evolcore 0.0.2 → 0.0.4

package/dist/config/config-manager.js

@@ -12,17 +12,22 @@
  */
 import fs from 'fs';
 import path from 'path';
+import crypto from 'crypto';
 import { resolvePaths, agentConfig as agentConfigPath, agentContactConfig, agentRelationConfig, agentDir, agentRelationsDir, agentRolesIndex, agentRoleConfig, } from '../paths.js';
 import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { loadSchema, currentVersion, isSchemaName, } from './schema-registry.js';
+import { isExplicitGroupId } from '../aun/group-identity.js';
+import { parseContactAlias } from './contact-alias.js';
+import { loadSchema, listSchemaVersions, currentVersion, isSchemaName, } from './schema-registry.js';
 import { mergeLayers, expandVars, buildEnvResolver } from './merge.js';
 import { normalizeAgentLifecycle } from './lifecycle.js';
 import { isBehaviorConfigFieldPath } from './config-field-policy.js';
 import { clearRoleStoreCache, isRoleName } from './role-store.js';
 import { writeRoleDefinition, writeRoleRegistry } from './role-service.js';
+import { mutateContactBookTransactionSync } from './contact-book-store.js';
 import { DAEMON_SCHEMA_NAME } from '../product.js';
+import { validateAccessPolicyDomain } from './access-policy-domain.js';
 export var ConfigTarget;
 (function (ConfigTarget) {
     ConfigTarget["Process"] = "process";
@@ -34,6 +39,8 @@ export var ConfigTarget;
     ConfigTarget["Role"] = "role";
 })(ConfigTarget || (ConfigTarget = {}));
 const configWriteListeners = new Set();
+const CONFIG_MUTATION_LOCK_WAIT_MS = 5_000;
+const CONFIG_MUTATION_LOCK_RETRY_MS = 20;
 /** Observe successful in-process config writes after cache invalidation. */
 export function onConfigWrite(listener) {
     configWriteListeners.add(listener);
@@ -76,10 +83,7 @@ export function assertRoleConfigV4Ready() {
     if (!fs.existsSync(agentsRoot))
         return;
     const issues = [];
-    const agentSchema = loadSchema('agent-config');
-    const agentSchemaV4 = loadSchema('agent-config', 4);
-    const relationSchema = loadSchema('relation-config');
-    const inspect = (file, schema, legacyAgent = false) => {
+    const inspect = (file, logicalName, minimumVersion) => {
         let value;
         try {
             value = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -88,18 +92,25 @@ export function assertRoleConfigV4Ready() {
             issues.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
             return;
         }
-        const expectedVersion = schema.version;
         const actualVersion = value && typeof value === 'object'
             ? value.$schema_version
             : undefined;
-        const acceptedLegacyAgent = legacyAgent && actualVersion === 4;
-        if (actualVersion !== expectedVersion && !acceptedLegacyAgent) {
+        if (typeof actualVersion !== 'number' || actualVersion < minimumVersion) {
             issues.push({
                 file,
-                detail: `$schema_version must be ${expectedVersion}, got ${String(actualVersion)}`,
+                detail: `$schema_version must be at least ${minimumVersion}, got ${String(actualVersion)}`,
             });
+            return;
+        }
+        let schema;
+        try {
+            schema = loadSchema(logicalName, actualVersion);
+        }
+        catch {
+            issues.push({ file, detail: `unsupported ${logicalName} schema version ${actualVersion}` });
+            return;
         }
-        if (!schema.validate(value) && !acceptedLegacyAgent) {
+        if (!schema.validate(value)) {
             const detail = (schema.validate.errors ?? []).map(error => {
                 const extra = typeof error.params?.additionalProperty === 'string'
                     ? ` (additionalProperty=${error.params.additionalProperty})`
@@ -128,12 +139,10 @@ export function assertRoleConfigV4Ready() {
         const agentDirPath = path.join(agentsRoot, entry.name);
         const agentFile = path.join(agentDirPath, 'config.json');
         if (fs.existsSync(agentFile)) {
-            const raw = JSON.parse(fs.readFileSync(agentFile, 'utf8'));
-            const legacyVersion = typeof raw?.$schema_version === 'number' && raw.$schema_version <= 4;
-            inspect(agentFile, legacyVersion ? agentSchemaV4 : agentSchema, raw?.$schema_version === 4);
+            inspect(agentFile, 'agent-config', 4);
         }
