evolcore 0.0.12 → 0.0.13

package/dist/core/command/command-handler.js

@@ -1,6 +1,6 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../message/message-utils.js';
+import { buildEnvelope, deliveryTargetFromSession, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
 import { loadDaemonConfig } from '../../config-store.js';
 import { logger } from '../../utils/logger.js';
@@ -18,6 +18,7 @@ import { displaySessionTitle } from '../session/session-title.js';
 import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
+import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
 import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
@@ -132,6 +133,15 @@ export class CommandHandler {
             .filter(key => key.startsWith(prefix))
             .map(key => key.slice(prefix.length));
     }
+    /** Return the runner-owned temporary root for a managed session, if any. */
+    getManagedSessionTempDir(session) {
+        try {
+            return this.getAgent(session.channel, session.baseagent).getManagedTempDir?.(session.id);
+        }
+        catch {
+            return undefined;
+        }
+    }
     formatBaseagentUnavailable(error) {
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         return `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
@@ -321,6 +331,7 @@ export class CommandHandler {
             channelId: definition.origin.channelId,
             session: definition.origin.session,
             threadId: definition.origin.threadId,
+            chatType: definition.origin.delivery?.chatType,
         };
     }
     canAccessTriggerDefinition(definition, peerId, channel, isAdmin) {
@@ -403,9 +414,6 @@ export class CommandHandler {
         }
         const targetChannelType = this.resolveChannelType(feedbackChannel);
         const feedbackChannelId = parsed.targetChannelId ?? peerId;
-        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChannelId.includes('.')) {
-            return { error: `AUN 渠道的 --target-channel-id 必须是 AID 格式（如 user.agentid.pub），收到："${parsed.targetChannelId}"` };
-        }
         const schedulerAid = parsed.agentId
             ?? this.getOwningAgent(feedbackChannel)?.aid
             ?? tryParseChannelKey(feedbackChannel)?.selfAID
@@ -414,11 +422,22 @@ export class CommandHandler {
         if (!schedulerAid || !scheduler) {
             return { error: `目标 agent 不存在或未就绪：${schedulerAid ?? feedbackChannel}` };
         }
+        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChatType) {
+            return { error: 'AUN 目标必须显式指定 --target-chat-type private 或 group' };
+        }
+        const targetDelivery = targetChannelType === 'aun'
+            ? parsed.targetChatType === 'group'
+                ? { chatType: 'group', groupId: feedbackChannelId }
+                : parsed.targetChatType === 'private'
+                    ? { chatType: 'private' }
+                    : { chatType: 'private' }
+            : undefined;
         const target = {
             channelKey: feedbackChannel,
             channelId: feedbackChannelId,
             session: parsed.targetSession,
             threadId: parsed.targetSession === 'thread' ? parsed.targetThreadId : undefined,
+            chatType: targetDelivery?.chatType,
         };
         if (target.session === 'thread') {
             const adapter = this.adapters.get(feedbackChannel);
@@ -439,6 +458,7 @@ export class CommandHandler {
             threadId: !originIsGroup ? threadId : undefined,
             peerId,
             sessionKey: activeSession?.sessionKey,
+            delivery: { chatType: 'private' },
         };
         if (!isAdmin && parsed.feedbackStrategy === 'target' && !sameFeedbackTarget(target, origin)) {
             return { error: '无权限：非 admin 只能把 trigger 投递到来源会话' };
@@ -618,7 +638,7 @@ export class CommandHandler {
     }
     /** 从 session 提取渠道预构建的回复上下文 */
     getReplyContext(session) {
-        return session.metadata?.replyContext;
+        return replyContextFromSession(session);
     }
     /**
      * 发送 CommandCard 卡片。卡片成功返回 null（调用方直接 return），失败返回降级文本。
@@ -1426,7 +1446,7 @@ export class CommandHandler {
      * - taskId/chatmode：从 processing_state 和 effective chatmode 注入
      */
     buildCtlReplyContext(session) {
-        const ctx = {};
+        const ctx = { delivery: deliveryTargetFromSession(session) };
         const meta = session.metadata;
         if (meta?.replyContext?.threadId)
             ctx.threadId = meta.replyContext.threadId;
@@ -1454,7 +1474,7 @@ export class CommandHandler {
             if (encrypted != null)
                 ctx.metadata.encrypted = encrypted;
         }
-        return Object.keys(ctx).length > 0 ? ctx : undefined;
+        return ctx;
     }
     resolveEffectiveChatmodeForSession(session) {
         const peerType = session.metadata?.peerType;
@@ -1509,35 +1529,51 @@ export class CommandHandler {
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
         });
-        const resolved = resolveConfigCommand(argv, {
