evolcore 0.0.19 → 0.0.21

package/dist/index.js

@@ -13,9 +13,11 @@ import { ClaudeSessionFileAdapter } from './core/session/adapters/claude-session
 import { CodexSessionFileAdapter } from './core/session/adapters/codex-session-file-adapter.js';
 import { GeminiSessionFileAdapter } from './core/session/adapters/gemini-session-file-adapter.js';
 import { EcagentSessionFileAdapter } from './core/session/adapters/ecagent-session-file-adapter.js';
-import { loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfig, initializeEckSnapshotsConfig } from './config-store.js';
+import { autoMigrateIfNeeded, loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfig, initializeEckSnapshotsConfig, isFullAccessEnabled } from './config-store.js';
+import { DEFAULT_ECWEB_PORT, ecwebService } from './config/daemon-services.js';
 import { ConfigTarget, initConfigManager, onConfigWrite, read as readConfig, shouldFailFastForMissingOwners } from './config/config-manager.js';
 import { ensureRoleConfigV4OnStartup, ensureRoleConfigV5OnStartup } from './config/role-migration-startup.js';
+import { ensureAuxiliaryModelMigrationOnStartup } from './config/schema-migration.js';
 import { ensureContactBookV2OnStartup } from './config/contact-book-v2-startup.js';
 import { resolvePeerDisplayLabel } from './config/contact-book.js';
 import { expirePendingContactRequests } from './config/contact-request-service.js';
@@ -42,6 +44,7 @@ import { buildEnvelope, isDeliveryTargetForChannel, replyContextFromSession } fr
 import { ResponseEngine } from './core/message/response-engine.js';
 import { MessageQueue } from './core/message/message-queue.js';
 import { MessageBridge } from './core/message/message-bridge.js';
+import { evaluateOutboundContactAdmission } from './core/message/message-admission.js';
 import { evaluateEvolMenuVersionGate, evolMenuResponseTransportMetadata, MenuRequestDeduper, hasValidMenuId, menuFailure, menuPayloadFingerprint, normalizeMenuResponseTiming, parseMenuControl, validateMenuRequest, withMenuProcessingTime, logMenuRequestCompleted, logMenuRequestReceived } from './core/command/menu-protocol.js';
 import { readInstalledEvolcoreVersion } from './utils/evolcore-version.js';
 import { recoverAllRoleMutationsSync } from './core/command/role-menu.js';
@@ -50,17 +53,19 @@ import { BootstrapService, completeBootstrapWithWelcome } from './core/bootstrap
 import { postBootstrapWelcomeOperationId } from './core/bootstrap-messages.js';
 import { MessageCache } from './core/message/message-cache.js';
 import { CommandHandler, isProcessLevelOwner } from './core/command/command-handler.js';
+import { AgentApplicationService } from './core/agent-application-service.js';
 import { EventBus } from './core/event-bus.js';
 import { eventPatternIncludesInternal, getEventCatalog } from './core/event-catalog.js';
 import { StatsCollector } from './utils/stats.js';
 import { AidStatsCollector } from './utils/stats.js';
 import { PermissionGateway } from './core/permission/approval-gateway.js';
 import { InteractionRouter, registerAdapterInteractions } from './core/interaction-router.js';
-import { AgentDelegationRegistry, authorizeDelegatedAunMsgSend } from './core/auth/agent-delegation.js';
-import { authorizeOperation, buildAuthSubject, isCrossAgentTriggerOperationAllowed, } from './core/auth/auth-gateway.js';
+import { AgentDelegationRegistry, authorizeDelegatedAunMsgSend, hasTrustedFullAccessDelegation, trustedExecutionIdentityInput, } from './core/auth/agent-delegation.js';
+import { authorizeOperation, buildAuthSubject, canApprovePersistentFullAccessTrigger, isCrossAgentTriggerOperationAllowed, } from './core/auth/auth-gateway.js';
 import { authorizationDenialData, formatAuthorizationDenial } from './core/auth/authorization-denial.js';
+import { auditFullAccessEvent } from './core/auth/authorization-audit.js';
 import { parsePeerKey } from './core/relation/peer-identity.js';
-import { isHClassPath } from './core/protected-paths.js';
+import { isHClassPath } from './core/permission/protected-paths.js';
 import { ChannelLoader, tryParseChannelKey } from './core/channel-loader.js';
 import { AgentLoader } from './core/baseagent-loader.js';
 import { EvolAgentRegistry } from './core/evolagent-registry.js';
@@ -490,7 +495,6 @@ async function runBindBootstrapDaemon(daemonCfg) {
         agentName: daemonCfg.aid,
         channelName: 'control',
         pureIdentity: true,
-        gatewayUrl: daemonCfg.aun?.gatewayUrl,
         defaultEncrypt: daemonCfg.aun?.defaultEncrypt,
         aunTrace: daemonCfg.debug?.aunTrace,
         aunSdkLog: daemonCfg.debug?.aunSdkLog,
@@ -734,6 +738,7 @@ async function main() {
         console.error(`[EvolCore] 包路径:   ${pkgRoot}`);
         console.error(`[EvolCore] 代码时间: ${latestMtime ? fmtTime(latestMtime) : '?'}`);
     }
+    console.error('[EvolCore] ✓ Version info printed');
     // 过滤飞书 SDK 的 info 日志
     const originalLog = console.log;
     const originalInfo = console.info;
@@ -751,12 +756,16 @@ async function main() {
             return;
         originalInfo(...args);
     };
+    console.error('[EvolCore] ✓ Console filter installed');
     logger.info(`EvolCore v${readEvolcoreVersion()} starting... (fastaun v${readFastaunVersion()})`);
+    console.error('[EvolCore] ✓ Logger initialized');
     // 确保数据目录存在
     ensureDataDirs();
+    console.error('[EvolCore] ✓ Data dirs ensured');
     // AUN keystore seed is an EvolCore application constant. A custom value can
     // make existing identities unreadable, so fail before migrations, snapshots,
     // instance registration, and service startup.
