evolcore 0.0.16 → 0.0.18

package/dist/core/auth/authorization-audit.js

@@ -2,6 +2,7 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
+import { buildAuthorizationEventKey } from '../audit/event-key.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
         event.decision === 'deny' ||
@@ -23,11 +24,15 @@ export function auditCommandAuthorization(event) {
 export function auditToolPreflightDenial(input) {
     auditCommandAuthorization({
         ts: Date.now(),
+        callId: input.requestId,
+        correlationId: input.requestId,
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
         dangerous: false,
         decision: 'deny',
+        executed: false,
+        executionState: 'blocked',
         decisionSource: 'policy',
         toolName: input.toolName,
         policyCode: input.policyCode,
@@ -55,11 +60,14 @@ export function auditToolPreflightDenial(input) {
 export function auditCodexApprovalDecision(input) {
     auditCommandAuthorization({
         ts: Date.now(),
+        callId: input.correlationId ?? input.requestId,
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
         dangerous: input.toolName === 'PermissionGrant',
         decision: input.decision,
+        executed: false,
+        executionState: input.decision === 'allow' ? 'authorized' : 'blocked',
         decisionSource: input.decisionSource,
         requestId: input.requestId,
         correlationId: input.correlationId ?? input.requestId,
@@ -73,12 +81,58 @@ export function auditCodexApprovalDecision(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: { method: input.method, executed: false },
+        argsSummary: { method: input.method },
+    });
+}
+/** Record a fail-closed infrastructure condition before a tool can execute. */
+export function auditToolInfrastructureFailure(input) {
+    auditCommandAuthorization({
+        ts: Date.now(),
+        source: 'agent-tool',
+        operation: 'tool.execution.blocked',
+        scope: 'filesystem',
+        dangerous: false,
+        decision: 'deny',
+        decisionSource: 'infrastructure',
+        executed: false,
+        executionState: 'blocked',
+        callId: input.callId,
+        correlationId: input.callId,
+        requestId: input.callId,
+        sessionId: input.sessionId ?? 'unknown',
+        agentAid: input.agentAid ?? 'unknown',
+        permissionMode: input.permissionMode ?? 'unknown',
+        toolName: input.toolName,
+        policyCode: input.policyCode,
+        reason: input.reason,
+        role: input.role ?? 'unknown',
+        taskId: input.taskId,
+        argsSummary: input.occurrences && input.occurrences > 1
+            ? { occurrences: input.occurrences }
+            : undefined,
     });
 }
 function buildAuditRecord(event) {
+    const executed = event.executed ?? false;
+    const executionState = event.executionState
+        ?? (event.decision === 'deny'
+            ? 'blocked'
+            : executed
+                ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
+                : 'authorized');
+    const lifecycleId = event.callId ?? event.correlationId ?? event.requestId;
     return {
         ts: event.ts,
+        eventKey: event.eventKey ?? (lifecycleId
+            ? buildAuthorizationEventKey({
+                sessionId: event.sessionId,
+                callId: event.callId,
+                correlationId: event.correlationId,
+                requestId: event.requestId,
+                operation: event.operation,
+            })
+            : undefined),
+        callId: event.callId,
         correlationId: event.correlationId ?? event.requestId,
         requestId: event.requestId,
         sessionId: event.sessionId,
@@ -96,23 +150,26 @@ function buildAuditRecord(event) {
         dangerous: event.dangerous,
         name: event.name,
         action: event.action,
-        args: event.args?.argv ? { argv: [...event.args.argv] } : undefined,
+        args: event.args?.argv ? { argv: sanitizeAuditArgv(event.args.argv, event.decision) } : undefined,
         actorId: redactIdentifier(event.actorId),
