evolcore 0.0.12 → 0.0.14

package/dist/cli/queue-command.js

@@ -10,10 +10,18 @@ export async function cmdQueue(args) {
 
 查询:
   --agent <aid>           必填，目标 agent（如 mybot.agentid.pub）
+  --after <time>          只显示 adapter 接收时间晚于该值的消息（epoch ms 或 ISO）
+  --before <time>         只显示 adapter 接收时间早于该值的消息（epoch ms 或 ISO）
   --showid                显示 messageId
   --full                  显示完整消息内容（不截断）
   --format json           以 JSON 格式输出
 
+JSON 时间字段:
+  receivedAt              adapter 收到消息时间（epoch ms）
+  enqueuedAt              实际进入队列时间（epoch ms）
+  queueWaitMs             排队等待时长（ms）
+  processingStartedAt     开始处理时间（epoch ms，active）
+
 操作:
   --clear                 清空该 agent 的所有待处理消息
   --cancel <messageId>    取消指定消息
@@ -21,6 +29,7 @@ export async function cmdQueue(args) {
 
 示例:
   ec queue --agent mybot.agentid.pub
+  ec queue --agent mybot.agentid.pub --after 2026-08-19T12:00:00+08:00
   ec queue --agent mybot.agentid.pub --showid
   ec queue --agent mybot.agentid.pub --clear
   ec queue --agent mybot.agentid.pub --cancel msg_d4e5f6
@@ -46,6 +55,12 @@ export async function cmdQueue(args) {
         process.exit(1);
     }
     const formatJson = formatValue === 'json';
+    const after = parseQueueTime(getArgValue(args, '--after'), '--after');
+    const before = parseQueueTime(getArgValue(args, '--before'), '--before');
+    if (after !== undefined && before !== undefined && after >= before) {
+        console.error('❌ --after 必须早于 --before');
+        process.exit(1);
+    }
     const clear = args.includes('--clear');
     const cancelIdx = args.indexOf('--cancel');
     const cancelCandidate = cancelIdx >= 0 && cancelIdx + 1 < args.length ? args[cancelIdx + 1] : undefined;
@@ -80,6 +95,8 @@ export async function cmdQueue(args) {
         action,
         messageId: cancelMsgId,
         sessionKey,
+        after,
+        before,
         sessionId: managed,
         delegationToken: process.env[AGENT_DELEGATION_TOKEN_ENV],
     } : {
@@ -88,6 +105,8 @@ export async function cmdQueue(args) {
         action,
         messageId: cancelMsgId,
         sessionKey,
+        after,
+        before,
     });
     if (!result) {
         console.error('错误: 无法连接 evolcore 服务');
@@ -118,6 +137,16 @@ export async function cmdQueue(args) {
     }
     console.log(renderQueueItemsCli(items, showId, full, agent));
 }
+function parseQueueTime(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        console.error(`❌ ${flag} 必须是 epoch 毫秒或 ISO 时间: ${value}`);
+        process.exit(1);
+    }
+    return parsed;
+}
 function renderQueueItemsCli(items, showId, full, aid) {
     const lines = [`${aid} — 队列 (${items.length} 条)`, ''];
     if (items.length === 0) {
@@ -151,6 +180,12 @@ function renderQueueItemsCli(items, showId, full, aid) {
             elapsed = sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
         }
         parts.push(` ${elapsed.padEnd(elapsedColWidth)}  `);
+        const wait = item.queueWaitMs == null ? '—' : formatDuration(item.queueWaitMs);
+        parts.push(` wait:${wait.padEnd(6)}  `);
+        if (item.receivedAt != null)
+            parts.push(` recv:${formatQueueTime(item.receivedAt)} `);
+        if (item.enqueuedAt != null)
+            parts.push(` enq:${formatQueueTime(item.enqueuedAt)} `);
         // 内容列
         const content = full ? item.preview.replace(/\.\.\.$/, '') : item.preview;
         parts.push(`"${content}"`);
@@ -158,3 +193,10 @@ function renderQueueItemsCli(items, showId, full, aid) {
     }
     return lines.join('\n');
 }
+function formatDuration(ms) {
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
+}
+function formatQueueTime(timestamp) {
+    return new Date(timestamp).toISOString();
+}