-            defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
-        });
-        if (!resolved.ok)
-            return { ok: false, code: resolved.code, error: resolved.reason };
-        const decision = authorizeOperation({
-            source: 'agent-tool',
-            subject,
-            intent: {
-                operation: resolved.command.operationId,
-                scope: resolved.command.commandScope,
+        const executeOne = (fieldArgv) => {
+            const resolved = resolveConfigCommand(fieldArgv, {
+                defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
+            });
+            if (!resolved.ok)
+                return { ok: false, code: resolved.code, error: resolved.reason };
+            const decision = authorizeOperation({
                 source: 'agent-tool',
-                args: {
-                    ...(resolved.command.self ? { self: resolved.command.self } : {}),
-                    ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
-                    ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                subject,
+                intent: {
+                    operation: resolved.command.operationId,
+                    scope: resolved.command.commandScope,
+                    source: 'agent-tool',
+                    args: {
+                        ...(resolved.command.self ? { self: resolved.command.self } : {}),
+                        ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
+                        ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                    },
+                    dangerous: resolved.command.dangerous,
                 },
-                dangerous: resolved.command.dangerous,
-            },
-            resolvedConfigCommand: resolved.command,
-            auditMetadata: {
-                argvHash: hashArgv(resolved.command.canonicalArgv),
-                taskId: grant.taskId,
-                messageId: grant.messageId,
-            },
-        });
-        if (!decision.allow)
-            return { ok: false, code: decision.code, error: decision.reason };
-        const result = executeResolvedConfigCommand(resolved.command, { role: subject.role });
+                resolvedConfigCommand: resolved.command,
+                auditMetadata: {
+                    argvHash: hashArgv(resolved.command.canonicalArgv),
+                    taskId: grant.taskId,
+                    messageId: grant.messageId,
+                },
+            });
+            if (!decision.allow)
+                return { ok: false, code: decision.code, error: decision.reason };
+            return executeResolvedConfigCommand(resolved.command, { role: subject.role });
+        };
+        const batch = splitConfigBatchGetArgv(argv);
+        if (batch && batch.fields.length > 1) {
+            const results = batch.fields.map(field => {
+                const result = executeOne(['config', 'get', field, ...batch.rest]);
+                if (!result.ok)
+                    return { ok: false, field, code: result.code, error: result.error };
+                if (result.subcommand !== 'get') {
+                    return { ok: false, field, code: 'UNEXPECTED_RESULT', error: `config get ${field} produced a non-get result` };
+                }
+                return result;
+            });
+            return { ok: true, result: { ok: true, subcommand: 'batch-get', results } };
+        }
+        const result = executeOne(argv);
         return result.ok
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
@@ -1747,23 +1783,41 @@ export class CommandHandler {
             const filePath = String(parsed.command.filePath || '');
             const projectPath = path.resolve(session.projectPath);
             const resolvedPath = path.resolve(projectPath, filePath);
-            if (!filePath || !isSameOrDescendant(resolvedPath, projectPath)) {
-                return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file must be inside the current session project' };
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedPaths = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!filePath || !allowedPaths.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file must be inside the current session project or managed TMPDIR' };
             }
             if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
                 return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
             }
+            let rulesFd;
             try {
                 const realProjectPath = fs.realpathSync(projectPath);
                 const realPath = fs.realpathSync(resolvedPath);
-                if (!isSameOrDescendant(realPath, realProjectPath)) {
-                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file resolves outside the current session project' };
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // The session may have closed and removed its temporary directory.
