedFsOperation(command) {
     if (!command.actorAid)
         throw new ManagedFsOperationError('INVALID_ACTOR', 'managed fs actor is required');
@@ -736,6 +772,31 @@ export async function executeManagedFsOperation(command) {
     try {
         return await withClient(command.actorAid, async (client) => {
             switch (command.kind) {
+                case 'mkdir':
+                    return { ok: true, command: 'mkdir', path: ref, result: await client.group.fs.mkdir(ref, { parents: command.parents }) };
+                case 'upload': {
+                    if (!command.localPath)
+                        throw new ManagedFsOperationError('INVALID_SOURCE', 'managed upload source is required');
+                    return { ok: true, command: 'upload', path: ref, localPath: command.localPath,
+                        result: await client.group.fs.cp(command.localPath, ref, { parents: true, overwrite: command.overwrite, force: command.overwrite }) };
+                }
+                case 'copy': {
+                    if (!command.remoteSourcePath)
+                        throw new ManagedFsOperationError('INVALID_SOURCE', 'managed copy source is required');
+                    const source = `${command.groupId}:${command.remoteSourcePath}`;
+                    return { ok: true, command: 'copy', src: source, path: ref,
+                        result: await client.group.fs.cp(source, ref, { recursive: command.recursive, overwrite: command.overwrite, force: command.overwrite }) };
+                }
+                case 'move': {
+                    if (!command.remoteSourcePath)
+                        throw new ManagedFsOperationError('INVALID_SOURCE', 'managed move source is required');
+                    const source = `${command.groupId}:${command.remoteSourcePath}`;
+                    return { ok: true, command: 'move', src: source, path: ref,
+                        result: await client.group.fs.mv(source, ref, { overwrite: command.overwrite, force: command.overwrite }) };
+                }
+                case 'remove':
+                    return { ok: true, command: 'remove', path: ref,
+                        result: await client.group.fs.rm(ref, { recursive: command.recursive, force: command.overwrite }) };
                 case 'ls': {
                     const raw = await client.group.fs.ls(ref);
                     const value = raw;
@@ -770,7 +831,7 @@ export async function executeManagedFsOperation(command) {
                         throw new ManagedFsOperationError('FS_SIZE_REQUIRED', 'group file size is required before managed cat');
                     if (size > maxBytes)
                         throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
-                    const bytes = bytesFromDownload(await client.group.fs.cp(ref, { kind: 'blob' }, { verifyHash: true }));
+                    const { bytes } = await downloadGroupFsBytes(client, ref);
                     if (bytes.byteLength > maxBytes)
                         throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
                     const headBytes = Math.min(command.headBytes ?? 256, MAX_MANAGED_FS_HEAD_BYTES, bytes.byteLength);

package/dist/aun/msg/upload.js

@@ -2,7 +2,22 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { guessMime, formatSize } from '../../utils/media-cache.js';
-import { inferPayloadType, isValidPayloadType } from './payload-type.js';
+const EXT_TYPE_MAP = {
+    '.png': 'image', '.jpg': 'image', '.jpeg': 'image',
+    '.gif': 'image', '.webp': 'image', '.svg': 'image',
+    '.bmp': 'image', '.heic': 'image', '.heif': 'image',
+    '.mp4': 'video', '.mov': 'video', '.webm': 'video',
+    '.avi': 'video', '.mkv': 'video', '.m4v': 'video',
+    '.opus': 'voice', '.mp3': 'voice', '.aac': 'voice',
+    '.m4a': 'voice', '.wav': 'voice', '.flac': 'voice', '.ogg': 'voice',
+};
+export function inferPayloadType(filename) {
+    const ext = path.extname(filename).toLowerCase();
+    return EXT_TYPE_MAP[ext] ?? 'file';
+}
+export function isValidPayloadType(value) {
+    return value === 'image' || value === 'video' || value === 'voice' || value === 'file';
+}
 /** 单次上传最大大小（与 daemon sendFile 一致）。 */
 export const MAX_AUN_ATTACHMENT_SIZE = 10 * 1024 * 1024;
 /** server 端 inline 上限错误的识别特征。优先匹配错误消息里的“inline 上限”字样。 */

package/dist/aun/outbox.js

@@ -1,6 +1,7 @@
 import crypto from 'crypto';
 import { agentOutboxPath } from '../paths.js';
 import { atomicRead, atomicWrite } from '../utils/atomic-write.js';
+import { isDeliveryTarget, isDeliveryTargetForChannel, sameDeliveryTarget } from '../core/message/message-utils.js';
 const MAX_ENTRIES_PER_AID = 20;
 const DEFAULT_TTL = 300_000; // 5 minutes
 function outboxFile(aid) {
@@ -16,6 +17,9 @@ function isExpired(entry) {
         return false;
     return Date.now() - entry.ts > entry.ttl;
 }
+export function isDeliveryForChannel(value, channelId) {
+    return isDeliveryTargetForChannel(value, channelId);
+}
 function readEntries(aid) {
     const file = outboxFile(aid);
     try {
@@ -43,17 +47,32 @@ function writeEntries(aid, entries) {
     atomicWrite(file, content);
 }
 export function enqueue(aid, opts) {
-    const existingEntries = readEntries(aid);
+    const delivery = opts.delivery;
+    if (!isDeliveryForChannel(delivery, opts.channelId)) {
+        const code = isDeliveryTarget(delivery) ? 'AUN_OUTBOUND_ROUTE_MISMATCH' : 'AUN_OUTBOUND_ROUTE_REQUIRED';
+        throw Object.assign(new Error(`invalid AUN outbox delivery route for channelId=${opts.channelId}`), { code });
+    }
+    let existingEntries = readEntries(aid);
     if (opts.dedupeKey) {
         const existing = existingEntries.find(entry => entry.dedupeKey === opts.dedupeKey && !isExpired(entry));
-        if (existing)
+        if (existing
+            && existing.channelId === opts.channelId
+            && isDeliveryForChannel(existing.delivery, existing.channelId)
+            && sameDeliveryTarget(existing.delivery, delivery)) {
             return existing;
+        }
+        if (existing) {
+            // A pre-route entry must not block corrected code from persisting the
+            // same logical operation with an explicit delivery target.
+            existingEntries = existingEntries.filter(entry => entry.id !== existing.id);
+        }
     }
     const entry = {
         id: generateId(),
         ts: Date.now(),
         aid,
         channelId: opts.channelId,
+        delivery,
         dedupeKey: opts.dedupeKey,
         critical: opts.critical,
         type: opts.type,
@@ -123,6 +142,9 @@ export function cleanup(aid) {
 // duplicate sends while allowing a later drain trigger to pick up entries
 // enqueued during an active pass.
 const activeDrainTails = new Map();
+function hasRouteForChannel(entry) {
+    return isDeliveryForChannel(entry.delivery, entry.channelId);
+}
 async function drainOnce(aid, sender) {
     const entries = readEntries(aid);
     if (entries.length === 0)
@@ -137,6 +159,13 @@ async function drainOnce(aid, sender) {
             expired++;
             continue;
         }
+        if (!hasRouteForChannel(entry)) {
+            // A route is security-sensitive metadata. An entry whose groupId does
+            // not match its address cannot be repaired from channelId, so remove it
+            // instead of retrying the same malformed send forever.
+            expired++;
+            continue;
+        }
         try {
             entry.attempts = (entry.attempts ?? 0) + 1;
             const ok = await sender(entry);