         for (const relationFile of walkRelationConfigs(path.join(agentDirPath, 'relations'))) {
-            inspect(relationFile, relationSchema);
+            inspect(relationFile, 'relation-config', 4);
         }
     }
     if (!issues.length)
@@ -156,7 +165,6 @@ export function assertRoleConfigV5Ready() {
     if (!fs.existsSync(agentsRoot))
         return;
     const issues = [];
-    const agentSchema = loadSchema('agent-config', 5);
     const registrySchema = loadSchema('role-registry');
     const readJson = (file) => {
         try {
@@ -177,9 +185,22 @@ export function assertRoleConfigV5Ready() {
         if (!fs.existsSync(agentFile))
             continue;
         const agent = readJson(agentFile);
-        if (!agent || !agentSchema.validate(agent)) {
+        const agentVersion = agent?.$schema_version;
+        let agentSchema = null;
+        if (typeof agentVersion === 'number' && agentVersion >= 5) {
+            try {
+                agentSchema = loadSchema('agent-config', agentVersion);
+            }
+            catch { }
+        }
+        if (!agent || !agentSchema || !agentSchema.validate(agent)) {
             if (agent)
-                issues.push({ file: agentFile, detail: schemaErrors(agentSchema) });
+                issues.push({
+                    file: agentFile,
+                    detail: agentSchema
+                        ? schemaErrors(agentSchema)
+                        : `agent schema version must be supported and >= 5, got ${String(agentVersion)}`,
+                });
             continue;
         }
         const registryFile = agentRolesIndex(aid);
@@ -201,6 +222,195 @@ export function assertRoleConfigV5Ready() {
         `node kits/migrations/migrate-role-config-v5.mjs --home ${JSON.stringify(root)}\n` +
         `node kits/migrations/migrate-role-config-v5.mjs --apply --home ${JSON.stringify(root)}`, { issues });
 }
+/** Final startup gate for the contact-book authorization migration. */
+export function assertContactBookV2Ready() {
+    const root = resolvePaths().root;
+    const agentsRoot = resolvePaths().agentsDir;
+    if (!fs.existsSync(agentsRoot))
+        return;
+    const issues = [];
+    const supportedSchemas = (name, minimumVersion) => (listSchemaVersions(name)
+        .filter(version => version >= minimumVersion)
+        .map(version => loadSchema(name, version)));
+    const agentSchemas = supportedSchemas('agent-config', 6);
+    const contactSchemas = supportedSchemas('contact-book', 2);
+    const relationSchemas = supportedSchemas('relation-config', 5);
+    const inspect = (file, schemas) => {
+        let value;
+        try {
+            value = JSON.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch (error) {
+            issues.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
+            return;
+        }
+        const candidates = Array.isArray(schemas) ? schemas : [schemas];
+        if (!candidates.some(schema => schema.validate(value))) {
+            const detail = (candidates.at(-1)?.validate.errors ?? [])
+                .map(error => `${error.instancePath || '/'} ${error.message}`)
+                .join('; ');
+            issues.push({ file, detail });
+        }
+    };
+    const walkRelationConfigs = (dir) => {
+        if (!fs.existsSync(dir))
+            return [];
+        const files = [];
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                files.push(...walkRelationConfigs(full));
+            else if (entry.isFile() && entry.name === 'config.json')
+                files.push(full);
+        }
+        return files;
+    };
+    for (const entry of fs.readdirSync(agentsRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !isValidAid(entry.name))
+            continue;
+        const dir = path.join(agentsRoot, entry.name);
+        const agentFile = path.join(dir, 'config.json');
+        if (!fs.existsSync(agentFile))
+            continue;
+        inspect(agentFile, agentSchemas);
+        const contactFile = path.join(dir, 'contact.json');
+        if (fs.existsSync(contactFile)) {
+            inspect(contactFile, contactSchemas);
+            inspectContactBookDomain(contactFile, agentFile, issues);
+        }
+        for (const relationFile of walkRelationConfigs(path.join(dir, 'relations'))) {
+            inspect(relationFile, relationSchemas);