+    console.error('[EvolCore] ✓ Checking AUN encryption seed...');
     try {
         assertAunEncryptionSeedPolicy(loadDaemonConfig().aun?.encryptionSeed, process.env.AUN_ENCRYPTION_SEED);
     }
@@ -766,6 +775,7 @@ async function main() {
         console.error(msg);
         process.exit(1);
     }
+    console.error('[EvolCore] ✓ AUN encryption seed validated');
     // .env 文件已在模块顶部加载，此处不再重复加载
     // ── 单实例保护（pre-check + post-write self-check）──
     // pre-check：发现已有活 main 直接退出，避免起任何副作用
@@ -780,11 +790,19 @@ async function main() {
             process.exit(1);
         }
     }
-    // 在登记 daemon 实例前自动备份并迁移旧角色配置；失败才阻止启动。
+    // 在登记 daemon 实例前自动备份并迁移旧配置；失败才阻止启动。
     try {
         // Crash recovery must precede schema gates and migrations so they never
         // inspect or migrate a partially applied Role Menu transaction.
         recoverAllRoleMutationsSync();
+        autoMigrateIfNeeded();
+        const auxiliaryModelMigration = await ensureAuxiliaryModelMigrationOnStartup();
+        if (auxiliaryModelMigration) {
+            const msg = `✓ Session Renew auxiliary model migration applied automatically: ${auxiliaryModelMigration.changedFiles} file(s)`
+                + (auxiliaryModelMigration.backup ? `; backup: ${auxiliaryModelMigration.backup}` : '');
+            logger.info(msg);
+            console.error(msg);
+        }
         const migration = await ensureRoleConfigV4OnStartup();
         if (migration) {
             const msg = `✓ Role config v4 migration applied automatically: ${migration.changedFiles} file(s)` +
@@ -829,7 +847,7 @@ async function main() {
     }
     // ── 自动迁移 ──
     migrateIdentitiesIfNeeded();
-    // autoMigrateIfNeeded 已随配置体系 v2 退场（fresh init，不做兼容过渡）。
+    // daemon.json 的旧 ecweb/serviceProxy 结构已在启动前归一化为 services[]。
     // ── 配置体系初始化（schema 字段不相交硬约束校验）──
     try {
         initConfigManager();
@@ -892,9 +910,10 @@ async function main() {
     // instance just before spawning us; the supervisor adopts it when healthy,
     // otherwise starts one and keeps it alive for the daemon's lifetime.
