evolcore 0.0.2 → 0.0.4

package/dist/index.js

@@ -16,9 +16,13 @@ import { loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfi
 import { ConfigTarget, initConfigManager, onConfigWrite } from './config/config-manager.js';
 import { ensureRoleConfigV4OnStartup } from './config/role-config-v4-startup.js';
 import { ensureRoleConfigV5OnStartup } from './config/role-config-v5-startup.js';
+import { ensureContactBookV2OnStartup } from './config/contact-book-v2-startup.js';
+import { resolvePeerDisplayLabel } from './config/contact-book.js';
+import { expirePendingContactRequests } from './config/contact-request-service.js';
 import { shouldFailFastForMissingOwners } from './config/owner-policy.js';
 import { isManagementRole } from './config/builtin-roles.js';
 import { checkRoleAccess, getFirstStaticAgentOwner, resolvePeerRoleDetail, roleToSessionIdentity } from './config/peer-role-resolver.js';
+import { isCrossAgentTriggerOperationAllowed, isCrossAgentTriggerReadOperation } from './core/auth/trigger-authorization.js';
 import { ensureStartupConfigSnapshot, isConfigSnapshotsEnabled, retentionCleanup, readCurrent, readWVersion, diffWorkingVsVersion, paramDiff, incrementSuccessCount } from './config/snapshot.js';
 import { appendBootLog, selfDiagnose } from './config/boot-log.js';
 import { CONFIG_SCHEMA_VERSION } from './types.js';
@@ -26,19 +30,22 @@ import { SessionManager } from './core/session/session-manager.js';
 import { ClaudeAgentPlugin } from './agents/claude-runner.js';
 import { CodexAgentPlugin } from './agents/codex-runner.js';
 import { GeminiAgentPlugin } from './agents/gemini-runner.js';
-import { FeishuChannelPlugin } from './channels/feishu.js';
-import { WechatChannelPlugin } from './channels/wechat.js';
+import { FeishuChannelPlugin, registerPendingFeishuContactBind } from './channels/feishu.js';
+import { WechatChannelPlugin, registerPendingWechatContactBind } from './channels/wechat.js';
 import { AUN_HANDOFF_MARKER_FIELD, AUNChannel, AUNChannelPlugin } from './channels/aun.js';
+import { assertAunEncryptionSeedPolicy } from './aun/aid/encryption-seed-policy.js';
 import { startServiceProxy } from './aun/service-proxy.js';
 import { BindService } from './utils/aid-bind.js';
 import { DingtalkChannelPlugin, registerPendingDingtalkContactBind } from './channels/dingtalk.js';
-import { QQBotChannelPlugin } from './channels/qqbot.js';
-import { WecomChannelPlugin } from './channels/wecom.js';
+import { QQBotChannelPlugin, registerPendingQQBotContactBind } from './channels/qqbot.js';
+import { WecomChannelPlugin, registerPendingWecomContactBind } from './channels/wecom.js';
 import { buildEnvelope } from './core/message/message-utils.js';
 import { ResponseEngine } from './core/message/response-engine.js';
 import { MessageQueue } from './core/message/message-queue.js';
 import { MessageBridge } from './core/message/message-bridge.js';
 import { MenuRequestDeduper, hasValidMenuId, menuFailure, menuPayloadFingerprint, parseMenuControl, validateMenuRequest } from './core/command/menu-protocol.js';
+import { evaluateEvolMenuVersionGate, evolMenuResponseTransportMetadata } from './core/command/evol-menu-version-gate.js';
+import { readInstalledEvolcoreVersion } from './utils/evolcore-version.js';
 import { recoverAllRoleMutationsSync } from './core/command/role-menu.js';
 import { HandoffRuntime } from './core/handoff/runtime.js';
 import { BootstrapService } from './core/bootstrap-service.js';
@@ -344,7 +351,7 @@ function removeLegacyAgentUpgradeCheck(manager) {
 export async function sendSystemPayload(adapter, envelope, payload) {
     await adapter.send(envelope, payload);