+        }
+    }
+    const correctionReceipt = path.join(root, 'data', 'contact-book-v2-relation-role-authority.json');
+    if (!hasContactRoleAuthorityReceipt(correctionReceipt)) {
+        const recoverable = findRelationRoleRemovedByExperimentalMigration(root);
+        if (recoverable) {
+            issues.push({
+                file: recoverable,
+                detail: 'experimental contact-book migration backup must be reviewed and relation role authority correction recorded',
+            });
+        }
+    }
+    if (!issues.length)
+        return;
+    const shown = issues.slice(0, 20)
+        .map(issue => `- ${path.relative(root, issue.file)}: ${issue.detail}`)
+        .join('\n');
+    const omitted = issues.length > 20 ? `\n- ... ${issues.length - 20} more issue(s)` : '';
+    throw new ConfigError('CONTACT_BOOK_V2_MIGRATION_REQUIRED', `Contact book authorization migration is required before daemon startup:\n${shown}${omitted}\n` +
+        `node kits/migrations/migrate-contact-book-v2.mjs --home ${JSON.stringify(root)}\n` +
+        `node kits/migrations/migrate-contact-book-v2.mjs --apply --home ${JSON.stringify(root)}`, { issues });
+}
+function inspectContactBookDomain(contactFile, agentFile, issues) {
+    let contact;
+    let agent;
+    try {
+        contact = JSON.parse(fs.readFileSync(contactFile, 'utf8'));
+        agent = JSON.parse(fs.readFileSync(agentFile, 'utf8'));
+    }
+    catch {
+        return;
+    }
+    const owners = new Set(Array.isArray(agent?.owners) ? agent.owners.map(String) : []);
+    const configuredChannelKeys = new Set((Array.isArray(agent?.channels) ? agent.channels : [])
+        .filter((channel) => channel && typeof channel === 'object' && channel.type !== 'aun')
+        .map((channel) => {
+        const type = String(channel.type || '').trim().toLowerCase();
+        const name = String(channel.name || '').trim();
+        return type && name ? `${type}#${String(agent?.aid || '').trim()}#${name}` : '';
+    })
+        .filter(Boolean));
+    const aliases = new Map();
+    for (const [primaryId, entry] of Object.entries(contact?.contacts ?? {})) {
+        if (isExplicitGroupId(primaryId)) {
+            issues.push({ file: contactFile, detail: `group contact ${primaryId} is not supported` });
+        }
+        if (entry?.status === 'blocked' && owners.has(primaryId)) {
+            issues.push({ file: contactFile, detail: `owner contact ${primaryId} cannot be blocked` });
+        }
+        for (const alias of Array.isArray(entry?.aliases) ? entry.aliases : []) {
+            const parsed = parseContactAlias(alias, agent?.aid);
+            if (!parsed) {
+                issues.push({ file: contactFile, detail: `invalid Contact alias ${String(alias)}; expected <channelKey>:<urlEncode(peerId)>` });
+                continue;
+            }
+            if (!configuredChannelKeys.has(parsed.channelKey)) {
+                issues.push({ file: contactFile, detail: `alias ${alias} references an unconfigured channel instance` });
+                continue;
+            }
+            const previous = aliases.get(parsed.alias);
+            if (previous && previous !== primaryId) {
+                issues.push({ file: contactFile, detail: `alias ${parsed.alias} is assigned to both ${previous} and ${primaryId}` });
+            }
+            else {
+                aliases.set(parsed.alias, primaryId);
+            }
+        }
+    }
+}
+function hasContactRoleAuthorityReceipt(file) {
+    try {
+        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return value?.migration === 'contact-book-v2-relation-role-authority' && value?.designVersion === 2;
+    }
+    catch {
+        return false;
+    }
+}
+function findRelationRoleRemovedByExperimentalMigration(root) {
+    const backupsRoot = path.join(root, 'backups', 'contact-book-v2-migration');
+    if (!fs.existsSync(backupsRoot))
+        return null;
+    for (const stamp of fs.readdirSync(backupsRoot, { withFileTypes: true })) {
+        if (!stamp.isDirectory())
+            continue;
+        try {
+            const manifest = JSON.parse(fs.readFileSync(path.join(backupsRoot, stamp.name, 'manifest.json'), 'utf8'));
+            if (manifest?.designVersion >= 2)
+                continue;
+        }
+        catch { }
+        const agentsRoot = path.join(backupsRoot, stamp.name, 'files', 'agents');