     let ecwebSupervisor = null;
-    if (daemonCfg.ecweb?.enabled) {
+    const ecwebConfig = ecwebService(daemonCfg.services);
+    if (ecwebConfig?.enabled === true) {
         ecwebSupervisor = createEcwebSupervisor({
-            port: daemonCfg.ecweb.port ?? 42705,
+            port: ecwebConfig.port ?? DEFAULT_ECWEB_PORT,
             logger,
         });
         try {
@@ -1047,8 +1066,8 @@ async function main() {
     agentLoader.register(new EcagentAgentPlugin());
     const creationErrors = [];
     const agentInstances = agentLoader.createAll(agentRegistry, {
-        onSessionIdUpdate: async (sessionId, agentSessionId) => {
-            await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+        onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+            return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
         },
     }, creationErrors);
     // agentMap 复合键：${aid}::${baseagent}
@@ -1194,6 +1213,7 @@ async function main() {
     const agentDelegationRegistry = new AgentDelegationRegistry();
     // 创建命令处理器
     const cmdHandler = new CommandHandler(sessionManager, agentMap, messageCache, eventBus, primaryRunnerKey);
+    let agentApplicationService;
     cmdHandler.setAgentDelegationRegistry(agentDelegationRegistry);
     cmdHandler.setPermissionGateway(permissionGateway);
     cmdHandler.setInteractionRouter(interactionRouter);
@@ -1429,10 +1449,19 @@ async function main() {
             && definition.feedback.target?.channelKey === 'daemon') {
             return 'daemon-control feedback';
         }
+        if (definition.execution.permissionMode === 'fullaccess')
+            return 'persistent fullaccess Trigger';
         return undefined;
     };
-    const hasDaemonTriggerAuthority = (subject) => (subject.isDaemonOwner || subject.processRole === 'daemon-service');
+    const hasDaemonTriggerAuthority = (subject) => (subject.isDaemonOwner || subject.processRole === 'daemon-service' || subject.dataScope === 'daemon');
     const validateTriggerDefinitionForActor = (definition, actor) => {
+        if (definition.execution.permissionMode === 'fullaccess') {
+            if (!isFullAccessEnabled())
+                throw new Error('fullaccess is disabled by daemon.json');
+            if (!actor.daemonOwner && !actor.fullAccess) {
+                throw new Error('persistent fullaccess Trigger requires DaemonOwner or fullaccess-run');
+            }
+        }
         const privilegedReason = daemonPrivilegedTriggerReason(definition);
         if (privilegedReason && !actor.daemonPrivileged)
             throw new Error(`${privilegedReason} requires DaemonOwner`);
@@ -1483,9 +1512,30 @@ async function main() {
         }
     };
     const authorizeTriggerExecution = (definition) => {
+        if (definition.execution.permissionMode === 'fullaccess' && !isFullAccessEnabled()) {
+            return { allowed: false, reason: 'fullaccess is disabled by daemon.json' };
+        }
+        if (definition.execution.permissionMode === 'fullaccess') {
+            if (!definition.authorizedBy) {
+                return { allowed: false, reason: 'fullaccess Trigger approval provenance is missing' };
+            }
+            const owners = new Set(loadDaemonConfig().owners ?? []);
+            if (!owners.has(definition.authorizedBy)) {
+                return { allowed: false, reason: 'fullaccess Trigger approver is no longer a current daemon-owner' };
+            }
+        }
         const origin = definition.origin;
         if (!origin?.peerId)
             return { allowed: false, reason: 'trigger origin peer is missing' };
+        // A persistent fullaccess definition is an already-approved daemon-scope
+        // task. Its origin remains useful for audit and feedback routing, but a
+        // relation lookup on the origin actor would make a cross-Agent Trigger
+        // persist successfully and then fail on every fire after creation.
+        // Approval provenance and the feature flag above remain mandatory; only
+        // the ordinary creator relation gate is bypassed for this mode.
+        if (definition.execution.permissionMode === 'fullaccess') {
+            return { allowed: true };
+        }
         if (origin.channelKey === 'daemon') {
             const subject = buildAuthSubject({
                 selfAid: definition.agentAid,
@@ -1552,7 +1602,8 @@ async function main() {
             return { allowed: false, reason: operationDecision.reason };
         }
         const privilegedReason = daemonPrivilegedTriggerReason(definition);
-        if (privilegedReason && !hasDaemonTriggerAuthority(subject)) {
+        const persistedFullAccessApproval = privilegedReason === 'persistent fullaccess Trigger';
+        if (privilegedReason && !persistedFullAccessApproval && !hasDaemonTriggerAuthority(subject)) {
             return { allowed: false, reason: `${privilegedReason} requires current DaemonOwner` };
         }
         if (definition.feedback.strategy === 'target' && !isManagementRole(role)) {
@@ -1600,6 +1651,7 @@ async function main() {
                 management: true,
                 daemonOwner: false,
                 daemonPrivileged: true,
+                fullAccess: false,
                 control: true,
                 role: 'none',
                 subject,
@@ -1638,18 +1690,20 @@ async function main() {
             identity: roleToSessionIdentity(currentRole),
             processOwners: loadDaemonConfig().owners ?? [],
             fromControlChannel: false,
+            ...trustedExecutionIdentityInput(validation.grant),
         });
-        if (validation.grant.selfAid !== agentAid && !subject.isDaemonOwner) {
+        if (validation.grant.selfAid !== agentAid && subject.dataScope !== 'daemon') {
             throw new Error('cross-agent Trigger operations require DaemonOwner');
         }
-        if (!subject.isDaemonOwner && !checkRoleAccess(currentRole, agentAid)) {
+        if (subject.dataScope !== 'daemon' && !checkRoleAccess(currentRole, agentAid)) {
             throw new Error('trigger actor no longer has access to this agent');
         }
         return {
             origin: actorOrigin,
-            management: isManagementRole(currentRole) || subject.isDaemonOwner,
+            management: isManagementRole(currentRole) || subject.dataScope === 'daemon',
             daemonOwner: subject.isDaemonOwner,
-            daemonPrivileged: subject.isDaemonOwner,
+            daemonPrivileged: subject.isDaemonOwner || subject.dataScope === 'daemon',
+            fullAccess: subject.processRole === 'fullaccess-run',
             selfAid: validation.grant.selfAid,
             control: false,
             role: currentRole || 'none',
@@ -1792,6 +1846,7 @@ async function main() {
     msgBridge.setInteractionRouter(interactionRouter);
     msgBridge.setContactBindRuntimeChecker(isContactBindChannelReady);
     msgBridge.setAidStatsCollector(aidStatsCollector);
+    cmdHandler.setContactRequestSubmitter((input) => msgBridge.submitAgentContactRequest(input));
     bootstrapService = new BootstrapService(agentRegistry, eventBus);
     msgBridge.setBootstrapService(bootstrapService);
     msgBridge.setHandoffRuntime(handoffRuntime);
@@ -1813,7 +1868,14 @@ async function main() {
                 payload: summarizeOutboundPayload(payload),
             });
             const result = await originalSend(envelope, payload);
-            if (shouldCountSentPayload(payload)) {
+            // AUN adapters return an explicit receipt. Only a receipt with a remote
+            // message ID proves delivery; queued/failed results must not be emitted
+            // as `message:sent`. Legacy adapters that return void remain compatible.
