evolcore 0.0.2 → 0.0.4

package/dist/core/command/menu-protocol.js

@@ -1,5 +1,6 @@
 import { createHash } from 'crypto';
 export const MENU_REQUEST_TYPES = new Set([
+    'menu.token.request',
     'menu.list',
     'menu.query',
     'menu.options',
@@ -12,6 +13,7 @@ const EXPLICIT_SCOPE_UPDATE_NAMES = new Set([
     'chatmode',
     'dispatch',
     'mentionmode',
+    'group',
     'permission',
 ]);
 const EXPLICIT_SCOPE_UPDATE_COMMANDS = new Set([
@@ -20,6 +22,7 @@ const EXPLICIT_SCOPE_UPDATE_COMMANDS = new Set([
     '/chatmode',
     '/dispatch',
     '/mentionmode',
+    '/group',
     '/perm',
 ]);
 function firstCommandToken(value) {
@@ -78,6 +81,8 @@ export function validateMenuRequest(request) {
     if (!MENU_REQUEST_TYPES.has(type)) {
         return { code: 'METHOD_NOT_FOUND', message: `Unknown menu request type: ${type}` };
     }
+    if (type === 'menu.token.request')
+        return null;
     const hasName = typeof request.name === 'string' && request.name.trim().length > 0;
     const hasCompatCmd = typeof request.cmd === 'string' && request.cmd.trim().length > 0;
     if (type !== 'menu.list' && !hasName && !hasCompatCmd) {
@@ -144,8 +149,9 @@ const INVALID_ARGUMENT_CODES = new Set([
 const STABLE_CODES = new Set([
     'ROLE_ACCESS_DENIED', 'PERMISSION_DENIED', 'UNAUTHORIZED', 'FORBIDDEN',
     'INVALID_ARGUMENT', 'NOT_ALLOWED', 'NOT_SUPPORTED', 'UNSUPPORTED',
-    'METHOD_NOT_FOUND', 'NOT_FOUND', 'CONFLICT', 'EXECUTION_TIMEOUT',
-    'TEMPORARILY_UNAVAILABLE', 'INTERNAL_ERROR', 'MISSING_SCOPE',
+    'METHOD_NOT_FOUND', 'NOT_FOUND', 'CONFLICT', 'EXPIRED', 'EXECUTION_TIMEOUT',
+    'TEMPORARILY_UNAVAILABLE', 'INTERNAL_ERROR', 'MISSING_SCOPE', 'UPGRADE_REQUIRED',
+    'MENU_TOKEN_REQUIRED', 'MENU_TOKEN_REJECTED', 'MENU_TOKEN_ENCRYPTION_REQUIRED',
 ]);
 export function normalizeMenuError(error) {
     const source = error && typeof error === 'object' ? error : {};

package/dist/core/command/menu-token-store.js

@@ -0,0 +1,102 @@
+import { createHash, randomBytes, timingSafeEqual } from 'crypto';
+import path from 'path';
+import { agentDataDir } from '../../paths.js';
+import { atomicReadJson, atomicWriteJson } from '../../utils/atomic-write.js';
+export const DEFAULT_MENU_TOKEN_IDLE_TIMEOUT_SECONDS = 30 * 24 * 60 * 60;
+export const MAX_MENU_TOKENS_PER_AGENT = 1_000;
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+function isTokenRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    return typeof record.peerAid === 'string'
+        && record.peerAid.trim().length > 0
+        && typeof record.tokenHash === 'string'
+        && /^[a-f0-9]{64}$/.test(record.tokenHash)
+        && typeof record.requestedAt === 'number'
+        && Number.isFinite(record.requestedAt)
+        && record.requestedAt >= 0
+        && typeof record.lastUsedAt === 'number'
+        && Number.isFinite(record.lastUsedAt)
+        && record.lastUsedAt >= 0
+        && typeof record.idleTimeout === 'number'
+        && Number.isInteger(record.idleTimeout)
+        && record.idleTimeout > 0;
+}
+function isExpired(record, now) {
+    return now - record.lastUsedAt >= record.idleTimeout * 1000;
+}
+function hashesEqual(left, right) {
+    const leftBytes = Buffer.from(left, 'hex');
+    const rightBytes = Buffer.from(right, 'hex');
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+export function menuTokenStorePath(selfAid) {
+    return path.join(agentDataDir(selfAid), 'menu-tokens.json');
+}
+export class MenuTokenStore {
+    maxRecords;
+    constructor(maxRecords = MAX_MENU_TOKENS_PER_AGENT) {
+        this.maxRecords = maxRecords;
+    }
+    issue(selfAid, peerAid, metadata = {}, now = Date.now()) {
+        const file = this.read(selfAid);
+        const idleTimeout = DEFAULT_MENU_TOKEN_IDLE_TIMEOUT_SECONDS;
+        const tokens = file.tokens.filter(record => record.peerAid !== peerAid && !isExpired(record, now));
