evolcore 0.0.12 → 0.0.14

package/dist/core/auth/authorization-audit.js

@@ -14,9 +14,47 @@ export function auditCommandAuthorization(event) {
     const auditRecord = buildAuditRecord(event);
     logAuditEvent(auditRecord);
 }
+/**
+ * Record a tool-level preflight denial (e.g. protected-path block) in the
+ * structured command-audit log. This covers interactive sessions whose
+ * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
+ */
+export function auditToolPreflightDenial(input) {
+    auditCommandAuthorization({
+        ts: Date.now(),
+        source: 'agent-tool',
+        operation: 'tool.preflight.deny',
+        scope: 'filesystem',
+        dangerous: false,
+        decision: 'deny',
+        decisionSource: 'policy',
+        toolName: input.toolName,
+        policyCode: input.policyCode,
+        reason: input.reason,
+        argsSummary: input.summary ? { summary: input.summary } : undefined,
+        sessionId: input.sessionId,
+        agentAid: input.agentAid,
+        permissionMode: input.permissionMode,
+        channel: input.channel,
+        actorId: input.actorId,
+        role: input.role ?? 'unknown',
+        selfAid: input.selfAid,
+        peerKey: input.peerKey,
+        requestId: input.requestId,
+        taskId: input.taskId,
+    });
+}
 function buildAuditRecord(event) {
     return {
         ts: event.ts,
+        correlationId: event.correlationId ?? event.requestId,
+        requestId: event.requestId,
+        sessionId: event.sessionId,
+        agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
+        permissionMode: event.permissionMode,
+        toolName: event.toolName,
+        policyCode: event.policyCode ?? event.code,
+        decisionSource: event.decisionSource,
         source: event.source,
         operation: event.operation,
         scope: event.scope,
@@ -71,6 +109,14 @@ function logAuditEvent(record) {
         `actor=${record.actorId || 'unknown'}`,
         record.taskId ? `task=${record.taskId}` : null,
         record.messageId ? `message=${record.messageId}` : null,
+        record.requestId ? `request=${record.requestId}` : null,
+        record.correlationId ? `correlation=${record.correlationId}` : null,
+        record.sessionId ? `session=${record.sessionId}` : null,
+        record.agentAid ? `agent=${record.agentAid}` : null,
+        record.permissionMode ? `permissionMode=${record.permissionMode}` : null,
+        record.toolName ? `tool=${record.toolName}` : null,
+        record.policyCode ? `policy=${record.policyCode}` : null,
+        record.decisionSource ? `decisionSource=${record.decisionSource}` : null,
         record.code ? `code=${record.code}` : null,
         record.matchedRule ? `rule=${record.matchedRule}` : null,
         record.dangerous ? 'dangerous=true' : null,
@@ -78,6 +124,7 @@ function logAuditEvent(record) {
         .filter(Boolean)
         .join(' ');
     logger[level](message);
+    logger[level](`[CommandAuditRecord] ${JSON.stringify(record)}`);
     if (record.reason)
         logger[level](`  reason: ${record.reason}`);
     if (record.argvHash)

package/dist/core/auth/operation-authorizer.js

@@ -170,6 +170,7 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         dangerous: opMeta.dangerous,
         matchedRule,
         constraints: permission.constraints,
+        permissionMode: permission.permissionMode,
     };
 }
 function matchCommandPermission(operation, category, commandPerms, isDangerous) {