+                }
+                const realAllowedPaths = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedPaths.some(root => isSameOrDescendant(realPath, root))) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file resolves outside the current session project or managed TMPDIR' };
                 }
-                const stat = fs.statSync(realPath);
+                if (isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
+                }
+                rulesFd = fs.openSync(realPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+                const stat = fs.fstatSync(rulesFd);
                 if (!stat.isFile() || stat.size < 1 || stat.size > 4 * 1024) {
                     return { ok: false, code: 'INVALID_RULES_CONTENT', error: 'Rules file must be a regular file from 1 to 4096 bytes' };
                 }
-                rulesContent = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(realPath));
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file cannot be a hard link' };
+                }
+                rulesContent = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(rulesFd));
             }
             catch (error) {
                 return {
@@ -1772,6 +1826,10 @@ export class CommandHandler {
                     error: error instanceof Error ? error.message : String(error),
                 };
             }
+            finally {
+                if (rulesFd !== undefined)
+                    fs.closeSync(rulesFd);
+            }
         }
         try {
             return { ok: true, result: await executeManagedGroupOperation(parsed.command, rulesContent) };
@@ -1860,7 +1918,7 @@ export class CommandHandler {
             };
         }
     }
-    /** Agent-managed current-group filesystem read entrypoint. */
+    /** Agent-managed current-group filesystem entrypoint. */
     async handleFsOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
@@ -1881,7 +1939,7 @@ export class CommandHandler {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
         if (grant.channelType !== 'aun' || grant.chatType !== 'group') {
-            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs reads require the current AUN group relation' };
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs operations require the current AUN group relation' };
         }
         let currentGroup;
         try {
@@ -1904,6 +1962,19 @@ export class CommandHandler {
             conversationId: currentGroup,
             processOwners: loadDaemonConfig().owners ?? [],
         });
+        const intentArgs = {
+            self: actorAid,
+            targetId: currentGroup,
+            peer: currentGroup,
+            peerKey: formatPeerKey('aun', currentGroup),
+            path: parsed.command.remotePath,
+            targetPath: parsed.command.remotePath,
+            ...(parsed.command.remoteSourcePath ? { sourcePath: parsed.command.remoteSourcePath } : {}),
+            ...(parsed.command.localPath ? { localPath: parsed.command.localPath } : {}),
+            ...(parsed.command.recursive !== undefined ? { recursive: parsed.command.recursive } : {}),
+            ...(parsed.command.parents !== undefined ? { parents: parsed.command.parents } : {}),
+            ...(parsed.command.overwrite !== undefined ? { overwrite: parsed.command.overwrite } : {}),
+        };
         const decision = authorizeOperation({
             source: 'agent-tool',
             subject,
@@ -1911,17 +1982,60 @@ export class CommandHandler {
                 operation: parsed.command.operationId,
                 scope: 'relation',
                 source: 'agent-tool',
-                args: {
-                    self: actorAid,
-                    targetId: currentGroup,
-                    peer: currentGroup,
-                    peerKey: formatPeerKey('aun', currentGroup),
-                },
+                args: intentArgs,
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv), taskId: grant.taskId, messageId: grant.messageId,
+                sessionId, agentAid: actorAid, toolName: 'ec.fs',
             },
-            auditMetadata: { argvHash: hashArgv(parsed.command.canonicalArgv), taskId: grant.taskId, messageId: grant.messageId },
         });
         if (!decision.allow)
             return { ok: false, code: decision.code, error: decision.reason };
+        if (parsed.command.kind === 'upload') {
+            const localPath = String(parsed.command.localPath || '').trim();
+            const projectPath = path.resolve(session.projectPath);
+            if (!localPath)
+                return { ok: false, code: 'INVALID_ARGUMENT', error: 'Managed upload source is required' };
+            const resolvedPath = path.resolve(projectPath, localPath);
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedRoots = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!allowedRoots.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source must be inside the current session project or managed TMPDIR' };
+            }
+            if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
+                return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source cannot be a protected EvolCore path' };
+            }
+            try {
+                const realProjectPath = fs.realpathSync(projectPath);
+                const stat = fs.lstatSync(resolvedPath);
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    return { ok: false, code: 'INVALID_LOCAL_FILE', error: 'Upload source must be a regular non-symlink file' };
+                }
+                const realPath = fs.realpathSync(resolvedPath);
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // A removed or invalid session temp root is not an upload root.