         selfAid: redactIdentifier(event.selfAid),
         peerKey: redactIdentifier(event.peerKey),
         channel: event.channel,
         channelId: redactIdentifier(event.channelId),
         role: event.role,
+        processRole: event.processRole,
         isDaemonOwner: event.isDaemonOwner,
         fromControlChannel: event.fromControlChannel,
         taskId: event.taskId,
         messageId: event.messageId,
         decision: event.decision,
+        executed,
+        executionState,
         code: event.code,
         reason: event.reason,
         matchedRule: event.matchedRule,
         argvHash: event.argvHash,
-        argsSummary: event.argsSummary,
+        argsSummary: summarizeAuthorizationArgs(event.operation, event.argsSummary),
         durationMs: event.durationMs,
         exitCode: event.exitCode,
     };
@@ -148,7 +205,9 @@ function logAuditEvent(record) {
         record.taskId ? `task=${record.taskId}` : null,
         record.messageId ? `message=${record.messageId}` : null,
         record.requestId ? `request=${record.requestId}` : null,
+        record.callId ? `call=${record.callId}` : null,
         record.correlationId ? `correlation=${record.correlationId}` : null,
+        record.eventKey ? `eventKey=${record.eventKey}` : null,
         record.sessionId ? `session=${record.sessionId}` : null,
         record.agentAid ? `agent=${record.agentAid}` : null,
         record.permissionMode ? `permissionMode=${record.permissionMode}` : null,
@@ -157,6 +216,8 @@ function logAuditEvent(record) {
         record.protectionClass ? `protectionClass=${record.protectionClass}` : null,
         record.matchedPath ? `matchedPath=${JSON.stringify(record.matchedPath)}` : null,
         record.decisionSource ? `decisionSource=${record.decisionSource}` : null,
+        `executed=${record.executed}`,
+        `executionState=${record.executionState}`,
         record.code ? `code=${record.code}` : null,
         record.matchedRule ? `rule=${record.matchedRule}` : null,
         record.dangerous ? 'dangerous=true' : null,
@@ -225,6 +286,52 @@ function writeRoleMutationAudit(payload) {
     }
     catch { }
 }
+function summarizeAuthorizationArgs(operation, args) {
+    if (!args)
+        return undefined;
+    const summary = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (value === undefined)
+            continue;
+        if (/^(?:self|peer|peerKey|target|targetId|session|sessionId|channelId)$/i.test(key)) {
+            summary[key] = typeof value === 'string' ? redactIdentifier(value) : '[redacted]';
+            continue;
+        }
+        if (/(?:value|token|secret|password|credential|content|payload|body|sql|query)/i.test(key)) {
+            summary[`${key}Type`] = Array.isArray(value) ? 'array' : typeof value;
+            summary[key] = '[redacted]';
+            continue;
+        }
+        if (typeof value === 'string') {
+            summary[key] = value.length <= 96 ? value : `${value.slice(0, 93)}...`;
+        }
+        else if (typeof value === 'number' || typeof value === 'boolean' || value === null) {
+            summary[key] = value;
+        }
+        else {
+            summary[key] = `[${Array.isArray(value) ? 'array' : 'object'}]`;
+        }
+    }
+    if (operation === 'ec.msg.history')
+        summary.kind = 'history';
+    return Object.keys(summary).length > 0 ? summary : undefined;
+}
+function sanitizeAuditArgv(argv, decision) {
+    if (decision === 'allow')
+        return [...argv];
+    const safe = [...argv];
+    if (safe[0] === 'config' && safe[1] === 'set' && safe.length > 3) {
+        safe[3] = '[redacted]';
+    }
+    for (let index = 0; index < safe.length - 1; index++) {
+        const flag = safe[index];
+        if (/^--(?:self|peer|session|channel|channel-id|token)$/i.test(flag)) {
+            safe[index + 1] = redactIdentifier(safe[index + 1]) ?? '[redacted]';
+            index++;
+        }
+    }
+    return safe;
+}
 function protectionClassForPolicy(policyCode) {
     if (!policyCode)
         return undefined;

