evolcore 0.0.17 → 0.0.18

package/dist/core/auth/operation-authorizer.js

@@ -5,6 +5,36 @@ import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
 import { normalizePeer } from '../model/config-scope.js';
 import { getOperationMeta } from './operation-catalog.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
+    'agent.list',
+    'agent.create',
+    'agent.delete',
+    'agent.enable',
+    'agent.disable',
+    'system.restart',
+    'system.upgrade',
+    'gateway.read',
+    'gateway.write',
+    'stats.peers',
+    'stats.groups',
+    'stats.sqlReadonly',
+    'stats.rebuild',
+    'aid.listLocal',
+    'aid.showLocal',
+    'aid.lookupRemote',
+]);
+const DAEMON_SERVICE_OPERATIONS = new Set([
+    'trigger.list',
+    'trigger.show',
+    'trigger.history',
+    'trigger.eventCatalog',
+    'trigger.create',
+    'trigger.update',
+    'trigger.setEnabled',
+    'trigger.cancel',
+    'trigger.delete',
+    'trigger.run',
+]);
 export function authorizeCommand(ctx) {
     return authorizeCommandInternal(ctx);
 }
@@ -42,7 +72,8 @@ export function evaluateRoleOperationCapability(params) {
         peerKey: capabilityPeer,
         role: params.role,
         chatType: params.chatType,
-        isDaemonOwner: params.fromControlChannel && params.role === 'owner',
+        processRole: 'none',
+        isDaemonOwner: false,
         fromControlChannel: params.fromControlChannel,
         source: 'menu',
     });
@@ -75,6 +106,45 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (!sourceAllowed) {
         return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is not available from source ${ctx.source}`, operation, intent.scope, opMeta.dangerous);
     }
+    if (ctx.processRole === 'daemon-service') {
+        if (!DAEMON_SERVICE_OPERATIONS.has(operation)) {
+            return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'daemon-service',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'daemon-service',
+        };
+    }
+    if (requiresDaemonOwner(ctx, resolvedConfigCommand)) {
+        if (!hasDaemonOwnerRole(ctx)) {
+            const reasonCode = daemonOwnerDenialReasonCode(ctx);
+            return denyDecision(ctx, 'NOT_ALLOWED', daemonOwnerDenialMessage(ctx), operation, intent.scope, opMeta.dangerous, 'daemon-owner', reasonCode);
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'daemon-owner',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'daemon-owner',
+        };
+    }
+    // Any authenticated role may inspect the current Agent through the daemon's
+    // redacted view. Cross-Agent inspection is handled by requiresDaemonOwner().
+    if (operation === 'agent.show' && isCurrentAgentTarget(ctx)) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'self-agent-read',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
@@ -84,23 +154,17 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!identityMutationCheck.ok) {
             return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
         }
-        if (resolvedConfigCommand.kind === 'global' && !ctx.isDaemonOwner) {
-            return denyDecision(ctx, 'NOT_ALLOWED', `Global config command ${operation} requires daemon owner permission`, operation, intent.scope, opMeta.dangerous);
-        }
-        if (role === 'owner' && !ctx.isDaemonOwner && intent.scope === 'process') {
-            return denyDecision(ctx, 'SCOPE_MISMATCH', 'Agent owners cannot access process, defaults, or global config commands', operation, intent.scope, opMeta.dangerous);
-        }