package/dist/core/auth/operation-catalog.js

@@ -65,7 +65,7 @@ const MSG_READ_OPERATIONS = [
     description,
     sources: ['agent-tool'],
 }));
-const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df'].map(kind => ({
+const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df', 'getfacl'].map(kind => ({
     id: `ec.fs.${kind}`,
     category: 'read',
     dangerous: false,
@@ -73,6 +73,14 @@ const GROUP_FS_READ_OPERATIONS = ['ls', 'stat', 'lstat', 'cat', 'find', 'df'].ma
     description: `Read current group filesystem (${kind})`,
     sources: ['agent-tool'],
 }));
+const GROUP_FS_WRITE_OPERATIONS = [['mkdir', 'write-own'], ['upload', 'write-own'], ['copy', 'write-own'], ['move', 'write-own'], ['remove', 'write-own'], ['setfacl', 'write-agent']].map(([kind, category]) => ({
+    id: `ec.fs.${kind}`,
+    category,
+    dangerous: false,
+    defaultScopes: ['relation'],
+    description: `Write current group filesystem (${kind})`,
+    sources: ['agent-tool'],
+}));
 const HANDOFF_READ_OPERATIONS = ['status', 'list', 'trace'].map(kind => ({
     id: `ec.handoff.${kind}`,
     category: 'read',
@@ -856,6 +864,7 @@ const OPERATIONS = [
     ...GROUP_MANAGEMENT_OPERATIONS,
     ...MSG_READ_OPERATIONS,
     ...GROUP_FS_READ_OPERATIONS,
+    ...GROUP_FS_WRITE_OPERATIONS,
     ...HANDOFF_READ_OPERATIONS,
     ...HANDOFF_WRITE_OPERATIONS,
     ...QUEUE_OPERATIONS,

package/dist/core/bootstrap-messages.js

@@ -31,14 +31,21 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
     const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
     if (hasMessageLogOperation(chatDir, operationId))
         return;
+    const existing = outbox.findByDedupeKey(aid, operationId);
+    if (existing?.delivery?.chatType === 'private' && existing.channelId === owner)
+        return;
+    if (existing)
+        outbox.remove(aid, existing.id);
     outbox.enqueue(aid, {
         channelId: owner,
+        delivery: { chatType: 'private' },
         dedupeKey: operationId,
         critical: true,
         type: 'text',
         text: renderPostBootstrapWelcome(aid, owner, ownerName),
         ttl: BOOTSTRAP_MESSAGE_TTL_MS,
         context: {
+            delivery: { chatType: 'private' },
             metadata: {
                 source: 'daemon',
                 chatmode: 'interactive',
@@ -49,12 +56,12 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
     });
 }
 export function hasPendingPostBootstrapWelcomeOutbox(aid) {
-    return !!outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
+    return outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid))?.delivery?.chatType === 'private';
 }
 /** Bind the durable completion welcome to the fresh post-bootstrap session. */
 export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
     const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    if (!entry)
+    if (!entry || entry.delivery?.chatType !== 'private')
         return false;
     if (entry.context?.sessionId === sessionId)
         return true;

package/dist/core/bootstrap-service.js

@@ -140,7 +140,13 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        const channelId = ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // The bootstrap prompt is deliberately a private message to the configured
+        // owner. An inbound owner message may have arrived from a group, in which
+        // case ctx.channelId is the group AID and must not be paired with the
+        // private delivery route below (that would call message.send(to=group)).
+        const channelId = channelType === 'aun'
+            ? recipientId
+            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;
@@ -166,6 +172,7 @@ export class BootstrapService {
                 channelId,
                 agentName: aid,
                 replyContext: {
+                    delivery: { chatType: 'private' },
                     metadata: {
                         source: 'daemon',
                         persistRequired: true,