package/dist/cli/restart-monitor.js

@@ -14,7 +14,6 @@ import { WEB_PACKAGE_NAME } from '../product.js';
 import { shouldSuppressRealRestart } from '../utils/restart-safety.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
-import { serviceProxyNeedsEcweb, startEcwebIfEnabled } from './daemon-commands.js';
 const execFileAsync = promisify(execFile);
 // 清理 Claude Code 环境变量，防止 SDK 认为是嵌套会话
 function cleanEnv() {
@@ -194,22 +193,12 @@ export async function cmdRestartMonitor() {
             await notifyDaemonOwners(p, `⚠️ ${WEB_PACKAGE_NAME} 升级失败，使用当前版本继续\n${ecwebUpgrade.error ?? ''}`.trim(), log);
             break;
     }
-    // source=ecweb 的 Service Proxy 只在 daemon 启动后的短窗口内发现实例。
-    // restart-monitor 直接 spawn daemon，必须在此先启动独立的 ec-web，不能绕过
-    // cmdStart 的 ECWeb 生命周期逻辑。
-    const ecwebStartedBeforeDaemon = serviceProxyNeedsEcweb(loadDaemonConfig())
-        ? await startEcwebIfEnabled(p)
-        : false;
-    if (ecwebStartedBeforeDaemon)
-        log('ECWeb started before daemon');
+    // ECWeb is owned by the daemon. Starting it here used to race with the
+    // daemon's own launcher and ECWeb's stale-instance cleanup, which could
+    // leave ServiceProxy pointed at a dead PID.
     // 启动并检测 ready signal
     let started = await spawnAndWaitReady(p, log, READY_TIMEOUT);
     if (started) {
-        // 没有 Service Proxy 时可以等 daemon ready 后再启动；有代理时已在上方启动，
-        // 避免重新拉起造成实例记录和反向隧道短暂失配。
-        if (!ecwebStartedBeforeDaemon && await startEcwebIfEnabled(p)) {
-            log('ECWeb started after daemon');
-        }
         log('✓ Service restarted successfully');
         archiveSelfHealLog(p, log);
         // 发起会话内的“重启成功”通知由新进程自行发送，此处只负责失败/自愈告警。