+                }
+                const realAllowedRoots = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedRoots.some(root => isSameOrDescendant(realPath, root))
+                    || isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source resolves outside the allowed project or managed TMPDIR path' };
+                }
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source cannot be a hard link inside managed TMPDIR' };
+                }
+                if (stat.size > 16 * 1024 * 1024) {
+                    return { ok: false, code: 'LOCAL_FILE_TOO_LARGE', error: 'Managed upload is limited to 16 MiB' };
+                }
+                parsed.command.localPath = realPath;
+            }
+            catch (error) {
+                return { ok: false, code: 'INVALID_LOCAL_FILE', error: error instanceof Error ? error.message : String(error) };
+            }
+        }
         try {
             return { ok: true, result: await executeManagedFsOperation(parsed.command) };
         }
@@ -2126,6 +2240,14 @@ export class CommandHandler {
         const showId = args.includes('--showid');
         const formatJson = args.includes('--format json');
         const full = args.includes('--full');
+        const after = parseQueueTimeArg(this.extractArg(args, '--after'));
+        const before = parseQueueTimeArg(this.extractArg(args, '--before'));
+        if (this.extractArg(args, '--after') && after === undefined)
+            return { ok: false, error: '❌ --after 必须是 epoch 毫秒或 ISO 时间' };
+        if (this.extractArg(args, '--before') && before === undefined)
+            return { ok: false, error: '❌ --before 必须是 epoch 毫秒或 ISO 时间' };
+        if (after !== undefined && before !== undefined && after >= before)
+            return { ok: false, error: '❌ --after 必须早于 --before' };
         // 操作分支
         if (args.includes('--clear')) {
             const count = this.messageQueue.clearBySession(sessionId);
@@ -2147,13 +2269,19 @@ export class CommandHandler {
                 : { ok: false, error: `❌ 当前无处理中任务` };
         }
         // 查询
-        const items = this.messageQueue.getQueueItemsBySession(sessionId);
+        const items = this.messageQueue.getQueueItemsBySession(sessionId, { after, before });
         if (formatJson) {
             return { ok: true, result: JSON.stringify({ items }, null, 2) };
         }
         return { ok: true, result: renderQueueItemsCtl(items, showId, full) };
     }
 }
+function parseQueueTimeArg(value) {
+    if (!value)
+        return undefined;
+    const parsed = /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 /**
  * ctl 专用渲染：不显示 session 标识列（因为只有一个 session）
  */
@@ -2176,14 +2304,33 @@ function renderQueueItemsCtl(items, showId, full) {
             parts.push(` ${name}  `);
         }
         const content = full ? item.preview.replace('...', '') : item.preview;
-        parts.push(`"${content}"`);
+        const timing = [
+            item.receivedAt != null ? `recv=${new Date(item.receivedAt).toISOString()}` : undefined,
+            item.enqueuedAt != null ? `enq=${new Date(item.enqueuedAt).toISOString()}` : undefined,
+            item.queueWaitMs != null ? `wait=${formatQueueDuration(item.queueWaitMs)}` : undefined,
+        ].filter(Boolean).join(' ');
+        parts.push(`${timing ? `${timing}  ` : ''}"${content}"`);
         lines.push(parts.join(''));
     }
     return lines.join('\n');
 }
+function formatQueueDuration(ms) {
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
+}
 function sameFeedbackTarget(target, origin) {
     if (!origin)
         return false;
+    const targetChannelType = tryParseChannelKey(target.channelKey)?.type
+        ?? target.channelKey.split('#', 1)[0];
+    const targetChatType = target.chatType
+        ?? (targetChannelType === 'aun' ? undefined : 'private');
+    if (!targetChatType)
+        return false;
+    const originDelivery = origin.delivery;
+    const originChatType = originDelivery?.chatType ?? 'private';
+    if (targetChatType !== originChatType)
+        return false;
     return target.channelKey === origin.channelKey
         && target.channelId === origin.channelId
         && target.session === origin.session

package/dist/core/command/menu-catalog.js