 }
-async function runBindBootstrapDaemon(daemonCfg, defaults) {
+async function runBindBootstrapDaemon(daemonCfg) {
     logger.warn('[bind-bootstrap] starting control AID + IPC only');
     const bindService = new BindService({
         receiverAid: daemonCfg.aid,
@@ -358,8 +365,8 @@ async function runBindBootstrapDaemon(daemonCfg, defaults) {
         agentName: daemonCfg.aid,
         channelName: 'control',
         pureIdentity: true,
-        aunTrace: daemonCfg.debug?.aunTrace ?? defaults.debug?.aunTrace,
-        aunSdkLog: daemonCfg.debug?.aunSdkLog ?? defaults.debug?.aunSdkLog,
+        aunTrace: daemonCfg.debug?.aunTrace,
+        aunSdkLog: daemonCfg.debug?.aunSdkLog,
     });
     try {
         await controlChannel.connect();
@@ -416,13 +423,7 @@ async function runBindBootstrapDaemon(daemonCfg, defaults) {
     process.on('exit', () => removeAll());
 }
 export function readEvolcoreVersion() {
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(getPackageRoot(), 'package.json'), 'utf-8'));
-        return pkg.version || 'unknown';
-    }
-    catch {
-        return 'unknown';
-    }
+    return readInstalledEvolcoreVersion();
 }
 function detectAvailableBaseagentsForBind() {
     const out = [];
@@ -582,6 +583,18 @@ async function main() {
     logger.info(`EvolCore v${readEvolcoreVersion()} starting... (fastaun v${readFastaunVersion()})`);
     // 确保数据目录存在
     ensureDataDirs();
+    // AUN keystore seed is an EvolCore application constant. A custom value can
+    // make existing identities unreadable, so fail before migrations, snapshots,
+    // instance registration, and service startup.
+    try {
+        assertAunEncryptionSeedPolicy(loadDaemonConfig().aun?.encryptionSeed, process.env.AUN_ENCRYPTION_SEED);
+    }
+    catch (error) {
+        const msg = `❌ ${error instanceof Error ? error.message : String(error)}`;
+        logger.error(msg);
+        console.error(msg);
+        process.exit(1);
+    }
     // .env 文件已在模块顶部加载，此处不再重复加载
     // ── 单实例保护（pre-check + post-write self-check）──
     // pre-check：发现已有活 main 直接退出，避免起任何副作用
@@ -598,6 +611,9 @@ async function main() {
     }
     // 在登记 daemon 实例前自动备份并迁移旧角色配置；失败才阻止启动。
     try {
+        // Crash recovery must precede schema gates and migrations so they never
+        // inspect or migrate a partially applied Role Menu transaction.
+        recoverAllRoleMutationsSync();
         const migration = await ensureRoleConfigV4OnStartup();
         if (migration) {
             const msg = `✓ Role config v4 migration applied automatically: ${migration.changedFiles} file(s)` +
@@ -612,6 +628,13 @@ async function main() {
             logger.info(msg);
             console.error(msg);
         }
+        const contactMigration = await ensureContactBookV2OnStartup();
+        if (contactMigration) {
+            const msg = `✓ Contact book v2 migration applied automatically: ${contactMigration.changedFiles} file(s)` +
+                (contactMigration.backup ? `; backup: ${contactMigration.backup}` : '');
+            logger.info(msg);
+            console.error(msg);
+        }
     }
     catch (e) {
         const msg = `❌ ${e instanceof Error ? e.message : String(e)}`;
@@ -639,7 +662,6 @@ async function main() {
     // ── 配置体系初始化（schema 字段不相交硬约束校验）──
     try {
         initConfigManager();
-        recoverAllRoleMutationsSync();
     }
     catch (e) {
         const msg = `❌ 配置 schema 校验失败: ${e instanceof Error ? e.message : String(e)}`;
@@ -670,6 +692,9 @@ async function main() {
         }
     }
     const daemonCfg = loadDaemonConfig();
+    if (daemonCfg.debug?.logLevel) {