package/dist/cli/task-context.js

@@ -1,5 +1,14 @@
 import { normalizeCausation } from '../core/causation/context.js';
+import { RUNTIME_LOCK_DIR_ENV } from '../core/runtime-lock.js';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
+export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
+export { RUNTIME_LOCK_DIR_ENV };
+const generatedProcessManagedTempDirs = new Set();
+let processTempCleanupRegistered = false;
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
@@ -23,10 +32,167 @@ function normalizeTaskRuntimeContext(value) {
         peerType: optionalString(value.peerType),
         peerRole: optionalString(value.peerRole),
         threadId: optionalString(value.threadId),
+        sessionRuntimeDir: optionalAbsolutePath(value.sessionRuntimeDir),
+        runtimeLockDir: optionalAbsolutePath(value.runtimeLockDir),
         handoffIds: handoffIds?.length ? handoffIds : undefined,
         causation: normalizeCausation(value.causation),
     };
 }
+function optionalAbsolutePath(value) {
+    if (typeof value !== 'string' || !path.isAbsolute(value))
+        return undefined;
+    return path.resolve(value);
+}
+function isPrivateDirectory(directory) {
+    try {
+        const resolved = path.resolve(directory);
+        const stat = fs.lstatSync(resolved);
+        if (!stat.isDirectory()
+            || stat.isSymbolicLink()
+            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (stat.mode & 0o077) !== 0)
+            return false;
+        // A private leaf below a symlinked ancestor can still escape the managed
+        // namespace. Walk the existing ancestor chain and reject such paths while
+        // allowing the normal public system temp parent (for generated roots).
+        let current = resolved;
+        while (true) {
+            const ancestor = fs.lstatSync(current);
+            if (ancestor.isSymbolicLink())
+                return false;
+            const parent = path.dirname(current);
+            if (parent === current)
+                break;
+            current = parent;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure the daemon has a private process-wide temporary root.
+ *
+ * Service managers commonly omit TMPDIR. In that case create a private
+ * directory below the platform temp root and publish it for all managed
+ * runners. An explicitly supplied value is accepted only when it is already
+ * a private directory owned by this process. A shared system directory such
+ * as `/tmp`, a symlink, or a group/world-readable path is replaced with a
+ * fresh private root instead of becoming a capability for managed children.
+ */
+export function ensureProcessManagedTempDir() {
+    const configured = process.env.TMPDIR?.trim();
+    if (configured) {
+        if (!path.isAbsolute(configured)) {
+            throw new Error('managed TMPDIR is unset or not absolute');
+        }
+        const resolved = path.resolve(configured);
+        if (isPrivateDirectory(resolved))
+            return resolved;
+    }
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-managed-tmp-'));
+    try {
+        fs.chmodSync(directory, 0o700);
+        if (!isPrivateDirectory(directory)) {
+            throw new Error(`managed temp path is not a private directory: ${directory}`);
+        }
+        process.env.TMPDIR = directory;
+        generatedProcessManagedTempDirs.add(directory);
+        if (!processTempCleanupRegistered) {
+            processTempCleanupRegistered = true;
+            process.once('exit', () => {
+                for (const candidate of generatedProcessManagedTempDirs) {
+                    if (!path.basename(candidate).startsWith('evolcore-managed-tmp-'))
+                        continue;
+                    try {
+                        if (isPrivateDirectory(candidate))
+                            fs.rmSync(candidate, { recursive: true, force: true });
+                    }
+                    catch {
+                        // Best-effort cleanup; the directory is private and uniquely named.
+                    }
+                }
+            });
+        }
+        return directory;
+    }
+    catch (error) {
+        try {
+            fs.rmSync(directory, { recursive: true, force: true });
+        }
+        catch { }
+        throw error;
+    }
+}
+function isRunnerOwnedSessionRuntimeDir(directory) {
+    const resolved = path.resolve(directory);
+    const base = path.basename(resolved);
+    const parent = path.dirname(resolved);
+    // Codex allocates a private, direct child named with a 24-character digest
+    // below its private evolcore-codex-* parent. The runner has already checked
+    // canonical containment before returning this path to the response engine.
+    const isCodexRuntime = /^[a-f0-9]{24}$/.test(base)
+        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(parent));
+    return isCodexRuntime && isPrivateDirectory(parent) && isPrivateDirectory(resolved);
+}
+/** Whether a task-provided runtime directory stays inside the process-managed
+ * TMPDIR and is safe to use for transient writes. */
+export function isManagedSessionRuntimeDir(directory) {
+    const tmpDir = process.env.TMPDIR?.trim();
+    if (!directory || !path.isAbsolute(directory) || !tmpDir || !path.isAbsolute(tmpDir))
+        return false;
+    const root = path.resolve(tmpDir);
+    const resolved = path.resolve(directory);
+    const relative = path.relative(root, resolved);
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+        return false;
+    return isPrivateDirectory(root) && isPrivateDirectory(resolved);
+}
+/**
+ * Create a private runtime directory below the process-provided TMPDIR.
+ * There is deliberately no os.tmpdir() fallback: managed sessions must not
+ * silently escape the session-owned temporary workspace.
+ */
+export function ensureSessionRuntimeDir(sessionId) {
+    const base = process.env.TMPDIR?.trim();
+    if (!base || !path.isAbsolute(base) || !sessionId)
+        return undefined;
+    const root = path.resolve(base);
+    const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
+    const directory = path.join(root, `evolcore-runtime-${digest}`);
+    try {
+        fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+        if (!isPrivateDirectory(root))
+            return undefined;
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        fs.mkdirSync(path.join(directory, 'locks'), { recursive: true, mode: 0o700 });
+        return isManagedSessionRuntimeDir(directory) ? directory : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Shared by tasks in one daemon runtime, while remaining outside each
+ * session's history/files area. The caller must still pass this path through
+ * the task environment before a sandboxed child can use it. */
+export function ensureRuntimeLockDir(sessionRuntimeDir) {
+    if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
+        return undefined;
+    if (!isManagedSessionRuntimeDir(sessionRuntimeDir) && !isRunnerOwnedSessionRuntimeDir(sessionRuntimeDir))
+        return undefined;
+    const parent = path.dirname(path.resolve(sessionRuntimeDir));
+    if (!isPrivateDirectory(parent))
+        return undefined;
+    const directory = path.join(parent, 'evolcore-locks');
+    try {
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        return isPrivateDirectory(directory) ? directory : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function runtimeRefMessageIdForMsgSend(args) {
     const runtime = args.runtime;
     if (!runtime)
@@ -76,5 +242,11 @@ export function buildTaskRuntimeEnv(ctx) {
     return {
         EVOLCORE_SESSION_ID: ctx.sessionId ?? '',
         [TASK_RUNTIME_CONTEXT_ENV]: JSON.stringify(clean),
+        // Every managed child receives the session directory as TMPDIR. This keeps
+        // ordinary temporary files and runtime-only fallbacks out of shared agent
+        // or process directories, including for non-Codex runners.
+        ...(clean.sessionRuntimeDir ? { TMPDIR: clean.sessionRuntimeDir } : {}),
+        ...(clean.sessionRuntimeDir ? { [SESSION_RUNTIME_DIR_ENV]: clean.sessionRuntimeDir } : {}),
+        ...(clean.runtimeLockDir ? { [RUNTIME_LOCK_DIR_ENV]: clean.runtimeLockDir } : {}),
     };
 }

