evolcore 0.0.2 → 0.0.4

package/dist/core/auth/agent-delegation.js

@@ -2,9 +2,11 @@ import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
+export const AGENT_DELEGATION_COMMAND_TTL_MS = 60_000;
 export class AgentDelegationRegistry {
     grantsByHash = new Map();
     activeHashBySession = new Map();
+    approvedCommands = new Map();
     issue(input) {
         this.revokeSession(input.sessionId);
         const token = crypto.randomBytes(32).toString('base64url');
@@ -13,7 +15,7 @@ export class AgentDelegationRegistry {
         this.activeHashBySession.set(input.sessionId, tokenHash);
         return token;
     }
-    validate(token, sessionId) {
+    validate(token, sessionId, commandHash) {
         if (!token) {
             return {
                 ok: false,
@@ -23,16 +25,49 @@ export class AgentDelegationRegistry {
         }
         const tokenHash = hashDelegationToken(token);
         const grant = this.grantsByHash.get(tokenHash);
-        if (!grant
-            || grant.sessionId !== sessionId
-            || this.activeHashBySession.get(sessionId) !== tokenHash) {
-            return {
-                ok: false,
-                code: 'INVALID_DELEGATION',
-                reason: 'The task delegation token is invalid, revoked, or belongs to another session',
-            };
+        if (grant
+            && grant.sessionId === sessionId
+            && this.activeHashBySession.get(sessionId) === tokenHash) {
+            return { ok: true, grant };
         }
-        return { ok: true, grant };
+        const approved = commandHash
+            ? this.consumeApprovedCommand(tokenHash, sessionId, commandHash)
+            : undefined;
+        if (approved)
+            return { ok: true, grant: approved };
+        return {
+            ok: false,
+            code: 'INVALID_DELEGATION',
+            reason: 'The task delegation token is invalid, revoked, or belongs to another session',
+        };
+    }
+    armApprovedCommand(input) {
+        const activeTokenHash = this.activeHashBySession.get(input.sessionId);
+        if (!activeTokenHash)
+            return false;
+        const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
+        if (!grant || grant.taskId !== input.taskId)
+            return false;
+        if (!input.carrierToken || !isDelegationCommandHash(input.commandHash))
+            return false;
+        this.deleteExpiredApprovedCommands();
+        const carrierTokenHash = hashDelegationToken(input.carrierToken);
+        const key = approvedCommandKey(carrierTokenHash, input.sessionId, input.commandHash);
+        const existing = this.approvedCommands.get(key);
+        const ttlMs = Math.max(1, Math.min(input.ttlMs ?? AGENT_DELEGATION_COMMAND_TTL_MS, AGENT_DELEGATION_COMMAND_TTL_MS));
+        this.approvedCommands.set(key, {
+            sessionId: input.sessionId,
+            taskId: input.taskId,
+            activeTokenHash,
+            commandHash: input.commandHash,
+            expiresAt: Date.now() + ttlMs,
+            remainingUses: existing
+                && existing.activeTokenHash === activeTokenHash
+                && existing.expiresAt > Date.now()
+                ? existing.remainingUses + 1
+                : 1,
+        });
+        return true;
     }
     revokeTask(sessionId, taskId) {
         const tokenHash = this.activeHashBySession.get(sessionId);
@@ -43,19 +78,59 @@ export class AgentDelegationRegistry {
             return;
         this.grantsByHash.delete(tokenHash);
         this.activeHashBySession.delete(sessionId);
+        this.deleteApprovedCommandsForSession(sessionId);
     }
     revokeSession(sessionId) {
         const tokenHash = this.activeHashBySession.get(sessionId);
         if (tokenHash)
             this.grantsByHash.delete(tokenHash);
         this.activeHashBySession.delete(sessionId);
+        this.deleteApprovedCommandsForSession(sessionId);
+    }
+    consumeApprovedCommand(carrierTokenHash, sessionId, commandHash) {
+        if (!isDelegationCommandHash(commandHash))
+            return undefined;
+        const key = approvedCommandKey(carrierTokenHash, sessionId, commandHash);
+        const approved = this.approvedCommands.get(key);
+        if (!approved)
+            return undefined;
+        if (approved.expiresAt <= Date.now()) {
+            this.approvedCommands.delete(key);
+            return undefined;
+        }
+        const activeTokenHash = this.activeHashBySession.get(sessionId);
+        const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
+        if (!grant
+            || activeTokenHash !== approved.activeTokenHash
+            || grant.taskId !== approved.taskId) {
+            this.approvedCommands.delete(key);
+            return undefined;
+        }
+        if (approved.remainingUses <= 1)
+            this.approvedCommands.delete(key);
+        else
+            approved.remainingUses--;
+        return grant;
+    }
+    deleteExpiredApprovedCommands() {
+        const now = Date.now();
+        for (const [key, approved] of this.approvedCommands) {
+            if (approved.expiresAt <= now)
+                this.approvedCommands.delete(key);
+        }
+    }
+    deleteApprovedCommandsForSession(sessionId) {
+        for (const [key, approved] of this.approvedCommands) {
+            if (approved.sessionId === sessionId)
+                this.approvedCommands.delete(key);
+        }
     }
 }
 export function authorizeDelegatedAunMsgSend(registry, input) {
     if (!input.sessionId) {
         return { ok: false, code: 'DELEGATION_REQUIRED', reason: 'Origin session is required' };
     }
-    const validation = registry.validate(input.delegationToken, input.sessionId);
+    const validation = registry.validate(input.delegationToken, input.sessionId, input.delegationCommandHash);
     if (!validation.ok)
         return validation;
     const grant = validation.grant;
@@ -109,3 +184,22 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }
+function approvedCommandKey(carrierTokenHash, sessionId, commandHash) {
+    return JSON.stringify([carrierTokenHash, sessionId, commandHash]);
+}
+function isDelegationCommandHash(value) {
+    return /^[a-f0-9]{64}$/.test(value);
+}
+export function hashDelegatedCommandArgv(argv) {
+    if (argv.length === 0 || argv.some(value => typeof value !== 'string' || value.includes('\0')))
+        return undefined;
+    return crypto.createHash('sha256')
+        .update('evolcore-agent-delegation-command-v1\0')
+        .update(JSON.stringify(argv))
+        .digest('hex');
+}
+export function hashCurrentDelegatedCommand(processArgv = process.argv) {
+    if (processArgv.length < 3)
+        return undefined;
+    return hashDelegatedCommandArgv(['ec', ...processArgv.slice(2)]);
+}