+            const deliveryConfirmed = result === undefined
+                || (result && typeof result === 'object' && result.status === 'sent'
+                    && typeof result.messageId === 'string'
+                    && result.messageId.length > 0);
+            if (shouldCountSentPayload(payload) && deliveryConfirmed) {
                 if ((inst.channelType || inst.adapter.channelName) !== 'aun') {
                     try {
                         const logPayload = outboundPayloadToLogText(payload);
@@ -2246,8 +2308,11 @@ async function main() {
     // Register every IPC executor/provider before exposing the endpoint. The
     // function declaration is hoisted, while its invocation remains here so a
     // failed bind still aborts before any AUN connection is attempted.
+    console.error('[EvolCore] ✓ Configuring IPC...');
     configureIpc();
+    console.error('[EvolCore] ✓ Starting IPC server...');
     await ipcServer.start();
+    console.error('[EvolCore] ✓ IPC server started');
     // ── 连接所有渠道（后台首连，AUN/任意渠道故障不阻塞 daemon 主流程）──
     logger.info(`🚀 EvolCore core is ready; connecting ${channelInstances.length} channel(s) in background`);
     const connectAllPromise = channelLoader.connectAll(channelInstances, {
@@ -2296,7 +2361,6 @@ async function main() {
             agentName: daemonCfg.aid,
             channelName: 'control',
             pureIdentity: true,
-            gatewayUrl: daemonCfg.aun?.gatewayUrl,
             defaultEncrypt: daemonCfg.aun?.defaultEncrypt,
             aunTrace: daemonCfg.debug?.aunTrace,
             aunSdkLog: daemonCfg.debug?.aunSdkLog,
@@ -2341,7 +2405,7 @@ async function main() {
                         ...(response.name ? { name: response.name } : {}),
                     };
                     try {
-                        await controlChannel.sendStructured(opts.channelId, timedResponse, menuResponseContext());
+                        await controlChannel.sendStructuredOrThrow(opts.channelId, timedResponse, menuResponseContext());
                         logMenuRequestCompleted(request, timedResponse, menuFlowContext, { delivery: 'sent' });
                         menuCompletionLogged = true;
                     }
@@ -2361,7 +2425,7 @@ async function main() {
                         // 用 sendStructured 直发 typed payload（payload.type='bind.response'），
                         // 不能用 sendMessage——它会把内容包成 {type:'text', text:...}，App 无法识别。
                         // encrypted 跟随入站请求：bind.response 与 bind.request 的加密/明文对称。
-                        await controlChannel.sendStructured(opts.channelId, response, controlReplyContext(opts));
+                        await controlChannel.sendStructuredOrThrow(opts.channelId, response, controlReplyContext(opts));
                     }
                     return;
                 }
@@ -2396,8 +2460,8 @@ async function main() {
                     return;
                 }
                 if (text.toLowerCase() === '/pair') {
-                    const port = daemonCfg.ecweb?.port ?? 42705;
-                    const pair = await fetchEcwebPairCode(port);
+                    const port = ecwebService(loadDaemonConfig().services)?.port ?? DEFAULT_ECWEB_PORT;
+                    const pair = await fetchEcwebPairCode(port, opts.peerId);
                     let reply;
                     if (pair) {
                         const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
@@ -2460,11 +2524,12 @@ async function main() {
         // ── Service Proxy：把本地服务（ecweb 等）通过控制 AID 暴露到 AUN 网络 ──
         // 挂在控制 AUNChannel 上，动态解引用其 client（规避重连换 client）。
         // 失败只 warn，不影响 daemon 主流程。
-        if (daemonCfg.serviceProxy?.enabled && daemonCfg.aid) {
+        const proxyServices = (daemonCfg.services ?? []).filter((service) => service.enabled === true && service.proxy?.enabled === true);
+        if (proxyServices.length > 0 && daemonCfg.aid) {
             // 短暂延迟确保控制 channel 完全就绪
             const channel = controlChannel;
             const aid = daemonCfg.aid;
-            const config = daemonCfg.serviceProxy;
+            const config = proxyServices;
             setTimeout(() => {
                 if (!channel)
                     return;
@@ -2795,7 +2860,7 @@ async function main() {
             if (delegation.grant.selfAid !== selfAid) {
                 return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation self agent does not match current session' };
             }
-            if (params.agent && params.agent !== selfAid) {
+            if (params.agent && params.agent !== selfAid && !hasTrustedFullAccessDelegation(delegation.grant)) {
                 return { ok: false, code: 'HANDOFF_AGENT_SCOPE_MISMATCH', error: 'agent does not match the current session' };
             }
             let conversationId;
@@ -2814,8 +2879,9 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
-            const managementRole = isManagementRole(subject.role);
+            const managementRole = isManagementRole(subject.role) || subject.dataScope === 'daemon';
             const decision = authorizeOperation({
                 source: 'agent-tool',
                 subject,
@@ -2938,6 +3004,12 @@ async function main() {
             if (!ch) {
                 return { ok: false, error: `AUN channel not found for ${params.aid}`, code: 'AUN_CHANNEL_NOT_FOUND' };
             }
+            if (params.scope === 'msg') {
+                const admission = await evaluateOutboundContactAdmission({ selfAid: params.aid, targetAid: params.to });
+                if (!admission.allow) {
+                    return { ok: false, error: admission.error, code: admission.code };
+                }
+            }
             // The IPC command already carries the caller-selected transport scope.