package/dist/cli/trigger-command.js

@@ -113,6 +113,7 @@ Create 参数模式支持:
   --permission <readonly|auto|request|bypass>（省略则继承当前身份配置）
   --tz <时区> (仅 cron)
   --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
+  --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)
   --target-session <main|thread> [--target-thread-id <threadId>]
   --trigger-thread <by-run|by-trigger>  (兼容旧值 per-run)
   --name <名称>
@@ -263,6 +264,11 @@ async function createTrigger(args, json) {
     if (!parsed.targetChannel || !parsed.targetChannelId) {
         throw new Error('CLI flag 模式需要显式指定 --target-channel <channelKey> --target-channel-id <id>');
     }
+    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel.startsWith('aun#');
+    if (targetIsAun && !parsed.targetChatType) {
+        throw new Error('AUN 目标必须显式指定 --target-chat-type private 或 group');
+    }
+    const targetChatType = parsed.targetChatType;
     const now = Date.now();
     if (parsed.targetSession === 'thread' && !parsed.targetThreadId) {
         throw new Error('--target-session thread 需要 --target-thread-id');
@@ -300,6 +306,7 @@ async function createTrigger(args, json) {
                 channelKey: parsed.targetChannel,
                 channelId: parsed.targetChannelId,
                 session: parsed.targetSession,
+                ...(targetChatType ? { chatType: targetChatType } : {}),
                 ...(parsed.targetSession === 'thread' ? { threadId: parsed.targetThreadId } : {}),
             },
         },

package/dist/config/access-policy.js

@@ -1,6 +1,5 @@
 import crypto from 'crypto';
-import { ConfigError, ConfigTarget, mutateConfig, read, validateConfig, } from './config-manager.js';
-import { validAgentOwnerIds, validateAccessPolicyDomain, } from './access-policy-domain.js';
+import { ConfigError, ConfigTarget, mutateConfig, read, validateConfig, validAgentOwnerIds, validateAccessPolicyDomain, } from './config-manager.js';
 export class AccessPolicyError extends Error {
     code;
     data;

package/dist/config/builtin-roles.js

@@ -44,6 +44,13 @@ export function getManagementCommandPermissions(role) {
         'role.policy.write': { allow: true, dangerous: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'ec.aid.show': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
         'ec.aid.agentmd.put': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.fs.mkdir': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.upload': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.copy': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.move': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.remove': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.getfacl': { allow: true, scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
+        'ec.fs.setfacl': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         '*': { allow: true },
         // Reload is valid from an Agent's own channel and the daemon control plane.
         // The control-channel gate still requires a daemon owner for cross-Agent reloads.