package/dist/core/auth/authorization-denial.js

@@ -0,0 +1,17 @@
+const NEXT_STEPS = {
+    DAEMON_OWNER_REQUIRED: 'Ask an AID listed in daemon.json.owners to run this operation from the daemon control channel or ECWeb.',
+    TARGET_SELF_ONLY: 'Target the current Agent, or ask a DaemonOwner to perform the cross-Agent operation.',
+    MANAGED_NON_INTERACTIVE_REQUIRED: 'Use the structured non-interactive Agent command (for example `ec agent new <aid> --non-interactive`) or ECWeb.',
+    PURGE_CONFIRMATION_REQUIRED: 'Run the purge from the daemon control plane and add --confirm-purge after verifying the target Agent.',
+};
+export function authorizationNextStep(reasonCode) {
+    return NEXT_STEPS[reasonCode];
+}
+export function authorizationDenialData(reasonCode) {
+    return { reasonCode, nextStep: authorizationNextStep(reasonCode) };
+}
+export function formatAuthorizationDenial(reason, reasonCode) {
+    if (!reasonCode)
+        return reason;
+    return `${reason}\nNext step: ${authorizationNextStep(reasonCode)}`;
+}

package/dist/core/auth/operation-authorizer.js

@@ -5,6 +5,36 @@ import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
 import { normalizePeer } from '../model/config-scope.js';
 import { getOperationMeta } from './operation-catalog.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
+    'agent.list',
+    'agent.create',
+    'agent.delete',
+    'agent.enable',
+    'agent.disable',
+    'system.restart',
+    'system.upgrade',
+    'gateway.read',
+    'gateway.write',
+    'stats.peers',
+    'stats.groups',
+    'stats.sqlReadonly',
+    'stats.rebuild',
+    'aid.listLocal',
+    'aid.showLocal',
+    'aid.lookupRemote',
+]);
+const DAEMON_SERVICE_OPERATIONS = new Set([
+    'trigger.list',
+    'trigger.show',
+    'trigger.history',
+    'trigger.eventCatalog',
+    'trigger.create',
+    'trigger.update',
+    'trigger.setEnabled',
+    'trigger.cancel',
+    'trigger.delete',
+    'trigger.run',
+]);
 export function authorizeCommand(ctx) {
     return authorizeCommandInternal(ctx);
 }
@@ -42,7 +72,8 @@ export function evaluateRoleOperationCapability(params) {
         peerKey: capabilityPeer,
         role: params.role,
         chatType: params.chatType,
-        isDaemonOwner: params.fromControlChannel && params.role === 'owner',
+        processRole: 'none',
+        isDaemonOwner: false,
         fromControlChannel: params.fromControlChannel,
         source: 'menu',
     });
@@ -75,6 +106,45 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (!sourceAllowed) {
         return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is not available from source ${ctx.source}`, operation, intent.scope, opMeta.dangerous);
     }
+    if (ctx.processRole === 'daemon-service') {
+        if (!DAEMON_SERVICE_OPERATIONS.has(operation)) {
+            return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'daemon-service',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'daemon-service',
+        };
+    }
+    if (requiresDaemonOwner(ctx, resolvedConfigCommand)) {
+        if (!hasDaemonOwnerRole(ctx)) {
+            const reasonCode = daemonOwnerDenialReasonCode(ctx);
+            return denyDecision(ctx, 'NOT_ALLOWED', daemonOwnerDenialMessage(ctx), operation, intent.scope, opMeta.dangerous, 'daemon-owner', reasonCode);
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'daemon-owner',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'daemon-owner',
+        };
+    }
+    // Any authenticated role may inspect the current Agent through the daemon's
+    // redacted view. Cross-Agent inspection is handled by requiresDaemonOwner().
+    if (operation === 'agent.show' && isCurrentAgentTarget(ctx)) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'self-agent-read',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
@@ -84,23 +154,17 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!identityMutationCheck.ok) {