package/dist/core/auth/authorization-audit.js

@@ -21,6 +21,9 @@ function buildAuditRecord(event) {
         operation: event.operation,
         scope: event.scope,
         dangerous: event.dangerous,
+        name: event.name,
+        action: event.action,
+        args: event.args?.argv ? { argv: [...event.args.argv] } : undefined,
         actorId: redactIdentifier(event.actorId),
         selfAid: redactIdentifier(event.selfAid),
         peerKey: redactIdentifier(event.peerKey),
@@ -47,11 +50,23 @@ function redactIdentifier(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
 function logAuditEvent(record) {
-    const level = record.decision === 'deny' ? 'warn' : 'info';
+    // A role-management snapshot fans out into several successful read checks.
+    // Keep those available for verbose ECWeb diagnostics without flooding INFO.
+    const routineEcwebRoleRead = record.source === 'ecweb'
+        && !record.dangerous
+        && (record.operation === 'role.policy.read' || record.operation === 'role.relation.read');
+    const level = record.decision === 'deny'
+        ? 'warn'
+        : routineEcwebRoleRead
+            ? 'debug'
+            : 'info';
     const marker = record.decision === 'deny' ? 'DENY' : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
     const message = [
         `[CommandAudit:${marker}]`,
         `operation=${record.operation}`,
+        record.name ? `name=${record.name}` : null,
+        record.action ? `action=${record.action}` : null,
+        record.args?.argv ? `args.argv=${JSON.stringify(record.args.argv)}` : null,
         `role=${record.role}`,
         `actor=${record.actorId || 'unknown'}`,
         record.taskId ? `task=${record.taskId}` : null,