package/dist/config/config-manager.js

@@ -12,6 +12,7 @@
  */
 import fs from 'fs';
 import path from 'path';
+import { ensureManagedLockParent, resolveManagedLockPath } from '../core/runtime-lock.js';
 import crypto from 'crypto';
 import { resolvePaths, agentConfig as agentConfigPath, agentContactConfig, agentRelationConfig, agentDir, agentRelationsDir, agentRolesIndex, agentRoleConfig, } from '../paths.js';
 import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
@@ -28,7 +29,27 @@ import { clearRoleStoreCache, isRoleName } from './role-store.js';
 import { writeRoleDefinition, writeRoleRegistry } from './role-service.js';
 import { mutateContactBookTransactionSync } from './contact-book-store.js';
 import { DAEMON_SCHEMA_NAME } from '../product.js';
-import { validateAccessPolicyDomain } from './access-policy-domain.js';
+export function shouldFailFastForMissingOwners(env = process.env) {
+    const value = (env.EVOLCORE_REQUIRE_OWNERS || '').trim().toLowerCase();
+    return value === '1' || value === 'true' || value === 'yes';
+}
+export function validAgentOwnerIds(agent) {
+    return [...new Set((agent?.owners ?? [])
+            .map(value => String(value || '').trim())
+            .filter(isValidAid))];
+}
+export function validateAccessPolicyDomain(selfAid, agent) {
+    const access = agent.access;
+    if (!access)
+        return undefined;
+    if (access.policyMode !== 'open' && validAgentOwnerIds(agent).length === 0) {
+        return {
+            code: 'restricted_mode_without_owner',
+            message: `Agent ${selfAid} cannot use ${access.policyMode} without an Owner`,
+        };
+    }
+    return undefined;
+}
 export var ConfigTarget;
 (function (ConfigTarget) {
     ConfigTarget["Process"] = "process";
@@ -773,12 +794,15 @@ function sortConfigValue(value) {
         .map(([key, nested]) => [key, sortConfigValue(nested)]));
 }
 function acquireConfigMutationLock(file) {
-    const lockDir = `${file}.mutation.lock`;
+    const lockDir = resolveManagedLockPath('config', file, `${file}.mutation.lock`);
     const ownerFile = path.join(lockDir, 'owner.json');
     const token = crypto.randomBytes(16).toString('hex');
     const candidate = `${lockDir}.candidate-${process.pid}-${token}`;
     const candidateOwner = path.join(candidate, 'owner.json');
-    fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (lockDir === `${file}.mutation.lock`)
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+    else
+        ensureManagedLockParent(lockDir);
     fs.mkdirSync(candidate);
     fs.writeFileSync(candidateOwner, `${JSON.stringify({ pid: process.pid, token })}\n`, { mode: 0o600 });
     let acquired = false;

package/dist/config/contact-book-store.js

@@ -6,6 +6,7 @@ import { isExplicitGroupId } from '../aun/group-identity.js';
 import { agentConfig, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
+import { ensureManagedLockParent, resolveManagedLockPath } from '../core/runtime-lock.js';
 import { ConfigTarget, notifyConfigWrite, validateConfig } from './config-manager.js';
 import { parseContactAlias } from './contact-alias.js';
 import { clearRoleStoreCache } from './role-store.js';
@@ -426,12 +427,16 @@ function readContactBookFromDisk(selfAid) {
     }
 }
 function acquireAgentLock(selfAid) {
-    const lockDir = path.join(agentDir(selfAid), LOCK_NAME);
+    const legacyLockDir = path.join(agentDir(selfAid), LOCK_NAME);
+    const lockDir = resolveManagedLockPath('contact', selfAid, legacyLockDir);
     const ownerFile = path.join(lockDir, 'owner.json');
     const lockToken = crypto.randomBytes(16).toString('hex');
     const candidateDir = `${lockDir}.candidate-${process.pid}-${lockToken}`;
     const candidateOwnerFile = path.join(candidateDir, 'owner.json');
-    fs.mkdirSync(path.dirname(lockDir), { recursive: true });
+    if (lockDir === legacyLockDir)
+        fs.mkdirSync(path.dirname(lockDir), { recursive: true });
+    else
+        ensureManagedLockParent(lockDir);
     fs.mkdirSync(candidateDir);
     fs.writeFileSync(candidateOwnerFile, `${JSON.stringify({
         pid: process.pid,