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (ctx.isDaemonOwner || role === 'owner') {
+        if (role === 'owner') {
             return {
                 allow: true,
                 operation,
                 scope: intent.scope,
-                role: ctx.isDaemonOwner ? 'owner' : role,
+                role,
                 dangerous: opMeta.dangerous,
-                matchedRule: ctx.isDaemonOwner ? 'daemon-owner' : 'agent-owner',
+                matchedRule: 'agent-owner',
             };
         }
     }
@@ -159,7 +223,7 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (permission.constraints) {
         const constraintCheck = checkConstraints(ctx, permission.constraints, resolvedConfigCommand);
         if (!constraintCheck.ok) {
-            return denyDecision(ctx, constraintCheck.code ?? 'ARGUMENT_MISMATCH', constraintCheck.reason || 'Command arguments do not satisfy permission constraints', operation, intent.scope, opMeta.dangerous, matchedRule);
+            return denyDecision(ctx, constraintCheck.code ?? 'ARGUMENT_MISMATCH', constraintCheck.reason || 'Command arguments do not satisfy permission constraints', operation, intent.scope, opMeta.dangerous, matchedRule, constraintCheck.reasonCode);
         }
     }
     return {
@@ -186,6 +250,59 @@ function matchCommandPermission(operation, category, commandPerms, isDangerous)
     matches.sort((a, b) => b.rank - a.rank);
     return matches[0];
 }
+function requiresDaemonOwner(ctx, resolvedConfigCommand) {
+    const { operation, scope, args } = ctx.intent;
+    if (scope === 'process' || scope === 'control')
+        return true;
+    if (DAEMON_OWNER_PROCESS_OPERATIONS.has(operation))
+        return true;
+    if (resolvedConfigCommand
+        && (resolvedConfigCommand.kind === 'global'
+            || resolvedConfigCommand.configScope === 'process'
+            || resolvedConfigCommand.configScope === 'defaults'))
+        return true;
+    if (operation === 'agent.reload' && hasDaemonOwnerRole(ctx)) {
+        return true;
+    }
+    if (operation === 'agent.show' || operation === 'agent.reload') {
+        return !isCurrentAgentTarget(ctx);
+    }
+    if (operation.startsWith('trigger.')) {
+        if (ctx.fromControlChannel)
+            return true;
+        const taskAgentAid = stringArg(args.taskAgentAid);
+        const targetAgentAid = stringArg(args.targetAgentAid) ?? stringArg(args.self);
+        return !!taskAgentAid && !!targetAgentAid && taskAgentAid !== targetAgentAid;
+    }
+    return false;
+}
+function hasDaemonOwnerRole(ctx) {
+    return ctx.isDaemonOwner === true || ctx.processRole === 'daemon-owner';
+}
+function daemonOwnerDenialReasonCode(ctx) {
+    if ((ctx.intent.operation === 'agent.show' || ctx.intent.operation === 'agent.reload')
+        && ctx.intent.scope !== 'control'
+        && !ctx.fromControlChannel
+        && !isCurrentAgentTarget(ctx)) {
+        return 'TARGET_SELF_ONLY';
+    }
+    return 'DAEMON_OWNER_REQUIRED';
+}
+function daemonOwnerDenialMessage(ctx) {
+    return daemonOwnerDenialReasonCode(ctx) === 'TARGET_SELF_ONLY'
+        ? `${ctx.intent.operation} may only target the current Agent from a managed Agent task.`
+        : daemonOwnerRequiredMessage(ctx.intent.operation);
+}
+function isCurrentAgentTarget(ctx) {
+    const targetAid = stringArg(ctx.intent.args.targetAgentAid)
+        ?? stringArg(ctx.intent.args.aid)
+        ?? stringArg(ctx.intent.args.self);
+    return !!ctx.selfAid && !!targetAid && targetAid === ctx.selfAid;
+}
+function daemonOwnerRequiredMessage(operation) {