@@ -131,6 +131,8 @@ export async function resolveMenuCatalogContext(input) {
         const rebuilt = buildAuthSubject({
             selfAid: subject.selfAid,
             actorId: subject.actorId,
+            requestId: subject.requestId,
+            sessionId: subject.sessionId,
             channel: subject.channel,
             channelType: transport,
             channelId: subject.actorId,
@@ -191,6 +193,8 @@ export async function resolveMenuCatalogContext(input) {
     const rebuilt = buildAuthSubject({
         selfAid: subject.selfAid,
         actorId: subject.actorId,
+        requestId: subject.requestId,
+        sessionId: subject.sessionId,
         channel: subject.channel,
         channelType: transport,
         channelId: canonicalGroupId,

package/dist/core/command/menu-handler.js

@@ -6,7 +6,7 @@ import { hasModelSwitcher } from '../../agents/runner-types.js';
 import { getCodexEfforts } from '../../agents/codex-runner.js';
 import { execCodexCliSync, resolveCodexCliPath } from '../../utils/codex-cli.js';
 import { resolvePaths, getPackageRoot, daemonControlDir } from '../../paths.js';
-import { buildEnvelope } from '../message/message-utils.js';
+import { buildEnvelope, isDeliveryTarget, isDeliveryTargetForChannel, replyContextFromSession } from '../message/message-utils.js';
 import path from 'path';
 import fs from 'fs';
 import os from 'os';
@@ -28,7 +28,7 @@ import { normalizeCliArgv, parseCliIntent, parseLegacyCliCommand, validateCliArg
 import { auditCommandAuthorization, hashArgv } from '../auth/authorization-audit.js';
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { evaluateRoleOperationCapability } from '../auth/operation-authorizer.js';
-import { splitConfigBatchGetArgv } from '../../config/config-batch-get.js';
+import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { chatmodeFieldForPeer, resolveChatModeForField } from '../message/peer-mode.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
 import { resolveRuntimePermissionMode, resolveRuntimeStringField, validateRuntimeStringFieldOverride, } from '../role/runtime-policy.js';
@@ -36,6 +36,7 @@ import { isManagementRole } from '../../config/builtin-roles.js';
 import { SYSTEM_CONTROL_CHANNEL } from '../system-channels.js';
 import { logger } from '../../utils/logger.js';
 import { shouldSuppressRealRestart } from '../../utils/restart-safety.js';
+import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { evolMenuResponseTransportMetadata, menuFailure, menuCommandForName, menuSuccess, normalizeMenuError, validateConfigWriteScope, validateMenuRequest, } from './menu-protocol.js';
 import { roleMenuAction, roleMenuOperation, roleMenuOptions, roleMenuQuery, roleMenuUpdate, } from './role-menu.js';
 import { handleConnectMenu, connectMenuOperation } from './connect-menu.js';
@@ -1013,8 +1014,13 @@ function buildRelationIntentArgs(params) {
     return out;
 }
 function buildMenuAuthSubject(owner, params) {
-    if (params.subject)
-        return params.subject;
+    if (params.subject) {
+        return {
+            ...params.subject,
+            ...(params.requestId && !params.subject.requestId ? { requestId: params.requestId } : {}),
+            ...(params.session?.id && !params.subject.sessionId ? { sessionId: params.session.id } : {}),
+        };
+    }
     const agent = owner.getOwningAgent?.(params.channel);
     const selfAid = agent?.aid || params.session?.selfAID;
     const channelType = owner.resolveChannelType?.(params.channel) || params.session?.channelType;
@@ -1025,6 +1031,8 @@ function buildMenuAuthSubject(owner, params) {
     return buildAuthSubject({
         selfAid,
         actorId: params.userId,
+        requestId: params.requestId,
+        sessionId: params.session?.id,
         channel: params.channel,
         channelType: channelType || params.channel.split('#')[0],
         channelId: params.channelId,
@@ -1114,7 +1122,7 @@ function buildRoleMenuContext(owner, channel, subject) {
                     channel: contactAdapter.channelName,
                     channelId: applicantAid,
                     agentName: owningAgent?.name ?? '<unknown>',
-                    replyContext: { metadata: evolMenuResponseTransportMetadata() },