+        setLogLevel(daemonCfg.debug.logLevel);
+    }
     if (initializeEckSnapshotsConfig(daemonCfg)) {
         logger.warn(`[ECK] Debug snapshots enabled at ${eckDebugDir()}; files may contain sensitive context and local paths.`);
     }
@@ -691,12 +716,9 @@ async function main() {
         logger.warn('[startup] daemon.json.owners 未配置：进程级 menu 操作（/system /agent）将一律拒绝。' +
             '如需远程管理，请在 daemon.json 配置 owners: [<你的 AID>]');
     }
-    // 应用配置中的日志级别（优先于环境变量）
-    // logLevel 现在不在新结构中——若要保留，将来可加 defaults.debug.logLevel
-    // 阶段 2c 暂跳过
     const paths = resolvePaths();
     if (bindBootstrapMode && daemonCfg.aid && loadAllAgents().agents.length === 0) {
-        await runBindBootstrapDaemon(daemonCfg, defaults);
+        await runBindBootstrapDaemon(daemonCfg);
         return;
     }
     // ── EvolAgent Registry：加载 agents/<aid>/config.json ──
@@ -744,14 +766,11 @@ async function main() {
         agentRuntimeError = 'No runnable self-agent (all are error/disabled).';
         logger.warn(`[startup] ${agentRuntimeError} Control Plane will remain available.`);
     }
-    // 进程级设置：idleMonitor 属于 daemon.json；debug 继续沿用 defaults 的现有行为。
+    // 进程级设置独立来自 daemon.json，不进入 Agent 覆盖链。
     const globalSettings = {
         idleMonitor: daemonCfg.idleMonitor,
-        debug: defaults.debug,
+        debug: daemonCfg.debug,
     };
-    if (globalSettings.debug?.logLevel) {
-        setLogLevel(globalSettings.debug.logLevel);
-    }
     // 启动期 anthropic 凭证校验已移除：runner 创建时由 AgentLoader 错误处理
     logger.info('✓ Config loaded');
     // Store for IPC access (T10 will wire this)
@@ -870,7 +889,9 @@ async function main() {
     const permissionGateway = new PermissionGateway();
     permissionGateway.setEventBus(eventBus);
     onConfigWrite(({ target, selector }) => {
-        if ((target !== ConfigTarget.Agent && target !== ConfigTarget.Contact) || !selector.self)
+        if ((target !== ConfigTarget.Agent
+            && target !== ConfigTarget.Contact
+            && target !== ConfigTarget.Relation) || !selector.self)
             return;
         const cancelled = permissionGateway.revalidatePendingApprovals(selector.self);
         if (cancelled > 0) {
@@ -906,7 +927,7 @@ async function main() {
         messageCache.cleanupExpired();
     }, 60 * 60 * 1000);
     // 渠道插件系统
-    const channelLoader = new ChannelLoader();
+    const channelLoader = new ChannelLoader(daemonCfg.debug);
     channelLoader.register(new FeishuChannelPlugin());
     channelLoader.register(new WechatChannelPlugin());
     channelLoader.register(new AUNChannelPlugin());
@@ -928,6 +949,14 @@ async function main() {
     }
     const channelInstances = evolagentInstances;
     logger.info(`✓ Created ${channelInstances.length} channel instance(s)`);
+    const contactRequestExpiryTimer = setInterval(() => {
+        for (const agent of agentRegistry.runnableAgents()) {
+            void expirePendingContactRequests(agent.aid).catch(error => {
+                logger.warn(`[contact-request] Pending expiry sweep failed: self=${agent.aid} error=${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+    }, 60_000);
+    contactRequestExpiryTimer.unref?.();
     const bindService = daemonCfg.aid
         ? new BindService({
             receiverAid: daemonCfg.aid,
@@ -990,6 +1019,10 @@ async function main() {
         await responseEngine.interruptSession(sessionKey, reason);
     });
     messageQueue.setEventBus(eventBus);
+    // Restore persisted input before Trigger schedulers start. Trigger-owned work
+    // is deliberately dropped here and reclaimed from active.json by its scheduler.