+    return `${operation} is a daemon-level operation and requires DaemonOwner. `
+        + 'Agent owner/admin and permissionMode=bypass do not grant this permission.';
+}
 function getRuleRank(rule, permission, operation, category, isDangerous) {
     const denyOffset = permission.allow ? 0 : 1;
     if (rule === operation)
@@ -215,8 +332,10 @@ function checkConstraints(ctx, constraints, resolvedConfigCommand) {
             return peerCheck;
     }
     if (constraints.ownAgentOnly || constraints.targetCurrentAgentOnly) {
-        const controlOwnerOverride = ctx.fromControlChannel && ctx.isDaemonOwner;
-        const targetAid = stringArg(ctx.intent.args.self) ?? stringArg(ctx.intent.args.aid);
+        const controlOwnerOverride = ctx.fromControlChannel && hasDaemonOwnerRole(ctx);
+        const targetAid = stringArg(ctx.intent.args.targetAgentAid)
+            ?? stringArg(ctx.intent.args.aid)
+            ?? stringArg(ctx.intent.args.self);
         if (!controlOwnerOverride && (!ctx.selfAid || !targetAid || targetAid !== ctx.selfAid)) {
             return { ok: false, reason: 'Only the current agent can be targeted' };
         }
@@ -238,8 +357,13 @@ function checkConstraints(ctx, constraints, resolvedConfigCommand) {
             reason: `Denied ${ctx.intent.operation}: role=${ctx.role}, source_chat=${ctx.chatType ?? 'unknown'}, target_group=${target}. This role may access group operations only from a group-chat task${sameGroup}; the target being a group is not sufficient.`,
         };
     }
-    if (constraints.requireDaemonOwner && !ctx.isDaemonOwner) {
-        return { ok: false, reason: 'This command requires daemon owner permission' };
+    if (constraints.requireDaemonOwner && !hasDaemonOwnerRole(ctx)) {
+        return {
+            ok: false,
+            code: 'NOT_ALLOWED',
+            reason: daemonOwnerRequiredMessage(ctx.intent.operation),
+            reasonCode: 'DAEMON_OWNER_REQUIRED',
+        };
     }
     if (constraints.requireControlChannel && !ctx.fromControlChannel) {
         return { ok: false, reason: 'This command requires the control channel' };
@@ -310,7 +434,7 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     if (policy === 'role-overridable-write'
         && resolvedConfigOp.fieldRule.access === 'owner-only'
         && ctx.role !== 'owner'
-        && !ctx.isDaemonOwner) {
+        && !hasDaemonOwnerRole(ctx)) {
         return { ok: false, reason: `Config field ${field} can only be changed by an owner` };
     }
     const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
@@ -386,7 +510,7 @@ function checkManagementIdentityMutation(ctx, command) {
     if (command.configScope !== 'agent') {
         return { ok: false, reason: `${field} requires an explicit current-agent target` };
     }
-    if (ctx.isDaemonOwner || ctx.role === 'owner')
+    if (hasDaemonOwnerRole(ctx) || ctx.role === 'owner')
         return { ok: true };
     return { ok: false, reason: `Only an Agent owner can modify ${field}` };
 }
@@ -625,7 +749,7 @@ function globMatches(pattern, value) {
 function stringArg(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
-function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRule) {
+function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRule, reasonCode) {
     return {
         allow: false,
         code,
@@ -635,5 +759,6 @@ function denyDecision(ctx, code, reason, operation, scope, dangerous, matchedRul
         role: ctx.role,
         dangerous,
         matchedRule,
+        ...(reasonCode ? { reasonCode } : {}),
     };
 }