+        if (tokens.length >= this.maxRecords) {
+            if (tokens.length !== file.tokens.length)
+                this.write(selfAid, tokens);
+            return null;
+        }
+        const menuToken = `mt_${randomBytes(32).toString('base64url')}`;
+        tokens.push({
+            peerAid,
+            tokenHash: hashToken(menuToken),
+            requestedAt: now,
+            lastUsedAt: now,
+            idleTimeout,
+            ...(metadata.clientName ? { clientName: metadata.clientName } : {}),
+            ...(metadata.clientVersion ? { clientVersion: metadata.clientVersion } : {}),
+            ...(metadata.evolVersion ? { evolVersion: metadata.evolVersion } : {}),
+        });
+        this.write(selfAid, tokens);
+        return { menuToken, idleTimeout };
+    }
+    use(selfAid, peerAid, menuToken, now = Date.now()) {
+        const file = this.read(selfAid);
+        const activeTokens = file.tokens.filter(record => !isExpired(record, now));
+        const tokenHash = typeof menuToken === 'string' && menuToken.length > 0 && menuToken.length <= 256
+            ? hashToken(menuToken)
+            : undefined;
+        const matchingIndex = tokenHash
+            ? activeTokens.findIndex(record => record.peerAid === peerAid && hashesEqual(record.tokenHash, tokenHash))
+            : -1;
+        if (matchingIndex < 0) {
+            if (activeTokens.length !== file.tokens.length)
+                this.write(selfAid, activeTokens);
+            return false;
+        }
+        activeTokens[matchingIndex] = { ...activeTokens[matchingIndex], lastUsedAt: now };
+        this.write(selfAid, activeTokens);
+        return true;
+    }
+    read(selfAid) {
+        try {
+            const value = atomicReadJson(menuTokenStorePath(selfAid));
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                return { schemaVersion: 1, tokens: [] };
+            const file = value;
+            if (file.schemaVersion !== 1 || !Array.isArray(file.tokens))
+                return { schemaVersion: 1, tokens: [] };
+            return { schemaVersion: 1, tokens: file.tokens.filter(isTokenRecord) };
+        }
+        catch {
+            return { schemaVersion: 1, tokens: [] };
+        }
+    }
+    write(selfAid, tokens) {
+        atomicWriteJson(menuTokenStorePath(selfAid), { schemaVersion: 1, tokens });
+    }
+}

package/dist/core/command/role-menu.js

@@ -3,8 +3,8 @@ import path from 'path';
 import crypto from 'crypto';
 import { ConfigTarget, read, resolveEffectiveWithSources, write } from '../../config/config-manager.js';
 import { getBuiltinRolesConfig, getRoleDefinition, isValidUserRoleName, readRolesConfig, } from '../../config/roles.js';
-import { BUILTIN_USER_ROLES, MANAGEMENT_ROLES, isManagementRole } from '../../config/builtin-roles.js';
-import { checkRoleAccess, isStaticAgentAdmin, isStaticAgentOwner, resolvePeerRoleDetail } from '../../config/peer-role-resolver.js';
+import { BUILTIN_USER_ROLES, MANAGEMENT_ROLES, expectedRoleRank, isManagementRole } from '../../config/builtin-roles.js';
+import { checkRoleAccess, isStaticAgentOwner, resolvePeerRoleDetail } from '../../config/peer-role-resolver.js';
 import { relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
 import { evaluateRoleOperationCapability } from '../auth/operation-authorizer.js';
 import { listOperations } from '../auth/operation-catalog.js';
@@ -55,8 +55,10 @@ export function roleMenuOperation(kind, args, value) {
     }
     if (kind === 'action')
         return 'role.policy.write';
-    if (args?.resource !== 'assignment')
+    if (args?.resource !== 'assignment' && args?.resource !== 'admin')
         return 'role.policy.write';
+    if (args?.resource === 'admin')
+        return 'role.assign';
     try {
         return JSON.parse(value ?? '') === null ? 'role.revoke' : 'role.assign';
     }