+    messageQueue.restorePersisted(false);
+    const droppedTriggerSessionIds = new Set(messageQueue.consumeDroppedTriggerSessionIds());
     // 进程退出时立即刷盘队列状态（防止 debounce 期间的消息丢失）
     onShutdown(() => messageQueue.persistQueuesImmediate());
     // 回填 messageQueue 引用
@@ -1061,6 +1094,43 @@ async function main() {
         baseagent: primaryAgent?.baseagent || 'codex',
         projectPath: primaryAgent?.projectPath || process.cwd(),
     };
+    const triggerBaseagentsForAgent = (agentAid) => {
+        const ownerName = agentRegistry.get(agentAid)?.name
+            ?? (agentAid === daemonTriggerOwner.aid ? primaryAgent?.name : undefined);
+        if (!ownerName)
+            return [];
+        const prefix = `${ownerName}::`;
+        return [...agentMap.keys()]
+            .filter(key => key.startsWith(prefix))
+            .map(key => key.slice(prefix.length));
+    };
+    const materializeTriggerCreateBaseagent = (input, agentAid) => {
+        const rawExecution = input.execution;
+        if (!rawExecution || typeof rawExecution !== 'object' || Array.isArray(rawExecution))
+            return input;
+        const execution = rawExecution;
+        if (execution.type !== 'trigger_session') {
+            if (execution.baseagent !== undefined) {
+                throw new Error('execution.baseagent is only allowed when execution.type=trigger_session');
+            }
+            return input;
+        }
+        if (execution.baseagent !== undefined
+            && (typeof execution.baseagent !== 'string' || !execution.baseagent.trim())) {
+            throw new Error('execution.baseagent must be a non-empty string');
+        }
+        const baseagent = typeof execution.baseagent === 'string'
+            ? execution.baseagent.trim()
+            : agentRegistry.get(agentAid)?.baseagent
+                ?? (agentAid === daemonTriggerOwner.aid ? daemonTriggerOwner.baseagent : undefined);
+        if (!baseagent)
+            throw new Error('unable to resolve Trigger session baseagent');
+        const available = triggerBaseagentsForAgent(agentAid);
+        if (!available.includes(baseagent)) {
+            throw new Error(`Trigger baseagent unavailable for ${agentAid}: ${baseagent} (available: ${available.join(', ') || 'none'})`);
+        }
+        return { ...input, execution: { ...execution, baseagent } };
+    };
     const getTriggerChannel = (agentAid, channelKey) => {
         if (agentAid === daemonTriggerOwner.aid && channelKey === daemonChannel.channelKey) {
             return {
@@ -1117,7 +1187,7 @@ async function main() {
             const agent = agentRegistry.get(definition.agentAid);
             const modelDecision = validateModelSelectionForRole({
                 role: actor.role,
-                baseagent: agent?.baseagent,
+                baseagent: definition.execution.baseagent ?? agent?.baseagent,
                 requestedModel: definition.execution.model,
                 selfAid: definition.agentAid,
             });
@@ -1125,7 +1195,9 @@ async function main() {
                 throw new Error(modelDecision.message || 'trigger model is not allowed by current role');
         }
         if (definition.execution.effort) {
-            const baseagent = agentRegistry.get(definition.agentAid)?.baseagent || 'claude';
+            const baseagent = definition.execution.baseagent
+                ?? agentRegistry.get(definition.agentAid)?.baseagent
+                ?? 'claude';
             const effortDecision = validateRuntimeStringFieldOverride({
                 selfAid: definition.agentAid,
                 role: actor.role,
@@ -1230,7 +1302,7 @@ async function main() {
         }
         return { allowed: true };
     };
-    const authenticatedTriggerActor = async (agentAid, actorSessionId, delegationToken, controlToken) => {
+    const authenticatedTriggerActor = async (agentAid, actorSessionId, delegationToken, delegationCommandHash, controlToken) => {
         if (typeof actorSessionId !== 'string' || !actorSessionId) {
             const providedToken = typeof controlToken === 'string' ? Buffer.from(controlToken) : undefined;
             const expectedToken = Buffer.from(triggerControlToken);
@@ -1266,12 +1338,9 @@ async function main() {
                 subject,
             };
         }
-        const validation = agentDelegationRegistry.validate(typeof delegationToken === 'string' ? delegationToken : undefined, actorSessionId);
+        const validation = agentDelegationRegistry.validate(typeof delegationToken === 'string' ? delegationToken : undefined, actorSessionId, typeof delegationCommandHash === 'string' ? delegationCommandHash : undefined);
         if (!validation.ok)
             throw new Error(validation.reason);
-        if (validation.grant.selfAid !== agentAid) {
-            throw new Error('trigger agent does not match authenticated task agent');
-        }
         const actorSession = await sessionManager.getSessionById(actorSessionId);
         const actorOrigin = actorSession ? originFromActorSession(actorSession, validation.grant.actorId, validation.grant.channel, validation.grant.chatType) : undefined;
         if (!actorSession || !actorOrigin?.peerId)
@@ -1280,7 +1349,9 @@ async function main() {
             throw new Error('trigger delegation actor does not match session peer');
         }
         const roleDetail = resolvePeerRoleDetail({
-            selfAid: validation.grant.selfAid,
+            // A cross-agent audit must be authorized by the target agent's role
+            // configuration, not by the task agent that carried the delegation.