             // Never reclassify the target by parsing its AID string: a private AID may
             // look group-like and a group identifier may use a future format.
@@ -3106,8 +3178,8 @@ async function main() {
                 const staged = candidate.config.enabled === false
                     ? []
                     : agentLoader.createForAgent(candidate, {
-                        onSessionIdUpdate: async (sessionId, agentSessionId) => {
-                            await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+                        onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+                            return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
                         },
                     }, creationErrors);
                 const onDisposeError = (instance, error) => {
@@ -3206,8 +3278,8 @@ async function main() {
                 }
                 const creationErrors = [];
                 const newAgentInstances = agentLoader.createForAgent(agent, {
-                    onSessionIdUpdate: async (sessionId, agentSessionId) => {
-                        await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+                    onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+                        return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
                     },
                 }, creationErrors);
                 for (const inst of newAgentInstances) {
@@ -3374,22 +3446,61 @@ async function main() {
                     resyncInFlight = undefined;
             }
         };
+        // Core-owned agent application facade. Menu/slash/managed-task callers use
+        // this in-process service after their own authorization checks; standalone
+        // CLI commands continue to reach these operations through IPC.
+        const coreHotLoadAgent = async (aid) => {
+            const hotLoad = globalThis.__evolcore_hotLoadAgent;
+            if (typeof hotLoad !== 'function')
+                throw new Error('Hot-load handler not initialized');
+            await hotLoad(aid);
+        };
+        const coreResyncAgents = async () => {
+            const resync = globalThis.__evolcore_resyncAgents;
+            if (typeof resync !== 'function')
+                throw new Error('Resync handler not initialized');
+            return await resync();
+        };
+        agentApplicationService = new AgentApplicationService({
+            registry: agentRegistry,
+            reload: (aid, options) => reloadCoordinator.reload(aid, options),
+            hooks: reloadHooks,
+            hotLoad: coreHotLoadAgent,
+            resync: coreResyncAgents,
+            create: async (options) => {
+                const { agentCreateNonInteractive } = await import('./cli/agent.js');
+                return await agentCreateNonInteractive(options, { hotLoadAgent: coreHotLoadAgent });
+            },
+            aunAids: () => channelInstances.flatMap((inst) => {
+                if (inst.channelType !== 'aun')
+                    return [];
+                const state = inst.channel?.getAidState?.();
+                return state ? [state] : [];
+            }),
+            aunAidStats: () => aidStatsCollector.getAllSnapshots(),
+        });
+        cmdHandler.setAgentApplicationService(agentApplicationService);
+        ipcServer.setAgentApplicationService(agentApplicationService);
         ipcServer.setStatsProvider(() => statsCollector.getSnapshot());
-        ipcServer.setAgentStatsProvider(() => agentRegistry.list().map((agent) => {
-            const snap = statsCollector.getSnapshot(agent.aid);
-            return {
-                aid: agent.aid,
-                received: snap.lastHour.received,
-                sent: snap.lastHour.sent,
-                completed: snap.lastHour.completed,
-                errors: snap.lastHour.errors,
-                interrupts: snap.lastHour.interrupts,
-                avgResponseMs: snap.lastHour.avgResponseMs,
-                processing: messageQueue.getProcessingCountByAgent(agent.aid),
-                queued: messageQueue.getQueueLengthByAgent(agent.aid),
-                muted: messageQueue.isAgentMuted(agent.aid),
-            };
-        }));
+        ipcServer.setAgentStatsProvider(() => {
+            const agents = agentRegistry.list();
+            const snapshots = statsCollector.getSnapshots(agents.map(agent => agent.aid));
+            return agents.map((agent) => {
+                const snap = snapshots.get(agent.aid);
+                return {
+                    aid: agent.aid,
+                    received: snap.lastHour.received,
+                    sent: snap.lastHour.sent,
+                    completed: snap.lastHour.completed,
+                    errors: snap.lastHour.errors,
+                    interrupts: snap.lastHour.interrupts,
+                    avgResponseMs: snap.lastHour.avgResponseMs,
+                    processing: messageQueue.getProcessingCountByAgent(agent.aid),
+                    queued: messageQueue.getQueueLengthByAgent(agent.aid),
+                    muted: messageQueue.isAgentMuted(agent.aid),
+                };
+            });
+        });
         // Queue snapshot & action (for ec queue --agent CLI)
         ipcServer.setQueueSnapshotProvider((params) => {
             const handle = agentRegistry.get(params.agent);
@@ -3447,8 +3558,11 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
-            if (params.targetAid && params.targetAid !== delegation.grant.selfAid && !subject.isDaemonOwner) {
+            if (params.targetAid
+                && params.targetAid !== delegation.grant.selfAid
+                && subject.dataScope !== 'daemon') {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'only the current Agent can be targeted' };
             }
             const decision = authorizeOperation({
@@ -3463,7 +3577,10 @@ async function main() {
                 auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