package/dist/core/auth/operation-catalog.js

@@ -539,7 +539,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['control'],
         description: '列出所有 agent（敏感信息）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.show',
@@ -547,7 +547,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['control', 'agent'],
         description: '查看 agent 详情（敏感信息）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.baseagent.current',
@@ -587,7 +587,23 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control'],
         description: '创建新 agent',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
+    },
+    {
+        id: 'agent.enable',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['control'],
+        description: '启用 agent',
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
+    },
+    {
+        id: 'agent.disable',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['control'],
+        description: '停用 agent',
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     {
         id: 'agent.reload',
@@ -595,7 +611,7 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control', 'agent'],
         description: '重载 agent 配置',
-        sources: ['slash', 'menu', 'control'],
+        sources: ['slash', 'menu', 'agent-tool', 'control'],
     },
     {
         id: 'agent.bootstrapComplete',
@@ -611,7 +627,7 @@ const OPERATIONS = [
         dangerous: true,
         defaultScopes: ['control'],
         description: '删除 agent（危险操作）',
-        sources: ['menu', 'menu.cli', 'control'],
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
     // ── System Operations ──
     {

package/dist/core/bootstrap-messages.js

@@ -5,6 +5,7 @@ import { generateWelcomeMessage } from '../utils/welcome.js';
 import * as outbox from '../aun/outbox.js';
 import { chatDirPath } from './session/session-fs-store.js';
 import { hasMessageLogOperation } from './message/message-log.js';
+import { isDeliveryTarget, sameDeliveryTarget } from './message/message-utils.js';
 export const BOOTSTRAP_MESSAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export function bootstrapInitialMessageOperationId(aid) {
     return `bootstrap-initial:v1:${aid}`;
@@ -26,26 +27,29 @@ export function renderPostBootstrapWelcome(aid, owner, ownerName) {
         includeBindingNote: true,
     });
 }
-export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
+export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, delivery = { chatType: 'private' }) {
     const operationId = postBootstrapWelcomeOperationId(aid);
     const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
     if (hasMessageLogOperation(chatDir, operationId))
         return;
     const existing = outbox.findByDedupeKey(aid, operationId);
-    if (existing?.delivery?.chatType === 'private' && existing.channelId === owner)
+    if (existing
+        && existing.channelId === owner
+        && isDeliveryTarget(existing.delivery)
+        && sameDeliveryTarget(existing.delivery, delivery))
         return;
     if (existing)
         outbox.remove(aid, existing.id);
     outbox.enqueue(aid, {
         channelId: owner,
-        delivery: { chatType: 'private' },
+        delivery,
         dedupeKey: operationId,
         critical: true,
         type: 'text',
         text: renderPostBootstrapWelcome(aid, owner, ownerName),
         ttl: BOOTSTRAP_MESSAGE_TTL_MS,
         context: {
-            delivery: { chatType: 'private' },
+            delivery,
             metadata: {
                 source: 'daemon',
                 chatmode: 'interactive',
@@ -56,12 +60,13 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName) {
     });
 }
 export function hasPendingPostBootstrapWelcomeOutbox(aid) {
-    return outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid))?.delivery?.chatType === 'private';
+    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
+    return !!entry && outbox.isDeliveryForChannel(entry.delivery, entry.channelId);
 }
 /** Bind the durable completion welcome to the fresh post-bootstrap session. */
 export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
     const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    if (!entry || entry.delivery?.chatType !== 'private')
+    if (!entry || !outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
         return false;
     if (entry.context?.sessionId === sessionId)
         return true;

package/dist/core/bootstrap-service.js

@@ -144,9 +144,31 @@ export class BootstrapService {
         // owner. An inbound owner message may have arrived from a group, in which
         // case ctx.channelId is the group AID and must not be paired with the
         // private delivery route below (that would call message.send(to=group)).
-        const channelId = channelType === 'aun'
-            ? recipientId
-            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // A configured AUN recipient may itself be a group AID. Ask the channel's
+        // authoritative group endpoint before choosing the transport; never infer
+        // group/private semantics from the AID string or from the inbound venue.
+        let isGroupRecipient = false;
+        try {
+            isGroupRecipient = channelType === 'aun'
+                ? (await ctx.adapter.isGroup?.(recipientId)) === true
+                : false;
+        }
+        catch (error) {
+            // Group/private routing is security-sensitive. If the authoritative
+            // probe fails, do not guess a route, and release the single-flight key
+            // so a later connection or retry can recover.
+            this.inFlight.delete(key);
+            logger.warn(`[Bootstrap] Failed to resolve recipient type for ${aid}: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        const delivery = isGroupRecipient === true
+            ? { chatType: 'group', groupId: recipientId }
+            : { chatType: 'private' };
+        const channelId = delivery.chatType === 'group'
+            ? delivery.groupId
+            : channelType === 'aun'
+                ? recipientId
+                : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;
@@ -172,7 +194,7 @@ export class BootstrapService {
                 channelId,
                 agentName: aid,
                 replyContext: {
-                    delivery: { chatType: 'private' },
+                    delivery,
                     metadata: {
                         source: 'daemon',
                         persistRequired: true,

package/dist/core/causation/aun-association.js

@@ -44,14 +44,13 @@ function ensureLoaded() {
 }
 function persist() {
     try {
-        if (associations.size === 0) {
-            removeAssociationFiles();
-            return;
-        }
+        // Keep the protected mount target present even when there are no pending
+        // associations. Removing it races with Bubblewrap's H-class projection.
         atomicWriteJson(associationFile(), [...associations].map(([messageId, association]) => ({
             messageId,
             ...association,
         })));
+        removeAssociationBackups();
     }
     catch {
     }
@@ -106,6 +105,10 @@ export function clearAunCausationForTests() {
 function removeAssociationFiles() {
     const file = associationFile();
     fs.rmSync(file, { force: true });
+    removeAssociationBackups();
+}
+function removeAssociationBackups() {
+    const file = associationFile();
     fs.rmSync(`${file}_`, { force: true });
     fs.rmSync(`${file}__`, { force: true });
 }