+                    replyContext: { delivery: { chatType: 'private' }, metadata: evolMenuResponseTransportMetadata() },
                 }), {
                     kind: 'custom',
                     channelType: 'aun',
@@ -2710,6 +2718,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
     const subject = buildMenuAuthSubject(this, {
         identity: authIdentity,
         session: authSession,
+        requestId,
         explicitChatType,
         channel,
         channelId,
@@ -2927,6 +2936,10 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             if (triggerThread !== undefined && triggerThread !== 'per_run' && triggerThread !== 'by_run' && triggerThread !== 'by_trigger') {
                 return { error: `无效 triggerThread: ${triggerThread}`, code: 'INVALID_ARGS' };
             }
+            const targetChatType = args.targetChatType;
+            if (targetChatType !== undefined && targetChatType !== 'private' && targetChatType !== 'group') {
+                return { error: `无效 targetChatType: ${targetChatType}`, code: 'INVALID_ARGS' };
+            }
             const parsed = {
                 scheduleType: args.scheduleType,
                 scheduleValue: String(args.scheduleValue ?? ''),
@@ -2937,6 +2950,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 name: args.name,
                 targetChannel: args.targetChannel,
                 targetChannelId: args.targetChannelId,
+                targetChatType,
                 targetThreadId: args.targetThreadId,
                 agentId: args.agentId,
                 model: args.model,
@@ -3313,13 +3327,56 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         }
         if (action === 'restart') {
             const suppressRealRestart = shouldSuppressRealRestart();
+            let restartReplyContext;
+            try {
+                restartReplyContext = session
+                    ? replyContextFromSession(session, transportReplyContext)
+                    : transportReplyContext;
+            }
+            catch (error) {
+                const code = error?.code;
+                if (channel.split('#', 1)[0].toLowerCase() !== 'aun'
+                    || (code !== 'AUN_OUTBOUND_ROUTE_REQUIRED' && code !== 'AUN_OUTBOUND_ROUTE_MISMATCH')) {
+                    throw error;
+                }
+                return {
+                    error: '当前 AUN 会话缺少有效的持久化出站路由，请从可信入站上下文重试',
+                    code,
+                };
+            }
+            const restartDelivery = restartReplyContext?.delivery
+                ?? (explicitChatType === 'group'
+                    ? { chatType: 'group', groupId: channelId }
+                    : explicitChatType === 'private'
+                        ? { chatType: 'private' }
+                        : undefined);
+            if (channel.split('#', 1)[0].toLowerCase() === 'aun'
+                && !isDeliveryTargetForChannel(restartDelivery, channelId)) {
+                return {
+                    error: '无法确定有效的重启通知出站路由，请从可信会话上下文重试',
+                    code: isDeliveryTarget(restartDelivery)
+                        ? 'AUN_OUTBOUND_ROUTE_MISMATCH'
+                        : 'AUN_OUTBOUND_ROUTE_REQUIRED',
+                };
+            }
             if (!suppressRealRestart) {
-                const restartInfo = { channel, channelId, timestamp: Date.now() };
+                const restartInfo = {
+                    channel,
+                    channelId,
+                    timestamp: Date.now(),
+                    ...(restartDelivery ? { delivery: restartDelivery } : {}),
+                };
                 const controlDir = daemonControlDir();
                 fs.mkdirSync(controlDir, { recursive: true });
                 fs.writeFileSync(path.join(controlDir, 'restart-pending.json'), JSON.stringify(restartInfo));
-                spawnDetachedNode([path.join(getPackageRoot(), 'dist', 'cli', 'index.js'), 'restart-monitor'], {
+                // Use the canonical CLI restart path so the restart itself performs
+                // the version check and automatic upgrades before replacing the daemon.
+                // Do not inherit managed-session credentials: otherwise cmdRestart can
+                // delegate back to this daemon and recursively enqueue another restart.