             return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
         }
-        if (resolvedConfigCommand.kind === 'global' && !ctx.isDaemonOwner) {
-            return denyDecision(ctx, 'NOT_ALLOWED', `Global config command ${operation} requires daemon owner permission`, operation, intent.scope, opMeta.dangerous);
-        }
-        if (role === 'owner' && !ctx.isDaemonOwner && intent.scope === 'process') {
-            return denyDecision(ctx, 'SCOPE_MISMATCH', 'Agent owners cannot access process, defaults, or global config commands', operation, intent.scope, opMeta.dangerous);
-        }
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (ctx.isDaemonOwner || role === 'owner') {
+        if (role === 'owner') {
             return {
                 allow: true,
                 operation,
                 scope: intent.scope,
-                role: ctx.isDaemonOwner ? 'owner' : role,
+                role,
                 dangerous: opMeta.dangerous,
-                matchedRule: ctx.isDaemonOwner ? 'daemon-owner' : 'agent-owner',
+                matchedRule: 'agent-owner',
             };
         }
     }
@@ -159,7 +223,7 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (permission.constraints) {
         const constraintCheck = checkConstraints(ctx, permission.constraints, resolvedConfigCommand);
         if (!constraintCheck.ok) {
-            return denyDecision(ctx, constraintCheck.code ?? 'ARGUMENT_MISMATCH', constraintCheck.reason || 'Command arguments do not satisfy permission constraints', operation, intent.scope, opMeta.dangerous, matchedRule);
+            return denyDecision(ctx, constraintCheck.code ?? 'ARGUMENT_MISMATCH', constraintCheck.reason || 'Command arguments do not satisfy permission constraints', operation, intent.scope, opMeta.dangerous, matchedRule, constraintCheck.reasonCode);
         }
     }
     return {
@@ -186,6 +250,59 @@ function matchCommandPermission(operation, category, commandPerms, isDangerous)
     matches.sort((a, b) => b.rank - a.rank);
     return matches[0];
 }
+function requiresDaemonOwner(ctx, resolvedConfigCommand) {
+    const { operation, scope, args } = ctx.intent;
+    if (scope === 'process' || scope === 'control')
+        return true;
+    if (DAEMON_OWNER_PROCESS_OPERATIONS.has(operation))
+        return true;
+    if (resolvedConfigCommand
+        && (resolvedConfigCommand.kind === 'global'
+            || resolvedConfigCommand.configScope === 'process'
+            || resolvedConfigCommand.configScope === 'defaults'))
+        return true;
+    if (operation === 'agent.reload' && hasDaemonOwnerRole(ctx)) {
+        return true;
+    }
+    if (operation === 'agent.show' || operation === 'agent.reload') {
+        return !isCurrentAgentTarget(ctx);
+    }
+    if (operation.startsWith('trigger.')) {
+        if (ctx.fromControlChannel)
+            return true;
+        const taskAgentAid = stringArg(args.taskAgentAid);
+        const targetAgentAid = stringArg(args.targetAgentAid) ?? stringArg(args.self);
+        return !!taskAgentAid && !!targetAgentAid && taskAgentAid !== targetAgentAid;
+    }
+    return false;
+}
+function hasDaemonOwnerRole(ctx) {
+    return ctx.isDaemonOwner === true || ctx.processRole === 'daemon-owner';
+}
+function daemonOwnerDenialReasonCode(ctx) {
+    if ((ctx.intent.operation === 'agent.show' || ctx.intent.operation === 'agent.reload')
+        && ctx.intent.scope !== 'control'
+        && !ctx.fromControlChannel
+        && !isCurrentAgentTarget(ctx)) {
+        return 'TARGET_SELF_ONLY';
+    }
+    return 'DAEMON_OWNER_REQUIRED';
+}
+function daemonOwnerDenialMessage(ctx) {
+    return daemonOwnerDenialReasonCode(ctx) === 'TARGET_SELF_ONLY'
+        ? `${ctx.intent.operation} may only target the current Agent from a managed Agent task.`
+        : daemonOwnerRequiredMessage(ctx.intent.operation);