package/dist/core/command/agent-control.js

@@ -11,22 +11,18 @@ import { isValidAid } from '../../aun/aid/validation.js';
 const SUPPORTED_AGENT_PATCH_FIELDS = new Set(['aid', 'name', 'avatar', 'active_baseagent', 'baseagents', 'projects', 'owners', 'chatmode', 'channels', 'channelOwners']);
 const HIDDEN_VALUE = '[hidden]';
 const SENSITIVE_CONFIG_KEYS = new Set([
-    'apiKey',
     'apikey',
-    'appId',
-    'appSecret',
-    'botId',
-    'clientId',
-    'clientSecret',
-    'secret',
-    'token',
-    'accessToken',
+    'appid',
+    'appsecret',
+    'botid',
     'authorization',
+    'clientid',
     'credential',
     'credentials',
     'password',
-    'privateKey',
-    'encryptionSeed',
+    'privatekey',
+    'encryptionseed',
+    'aeskey',
 ]);
 const HIDDEN_SETTINGS_KEYS = new Set([
     'pathToClaudeCodeExecutable',
@@ -225,7 +221,7 @@ function sanitizeConfigValue(value) {
             if (out.effort === undefined)
                 out.effort = sanitizeConfigValue(raw);
         }
-        else if (SENSITIVE_CONFIG_KEYS.has(key)) {
+        else if (isSensitiveConfigKey(key)) {
             out[key] = raw == null || raw === '' ? raw : HIDDEN_VALUE;
         }
         else if (key === 'projects') {
@@ -237,6 +233,18 @@ function sanitizeConfigValue(value) {
     }
     return out;
 }
+function isSensitiveConfigKey(key) {
+    const normalized = key.replace(/[-_\s]/g, '').toLowerCase();
+    return SENSITIVE_CONFIG_KEYS.has(normalized)
+        || normalized.endsWith('token')
+        || normalized.endsWith('secret')
+        || normalized.endsWith('password')
+        || normalized.endsWith('credential')
+        || normalized.endsWith('credentials')
+        || normalized.endsWith('privatekey')
+        || normalized.endsWith('apikey')
+        || normalized.endsWith('authorization');
+}
 function buildSafeAgentConfig(config) {
     if (!config)
         return null;
@@ -592,14 +600,15 @@ export async function execAgentQuery(args) {
     }
     const config = cfgRead(ConfigTarget.Agent, { self: aid });
     const safeConfig = buildSafeAgentConfig(config);
+    const safeAgentConfig = safeConfig ?? {};
     const data = {
         ...res,
         config: {
             ...(res.config ?? {}),
-            active_baseagent: config?.active_baseagent ?? res.config?.baseagent ?? null,
-            projects: stripUnsupportedProjectFields(config?.projects) ?? {},
-            baseagents: config?.baseagents ?? {},
-            owners: config?.owners ?? res.config?.owners ?? [],
+            active_baseagent: safeAgentConfig.active_baseagent ?? res.config?.baseagent ?? null,
+            projects: safeAgentConfig.projects ?? {},
+            baseagents: safeAgentConfig.baseagents ?? {},
+            owners: safeAgentConfig.owners ?? res.config?.owners ?? [],
         },
         safeConfig,
     };