package/dist/core/command/command-handler.js

@@ -1,6 +1,6 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../message/message-utils.js';
+import { buildEnvelope, deliveryTargetFromSession, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
 import { loadDaemonConfig } from '../../config-store.js';
 import { logger } from '../../utils/logger.js';
@@ -18,6 +18,7 @@ import { displaySessionTitle } from '../session/session-title.js';
 import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
+import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
 import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
@@ -132,6 +133,15 @@ export class CommandHandler {
             .filter(key => key.startsWith(prefix))
             .map(key => key.slice(prefix.length));
     }
+    /** Return the runner-owned temporary root for a managed session, if any. */
+    getManagedSessionTempDir(session) {
+        try {
+            return this.getAgent(session.channel, session.baseagent).getManagedTempDir?.(session.id);
+        }
+        catch {
+            return undefined;
+        }
+    }
     formatBaseagentUnavailable(error) {
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         return `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
@@ -321,6 +331,7 @@ export class CommandHandler {
             channelId: definition.origin.channelId,
             session: definition.origin.session,
             threadId: definition.origin.threadId,
+            chatType: definition.origin.delivery?.chatType,
         };
     }
     canAccessTriggerDefinition(definition, peerId, channel, isAdmin) {
@@ -403,9 +414,6 @@ export class CommandHandler {
         }
         const targetChannelType = this.resolveChannelType(feedbackChannel);
         const feedbackChannelId = parsed.targetChannelId ?? peerId;
-        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChannelId.includes('.')) {
-            return { error: `AUN 渠道的 --target-channel-id 必须是 AID 格式（如 user.agentid.pub），收到："${parsed.targetChannelId}"` };
-        }
         const schedulerAid = parsed.agentId
             ?? this.getOwningAgent(feedbackChannel)?.aid
             ?? tryParseChannelKey(feedbackChannel)?.selfAID
@@ -414,11 +422,22 @@ export class CommandHandler {
         if (!schedulerAid || !scheduler) {
             return { error: `目标 agent 不存在或未就绪：${schedulerAid ?? feedbackChannel}` };
         }
+        if (targetChannelType === 'aun' && parsed.targetChannelId && !parsed.targetChatType) {
+            return { error: 'AUN 目标必须显式指定 --target-chat-type private 或 group' };
+        }
+        const targetDelivery = targetChannelType === 'aun'
+            ? parsed.targetChatType === 'group'
+                ? { chatType: 'group', groupId: feedbackChannelId }
+                : parsed.targetChatType === 'private'
+                    ? { chatType: 'private' }
+                    : { chatType: 'private' }
+            : undefined;
         const target = {
             channelKey: feedbackChannel,
             channelId: feedbackChannelId,
             session: parsed.targetSession,
             threadId: parsed.targetSession === 'thread' ? parsed.targetThreadId : undefined,
+            chatType: targetDelivery?.chatType,
         };
         if (target.session === 'thread') {
             const adapter = this.adapters.get(feedbackChannel);
@@ -439,6 +458,7 @@ export class CommandHandler {
             threadId: !originIsGroup ? threadId : undefined,
             peerId,
             sessionKey: activeSession?.sessionKey,
+            delivery: { chatType: 'private' },
         };
         if (!isAdmin && parsed.feedbackStrategy === 'target' && !sameFeedbackTarget(target, origin)) {
             return { error: '无权限：非 admin 只能把 trigger 投递到来源会话' };
@@ -618,7 +638,7 @@ export class CommandHandler {
     }
     /** 从 session 提取渠道预构建的回复上下文 */
     getReplyContext(session) {
-        return session.metadata?.replyContext;
+        return replyContextFromSession(session);
     }
     /**
      * 发送 CommandCard 卡片。卡片成功返回 null（调用方直接 return），失败返回降级文本。
@@ -1426,7 +1446,7 @@ export class CommandHandler {
      * - taskId/chatmode：从 processing_state 和 effective chatmode 注入
      */
     buildCtlReplyContext(session) {
-        const ctx = {};
+        const ctx = { delivery: deliveryTargetFromSession(session) };
         const meta = session.metadata;
         if (meta?.replyContext?.threadId)
             ctx.threadId = meta.replyContext.threadId;
@@ -1454,7 +1474,7 @@ export class CommandHandler {
             if (encrypted != null)
                 ctx.metadata.encrypted = encrypted;
         }
-        return Object.keys(ctx).length > 0 ? ctx : undefined;
+        return ctx;
     }
     resolveEffectiveChatmodeForSession(session) {
         const peerType = session.metadata?.peerType;
@@ -1509,35 +1529,51 @@ export class CommandHandler {
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
         });
-        const resolved = resolveConfigCommand(argv, {
-            defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
-        });
-        if (!resolved.ok)
-            return { ok: false, code: resolved.code, error: resolved.reason };
-        const decision = authorizeOperation({
-            source: 'agent-tool',
-            subject,
-            intent: {
-                operation: resolved.command.operationId,