+}
+function isCurrentAgentTarget(ctx) {
+    const targetAid = stringArg(ctx.intent.args.targetAgentAid)
+        ?? stringArg(ctx.intent.args.aid)
+        ?? stringArg(ctx.intent.args.self);
+    return !!ctx.selfAid && !!targetAid && targetAid === ctx.selfAid;
+}
+function daemonOwnerRequiredMessage(operation) {
+    return `${operation} is a daemon-level operation and requires DaemonOwner. `
+        + 'Agent owner/admin and permissionMode=bypass do not grant this permission.';
+}
 function getRuleRank(rule, permission, operation, category, isDangerous) {
     const denyOffset = permission.allow ? 0 : 1;
     if (rule === operation)
@@ -215,8 +332,10 @@ function checkConstraints(ctx, constraints, resolvedConfigCommand) {
             return peerCheck;
     }
     if (constraints.ownAgentOnly || constraints.targetCurrentAgentOnly) {
-        const controlOwnerOverride = ctx.fromControlChannel && ctx.isDaemonOwner;
-        const targetAid = stringArg(ctx.intent.args.self) ?? stringArg(ctx.intent.args.aid);
+        const controlOwnerOverride = ctx.fromControlChannel && hasDaemonOwnerRole(ctx);
+        const targetAid = stringArg(ctx.intent.args.targetAgentAid)
+            ?? stringArg(ctx.intent.args.aid)
+            ?? stringArg(ctx.intent.args.self);
         if (!controlOwnerOverride && (!ctx.selfAid || !targetAid || targetAid !== ctx.selfAid)) {
             return { ok: false, reason: 'Only the current agent can be targeted' };
         }
@@ -238,8 +357,13 @@ function checkConstraints(ctx, constraints, resolvedConfigCommand) {
             reason: `Denied ${ctx.intent.operation}: role=${ctx.role}, source_chat=${ctx.chatType ?? 'unknown'}, target_group=${target}. This role may access group operations only from a group-chat task${sameGroup}; the target being a group is not sufficient.`,
         };
     }
-    if (constraints.requireDaemonOwner && !ctx.isDaemonOwner) {
-        return { ok: false, reason: 'This command requires daemon owner permission' };
+    if (constraints.requireDaemonOwner && !hasDaemonOwnerRole(ctx)) {
+        return {
+            ok: false,
+            code: 'NOT_ALLOWED',
+            reason: daemonOwnerRequiredMessage(ctx.intent.operation),
+            reasonCode: 'DAEMON_OWNER_REQUIRED',
+        };
     }
     if (constraints.requireControlChannel && !ctx.fromControlChannel) {
         return { ok: false, reason: 'This command requires the control channel' };
@@ -310,7 +434,7 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     if (policy === 'role-overridable-write'
         && resolvedConfigOp.fieldRule.access === 'owner-only'
         && ctx.role !== 'owner'
-        && !ctx.isDaemonOwner) {
+        && !hasDaemonOwnerRole(ctx)) {
         return { ok: false, reason: `Config field ${field} can only be changed by an owner` };
     }
     const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
@@ -386,7 +510,7 @@ function checkManagementIdentityMutation(ctx, command) {
     if (command.configScope !== 'agent') {
         return { ok: false, reason: `${field} requires an explicit current-agent target` };
     }
-    if (ctx.isDaemonOwner || ctx.role === 'owner')
+    if (hasDaemonOwnerRole(ctx) || ctx.role === 'owner')
         return { ok: true };
     return { ok: false, reason: `Only an Agent owner can modify ${field}` };
 }
@@ -625,7 +749,7 @@ function globMatches(pattern, value) {
 function stringArg(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
-function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRule) {
+function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRule, reasonCode) {
     return {
         allow: false,
         code,
@@ -635,5 +759,6 @@ function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRul
         role: ctx.role,
         dangerous,
         matchedRule,
+        ...(reasonCode ? { reasonCode } : {}),
     };
 }