             });
             return decision.allow
-                ? { ok: true, aid: delegation.grant.selfAid }
+                ? {
+                    ok: true,
+                    aid: subject.dataScope === 'daemon' ? (params.targetAid ?? delegation.grant.selfAid) : delegation.grant.selfAid,
+                }
                 : { ok: false, code: decision.code, error: decision.reason };
         }
         ipcServer.setAgentOperationExecutor(async (argv, sessionId, delegationToken, delegationCommandHash) => {
@@ -3528,6 +3645,7 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
             const decision = authorizeOperation({
                 source: 'agent-tool',
@@ -3555,7 +3673,7 @@ async function main() {
             }
             const { execAgentAction, execAgentOptions, execAgentQuery } = await import('./core/command/agent-control.js');
             if (operation === 'agent.list') {
-                const result = await execAgentOptions({ options: 'all' });
+                const result = await execAgentOptions({ options: 'all' }, agentApplicationService);
                 if ('error' in result)
                     return fail(result.code, result.error);
                 const agents = Array.isArray(result.data?.agents) ? result.data.agents.map((agent) => ({
@@ -3572,7 +3690,7 @@ async function main() {
                 return { ok: true, result: { ok: true, agents, redacted: true } };
             }
             if (operation === 'agent.show') {
-                const result = await execAgentQuery({ aid: targetAid });
+                const result = await execAgentQuery({ aid: targetAid }, agentApplicationService);
                 if ('error' in result)
                     return fail(result.code, result.error);
                 const agent = result.data ?? {};
@@ -3614,7 +3732,7 @@ async function main() {
                     return fail('INVALID_ARGS', validationError);
                 if (argv.includes('--dry-run'))
                     return { ok: true, result: { ok: true, dryRun: true, plan } };
-                const result = await agentCreateNonInteractive({
+                const createOptions = {
                     aid: plan.aid,
                     project: plan.project,
                     baseagent: plan.baseagent,
@@ -3622,22 +3740,33 @@ async function main() {
                     name: plan.name,
                     description: plan.description,
                     force: argv.includes('--force'),
-                });
+                };
+                const result = agentApplicationService
+                    ? await agentApplicationService.create(createOptions)
+                    : await agentCreateNonInteractive(createOptions);
                 return !result.ok
                     ? fail(result.code ?? 'INTERNAL', result.error)
                     : { ok: true, result: { ...result, configPath: '[redacted]' } };
             }
             if (operation === 'agent.delete') {
-                const { agentDelete } = await import('./cli/agent.js');
-                const result = await agentDelete(targetAid ?? '', argv.includes('--purge'));
+                const result = agentApplicationService
+                    ? await agentApplicationService.delete(targetAid ?? '', argv.includes('--purge'))
+                    : await (async () => {
+                        const { agentDelete } = await import('./cli/agent.js');
+                        return await agentDelete(targetAid ?? '', argv.includes('--purge'));
+                    })();
                 return 'error' in result ? fail(result.code ?? 'INTERNAL', result.error) : { ok: true, result };
             }
             if (operation === 'agent.reload' && !targetAid) {
-                const { agentReload } = await import('./cli/agent.js');
-                const result = await agentReload();
+                const result = agentApplicationService
+                    ? await agentApplicationService.reload()
+                    : await (async () => {
+                        const { agentReload } = await import('./cli/agent.js');
+                        return await agentReload();
+                    })();
                 return !result.ok ? fail(result.code ?? 'INTERNAL', result.error) : { ok: true, result };
             }
-            const result = await execAgentAction(sub, { aid: targetAid ?? taskAid, force: argv.includes('--force') }, delegation.grant.actorId, eventBus);
+            const result = await execAgentAction(sub, { aid: targetAid ?? taskAid, force: argv.includes('--force') }, delegation.grant.actorId, eventBus, agentApplicationService);
             return 'error' in result ? fail(result.code, result.error) : { ok: true, result: { ok: true, ...(result.data ?? {}) } };
         });
         ipcServer.setQueueOperationExecutor(async (params) => {
@@ -3696,12 +3825,51 @@ async function main() {
                     throw new Error(`agent not found: ${agentAid}`);
                 return agentAid;
             };
+            const auditFullAccessTriggerConfiguration = (event, definition, actor, reason) => {
+                auditFullAccessEvent({
+                    event,
+                    source: 'trigger',
+                    actorId: actor.origin.peerId,
+                    processRole: actor.daemonOwner ? 'daemon-owner' : actor.subject.processRole,
+                    authorizedBy: definition.authorizedBy,
+                    agentAid: definition.agentAid,
+                    triggerId: definition.id,
+                    reason,
+                });
+            };
+            const rejectUnapprovedFullAccessConfiguration = (definition, actor) => {
+                // A managed Agent task may carry a daemon-owner identity for ordinary
+                // scoped operations. That delegation is never a human approval for a
+                // persistent host-level Trigger; only the explicit user/menu paths may
+                // create or retain this mode.