+        if (!fs.existsSync(agentsRoot))
+            continue;
+        for (const agent of fs.readdirSync(agentsRoot, { withFileTypes: true })) {
+            if (!agent.isDirectory() || !isValidAid(agent.name))
+                continue;
+            const relationsRoot = path.join(agentsRoot, agent.name, 'relations');
+            if (!fs.existsSync(relationsRoot))
+                continue;
+            for (const relation of fs.readdirSync(relationsRoot, { withFileTypes: true })) {
+                if (!relation.isDirectory() || relation.name.startsWith('_'))
+                    continue;
+                const backupFile = path.join(relationsRoot, relation.name, 'config.json');
+                if (!fs.existsSync(backupFile))
+                    continue;
+                let backupValue;
+                try {
+                    backupValue = JSON.parse(fs.readFileSync(backupFile, 'utf8'));
+                }
+                catch {
+                    continue;
+                }
+                if (typeof backupValue?.role !== 'string' || backupValue.role === 'owner')
+                    continue;
+                const currentFile = path.join(root, 'agents', agent.name, 'relations', relation.name, 'config.json');
+                let currentValue;
+                try {
+                    currentValue = JSON.parse(fs.readFileSync(currentFile, 'utf8'));
+                }
+                catch {
+                    continue;
+                }
+                if (typeof currentValue?.$schema_version === 'number' && currentValue.$schema_version >= 5) {
+                    return currentFile;
+                }
+            }
+        }
+    }
+    return null;
+}
 /**
  * 启动时检查 schema 版本（daemon 启动时调用）。
  * 扫描所有配置文件，如有版本不匹配则警告一次。
@@ -420,7 +630,12 @@ export function write(target, value, sel, opts = {}) {
         finishConfigWrite(target, sel, file);
         return;
     }
-    const schema = loadSchema(TARGET_SCHEMA[target]);
+    const requestedVersion = value && typeof value === 'object'
+        ? Number(value.$schema_version)
+        : NaN;
+    const schema = target === ConfigTarget.Contact && requestedVersion === 2
+        ? loadSchema('contact-book', 2)
+        : loadSchema(TARGET_SCHEMA[target]);
     const withVer = ensureSchemaVersion(value, schema.version);
     const migrated = withVer;
     // Agent config 写入规范化（aid 校验、projects 字段清理）
@@ -434,15 +649,166 @@ export function write(target, value, sel, opts = {}) {
         validateOrThrow(schema, normalized, target);
         // 1b. responseModeParams 桶内容校验：主 schema 把 responseModeParams 当黑箱，
         //     此处使用“模式桶 schema”逐桶校验内容（桶键 = 已登记的响应模式 id）。
-        if (target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
+        if (target === ConfigTarget.Defaults || target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
             validateResponseModeParams(normalized?.responseModeParams, target);
         }
+        if (target === ConfigTarget.Agent) {
+            const selfAid = sel?.self || String(normalized?.aid || '').trim();
+            const issue = validateAccessPolicyDomain(selfAid, normalized);
+            if (issue)
+                throw new ConfigError(issue.code, issue.message);
+        }
+    }
+    // Owner 是实际联系人。将 Agent 配置和缺失的 Owner 联系人写入同一可恢复事务，
+    // 避免渠道身份绑定承担联系人创建职责。
+    const ownerIds = target === ConfigTarget.Agent && Array.isArray(normalized.owners)
+        ? [...new Set(normalized.owners
+                .map((value) => String(value || '').trim())
+                .filter((value) => isValidAid(value)))]
+        : [];
+    if (target === ConfigTarget.Agent && sel?.self && ownerIds.length > 0) {
+        const before = readTextOrNull(file);
+        const after = `${JSON.stringify(normalized, null, 2)}\n`;
+        mutateContactBookTransactionSync({
+            selfAid: sel.self,
+            actor: 'agent-owner-sync',
+            mutation: { type: 'ensure-contacts', primaryIds: ownerIds },
+        }, [{ file, before, after }]);
+        finishConfigWrite(target, sel, file);
+        return;
     }
     // 2. 写入文件
     fs.mkdirSync(path.dirname(file), { recursive: true });
     atomicWriteJson(file, normalized);
     finishConfigWrite(target, sel, file);
 }
+/**
+ * Mutate one configuration document while holding a file-scoped, cross-process lock.