@@ -168,9 +170,11 @@ export async function roleMenuUpdate(context, args, rawValue) {
             result = updateDefinition(context.self, args, value);
         }
         else if (resource === 'defaultRoles')
-            result = updateDefaultRoles(context.self, args, value);
+            result = updateDefaultRoles(context, args, value);
         else if (resource === 'assignment')
             result = await updateAssignment(context, args, value);
+        else if (resource === 'admin')
+            result = await updateAdminAssignment(context, args, value);
         else
             throw roleError('NOT_SUPPORTED', 'The requested Role resource is not supported', context.self, { resource: resource || null });
         auditMutation(context, args, before, result, resource === 'defaultRoles' ? 'default-update' : resource === 'assignment' ? 'assignment' : 'update');
@@ -260,6 +264,8 @@ function auditMutation(context, args, before, result, operation) {
     const afterRelation = relationFile ? afterFiles[relationFile] : undefined;
     const roleId = (stringArg(args?.roleId) || undefined)
         ?? result?.roleId
+        ?? result?.assignment?.explicitRole
+        ?? result?.assignment?.explicitDefaultRole
         ?? (isObject(afterRelation) && typeof afterRelation.role === 'string' ? afterRelation.role : undefined)
         ?? (isObject(beforeRelation) && typeof beforeRelation.role === 'string' ? beforeRelation.role : undefined);
     const primaryFile = before.relation
@@ -300,7 +306,7 @@ export function recoverAllRoleMutationsSync() {
     if (!fs.existsSync(agentsDir))
         return;
     for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
-        if (!entry.isDirectory())
+        if (!entry.isDirectory() || !isValidAid(entry.name))
             continue;
         if (!fs.existsSync(roleJournalPath(entry.name)))
             continue;
@@ -447,7 +453,8 @@ function updateDefinition(self, args, value) {
         ...(args?.remove ? { removed: normalizeRemove(args.remove) } : {}),
     };
 }
-function updateDefaultRoles(self, args, value) {
+function updateDefaultRoles(context, args, value) {
+    const self = context.self;
     if (!isObject(value))
         throw invalidJsonType(self, 'defaultRoles', 'object');
     assertOnlyKeys(value, ['private', 'group'], 'defaultRoles', self);
@@ -460,6 +467,13 @@ function updateDefaultRoles(self, args, value) {
     };
     assertPolicyRevision(self, args);
     const registry = readRoleRegistry(self);
+    const changesAdminDefault = ['private', 'group'].some(scene => registry.defaultRoles[scene] !== nextDefaults[scene]
+        && (registry.defaultRoles[scene] === 'admin' || nextDefaults[scene] === 'admin'));
+    if (context.actorRole !== 'owner' && changesAdminDefault) {
+        throw roleError('NOT_ALLOWED', 'Only an owner can set or replace an admin default role', self, {
+            kind: 'admin_owner_only',
+        });
+    }
     const nextRegistry = { ...registry, defaultRoles: nextDefaults };
     const changed = stableStringify(registry) !== stableStringify(nextRegistry);
     if (changed)
@@ -484,30 +498,79 @@ async function updateAssignment(context, args, value) {
     if (roleId !== null)
         target = await validateTargetExists(context, target);
     const targetAid = target.kind === 'private' ? target.peerAid : null;
-    if (targetAid && (isStaticAgentOwner(self, targetAid) || isStaticAgentAdmin(self, targetAid))) {
-        throw roleError('NOT_ALLOWED', 'Static Agent owner/admin assignments cannot be changed through relations', self, {
-            kind: 'protected_management_assignment',
+    if (targetAid && isStaticAgentOwner(self, targetAid)) {
+        throw roleError('NOT_ALLOWED', 'Owner assignments cannot be changed through relations', self, {
+            kind: 'owner_protected',
             targetAid,
         });
     }
     const current = readRelation(target.peerKey, self);