package/dist/core/auth/operation-authorizer.js

@@ -18,6 +18,8 @@ export const USER_PLANE_CAPABILITY_CEILING = {
         'chatmode.update',
         'mentionmode.current',
         'mentionmode.update',
+        'group.mentionmode.current',
+        'group.rulespolicy.current',
         'session.list',
         'session.create',
         'session.rename',
@@ -55,6 +57,8 @@ export const USER_PLANE_CAPABILITY_CEILING = {
     ]),
     denyNamespaces: new Set([
         'role',
+        'connect',
+        'contact',
         'agent',
         'system',
         'storage',
@@ -413,6 +417,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     if (!resolvedConfigOp.route || (resolvedConfigOp.fieldRule.class !== 'safe-scalar' && resolvedConfigOp.fieldRule.class !== 'safe-readonly-object')) {
         return { ok: false, reason: `Config field ${field} is not available to user roles` };
     }
+    if (policy === 'role-overridable-write'
+        && resolvedConfigOp.fieldRule.access === 'owner-only'
+        && ctx.role !== 'owner'
+        && !ctx.isDaemonOwner) {
+        return { ok: false, reason: `Config field ${field} can only be changed by an owner` };
+    }
     const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
     const fieldPermission = roleDef
         ? resolveRoleFieldPermission(roleDef.permissions || {}, field)

package/dist/core/auth/operation-catalog.js

@@ -133,6 +133,46 @@ const OPERATIONS = [
         description: 'Update group mention mode',
         sources: ['slash', 'menu'],
     },
+    {
+        id: 'group.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'List joined AUN groups',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.mentionmode.current',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Read a group mention mode',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.mentionmode.update',
+        category: 'write-own',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Update a group mention mode',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.rulespolicy.current',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Read a group rules loading policy',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.rulespolicy.update',
+        category: 'write-own',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Update a group rules loading policy',
+        sources: ['menu'],
+    },
     {
         id: 'session.list',
         category: 'read',
@@ -180,7 +220,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['filesystem'],
         description: '获取文件内容（需路径沙箱检查）',
-        sources: ['menu'],
+        sources: ['slash', 'menu'],
     },
     // ── Trigger Operations ──
     {
@@ -304,6 +344,70 @@ const OPERATIONS = [
         description: 'Modify role definitions, command permissions, default roles, or usage limits',
         sources: ['menu', 'ecweb', 'control'],
     },
+    {
+        id: 'contact.read',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Read the Agent contact block list',
+        sources: ['agent-tool'],
+    },
+    {
+        id: 'contact.block',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Block or unblock a canonical contact across bound private channels',
+        sources: ['agent-tool'],
+    },
+    {
+        id: 'connect.read',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Read contacts, groups, assignments, or contact details',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.assign',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Assign a role to a relation',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.revoke',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Revoke a role assignment from a relation',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.admin',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Grant or revoke admin status',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.write',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Manage contacts, contact requests, and allowed group channels',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.access.write',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Manage owner-only Agent access policy and request limit settings',
+        sources: ['menu', 'ecweb', 'control'],
+    },
     // Agent Operations
     {
         id: 'agent.list',

package/dist/core/auth/trigger-authorization.js

@@ -0,0 +1,15 @@
+const CROSS_AGENT_READ_OPERATIONS = new Set([
+    'trigger.list',
+    'trigger.show',
+    'trigger.history',
+]);
+export function isCrossAgentTriggerOperationAllowed(input) {
+    if (input.control || input.taskAgentAid === input.targetAgentAid)
+        return true;
+    if (!input.taskAgentAid || !input.targetManagement)
+        return false;
+    return CROSS_AGENT_READ_OPERATIONS.has(input.operation);
+}
+export function isCrossAgentTriggerReadOperation(operation) {
+    return CROSS_AGENT_READ_OPERATIONS.has(operation);
+}