-                scope: resolved.command.commandScope,
+        const executeOne = (fieldArgv) => {
+            const resolved = resolveConfigCommand(fieldArgv, {
+                defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
+            });
+            if (!resolved.ok)
+                return { ok: false, code: resolved.code, error: resolved.reason };
+            const decision = authorizeOperation({
                 source: 'agent-tool',
-                args: {
-                    ...(resolved.command.self ? { self: resolved.command.self } : {}),
-                    ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
-                    ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                subject,
+                intent: {
+                    operation: resolved.command.operationId,
+                    scope: resolved.command.commandScope,
+                    source: 'agent-tool',
+                    args: {
+                        ...(resolved.command.self ? { self: resolved.command.self } : {}),
+                        ...(resolved.command.peerKey ? { peer: resolved.command.peerKey, peerKey: resolved.command.peerKey } : {}),
+                        ...('field' in resolved.command && resolved.command.field ? { field: resolved.command.field } : {}),
+                    },
+                    dangerous: resolved.command.dangerous,
                 },
-                dangerous: resolved.command.dangerous,
-            },
-            resolvedConfigCommand: resolved.command,
-            auditMetadata: {
-                argvHash: hashArgv(resolved.command.canonicalArgv),
-                taskId: grant.taskId,
-                messageId: grant.messageId,
-            },
-        });
-        if (!decision.allow)
-            return { ok: false, code: decision.code, error: decision.reason };
-        const result = executeResolvedConfigCommand(resolved.command, { role: subject.role });
+                resolvedConfigCommand: resolved.command,
+                auditMetadata: {
+                    argvHash: hashArgv(resolved.command.canonicalArgv),
+                    taskId: grant.taskId,
+                    messageId: grant.messageId,
+                },
+            });
+            if (!decision.allow)
+                return { ok: false, code: decision.code, error: decision.reason };
+            return executeResolvedConfigCommand(resolved.command, { role: subject.role });
+        };
+        const batch = splitConfigBatchGetArgv(argv);
+        if (batch && batch.fields.length > 1) {
+            const results = batch.fields.map(field => {
+                const result = executeOne(['config', 'get', field, ...batch.rest]);
+                if (!result.ok)
+                    return { ok: false, field, code: result.code, error: result.error };
+                if (result.subcommand !== 'get') {
+                    return { ok: false, field, code: 'UNEXPECTED_RESULT', error: `config get ${field} produced a non-get result` };
+                }
+                return result;
+            });
+            return { ok: true, result: { ok: true, subcommand: 'batch-get', results } };
+        }
+        const result = executeOne(argv);
         return result.ok
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
@@ -1747,23 +1783,41 @@ export class CommandHandler {
             const filePath = String(parsed.command.filePath || '');
             const projectPath = path.resolve(session.projectPath);
             const resolvedPath = path.resolve(projectPath, filePath);
-            if (!filePath || !isSameOrDescendant(resolvedPath, projectPath)) {
-                return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file must be inside the current session project' };
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedPaths = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!filePath || !allowedPaths.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file must be inside the current session project or managed TMPDIR' };
             }
             if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
                 return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
             }
+            let rulesFd;
             try {
                 const realProjectPath = fs.realpathSync(projectPath);
                 const realPath = fs.realpathSync(resolvedPath);
-                if (!isSameOrDescendant(realPath, realProjectPath)) {
-                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file resolves outside the current session project' };
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // The session may have closed and removed its temporary directory.
+                }
+                const realAllowedPaths = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedPaths.some(root => isSameOrDescendant(realPath, root))) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file resolves outside the current session project or managed TMPDIR' };
                 }
-                const stat = fs.statSync(realPath);
+                if (isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_RULES_PATH', error: 'Rules file cannot be read from a protected EvolCore path' };
+                }
+                rulesFd = fs.openSync(realPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+                const stat = fs.fstatSync(rulesFd);