package/dist/core/command/command-handler.js

@@ -19,7 +19,7 @@ import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
-import { hashArgv } from '../auth/authorization-audit.js';
+import { auditCommandAuthorization, hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
 import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
 import { executeManagedGroupOperation, isManagedGroupRelationRead, ManagedGroupOperationError, resolveManagedGroupOperation, executeManagedMsgOperation, ManagedMsgOperationError, resolveManagedMsgOperation, executeManagedFsOperation, ManagedFsOperationError, resolveManagedFsOperation, } from '../../aun/msg/managed-operation.js';
@@ -27,7 +27,7 @@ import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { isHClassPath, isLClassPath, isSameOrDescendant } from '../protected-paths.js';
 import { validateModelSelectionForRole } from '../model/model-permission.js';
 import { getModelInfo } from '../model/model-catalog.js';
-import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride } from '../role/runtime-policy.js';
+import { constrainRuntimePermissionMode, resolveRuntimePermissionMode, validateRuntimeStringFieldOverride } from '../role/runtime-policy.js';
 import { parsePeerKey } from '../relation/peer-identity.js';
 import { isQuickCommand } from './slash-gate.js';
 import { handleSlashCommand } from './slash-handler.js';
@@ -1002,7 +1002,13 @@ export class CommandHandler {
             }
             const payload = result;
             if (payload.kind === 'command.error') {
-                return { error: payload.text || '执行失败', code: 'EXEC_FAILED' };
+                return {
+                    error: payload.text || '执行失败',
+                    code: payload.reason || 'EXEC_FAILED',
+                    ...(payload.reasonCode ? {
+                        data: { reasonCode: payload.reasonCode, nextStep: payload.nextStep },
+                    } : {}),
+                };
             }
             const data = payload.structured && typeof payload.structured === 'object'
                 ? { ...payload.structured }
@@ -1771,6 +1777,7 @@ export class CommandHandler {
                 },
             },
             auditMetadata: {
+                correlationId: grant.taskId,
                 argvHash: hashArgv(parsed.command.canonicalArgv),
                 taskId: grant.taskId,
                 messageId: grant.messageId,
@@ -1854,8 +1861,41 @@ export class CommandHandler {
         if (!session)
             return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
         const parsed = resolveManagedMsgOperation(argv);
-        if (!parsed.ok)
+        if (!parsed.ok) {
+            const grant = delegation.grant;
+            auditCommandAuthorization({
+                ts: Date.now(),
+                source: 'agent-tool',
+                operation: 'ec.msg.managed.parse',
+                scope: 'relation',
+                dangerous: false,
+                decision: 'deny',
+                executed: false,
+                executionState: 'blocked',
+                decisionSource: 'policy',
+                policyCode: parsed.code,
+                code: parsed.code,
+                reason: parsed.reason,
+                correlationId: grant.taskId,
+                requestId: grant.taskId,
+                sessionId,
+                agentAid: grant.selfAid,
+                permissionMode: resolveRuntimePermissionMode({ selfAid: grant.selfAid, role: grant.issuedRole }).effectiveValue,
+                actorId: grant.actorId,
+                selfAid: grant.selfAid,
+                peerKey: grant.peerKey,
+                channel: grant.channel,
+                role: grant.issuedRole,
+                taskId: grant.taskId,
+                messageId: grant.messageId,
+                argvHash: hashArgv(argv),
+                argsSummary: {
+                    subcommand: String(argv[1] ?? argv[0] ?? '<missing>'),
+                    providedOptions: argv.filter(value => typeof value === 'string' && value.startsWith('--')).join(','),
+                },
+            });
             return { ok: false, code: parsed.code, error: parsed.reason };
+        }
         const grant = delegation.grant;
         const grantSelfAid = grant.selfAid.replace(/^@/, '');
         const sessionSelfAid = session.selfAID?.replace(/^@/, '');
@@ -1897,9 +1937,15 @@ export class CommandHandler {
                     targetId: parsed.command.target,
                     peer: parsed.command.target,
                     peerKey: formatPeerKey('aun', parsed.command.target),
+                    ...(parsed.command.session ? { session: parsed.command.session } : {}),
+                    ...(parsed.command.limit !== undefined ? { limit: parsed.command.limit } : {}),
+                    ...(parsed.command.before !== undefined ? { before: parsed.command.before } : {}),
+                    ...(parsed.command.after !== undefined ? { after: parsed.command.after } : {}),
+                    ...(parsed.command.direction ? { direction: parsed.command.direction } : {}),
                 },
             },
             auditMetadata: {
+                correlationId: grant.taskId,
                 argvHash: hashArgv(parsed.command.canonicalArgv),
                 taskId: grant.taskId,
                 messageId: grant.messageId,

package/dist/core/command/group-menu.js

@@ -225,7 +225,7 @@ function updateSetting(key, target, value, args, context) {
     if (!allowed.has(raw)) {
         throw new GroupMenuError('INVALID_ARGUMENT', `Invalid ${key} value: ${raw || '<empty>'}`);
     }
-    if (key === 'rulesPolicy' && context.role !== 'owner' && !context.isDaemonOwner) {
+    if (key === 'rulesPolicy' && context.role !== 'owner') {
         throw new GroupMenuError('PERMISSION_DENIED', 'rulesPolicy can only be changed by an Agent owner');
     }
     const expectedRevision = stringArg(args?.expectedRevision);