package/dist/core/bootstrap-service.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { randomBytes } from 'crypto';
 import { kitsTemplatesDir, agentMdPath } from '../paths.js';
+import { resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { logger } from '../utils/logger.js';
 import { loadAgent, saveAgent } from '../config-store.js';
 import { normalizeAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
@@ -130,15 +131,7 @@ export class BootstrapService {
         return renderTemplate(template, vars).trim();
     }
     resolveAgentDisplayName(aid) {
-        try {
-            const content = fs.readFileSync(agentMdPath(aid), 'utf-8');
-            const fm = content.match(/^---\n([\s\S]*?)\n---/)?.[1] || '';
-            const name = fm.match(/^name:\s*["']?(.+?)["']?\s*$/m)?.[1]?.trim();
-            if (name)
-                return name;
-        }
-        catch { }
-        return aid.split('.')[0];
+        return resolveAgentDisplayName(aid) || aid.split('.')[0];
     }
     resolveBaseagent(agent, aid) {
         try {

package/dist/core/channel-loader.js

@@ -26,7 +26,11 @@ export function showActivitiesPolicy(mode, chatType, _identity) {
 }
 // ── ChannelLoader ──────────────────────────────────────────────────────────
 export class ChannelLoader {
+    processDebug;
     plugins = new Map();
+    constructor(processDebug) {
+        this.processDebug = processDebug;
+    }
     register(plugin) {
         if (this.plugins.has(plugin.name)) {
             throw new Error(`Channel plugin '${plugin.name}' already registered`);
@@ -46,7 +50,7 @@ export class ChannelLoader {
         const ctx = {
             agentName: agent.aid,
             defaultProjectPath: agent.config.projects?.defaultPath ?? process.cwd(),
-            debug: agent.config.debug,
+            debug: this.processDebug,
         };
         // Build the full list of config instances to create.
         // AUN is synthesised from agent.aid; any explicit aun entry in channels[] is skipped.
@@ -252,7 +256,7 @@ export function buildReloadHooks(deps) {
             const ctx = {
                 agentName: agent.aid ?? agent.config?.aid,
                 defaultProjectPath: agent.config?.projects?.defaultPath ?? process.cwd(),
-                debug: agent.config?.debug,
+                debug: channelLoader.processDebug,
             };
             const plugin = channelLoader.getPlugin(cfgInst.type);
             if (!plugin)