package/dist/config/peer-role-resolver.js

@@ -123,8 +123,12 @@ export function resolvePeerRoleDetail(ctx) {
     const winner = selectHighestRank(candidates, ctx.selfAid);
     if (winner)
         return resultFor(winner.role, winner.source, actor, ctx.selfAid);
-    return roleRegistryExists(ctx.selfAid) && roleExists('visitor', ctx.selfAid)
-        ? resultFor('visitor', 'builtin-fallback', actor, ctx.selfAid)
+    // Group members get the normal interactive member policy when no explicit
+    // group/actor/default assignment exists. Private conversations retain the
+    // read-only visitor fallback.
+    const fallbackRole = ctx.chatType === 'group' ? 'member' : 'visitor';
+    return roleRegistryExists(ctx.selfAid) && roleExists(fallbackRole, ctx.selfAid)
+        ? resultFor(fallbackRole, 'builtin-fallback', actor, ctx.selfAid)
         : resultFor(null, 'none', actor, ctx.selfAid);
 }
 export function roleToSessionIdentity(role) {

package/dist/config/role-migration-startup.js

@@ -0,0 +1,53 @@
+import path from 'path';
+import { pathToFileURL } from 'url';
+import { getPackageRoot, resolvePaths } from '../paths.js';
+import { assertRoleConfigV4Ready, assertRoleConfigV5Ready, ConfigError } from './config-manager.js';
+/** Apply the one-off v4 role config migration before daemon startup. */
+export async function ensureRoleConfigV4OnStartup() {
+    try {
+        assertRoleConfigV4Ready();
+        return null;
+    }
+    catch (error) {
+        if (!(error instanceof ConfigError) || error.code !== 'ROLE_CONFIG_MIGRATION_REQUIRED')
+            throw error;
+    }
+    const home = resolvePaths().root;
+    const script = path.join(getPackageRoot(), 'kits', 'migrations', 'migrate-role-config-v4.mjs');
+    try {
+        const migration = await import(pathToFileURL(script).href);
+        const result = migration.runMigration({ home, apply: true });
+        assertRoleConfigV4Ready();
+        return result;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new ConfigError('ROLE_CONFIG_MIGRATION_FAILED', `Automatic role config v4 migration failed: ${detail}\n` +
+            `Fix the reported config or run manually:\n` +
+            `node kits/migrations/migrate-role-config-v4.mjs --apply --home ${JSON.stringify(home)}`, { cause: error });
+    }
+}
+/** Apply the standalone v5 role registry migration before daemon startup. */
+export async function ensureRoleConfigV5OnStartup() {
+    try {
+        assertRoleConfigV5Ready();
+        return null;
+    }
+    catch (error) {
+        if (!(error instanceof ConfigError) || error.code !== 'ROLE_CONFIG_V5_MIGRATION_REQUIRED')
+            throw error;
+    }
+    const home = resolvePaths().root;
+    const script = path.join(getPackageRoot(), 'kits', 'migrations', 'migrate-role-config-v5.mjs');
+    try {
+        const migration = await import(pathToFileURL(script).href);
+        const result = migration.runMigration({ home, apply: true });
+        assertRoleConfigV5Ready();
+        return result;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new ConfigError('ROLE_CONFIG_V5_MIGRATION_FAILED', `Automatic standalone role migration failed: ${detail}\n` +
+            `node kits/migrations/migrate-role-config-v5.mjs --apply --home ${JSON.stringify(home)}`, { cause: error });
+    }
+}