+    if (context.actorRole !== 'owner' && (roleId === 'admin' || current?.config.role === 'admin')) {
+        throw roleError('NOT_ALLOWED', 'Only an owner can grant or revoke admin', self, {
+            kind: 'admin_owner_only',
+            target: target.peerKey,
+        });
+    }
     assertRelationRevision(self, args, current?.revision ?? null, target.peerKey);
-    if (!current && roleId === null) {
+    if (!current && roleId === null)
         return assignmentResponse(self, target, null, false, null);
-    }
     const relation = clone(current?.config ?? { $schema_version: currentVersion('relation-config') });
-    relation.targetKind = target.kind === 'private' ? 'private' : 'group';
+    relation.targetKind = target.kind;
     if (roleId === null)
         delete relation.role;
     else
         relation.role = roleId;
-    const normalized = normalizeRelationForScene(relation, target.kind === 'private' ? 'private' : 'group');
+    const normalized = normalizeRelationForScene(relation, target.kind);
     const changed = stableStringify(current?.config ?? null) !== stableStringify(normalized);
     if (changed)
         write(ConfigTarget.Relation, normalized, { self, peerKey: target.peerKey });
     const nextRevision = changed ? revision(normalized) : current?.revision ?? null;
     return assignmentResponse(self, target, normalized, changed, nextRevision);
 }
+async function updateAdminAssignment(context, args, value) {
+    const self = context.self;
+    if (context.actorRole !== 'owner') {
+        throw roleError('NOT_ALLOWED', 'Only an owner can grant or revoke admin', self, { kind: 'admin_owner_only' });
+    }
+    let target = normalizeTarget(args?.target, self);
+    if (target.kind !== 'private')
+        throw invalidTargetValue(self, 'target.kind');
+    if (isStaticAgentOwner(self, target.peerAid)) {
+        throw roleError('NOT_ALLOWED', 'Owner assignments cannot be changed through contact admin', self, { kind: 'owner_protected' });
+    }
+    const enabled = value === true || value === 'grant'
+        ? true
+        : value === false || value === null || value === 'revoke'
+            ? false
+            : undefined;
+    if (enabled === undefined)
+        throw invalidJsonType(self, 'admin', 'boolean, grant, revoke, or null');
+    if (enabled)
+        target = await validateTargetExists(context, target);
+    const current = readRelation(target.peerKey, self);
+    assertRelationRevision(self, args, current?.revision ?? null, target.peerKey);
+    if (!current && !enabled) {
+        return {
+            $schema_version: ROLE_MENU_SCHEMA_VERSION, self, resource: 'admin', target,
+            changed: false, relationRevision: null, admin: false,
+        };
+    }
+    const relation = clone(current?.config ?? { $schema_version: currentVersion('relation-config') });
+    relation.targetKind = 'private';
+    if (enabled)
+        relation.role = 'admin';
+    else if (relation.role === 'admin')
+        delete relation.role;
+    const normalized = normalizeRelationForScene(relation, 'private');
+    const changed = stableStringify(current?.config ?? null) !== stableStringify(normalized);
+    if (changed)
+        write(ConfigTarget.Relation, normalized, { self, peerKey: target.peerKey });
+    const nextRevision = changed ? revision(normalized) : current?.revision ?? null;
+    return {
+        $schema_version: ROLE_MENU_SCHEMA_VERSION, self, resource: 'admin', target,
+        changed, relationRevision: nextRevision, admin: normalized.role === 'admin',
+    };
+}
 function createRole(self, args) {
     const roleId = requiredRoleId(args, self);
     if (!isValidUserRoleName(roleId)) {
@@ -520,6 +583,10 @@ function createRole(self, args) {
     if (!isObject(args?.definition))
         throw validationFailed(self, roleId, [{ field: 'definition', code: 'INVALID_TYPE', message: 'definition must be an object' }]);