+                const approvalSource = actor.control ? 'daemon-service' : 'agent-delegation';
+                if (definition.execution.permissionMode === 'fullaccess'
+                    && !actor.fullAccess
+                    && !canApprovePersistentFullAccessTrigger({
+                        daemonOwner: actor.daemonOwner,
+                        source: approvalSource,
+                    })) {
+                    throw new Error('persistent fullaccess Trigger requires an explicit user or management-channel action');
+                }
+            };
+            const withFullAccessConfigurationProvenance = (definition, actor) => {
+                if (definition.execution.permissionMode !== 'fullaccess') {
+                    const { authorizedBy: _authorizedBy, ...deescalated } = definition;
+                    return deescalated;
+                }
+                const authorizedBy = actor.fullAccess
+                    ? actor.subject.authorizedBy
+                    : actor.subject.principalId ?? actor.origin.peerId;
+                if (!authorizedBy)
+                    throw new Error('fullaccess Trigger approval provenance is unavailable');
+                return { ...definition, authorizedBy };
+            };
             const authorizeTrigger = async (agentAid, operation, triggerId) => {
                 const actor = await authenticatedTriggerActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.delegationCommandHash, cmd.controlToken);
                 const isCrossAgent = !actor.control && actor.selfAid !== agentAid;
                 if (!isCrossAgentTriggerOperationAllowed({
                     control: actor.control,
-                    daemonOwner: actor.daemonOwner,
+                    daemonOwner: actor.daemonOwner || actor.fullAccess,
                     taskAgentAid: actor.selfAid,
                     targetAgentAid: agentAid,
                     targetManagement: actor.management,
@@ -3734,7 +3902,12 @@ async function main() {
                     return actor;
                 const definition = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === triggerId);
                 const privilegedReason = definition ? daemonPrivilegedTriggerReason(definition) : undefined;
-                if (privilegedReason && !actor.daemonPrivileged) {
+                const persistedFullAccessApproval = privilegedReason === 'persistent fullaccess Trigger';
+                const deescalationOperation = operation === 'trigger.update'
+                    || operation === 'trigger.setEnabled'
+                    || operation === 'trigger.cancel'
+                    || operation === 'trigger.delete';
+                if (privilegedReason && !persistedFullAccessApproval && !actor.daemonPrivileged && !deescalationOperation) {
                     throw new Error(`${privilegedReason} requires DaemonOwner`);
                 }
                 if (actor.management)
@@ -3751,7 +3924,9 @@ async function main() {
                     const agentAid = requireAgent(cmd.agentAid);
                     const actor = await authorizeTrigger(agentAid, 'trigger.list');
                     const scheduler = schedulerFor(agentAid);
-                    const definitions = scheduler.list({ all: cmd.all === true }).filter(trigger => ((actor.daemonPrivileged || !daemonPrivilegedTriggerReason(trigger))
+                    const definitions = scheduler.list({ all: cmd.all === true }).filter(trigger => ((actor.daemonPrivileged
+                        || !daemonPrivilegedTriggerReason(trigger)
+                        || daemonPrivilegedTriggerReason(trigger) === 'persistent fullaccess Trigger')
                         && (actor.management
                             || (trigger.origin?.peerId === actor.origin?.peerId && trigger.origin?.channelKey === actor.origin?.channelKey))));
                     return { ok: true, triggers: scheduler.listItems(definitions) };
@@ -3808,11 +3983,16 @@ async function main() {
                     const agentAid = requireAgent(rawDefinition.agentAid);
                     const actor = await authorizeTrigger(agentAid, 'trigger.create');
                     const materialized = materializeTriggerCreateBaseagent({ ...rawDefinition, origin: actor.origin }, agentAid);
-                    const definition = normalizeTriggerDefinition(materialized);
+                    let definition = normalizeTriggerDefinition(materialized);
+                    rejectUnapprovedFullAccessConfiguration(definition, actor);
+                    definition = withFullAccessConfigurationProvenance(definition, actor);
                     validateTriggerDefinitionForActor(definition, actor);
                     requireAgent(definition.agentAid);
                     validateTriggerFeedbackChannels(definition);
                     const trigger = schedulerFor(definition.agentAid).create(definition, cmd.files ?? [], { enable: cmd.enable });
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, 'fullaccess Trigger created through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.update': {