package/dist/config/role-store.js

@@ -113,7 +113,7 @@ function readRegistry(selfAid, diagnostics) {
                     code: 'INVALID_ROLE_ASSIGNMENT',
                     roleId: selected,
                     file: path.relative(resolvePaths().root, file),
-                    message: `defaultRoles.${scene} references invalid or unregistered role ${selected}; using visitor fallback`,
+                    message: `defaultRoles.${scene} references invalid or unregistered role ${selected}; using ${scene === 'group' ? 'member' : 'visitor'} fallback`,
                 });
                 defaultRoles[scene] = null;
             }

package/dist/core/auth/agent-delegation.js

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
-export const AGENT_DELEGATION_COMMAND_TTL_MS = 60_000;
+export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
 export class AgentDelegationRegistry {
     grantsByHash = new Map();
     activeHashBySession = new Map();

package/dist/core/auth/auth-gateway.js

@@ -4,6 +4,22 @@ import { formatPeerKey } from '../relation/peer-identity.js';
 import { authorizeCommand, authorizeResolvedConfigCommand } from './operation-authorizer.js';
 import { auditCommandAuthorization } from './authorization-audit.js';
 import { hasTrustedPrincipal } from './authenticated-actor.js';
+import { resolveRuntimePermissionMode } from '../role/runtime-policy.js';
+const CROSS_AGENT_READ_OPERATIONS = new Set([
+    'trigger.list',
+    'trigger.show',
+    'trigger.history',
+]);
+export function isCrossAgentTriggerOperationAllowed(input) {
+    if (input.control || input.taskAgentAid === input.targetAgentAid)
+        return true;
+    if (!input.taskAgentAid || !input.targetManagement)
+        return false;
+    return CROSS_AGENT_READ_OPERATIONS.has(input.operation);
+}
+export function isCrossAgentTriggerReadOperation(operation) {
+    return CROSS_AGENT_READ_OPERATIONS.has(operation);
+}
 export function buildAuthSubject(input) {
     const chatType = input.chatType === 'group' ? 'group' : 'private';
     const actorId = input.actorId;
@@ -27,6 +43,8 @@ export function buildAuthSubject(input) {
     return {
         selfAid: input.selfAid,
         actorId,
+        requestId: input.requestId,
+        sessionId: input.sessionId,
         channel: input.channel,
         channelType: input.channelType,
         channelId: input.channelId,
@@ -41,6 +59,8 @@ export function buildAuthSubject(input) {
         allowAccess: isDaemonOwner || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
+        permissionMode: input.permissionMode
+            ?? resolveRuntimePermissionMode({ selfAid: input.selfAid, role }).effectiveValue,
     };
 }
 function isProcessOwner(input) {
@@ -144,6 +164,16 @@ function resolveRoleDetail(input) {
 function auditDecision(params, decision) {
     auditCommandAuthorization({
         ts: Date.now(),
+        ...params.auditMetadata,
+        correlationId: params.auditMetadata?.correlationId ?? params.auditMetadata?.requestId ?? params.subject.requestId,
+        requestId: params.auditMetadata?.requestId ?? params.subject.requestId,
+        sessionId: params.auditMetadata?.sessionId ?? params.subject.sessionId,
+        agentAid: params.auditMetadata?.agentAid ?? params.subject.selfAid,
+        permissionMode: params.auditMetadata?.permissionMode
+            ?? (decision.allow ? decision.permissionMode ?? params.subject.permissionMode : params.subject.permissionMode),
+        toolName: params.auditMetadata?.toolName,
+        policyCode: params.auditMetadata?.policyCode ?? (decision.allow ? undefined : decision.code),
+        decisionSource: params.auditMetadata?.decisionSource ?? (decision.allow ? 'command' : 'policy'),
         source: params.source,
         operation: params.intent.operation,
         scope: params.intent.scope,
@@ -161,6 +191,5 @@ function auditDecision(params, decision) {
         reason: decision.allow ? undefined : decision.reason,
         matchedRule: decision.matchedRule,
         argsSummary: params.intent.args,
-        ...params.auditMetadata,
     });
 }