+            selfAid: agentAid,
             channelKey: validation.grant.channel,
             channelType: validation.grant.channelType,
             chatType: 'private',
@@ -1288,11 +1359,11 @@ async function main() {
             conversationId: validation.grant.actorId,
         });
         const currentRole = roleDetail.effectiveRole;
-        if (!checkRoleAccess(currentRole, validation.grant.selfAid)) {
+        if (!checkRoleAccess(currentRole, agentAid)) {
             throw new Error('trigger actor no longer has access to this agent');
         }
         const subject = buildAuthSubject({
-            selfAid: validation.grant.selfAid,
+            selfAid: agentAid,
             actorId: validation.grant.actorId,
             channel: validation.grant.channel,
             channelType: validation.grant.channelType,
@@ -1385,18 +1456,36 @@ async function main() {
         }
     };
     cmdHandler.setTriggerSchedulerResolver((agentAid) => triggerSchedulers.get(agentAid));
-    const startedTriggerAgents = new Set();
+    const triggerSchedulerStarts = new Map();
     const ensureTriggerSchedulerStarted = async (agent) => {
-        if (startedTriggerAgents.has(agent.aid))
-            return;
-        startedTriggerAgents.add(agent.aid);
-        await startTriggerScheduler(agent);
+        const existing = triggerSchedulerStarts.get(agent.aid);
+        if (existing)
+            return await existing;
+        const starting = startTriggerScheduler(agent);
+        triggerSchedulerStarts.set(agent.aid, starting);
+        try {
+            await starting;
+        }
+        catch (error) {
+            if (triggerSchedulerStarts.get(agent.aid) === starting)
+                triggerSchedulerStarts.delete(agent.aid);
+            throw error;
+        }
     };
     const ensureDaemonTriggerSchedulerStarted = async () => {
-        if (startedTriggerAgents.has(daemonTriggerOwner.aid))
-            return;
-        startedTriggerAgents.add(daemonTriggerOwner.aid);
-        await startTriggerScheduler(daemonTriggerOwner, { seedUpgradeCheck: true });
+        const existing = triggerSchedulerStarts.get(daemonTriggerOwner.aid);
+        if (existing)
+            return await existing;
+        const starting = startTriggerScheduler(daemonTriggerOwner, { seedUpgradeCheck: true });
+        triggerSchedulerStarts.set(daemonTriggerOwner.aid, starting);
+        try {
+            await starting;
+        }
+        catch (error) {
+            if (triggerSchedulerStarts.get(daemonTriggerOwner.aid) === starting)
+                triggerSchedulerStarts.delete(daemonTriggerOwner.aid);
+            throw error;
+        }
     };
     // 默认策略
     const defaultPolicy = {
@@ -1417,8 +1506,15 @@ async function main() {
     const defaultProjectPath = primaryAgent?.projectPath
         ?? defaults.projects?.defaultPath
         ?? path.join(paths.root, 'projects', 'default');
+    const isContactBindChannelReady = (channelKey) => {
+        const inst = channelInstances.find(candidate => candidate.adapter.channelKey === channelKey);
+        return !!inst && inst.channel.getStatus?.().connected === true;
+    };
     const msgBridge = new MessageBridge(defaultProjectPath, sessionManager, processor, messageQueue, cmdHandler, eventBus, primaryAgent?.config.debounce, () => processLevelOwners);
     msgBridge.setAgentRegistry(agentRegistry);
+    msgBridge.setInteractionRouter(interactionRouter);
+    msgBridge.setContactBindRuntimeChecker(isContactBindChannelReady);
+    msgBridge.setAidStatsCollector(aidStatsCollector);
     const bootstrapService = new BootstrapService(agentRegistry, eventBus);
     msgBridge.setBootstrapService(bootstrapService);
     msgBridge.setHandoffRuntime(handoffRuntime);
@@ -1445,7 +1541,7 @@ async function main() {
                             const isGroup = session.chatType === 'group';
                             const target = isGroup
                                 ? (session.metadata?.groupId || session.channelId)