                 if (!stat.isFile() || stat.size < 1 || stat.size > 4 * 1024) {
                     return { ok: false, code: 'INVALID_RULES_CONTENT', error: 'Rules file must be a regular file from 1 to 4096 bytes' };
                 }
-                rulesContent = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(realPath));
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_RULES_PATH', error: 'Rules file cannot be a hard link' };
+                }
+                rulesContent = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(rulesFd));
             }
             catch (error) {
                 return {
@@ -1772,6 +1826,10 @@ export class CommandHandler {
                     error: error instanceof Error ? error.message : String(error),
                 };
             }
+            finally {
+                if (rulesFd !== undefined)
+                    fs.closeSync(rulesFd);
+            }
         }
         try {
             return { ok: true, result: await executeManagedGroupOperation(parsed.command, rulesContent) };
@@ -1860,7 +1918,7 @@ export class CommandHandler {
             };
         }
     }
-    /** Agent-managed current-group filesystem read entrypoint. */
+    /** Agent-managed current-group filesystem entrypoint. */
     async handleFsOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
@@ -1881,7 +1939,7 @@ export class CommandHandler {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
         if (grant.channelType !== 'aun' || grant.chatType !== 'group') {
-            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs reads require the current AUN group relation' };
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs operations require the current AUN group relation' };
         }
         let currentGroup;
         try {
@@ -1904,6 +1962,22 @@ export class CommandHandler {
             conversationId: currentGroup,
             processOwners: loadDaemonConfig().owners ?? [],
         });
+        const intentArgs = {
+            self: actorAid,
+            targetId: currentGroup,
+            peer: currentGroup,
+            peerKey: formatPeerKey('aun', currentGroup),
+            path: parsed.command.remotePath,
+            targetPath: parsed.command.remotePath,
+            ...(parsed.command.remoteSourcePath ? { sourcePath: parsed.command.remoteSourcePath } : {}),
+            ...(parsed.command.localPath ? { localPath: parsed.command.localPath } : {}),
+            ...(parsed.command.recursive !== undefined ? { recursive: parsed.command.recursive } : {}),
+            ...(parsed.command.parents !== undefined ? { parents: parsed.command.parents } : {}),
+            ...(parsed.command.overwrite !== undefined ? { overwrite: parsed.command.overwrite } : {}),
+            ...(parsed.command.aclGrantee ? { aclGrantee: parsed.command.aclGrantee } : {}),
+            ...(parsed.command.aclPerms ? { aclPerms: parsed.command.aclPerms } : {}),
+            ...(parsed.command.aclRemove !== undefined ? { aclRemove: parsed.command.aclRemove } : {}),
+        };
         const decision = authorizeOperation({
             source: 'agent-tool',
             subject,
@@ -1911,17 +1985,60 @@ export class CommandHandler {
                 operation: parsed.command.operationId,
                 scope: 'relation',
                 source: 'agent-tool',
-                args: {
-                    self: actorAid,
-                    targetId: currentGroup,
-                    peer: currentGroup,
-                    peerKey: formatPeerKey('aun', currentGroup),
-                },
+                args: intentArgs,
+            },
+            auditMetadata: {
+                argvHash: hashArgv(parsed.command.canonicalArgv), taskId: grant.taskId, messageId: grant.messageId,
+                sessionId, agentAid: actorAid, toolName: 'ec.fs',
             },
-            auditMetadata: { argvHash: hashArgv(parsed.command.canonicalArgv), taskId: grant.taskId, messageId: grant.messageId },
         });
         if (!decision.allow)
             return { ok: false, code: decision.code, error: decision.reason };
+        if (parsed.command.kind === 'upload') {
+            const localPath = String(parsed.command.localPath || '').trim();
+            const projectPath = path.resolve(session.projectPath);
+            if (!localPath)
+                return { ok: false, code: 'INVALID_ARGUMENT', error: 'Managed upload source is required' };
+            const resolvedPath = path.resolve(projectPath, localPath);
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const allowedRoots = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!allowedRoots.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source must be inside the current session project or managed TMPDIR' };
+            }
+            if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
+                return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source cannot be a protected EvolCore path' };
+            }
+            try {
+                const realProjectPath = fs.realpathSync(projectPath);
+                const stat = fs.lstatSync(resolvedPath);
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    return { ok: false, code: 'INVALID_LOCAL_FILE', error: 'Upload source must be a regular non-symlink file' };