package/dist/core/auth/operation-catalog.js

@@ -539,7 +539,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['control'],
         description: '列出所有 agent（敏感信息）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.show',
@@ -547,7 +547,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['control', 'agent'],
         description: '查看 agent 详情（敏感信息）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.baseagent.current',
@@ -587,7 +587,23 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control'],
         description: '创建新 agent',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
+    },
+    {
+        id: 'agent.enable',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['control'],
+        description: '启用 agent',
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
+    },
+    {
+        id: 'agent.disable',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['control'],
+        description: '停用 agent',
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.reload',
@@ -595,7 +611,7 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control', 'agent'],
         description: '重载 agent 配置',
-        sources: ['slash', 'menu', 'control'],
+        sources: ['slash', 'menu', 'agent-tool', 'control'],
     },
     {
         id: 'agent.bootstrapComplete',
@@ -611,7 +627,7 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control'],
         description: '删除 agent（危险操作）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     // ── System Operations ──
     {

package/dist/core/bootstrap-messages.js

@@ -5,6 +5,7 @@ import { generateWelcomeMessage } from '../utils/welcome.js';
 import * as outbox from '../aun/outbox.js';
 import { chatDirPath } from './session/session-fs-store.js';
 import { hasMessageLogOperation } from './message/message-log.js';
+import { isDeliveryTarget, sameDeliveryTarget } from './message/message-utils.js';
 export const BOOTSTRAP_MESSAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export function bootstrapInitialMessageOperationId(aid) {
     return `bootstrap-initial:v1:${aid}`;
@@ -26,26 +27,29 @@ export function renderPostBootstrapWelcome(aid, owner, ownerName) {
         includeBindingNote: true,
     });
 }
-export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
+export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, delivery = { chatType: 'private' }) {
     const operationId = postBootstrapWelcomeOperationId(aid);
     const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
     if (hasMessageLogOperation(chatDir, operationId))
         return;
     const existing = outbox.findByDedupeKey(aid, operationId);
-    if (existing?.delivery?.chatType === 'private' && existing.channelId === owner)
+    if (existing
+        && existing.channelId === owner
+        && isDeliveryTarget(existing.delivery)
+        && sameDeliveryTarget(existing.delivery, delivery))
         return;
     if (existing)
         outbox.remove(aid, existing.id);
     outbox.enqueue(aid, {
         channelId: owner,
-        delivery: { chatType: 'private' },
+        delivery,
         dedupeKey: operationId,
         critical: true,
         type: 'text',
         text: renderPostBootstrapWelcome(aid, owner, ownerName),
         ttl: BOOTSTRAP_MESSAGE_TTL_MS,
         context: {
-            delivery: { chatType: 'private' },
+            delivery,
             metadata: {
                 source: 'daemon',
                 chatmode: 'interactive',
@@ -56,12 +60,13 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
     });
 }
 export function hasPendingPostBootstrapWelcomeOutbox(aid) {
-    return outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid))?.delivery?.chatType === 'private';
+    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
+    return !!entry && outbox.isDeliveryForChannel(entry.delivery, entry.channelId);
 }
 /** Bind the durable completion welcome to the fresh post-bootstrap session. */
 export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
     const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    if (!entry || entry.delivery?.chatType !== 'private')
+    if (!entry || !outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
         return false;
     if (entry.context?.sessionId === sessionId)
         return true;

package/dist/core/bootstrap-service.js

@@ -144,9 +144,31 @@ export class BootstrapService {
         // owner. An inbound owner message may have arrived from a group, in which
         // case ctx.channelId is the group AID and must not be paired with the
         // private delivery route below (that would call message.send(to=group)).
-        const channelId = channelType === 'aun'
-            ? recipientId
-            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // A configured AUN recipient may itself be a group AID. Ask the channel's
+        // authoritative group endpoint before choosing the transport; never infer
+        // group/private semantics from the AID string or from the inbound venue.
+        let isGroupRecipient = false;
+        try {
+            isGroupRecipient = channelType === 'aun'
+                ? (await ctx.adapter.isGroup?.(recipientId)) === true
+                : false;
+        }
+        catch (error) {
+            // Group/private routing is security-sensitive. If the authoritative
+            // probe fails, do not guess a route, and release the single-flight key
+            // so a later connection or retry can recover.
+            this.inFlight.delete(key);
+            logger.warn(`[Bootstrap] Failed to resolve recipient type for ${aid}: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        const delivery = isGroupRecipient === true
+            ? { chatType: 'group', groupId: recipientId }
+            : { chatType: 'private' };
+        const channelId = delivery.chatType === 'group'
+            ? delivery.groupId
+            : channelType === 'aun'
+                ? recipientId
+                : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;
@@ -172,7 +194,7 @@ export class BootstrapService {
                 channelId,
                 agentName: aid,
                 replyContext: {
-                    delivery: { chatType: 'private' },
+                    delivery,
                     metadata: {
                         source: 'daemon',
                         persistRequired: true,

package/dist/core/causation/aun-association.js

@@ -44,14 +44,13 @@ function ensureLoaded() {
 }
 function persist() {
     try {
-        if (associations.size === 0) {
-            removeAssociationFiles();
-            return;
-        }
+        // Keep the protected mount target present even when there are no pending
+        // associations. Removing it races with Bubblewrap's H-class projection.
         atomicWriteJson(associationFile(), [...associations].map(([messageId, association]) => ({
             messageId,
             ...association,
         })));
+        removeAssociationBackups();
     }
     catch {
     }
@@ -106,6 +105,10 @@ export function clearAunCausationForTests() {
 function removeAssociationFiles() {
     const file = associationFile();
     fs.rmSync(file, { force: true });
+    removeAssociationBackups();
+}
+function removeAssociationBackups() {
+    const file = associationFile();
     fs.rmSync(`${file}_`, { force: true });
     fs.rmSync(`${file}__`, { force: true });
 }