package/dist/core/command/command-handler.js

@@ -18,6 +18,7 @@ import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
 import { hashArgv } from '../auth/authorization-audit.js';
+import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { validateModelSelectionForRole } from '../model/model-permission.js';
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride } from '../role/runtime-policy.js';
@@ -353,10 +354,13 @@ export class CommandHandler {
     validateTriggerRuntimeFields(definition, role, baseagent) {
         if (!role)
             return undefined;
+        const executionBaseagent = definition.execution.type === 'trigger_session'
+            ? definition.execution.baseagent ?? baseagent
+            : baseagent;
         if (definition.execution.model) {
             const modelDecision = validateModelSelectionForRole({
                 role,
-                baseagent,
+                baseagent: executionBaseagent,
                 requestedModel: definition.execution.model,
                 selfAid: definition.agentAid,
             });
@@ -364,7 +368,7 @@ export class CommandHandler {
                 return modelDecision.message || '当前角色不允许使用该 Trigger 模型';
         }
         if (definition.execution.effort) {
-            const base = baseagent || 'claude';
+            const base = executionBaseagent || 'claude';
             const effortDecision = validateRuntimeStringFieldOverride({
                 selfAid: definition.agentAid,
                 role,
@@ -447,6 +451,29 @@ export class CommandHandler {
         const permissionError = this.validateTriggerPermissionModeForRole(permissionMode, isAdmin, triggerRole.role, schedulerAid);
         if (permissionError)
             return { error: permissionError };
+        if (parsed.baseagent !== undefined) {
+            if (typeof parsed.baseagent !== 'string' || !parsed.baseagent.trim()) {
+                return { error: 'Trigger baseagent 不能为空' };
+            }
+            if (parsed.executionType !== 'trigger_session') {
+                return { error: 'Trigger baseagent 仅适用于 trigger_session' };
+            }
+        }
+        const triggerOwner = this.agentRegistry?.get?.(schedulerAid) ?? this.getOwningAgent(channel);
+        const executionBaseagent = parsed.executionType === 'trigger_session'
+            ? parsed.baseagent?.trim() ?? triggerOwner?.baseagent ?? triggerRole.baseagent
+            : undefined;
+        if (parsed.executionType === 'trigger_session') {
+            if (!executionBaseagent)
+                return { error: '无法确定 Trigger 会话的 baseagent' };
+            const ownerName = triggerOwner?.name || '<unknown>';
+            const available = this.getAvailableBaseagentsForOwner(ownerName);
+            if (!available.includes(executionBaseagent)) {
+                return {
+                    error: `Trigger baseagent 不可用：${executionBaseagent}（可用：${available.join(' / ') || '无'}）`,
+                };
+            }
+        }
         const definition = {
             $schema_version: 3.1,
             id,
@@ -460,7 +487,10 @@ export class CommandHandler {
             execution: {
                 type: parsed.executionType,
                 ...(script ? { script } : { prompt: parsed.prompt || '' }),
-                ...(parsed.executionType === 'trigger_session' ? { thread: parsed.triggerThread ?? 'by_trigger' } : {}),
+                ...(parsed.executionType === 'trigger_session' ? {
+                    thread: parsed.triggerThread ?? 'by_trigger',
+                    baseagent: executionBaseagent,
+                } : {}),
                 model: parsed.model,
                 effort: parsed.effort,
                 ...(permissionMode !== undefined ? { permissionMode } : {}),
@@ -784,12 +814,9 @@ export class CommandHandler {
             item.lastActive = s.updatedAt;
         return item;
     }
-    /**
-     * 返回结构化命令菜单（供 menu.query 使用）
-     * owner 看到全部命令，admin 看到管理级命令（不含 owner-only），visitor/member 仅看到用户级命令
-     */
-    getMenuItems(role, chatType = 'private', scope = 'agent') {
-        return menuGetMenuItems.call(this, role, chatType, scope);
+    /** 返回结构化命令菜单，已迁移的命令按当前授权主体过滤。 */
+    getMenuItems(role, chatType = 'private', scope = 'agent', authSubject) {
+        return menuGetMenuItems.call(this, role, chatType, scope, authSubject);
     }
     /** 动态子菜单：根据 cmd 路径返回选项列表（供 menu.query + cmd 使用） */
     async getSubMenuItems(cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel = false, authSubject, source = 'menu') {
@@ -813,8 +840,8 @@ export class CommandHandler {
         return await menuExecMenuUpdate.call(this, cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel, args, authSubject, source);
     }
     /** menu.action — 触发动词。 */
-    async execMenuAction(cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel = false, authSubject, source = 'menu') {
-        return await menuExecMenuAction.call(this, cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel, authSubject, source);
+    async execMenuAction(cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel = false, authSubject, source = 'menu', transportReplyContext, deferSideEffect) {
+        return await menuExecMenuAction.call(this, cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel, authSubject, source, transportReplyContext, deferSideEffect);
     }
     /** ECWeb 专用入口：身份只取可信 IPC 信封。 */
     async execMenuForEcweb(payload, auth) {
@@ -955,9 +982,9 @@ export class CommandHandler {
     /**
      * 主命令处理入口
      */