     const definition = clone(args.definition);
+    if (definition.rank !== undefined && definition.rank !== expectedRoleRank(roleId)) {
+        throw validationFailed(self, roleId, [{ field: 'definition.rank', code: 'INVALID_VALUE', message: 'custom role rank is fixed at 500' }]);
+    }
+    definition.rank = expectedRoleRank(roleId);
     const errors = validateRoleConfig(definition);
     if (errors.length)
         throw validationFailed(self, roleId, errors);
@@ -596,6 +663,11 @@ async function deleteRole(context, args) {
     const replacement = hasReplacement
         ? validateAssignableRole(args?.replacementRoleId, self, 'replacementRoleId')
         : undefined;
+    if (replacement === 'admin' && context.actorRole !== 'owner') {
+        throw roleError('NOT_ALLOWED', 'Only an owner can replace role assignments with admin', self, {
+            kind: 'admin_owner_only',
+        });
+    }
     if (replacement === roleId) {
         throw validationFailed(self, roleId, [{ field: 'replacementRoleId', code: 'INVALID_VALUE', message: 'replacementRoleId must differ from roleId' }]);
     }
@@ -646,11 +718,13 @@ async function assignmentInventory(context, args, policyRevision) {
     if (args?.roleId !== undefined && !roleFilter)
         throw validationFailed(self, undefined, [{ field: 'roleId', code: 'INVALID_VALUE', message: 'roleId must be a non-empty string' }]);
     const items = [];
-    const defaults = effectiveDefaultRoles(self);
-    for (const scene of ['private', 'group']) {
-        const roleId = defaults[scene];
-        if (roleId && (!roleFilter || roleFilter === roleId)) {
-            items.push({ target: { kind: 'default', scene }, roleId, relationRevision: null });
+    if (args?.includeDefaults !== false) {
+        const defaults = effectiveDefaultRoles(self);
+        for (const scene of ['private', 'group']) {
+            const roleId = defaults[scene];
+            if (roleId && (!roleFilter || roleFilter === roleId)) {
+                items.push({ target: { kind: 'default', scene }, roleId, relationRevision: null });
+            }
         }
     }
     let complete = true;
@@ -930,11 +1004,13 @@ function normalizeTarget(value, self) {
         const groupId = stringArg(value.groupId);
         if (!groupId)
             throw invalidTarget(self, 'target.groupId');
+        if (!isValidAid(groupId) && !isExplicitGroupId(groupId))
+            throw invalidTargetValue(self, 'target.groupId');
         return { kind, groupId, peerKey: formatPeerKey('aun', groupId) };
     }
     throw validationFailed(self, undefined, [{ field: 'target.kind', code: 'INVALID_VALUE', message: 'target.kind must be private or group' }]);
 }
-function targetRoleView(self, target, relation) {
+function targetRoleView(self, target, relation = null) {
     if (target.kind === 'private') {
         const explicitRole = relation?.role ?? null;
         const detail = resolvePeerRoleDetail({
@@ -1086,7 +1162,15 @@ function policyDocument(agent) {
 function roleMeta(self, roleId) {
     if (isManagementRole(roleId)) {
         const overridden = fs.existsSync(agentRoleConfig(self, roleId));
-        return { origin: 'builtin', overridden, kind: 'management', assignable: false, editable: true, deletable: false, resettable: true };
+        return {
+            origin: 'builtin',
+            overridden,
+            kind: 'management',
+            assignable: roleId === 'admin',
+            editable: true,
+            deletable: false,
+            resettable: true,
+        };
     }
     const builtin = Object.prototype.hasOwnProperty.call(getBuiltinRolesConfig().roles, roleId);
     const overridden = fs.existsSync(agentRoleConfig(self, roleId));
@@ -1131,7 +1215,7 @@ function parseUpdateValue(rawValue, self) {
 function validateAssignableRole(value, self, field) {
     if (value === null)