@@ -3827,11 +4007,21 @@ async function main() {
                     if (cmd.expectedRevision !== undefined && cmd.expectedRevision !== currentRevision) {
                         throw new Error(`trigger revision conflict: expected ${cmd.expectedRevision}, current ${currentRevision}`);
                     }
-                    const definition = applyTriggerPatch(existing, cmd.patch, { fromPromptFile: cmd.promptFile === true });
+                    let definition = applyTriggerPatch(existing, cmd.patch, { fromPromptFile: cmd.promptFile === true });
+                    rejectUnapprovedFullAccessConfiguration(definition, actor);
+                    definition = withFullAccessConfigurationProvenance(definition, actor);
                     validateTriggerDefinitionForActor(definition, actor);
                     validateTriggerFeedbackChannels(definition);
                     const scheduler = schedulerFor(agentAid);
                     const trigger = scheduler.update(cmd.triggerId, definition);
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, existing.execution.permissionMode === 'fullaccess'
+                            ? 'fullaccess Trigger updated through IPC'
+                            : 'Trigger elevated to fullaccess through IPC');
+                    }
+                    else if (existing.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.deescalated', existing, actor, 'Trigger permissionMode changed from fullaccess through IPC');
+                    }
                     return { ok: true, trigger: scheduler.listItem(trigger), revision: definitionRevision(trigger) };
                 }
                 case 'trigger.setEnabled': {
@@ -3840,8 +4030,26 @@ async function main() {
                         throw new Error('missing triggerId');
                     if (typeof cmd.enabled !== 'boolean')
                         throw new Error('missing enabled');
-                    await authorizeTrigger(agentAid, 'trigger.setEnabled', cmd.triggerId);
-                    const trigger = schedulerFor(agentAid).setEnabled(cmd.triggerId, cmd.enabled);
+                    const actor = await authorizeTrigger(agentAid, 'trigger.setEnabled', cmd.triggerId);
+                    const existing = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === cmd.triggerId);
+                    if (!existing)
+                        throw new Error(`trigger not found: ${cmd.triggerId}`);
+                    if (cmd.enabled && existing.execution.permissionMode === 'fullaccess') {
+                        rejectUnapprovedFullAccessConfiguration(existing, actor);
+                        if (!isFullAccessEnabled())
+                            throw new Error('fullaccess is disabled by daemon.json');
+                        if (!actor.daemonOwner && !actor.fullAccess) {
+                            throw new Error('enabling a fullaccess Trigger requires a DaemonOwner or fullaccess-run');
+                        }
+                    }
+                    const scheduler = schedulerFor(agentAid);
+                    if (cmd.enabled && existing.execution.permissionMode === 'fullaccess') {
+                        scheduler.update(cmd.triggerId, withFullAccessConfigurationProvenance(existing, actor));
+                    }
+                    const trigger = scheduler.setEnabled(cmd.triggerId, cmd.enabled);
+                    if (cmd.enabled && trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, 'fullaccess Trigger enabled through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.cancel': {
@@ -3856,8 +4064,11 @@ async function main() {
                     const agentAid = requireAgent(cmd.agentAid);
                     if (!cmd.triggerId)
                         throw new Error('missing triggerId');
-                    await authorizeTrigger(agentAid, 'trigger.delete', cmd.triggerId);
+                    const actor = await authorizeTrigger(agentAid, 'trigger.delete', cmd.triggerId);
                     const trigger = schedulerFor(agentAid).delete(cmd.triggerId);
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.deescalated', trigger, actor, 'fullaccess Trigger deleted through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.run': {
@@ -3925,6 +4136,13 @@ async function main() {
             }
         };
         try {
+            // ECWeb is owned by the daemon.  Stop it from the unified shutdown
+            // path as well as the signal handler so an IPC-driven `ec restart`
+            // cannot leave the old ECWeb process running after its package was
+            // upgraded on disk.
+            await shutdownStep('stop ECWeb supervisor', async () => {
+                await ecwebSupervisor?.stop();
+            });
             const queueShutdown = messageQueue.shutdownGracefully();
             await shutdownStep('cancel pending permissions', () => permissionGateway.cancelAllPending('daemon_restart'));
             await shutdownStep('wait for trigger schedulers', async () => {