+ *
+ * Callers must keep the callback synchronous. This is the safe primitive for
+ * read-modify-write paths; direct `read()` followed by `write()` cannot protect
+ * unrelated fields from another process writing the same config document.
+ */
+export function mutateConfig(target, sel, mutate) {
+    if (target === ConfigTarget.RoleRegistry || target === ConfigTarget.Role || target === ConfigTarget.Contact) {
+        throw new ConfigError('MUTATION_UNSUPPORTED', `mutateConfig does not support ${target}`);
+    }
+    const file = targetPath(target, sel);
+    const release = acquireConfigMutationLock(file);
+    try {
+        const current = read(target, sel, { cache: false });
+        const next = current ? cloneConfigValue(current) : configSkeleton(target, sel);
+        const before = stableConfigValue(current ?? next);
+        const value = mutate(next);
+        const changed = before !== stableConfigValue(next);
+        if (changed)
+            write(target, next, sel);
+        return { value, changed };
+    }
+    finally {
+        release();
+    }
+}
+function cloneConfigValue(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function stableConfigValue(value) {
+    return JSON.stringify(sortConfigValue(value));
+}
+function sortConfigValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortConfigValue);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, nested]) => [key, sortConfigValue(nested)]));
+}
+function acquireConfigMutationLock(file) {
+    const lockDir = `${file}.mutation.lock`;
+    const ownerFile = path.join(lockDir, 'owner.json');
+    const token = crypto.randomBytes(16).toString('hex');
+    const candidate = `${lockDir}.candidate-${process.pid}-${token}`;
+    const candidateOwner = path.join(candidate, 'owner.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.mkdirSync(candidate);
+    fs.writeFileSync(candidateOwner, `${JSON.stringify({ pid: process.pid, token })}\n`, { mode: 0o600 });
+    let acquired = false;
+    const deadline = Date.now() + CONFIG_MUTATION_LOCK_WAIT_MS;
+    try {
+        while (true) {
+            try {
+                fs.renameSync(candidate, lockDir);
+                acquired = true;
+                return () => releaseConfigMutationLock(lockDir, ownerFile, token);
+            }
+            catch (error) {
+                if (error?.code !== 'EEXIST' && error?.code !== 'ENOTEMPTY')
+                    throw error;
+                if (reclaimStaleConfigMutationLock(lockDir, ownerFile))
+                    continue;
+                if (Date.now() >= deadline) {
+                    throw new ConfigError('LOCK_TIMEOUT', `Timed out waiting for config mutation lock: ${file}`);
+                }
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, CONFIG_MUTATION_LOCK_RETRY_MS);
+            }
+        }
+    }
+    finally {
+        if (!acquired)
+            fs.rmSync(candidate, { recursive: true, force: true });
+    }
+}
+function reclaimStaleConfigMutationLock(lockDir, ownerFile) {
+    let raw;
+    let pid;
+    try {
+        raw = fs.readFileSync(ownerFile, 'utf8');
+        pid = Number(JSON.parse(raw).pid);
+    }
+    catch {
+        return false;
+    }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        if (error?.code !== 'ESRCH')
+            return false;
+        const reclaimed = `${lockDir}.reclaimed-${crypto.createHash('sha256').update(raw).digest('hex').slice(0, 16)}`;
+        try {
+            fs.renameSync(lockDir, reclaimed);
+            fs.rmSync(reclaimed, { recursive: true, force: true });
+            return true;
+        }
+        catch (renameError) {
+            return renameError?.code === 'ENOENT';
+        }
+    }
+}
+function releaseConfigMutationLock(lockDir, ownerFile, token) {
+    try {
+        const owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8'));
+        if (owner.token === token)
+            fs.rmSync(lockDir, { recursive: true, force: true });
+    }
+    catch {
+        // A replaced lock is not ours to release.