-                                : (session.metadata?.peerId || envelope.channelId);
+                                : (envelope.replyContext?.peerId || session.metadata?.peerId || envelope.channelId);
                             appendMessageLog(chatDir, buildOutboundEntry({
                                 from: owningAgent?.aid ?? envelope.agentName ?? session.selfAID ?? 'self',
                                 to: String(target || envelope.channelId),
@@ -1463,6 +1559,16 @@ async function main() {
                                 source: normalizeMessageSource(envelope.replyContext?.metadata?.source),
                                 chatmode: envelope.chatmode,
                             }));
+                            // Per-AID 统计（预览行/tooltip 数据源）。AUN 在 channel 层自行记账，此处只补非 AUN。
+                            const statsAid = owningAgent?.aid ?? envelope.agentName ?? session.selfAID;
+                            if (statsAid) {
+                                aidStatsCollector.recordOutbound(statsAid, String(target || envelope.channelId), Buffer.byteLength(logPayload.text, 'utf-8'), logPayload.text, false, undefined, envelope.chatmode, 'send', {
+                                    channelType: inst.channelType || inst.adapter.channelName,
+                                    // 与入向同一套展示名解析：联系人簿 displayName 优先，兜底原生 ID
+                                    peerLabel: resolvePeerDisplayLabel(statsAid, inst.channelType || inst.adapter.channelName, String(target || envelope.channelId), inst.adapter.channelKey) || session.metadata?.peerName || String(target || envelope.channelId),
+                                    routeId: envelope.channelId,
+                                });
+                            }
                         }
                     }
                     catch (err) {
@@ -1612,7 +1718,7 @@ async function main() {
         const agent = agentRegistry.resolveByChannel(inst.adapter.channelKey) ?? agentRegistry.resolveByChannel(name);
         if (!agent)
             return;
-        if (!agent.config.debug?.upmsg)
+        if (!daemonCfg.debug?.upmsg)
             return;
         const ownerAid = getFirstStaticAgentOwner(agent.aid);
         if (!ownerAid)
@@ -1787,15 +1893,15 @@ async function main() {
     // Trigger scheduler 与渠道连接解耦：cron 定时任务独立于渠道可用性运行
     // （触发时若渠道未连，发送侧自行排队/重试）。markChannelConnected 里的
     // ensureTriggerSchedulerStarted 仅作"尽早启动"优化，此处保证即使渠道首连
-    // 全部失败（如 gateway 宕机），trigger 仍无条件启动。Set 去重，不会重复。
-    ensureDaemonTriggerSchedulerStarted().catch((e) => {
-        logger.warn(`[startup] daemon trigger scheduler start failed for ${daemonTriggerOwner.aid}: ${e}`);
-    });
-    for (const agent of triggerStartupAgents) {
-        ensureTriggerSchedulerStarted(agent).catch((e) => {
+    // 全部失败（如 gateway 宕机），trigger 仍无条件启动。Promise 去重，不会重复。
+    await Promise.all([
+        ensureDaemonTriggerSchedulerStarted().catch((e) => {
+            logger.warn(`[startup] daemon trigger scheduler start failed for ${daemonTriggerOwner.aid}: ${e}`);
+        }),
+        ...triggerStartupAgents.map(agent => ensureTriggerSchedulerStarted(agent).catch((e) => {
             logger.warn(`[startup] trigger scheduler start failed for ${agent.aid}: ${e}`);
-        });
-    }
+        })),
+    ]);
     // ── 控制 AID（daemon 进程身份）：pureIdentity 接入 AUN，独立于 evolagent ──
     // 证书缺失检测/生成在 CLI 侧（ec start）完成。daemon 是后台进程无终端，
     // 这里只做兜底：证书缺失时 warn 并继续（AUNChannel 内部后台重连），绝不阻塞。
@@ -1813,8 +1919,8 @@ async function main() {
             agentName: daemonCfg.aid,
             channelName: 'control',
             pureIdentity: true,
-            aunTrace: daemonCfg.debug?.aunTrace ?? defaults.debug?.aunTrace,
-            aunSdkLog: daemonCfg.debug?.aunSdkLog ?? defaults.debug?.aunSdkLog,
+            aunTrace: daemonCfg.debug?.aunTrace,
+            aunSdkLog: daemonCfg.debug?.aunSdkLog,
         });
         // connect() 失败不置空实例：AUNChannel 内部有无限重连（SDK auto_reconnect +
         // scheduleReconnect），首连失败后台会自愈；保留实例供 status 显示 disconnected。
@@ -1884,13 +1990,16 @@ async function main() {