-    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject) {
+    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
         try {
-            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject);
+            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
             return result;
         }
         catch (error) {
@@ -968,8 +995,8 @@ export class CommandHandler {
             throw error;
         }
     }
-    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject) {
-        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject);
+    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
+        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
     }
     async handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId) {
         if (content === '/trigger') {
@@ -1117,8 +1144,13 @@ export class CommandHandler {
             const nextStr = updated.trigger.nextFireAt ? new Date(updated.trigger.nextFireAt).toLocaleString() : '未计算';
             return `✅ 触发器已更新：**${updated.trigger.name}**\n下次触发：${nextStr}`;
         }
-        if (sub.startsWith('set ')) {
-            const args = sub.slice('set '.length);
+        const createSubcommand = sub.startsWith('create ')
+            ? 'create'
+            : sub.startsWith('set ')
+                ? 'set'
+                : undefined;
+        if (createSubcommand) {
+            const args = sub.slice(`${createSubcommand} `.length);
             const result = parseTriggerSet(args);
             if (!result.ok)
                 return `❌ ${result.error}`;
@@ -1131,9 +1163,9 @@ export class CommandHandler {
         return `❌ 未知子命令。用法：
 /trigger — 查看活跃触发器
 /trigger list [--all] — 查看所有触发器
-/trigger set <参数> — 注册触发器
+/trigger create <参数> — 创建触发器（set 为兼容别名）
 /trigger update <名称|ID> <参数> — 修改触发器
-常用参数：--delay/--at/--cron/--every、--prompt、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）
+常用参数：--exec script|trigger-session|target-session（create 必填）、--delay/--at/--cron/--every、--prompt、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）
 /trigger enable <名称|ID> — 启用触发器
 /trigger disable <名称|ID> — 暂停触发器
 /trigger show <名称|ID> — 查看触发器详情
@@ -1416,11 +1448,11 @@ export class CommandHandler {
      * Agent managed CLI config entrypoint. Identity and relation are resolved
      * from the daemon-owned session rather than caller-provided flags.
      */
-    async handleConfigOperation(argv, sessionId, delegationToken) {
+    async handleConfigOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
         }
-        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId);
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
         const session = await this.sessionManager.getSessionById(sessionId);
@@ -1477,6 +1509,66 @@ export class CommandHandler {
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
     }
+    /** Agent-managed contact CLI entrypoint. The daemon owns actor resolution and authorization. */
+    async handleContactOperation(argv, sessionId, delegationToken, delegationCommandHash) {
+        if (!this.agentDelegationRegistry) {
+            return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
+        }
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!delegation.ok)
+            return { ok: false, code: delegation.code, error: delegation.reason };
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return { ok: false, code: 'INVALID_SESSION', error: 'Invalid session' };
+        const grant = delegation.grant;
+        let conversationId;
+        try {
+            conversationId = parsePeerKey(grant.peerKey).channelId;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
+        }
+        const resolved = resolveContactCommand(argv);
+        if (!resolved.ok)
+            return { ok: false, code: resolved.code, error: resolved.reason };
+        if (resolved.command.selfAid !== grant.selfAid) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent contact book can be targeted' };
+        }
+        const subject = buildAuthSubject({
+            selfAid: grant.selfAid,
+            actorId: grant.actorId,
+            channel: grant.channel,
+            channelType: grant.channelType,
+            channelId: conversationId,
+            chatType: grant.chatType,
+            conversationId,
+            processOwners: loadDaemonConfig().owners ?? [],
+        });
+        const decision = authorizeOperation({
+            source: 'agent-tool',
+            subject,
+            intent: {
+                operation: resolved.command.operationId,
+                scope: 'agent',
+                source: 'agent-tool',
+                args: {
+                    self: resolved.command.selfAid,
+                    ...('primaryId' in resolved.command ? { primaryId: resolved.command.primaryId } : {}),
+                },
+            },
+            auditMetadata: {
+                argvHash: hashArgv(resolved.command.canonicalArgv),
+                taskId: grant.taskId,
+                messageId: grant.messageId,
+            },
+        });
+        if (!decision.allow)
+            return { ok: false, code: decision.code, error: decision.reason };
+        const result = await executeResolvedContactCommand(resolved.command, grant.actorId);
+        return result.ok
+            ? { ok: true, result }
+            : { ok: false, code: result.code, error: result.error, ...(result.data ? { data: result.data } : {}) };
+    }
     setAgentDelegationRegistry(registry) {
         this.agentDelegationRegistry = registry;
     }