+                }
+                const realPath = fs.realpathSync(resolvedPath);
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch {
+                    // A removed or invalid session temp root is not an upload root.
+                }
+                const realAllowedRoots = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedRoots.some(root => isSameOrDescendant(realPath, root))
+                    || isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_LOCAL_PATH', error: 'Upload source resolves outside the allowed project or managed TMPDIR path' };
+                }
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_LOCAL_PATH', error: 'Upload source cannot be a hard link inside managed TMPDIR' };
+                }
+                if (stat.size > 16 * 1024 * 1024) {
+                    return { ok: false, code: 'LOCAL_FILE_TOO_LARGE', error: 'Managed upload is limited to 16 MiB' };
+                }
+                parsed.command.localPath = realPath;
+            }
+            catch (error) {
+                return { ok: false, code: 'INVALID_LOCAL_FILE', error: error instanceof Error ? error.message : String(error) };
+            }
+        }
         try {
             return { ok: true, result: await executeManagedFsOperation(parsed.command) };
         }
@@ -2126,6 +2243,14 @@ export class CommandHandler {
         const showId = args.includes('--showid');
         const formatJson = args.includes('--format json');
         const full = args.includes('--full');
+        const after = parseQueueTimeArg(this.extractArg(args, '--after'));
+        const before = parseQueueTimeArg(this.extractArg(args, '--before'));
+        if (this.extractArg(args, '--after') && after === undefined)
+            return { ok: false, error: '❌ --after 必须是 epoch 毫秒或 ISO 时间' };
+        if (this.extractArg(args, '--before') && before === undefined)
+            return { ok: false, error: '❌ --before 必须是 epoch 毫秒或 ISO 时间' };
+        if (after !== undefined && before !== undefined && after >= before)
+            return { ok: false, error: '❌ --after 必须早于 --before' };
         // 操作分支
         if (args.includes('--clear')) {
             const count = this.messageQueue.clearBySession(sessionId);
@@ -2147,13 +2272,19 @@ export class CommandHandler {
                 : { ok: false, error: `❌ 当前无处理中任务` };
         }
         // 查询
-        const items = this.messageQueue.getQueueItemsBySession(sessionId);
+        const items = this.messageQueue.getQueueItemsBySession(sessionId, { after, before });
         if (formatJson) {
             return { ok: true, result: JSON.stringify({ items }, null, 2) };
         }
         return { ok: true, result: renderQueueItemsCtl(items, showId, full) };
     }
 }
+function parseQueueTimeArg(value) {
+    if (!value)
+        return undefined;
+    const parsed = /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 /**
  * ctl 专用渲染：不显示 session 标识列（因为只有一个 session）
  */
@@ -2176,14 +2307,33 @@ function renderQueueItemsCtl(items, showId, full) {
             parts.push(` ${name}  `);
         }
         const content = full ? item.preview.replace('...', '') : item.preview;
-        parts.push(`"${content}"`);
+        const timing = [
+            item.receivedAt != null ? `recv=${new Date(item.receivedAt).toISOString()}` : undefined,
+            item.enqueuedAt != null ? `enq=${new Date(item.enqueuedAt).toISOString()}` : undefined,
+            item.queueWaitMs != null ? `wait=${formatQueueDuration(item.queueWaitMs)}` : undefined,
+        ].filter(Boolean).join(' ');
+        parts.push(`${timing ? `${timing}  ` : ''}"${content}"`);
         lines.push(parts.join(''));
     }
     return lines.join('\n');
 }
+function formatQueueDuration(ms) {
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec >= 60 ? `${Math.floor(sec / 60)}m${sec % 60}s` : `${sec}s`;
+}
 function sameFeedbackTarget(target, origin) {
     if (!origin)
         return false;
+    const targetChannelType = tryParseChannelKey(target.channelKey)?.type
+        ?? target.channelKey.split('#', 1)[0];
+    const targetChatType = target.chatType
+        ?? (targetChannelType === 'aun' ? undefined : 'private');
+    if (!targetChatType)
+        return false;
+    const originDelivery = origin.delivery;
+    const originChatType = originDelivery?.chatType ?? 'private';
+    if (targetChatType !== originChatType)
+        return false;
     return target.channelKey === origin.channelKey
         && target.channelId === origin.channelId
         && target.session === origin.session

package/dist/core/command/menu-catalog.js

@@ -131,6 +131,8 @@ export async function resolveMenuCatalogContext(input) {
         const rebuilt = buildAuthSubject({
             selfAid: subject.selfAid,
             actorId: subject.actorId,
+            requestId: subject.requestId,
+            sessionId: subject.sessionId,
             channel: subject.channel,
             channelType: transport,
             channelId: subject.actorId,
@@ -191,6 +193,8 @@ export async function resolveMenuCatalogContext(input) {
     const rebuilt = buildAuthSubject({
         selfAid: subject.selfAid,
         actorId: subject.actorId,
+        requestId: subject.requestId,
+        sessionId: subject.sessionId,
         channel: subject.channel,
         channelType: transport,
         channelId: canonicalGroupId,