         return null;
-    if (typeof value !== 'string' || !value.trim() || isManagementRole(value) || !getRoleDefinition(value, self)) {
+    if (typeof value !== 'string' || !value.trim() || value === 'owner' || !getRoleDefinition(value, self)) {
         throw validationFailed(self, undefined, [{ field, code: 'INVALID_VALUE', message: 'value must be null or an existing assignable user role' }]);
     }
     return value;
@@ -1288,11 +1372,15 @@ function validateRoleDomainTransactionChanges(self, registry, changes) {
     for (const change of changes) {
         if (!change.after || !change.file.endsWith('.json') || change.file.endsWith('index.json'))
             continue;
-        if (!change.file.includes(`${path.sep}relations${path.sep}`)) {
-            const roleSchema = loadSchema('role-config');
-            const value = JSON.parse(change.after);
-            if (!roleSchema.validate(value))
-                throw validationFailed(self, undefined, [{ field: 'role', code: 'SCHEMA_INVALID', message: 'invalid role definition' }]);
+        const isRelation = change.file.includes(`${path.sep}relations${path.sep}`);
+        const schema = loadSchema(isRelation ? 'relation-config' : 'role-config');
+        const value = JSON.parse(change.after);
+        if (!schema.validate(value)) {
+            throw validationFailed(self, undefined, [{
+                    field: isRelation ? 'relation' : 'role',
+                    code: 'SCHEMA_INVALID',
+                    message: isRelation ? 'invalid relation config' : 'invalid role definition',
+                }]);
         }
     }
 }
@@ -1337,12 +1425,23 @@ function removeJournalFiles(journalFile) {
 }
 function validateJournal(self, journal) {
     const root = path.resolve(agentDir(self));
-    if (journal.$schema_version !== 1 || journal.self !== self || !Array.isArray(journal.changes))
+    if (journal.$schema_version !== 1 || journal.self !== self
+        || (journal.state !== 'prepared' && journal.state !== 'committed')
+        || !Array.isArray(journal.changes))
         throw new Error('Invalid Role mutation journal');
+    const seen = new Set();
     for (const change of journal.changes) {
+        if (!change || typeof change !== 'object' || typeof change.file !== 'string'
+            || (change.before !== null && typeof change.before !== 'string')
+            || (change.after !== null && typeof change.after !== 'string')) {
+            throw new Error('Role mutation journal contains an invalid change');
+        }
         const file = path.resolve(change.file);
-        if (file !== root && !file.startsWith(root + path.sep))
+        if (file === root || !file.startsWith(root + path.sep))
             throw new Error('Role mutation journal contains an unsafe path');
+        if (seen.has(file))
+            throw new Error('Role mutation journal contains duplicate file changes');
+        seen.add(file);
     }
 }
 function applyFileContent(file, content) {
@@ -1498,7 +1597,7 @@ function operationLabel(id) {
     return labels[id] ?? title(id);
 }
 function validRoleOrNull(value, self) {
-    return typeof value === 'string' && !isManagementRole(value) && getRoleDefinition(value, self) ? value : null;
+    return typeof value === 'string' && value !== 'owner' && getRoleDefinition(value, self) ? value : null;
 }
 function getNested(value, field) {
     let cursor = value;

package/dist/core/command/slash-gate.js

@@ -71,7 +71,7 @@ export function guardRoleCommand(content, activeChatType, isAdmin) {
     const userGroupCommands = [
         '/status', '/help', '/evolhelp', '/check', '/chatmode', '/mentionmode',
         '/model', '/effort', '/baseagent', '/perm', '/activity', '/stop',
-        '/resume', '/trigger',
+        '/resume', '/trigger', '/file',
     ];
     const userCommands = activeChatType === 'group' && !isAdmin
         ? userGroupCommands