+                spawnDetachedNode([path.join(getPackageRoot(), 'dist', 'cli', 'index.js'), 'restart'], {
                     EVOLCORE_HOME: resolvePaths().root,
+                    EVOLCORE_SESSION_ID: '',
+                    [AGENT_DELEGATION_TOKEN_ENV]: '',
                 });
             }
             else {
@@ -3386,6 +3443,17 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             ? (session?.metadata?.groupId || channelId)
             : userId;
         const cliPeerKey = cliChannelType && cliPeerKeyId ? formatPeerKey(cliChannelType, cliPeerKeyId) : undefined;
+        const subject = buildMenuAuthSubject(this, {
+            identity,
+            session,
+            requestId,
+            explicitChatType,
+            channel,
+            channelId,
+            userId,
+            fromControlChannel: fromControlChannel ?? false,
+            subject: authSubject,
+        });
         if (Array.isArray(args?.argv)) {
             argv = withDefaultRelationContext(argv, { self: cliSelfAid, peer: cliPeerKey });
         }
@@ -3404,6 +3472,8 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 await auditCommandAuthorization({
                     ts: Date.now(), source: 'menu.cli', operation: parsed.intent.operation,
                     scope: parsed.intent.scope, dangerous: true, actorId: userId,
+                    requestId, sessionId: subject.sessionId, agentAid: subject.selfAid,
+                    permissionMode: subject.permissionMode,
                     channel, channelId, role: identity.role, decision: 'deny', code: 'NOT_ALLOWED',
                     reason: 'Unrecognized CLI command', taskId: requestId, argvHash: hashArgv(intentArgv),
                     name: 'cli', action: 'exec', args: { argv: [...requestedArgv] },
@@ -3412,16 +3482,6 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             }
             parsedCommands.push(parsed);
         }
-        const subject = buildMenuAuthSubject(this, {
-            identity,
-            session,
-            explicitChatType,
-            channel,
-            channelId,
-            userId,
-            fromControlChannel: fromControlChannel ?? false,
-            subject: authSubject,
-        });
         const selfAid = subject.selfAid;
         const peerKey = subject.peerKey;
         const isDaemonOwner = subject.isDaemonOwner;
@@ -3446,6 +3506,10 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 allowExplicitRelationTarget: true,
                 auditAllowed: false,
                 auditMetadata: {
+                    requestId,
+                    sessionId: subject.sessionId,
+                    agentAid: subject.selfAid,
+                    permissionMode: subject.permissionMode,
                     taskId: requestId,
                     argvHash: hashArgv(authArgv),
                     name: 'cli',
@@ -3466,6 +3530,8 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 ts: Date.now(), source: 'menu.cli', operation: parsed.intent.operation,
                 scope: parsed.intent.scope, dangerous: parsed.intent.dangerous ?? false,
                 actorId: userId, selfAid, peerKey,
+                requestId, sessionId: subject.sessionId, agentAid: selfAid,
+                permissionMode: subject.permissionMode,
                 channel, channelId, role: identity.role, isDaemonOwner,
                 fromControlChannel: fromControlChannel ?? false, decision: 'allow',
                 matchedRule: decision.command?.matchedRule, taskId: requestId, argvHash: hashArgv(argv),
@@ -3509,7 +3575,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             return { error: '通道不存在', code: 'EXEC_FAILED' };
         if (!adapter.capabilities?.file)
             return { error: '通道不支持文件发送', code: 'NOT_SUPPORTED' };
-        const sessionReplyContext = session ? this.getReplyContext(session) : undefined;
+        const sessionReplyContext = session ? replyContextFromSession(session, this.getReplyContext(session)) : undefined;
         const replyCtx = transportReplyContext
             ? {
                 ...(sessionReplyContext ?? {}),
@@ -3593,6 +3659,7 @@ async function execMenuForSystemControl(payload, context) {
     const trustedSubject = buildAuthSubject({
         selfAid: targetAid,
         actorId: context.actorAid,
+        requestId: id !== undefined && id !== null && String(id) ? String(id) : undefined,
         channel: targetChannel,
         channelType: 'aun',
         channelId: context.actorAid || SYSTEM_CONTROL_CHANNEL,