+    }
+}
+function readTextOrNull(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
 function finishConfigWrite(target, sel, file) {
     if (fileCacheAvailable())
         fileCache.invalidate(file);
@@ -459,6 +825,10 @@ function finishConfigWrite(target, sel, file) {
         }
     }
 }
+/** Notify cache and security listeners after a caller-owned atomic transaction commits. */
+export function notifyConfigWrite(target, sel) {
+    finishConfigWrite(target, sel, targetPath(target, sel));
+}
 function ensureSchemaVersion(value, version) {
     return value && typeof value === 'object'
         ? { ...value, $schema_version: version }
@@ -483,10 +853,9 @@ function validateOrThrow(schema, value, target) {
 function validateProcessOnlyFields(target, value) {
     if (target === ConfigTarget.Process || !value || typeof value !== 'object')
         return [];
-    const debug = value.debug;
-    if (!debug || typeof debug !== 'object' || !Object.prototype.hasOwnProperty.call(debug, 'eckSnapshots'))
+    if (!Object.prototype.hasOwnProperty.call(value, 'debug'))
         return [];
-    return ['/debug/eckSnapshots is only allowed in process config'];
+    return ['/debug is only allowed in process config'];
 }
 /**
  * responseModeParams 桶专项校验。
@@ -531,7 +900,12 @@ function validateResponseModeParams(params, target) {
  * 供 config-store.validateAgentConfig 等只校验不落盘的场景使用。
  */
 export function validateConfig(target, value) {
-    const schema = loadSchema(TARGET_SCHEMA[target]);
+    const requestedVersion = value && typeof value === 'object'
+        ? Number(value.$schema_version)
+        : NaN;
+    const schema = target === ConfigTarget.Contact && requestedVersion === 2
+        ? loadSchema('contact-book', 2)
+        : loadSchema(TARGET_SCHEMA[target]);
     const withVer = ensureSchemaVersion(value, schema.version);
     const ok = schema.validate(withVer);
     const errors = validateProcessOnlyFields(target, withVer);
@@ -567,6 +941,11 @@ export function ensureFile(target, sel) {
     const file = targetPath(target, sel);
     if (fs.existsSync(file))
         return;
+    const skeleton = configSkeleton(target, sel);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    atomicWriteJson(file, skeleton);
+}
+function configSkeleton(target, sel) {
     const schema = loadSchema(TARGET_SCHEMA[target]);
     const skeleton = { $schema_version: schema.version };
     const props = schema.raw.properties || {};
@@ -586,8 +965,7 @@ export function ensureFile(target, sel) {
         else if (spec?.type === 'object')
             skeleton[key] = {};
     }
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    atomicWriteJson(file, skeleton);
+    return skeleton;
 }
 // ── schema 版本迁移 ───────────────────────────────────────────────────────
 //
@@ -618,9 +996,11 @@ export function resolveAgentConfig(sel, opts = {}) {
 function stripStaticOwnerField(config) {
     if (!config)
         return config;
-    if (!Object.prototype.hasOwnProperty.call(config, 'owners') && !Object.prototype.hasOwnProperty.call(config, 'admins'))
+    if (!Object.prototype.hasOwnProperty.call(config, 'owners')
+        && !Object.prototype.hasOwnProperty.call(config, 'admins')
+        && !Object.prototype.hasOwnProperty.call(config, 'access'))
         return config;
-    const { owners: _owners, admins: _admins, ...rest } = config;
+    const { owners: _owners, admins: _admins, access: _access, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -643,13 +1023,11 @@ export function resolveEffective(sel, opts = {}) {
         lifecycle: config.lifecycle,
         initialized: config.initialized,
         owners: config.owners,
-        admins: config.admins,
         aun: config.aun,
         channels: config.channels ?? [],
         models: config.models,
         projects: config.projects,
         capabilities: config.capabilities,
-        debug: config.debug,
         observable: config.observable,
         extra_backup: config.extra_backup,
         // Runtime configuration parameters
@@ -664,6 +1042,7 @@ export function resolveEffective(sel, opts = {}) {
         debounce: config.debounce,
         show_activities: config.show_activities,
         session_renew: config.session_renew,
+        groupRules: config.groupRules,
         render: config.render,
         sessionManifests: config.sessionManifests,
         enable_rich_content: config.enable_rich_content,
@@ -691,6 +1070,7 @@ const EFFECTIVE_BEHAVIOR_FIELDS = [
     'debounce',
     'show_activities',
     'session_renew',
+    'groupRules',
     'render',
     'sessionManifests',
     'enable_rich_content',