                 const menuControl = parseMenuControl(text);
                 const isRoleMenu = menuControl.isMenu
                     && (menuControl.name === 'role' || menuControl.request.cmd === '/role');
+                const menuResponseContext = () => ({
+                    metadata: evolMenuResponseTransportMetadata(opts.encrypted),
+                });
                 if (menuControl.isMenu && !hasValidMenuId(menuControl)) {
                     logger.warn(`[ControlMenu] dropped malformed request without id type=${menuControl.type}`);
                     return;
                 }
                 if (menuControl.isMenu && !isRoleMenu && !isProcessLevelOwner(opts.peerId, processLevelOwners)) {
                     const response = menuFailure({ id: menuControl.id, ...(menuControl.name?.trim() ? { name: menuControl.name } : {}) }, { code: 'ROLE_ACCESS_DENIED', message: 'Current identity cannot access the control channel' });
-                    await controlChannel.sendStructured(opts.channelId, response, { metadata: { encrypted: opts.encrypted } });
+                    await controlChannel.sendStructured(opts.channelId, response, menuResponseContext());
                     return;
                 }
                 if (!isRoleMenu && !isProcessLevelOwner(opts.peerId, processLevelOwners)) {
@@ -1913,9 +2022,17 @@ async function main() {
                 }
                 // menu.* JSON 路由：owner 已在上方校验，转交 execMenuForControl（fromControlChannel=true）
                 if (menuControl.isMenu) {
+                    const versionError = evaluateEvolMenuVersionGate({
+                        encrypted: opts.encrypted,
+                        protectedHeaders: opts.protectedHeaders,
+                    });
+                    if (versionError) {
+                        await controlChannel.sendStructured(opts.channelId, menuFailure({ id: menuControl.id, ...(menuControl.name?.trim() ? { name: menuControl.name } : {}) }, versionError), menuResponseContext());
+                        return;
+                    }
                     const validationError = validateMenuRequest(menuControl.request);
                     if (validationError) {
-                        await controlChannel.sendStructured(opts.channelId, menuFailure({ id: menuControl.id, ...(menuControl.name?.trim() ? { name: menuControl.name } : {}) }, validationError), { metadata: { encrypted: opts.encrypted } });
+                        await controlChannel.sendStructured(opts.channelId, menuFailure({ id: menuControl.id, ...(menuControl.name?.trim() ? { name: menuControl.name } : {}) }, validationError), menuResponseContext());
                         return;
                     }
                     const deduped = await controlMenuDeduper.execute([opts.channelId, opts.peerId, menuControl.id].join('\u001f'), menuPayloadFingerprint(menuControl.raw), () => cmdHandler.execMenuForControl(parsed, opts.peerId));
@@ -1924,7 +2041,7 @@ async function main() {
                         : deduped.value;
                     // 同 bind.response：sendStructured 直发 typed payload（payload.type='menu.response'），
                     // 不能用 sendMessage（会包成 {type:'text',...}）；encrypted 跟随入站请求保持对称。
-                    await controlChannel.sendStructured(opts.channelId, response, { metadata: { encrypted: opts.encrypted } });
+                    await controlChannel.sendStructured(opts.channelId, response, menuResponseContext());
                     return;
                 }
                 // owner 发的其他内容：提示可用指令
@@ -1991,9 +2108,7 @@ async function main() {
             });
         }
     });
-    // 先恢复消息队列。若某个 session 有原始 active/pending 消息，下面的泛化 resume 会跳过它。
-    messageQueue.restorePersisted(false);
-    const droppedTriggerSessionIds = new Set(messageQueue.consumeDroppedTriggerSessionIds());
+    // Trigger scheduler 已在队列恢复之后启动；这里只协调其余持久化工作。
     // runnableAgents() only returns pre-start `stopped` agents. Reuse the stable
     // startup snapshot because channel connection may already mark them running.
     const recoveryAids = triggerStartupAgents.map(agent => agent.aid);
@@ -2029,8 +2144,13 @@ async function main() {
         logger.info(`[Resume] Found ${pendingSessions.length} pending session(s) from before restart`);
         for (const session of pendingSessions) {
             if (droppedTriggerSessionIds.has(session.id)) {
-                logger.info(`[Resume] session ${session.id}: dropped stale Trigger execution, clearing processing without resume`);
-                sessionManager.clearProcessing(session.id);
+                if (messageQueue.isProcessing(session.id) || messageQueue.getQueueLength(session.id) > 0) {
+                    logger.info(`[Resume] session ${session.id}: Trigger scheduler already reclaimed execution, skipping generic resume`);
+                }
+                else {
+                    logger.info(`[Resume] session ${session.id}: dropped stale Trigger execution was not reclaimable, clearing processing`);
+                    sessionManager.clearProcessing(session.id);
+                }
                 continue;
             }
             if (messageQueue.isProcessing(session.id) || messageQueue.getQueueLength(session.id) > 0) {
@@ -2121,8 +2241,8 @@ async function main() {
                 ? { aid: daemonCfg.aid, connected: controlChannel?.getAidState().status === 'connected' }
                 : undefined,
         };
-    }, async (cmd, sessionId, delegationToken) => {
-        const delegation = agentDelegationRegistry.validate(delegationToken, sessionId);
+    }, async (cmd, sessionId, delegationToken, delegationCommandHash) => {
+        const delegation = agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
         return cmdHandler.handleCtl(cmd, sessionId);
@@ -2131,9 +2251,27 @@ async function main() {
     ipcServer.setAgentRegistry(agentRegistry);
     ipcServer.setDingtalkContactBindExecutor({
         register: (cmd) => registerPendingDingtalkContactBind(cmd),
+        isChannelReady: isContactBindChannelReady,
+    });
+    ipcServer.setFeishuContactBindExecutor({
+        register: (cmd) => registerPendingFeishuContactBind(cmd),
+        isChannelReady: isContactBindChannelReady,
+    });
+    ipcServer.setQQBotContactBindExecutor({
+        register: (cmd) => registerPendingQQBotContactBind(cmd),
+        isChannelReady: isContactBindChannelReady,
+    });
+    ipcServer.setWecomContactBindExecutor({
+        register: (cmd) => registerPendingWecomContactBind(cmd),
+        isChannelReady: isContactBindChannelReady,
+    });
+    ipcServer.setWechatContactBindExecutor({
+        register: (cmd) => registerPendingWechatContactBind(cmd),
+        isChannelReady: isContactBindChannelReady,
     });
     ipcServer.setMenuExecutor((payload, auth) => cmdHandler.execMenuForEcweb(payload, auth));
-    ipcServer.setConfigOperationExecutor((argv, sessionId, delegationToken) => cmdHandler.handleConfigOperation(argv, sessionId, delegationToken));
+    ipcServer.setConfigOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleConfigOperation(argv, sessionId, delegationToken, delegationCommandHash));
+    ipcServer.setContactOperationExecutor((argv, sessionId, delegationToken, delegationCommandHash) => cmdHandler.handleContactOperation(argv, sessionId, delegationToken, delegationCommandHash));
     cmdHandler.setDaemonStatusProvider(() => {
         const aidState = controlChannel?.getAidState?.();
         return {
@@ -2259,6 +2397,7 @@ async function main() {
             : undefined;
         const delegation = authorizeDelegatedAunMsgSend(agentDelegationRegistry, {
             delegationToken: params.delegationToken,
+            delegationCommandHash: params.delegationCommandHash,
             sessionId: params.originSessionId,
             messageId: params.originMessageId,
             aid: params.aid,
@@ -2481,6 +2620,10 @@ async function main() {
     };
     // Full resync handler: scan disk, load new agents, unload removed/disabled, reload changed
     globalThis.__evolcore_resyncAgents = async () => {
+        // 先清 kit 缓存：'kits' 组（manifest / fragment / schema / 角色模板）走 on-reload
+        // 策略，平时不查盘。放在扫盘与 reload 之前，本轮上下线的 agent 才能读到磁盘上的
+        // 最新版本——放在末尾的话，这一轮全用旧值，改动要等下一次 resync 才生效。
+        invalidateKitCache();
         const { loadAllAgents: scanAgents, loadDefaults: readDefaults } = await import('./config-store.js');
         const { resolveEffective } = await import('./config/config-manager.js');
         const freshDefaults = readDefaults();
@@ -2502,6 +2645,7 @@ async function main() {
                 }
                 await triggerSchedulers.get(aid)?.stop();
                 triggerSchedulers.delete(aid);
+                triggerSchedulerStarts.delete(aid);
                 // 断开所有 channels
                 for (const chName of agent.channelInstanceNames()) {
                     const inst = channelInstances.find(i => i.adapter.channelName === chName);
@@ -2554,8 +2698,7 @@ async function main() {
                 results.push(`⚠ ${cfg.aid}: ${e?.message || e}`);
             }
         }
-        // 重建 channel index + 清除 kit 缓存
-        invalidateKitCache();
+        // 重建 channel index（kit 缓存已在本轮开头清过）
         agentRegistry.channelIndex.clear();
         agentRegistry.buildChannelIndex();
         logger.info(`[Resync] Done: ${results.length} agent(s) processed`);
@@ -2627,8 +2770,21 @@ async function main() {
             return agentAid;
         };
         const authorizeTrigger = async (agentAid, operation, triggerId) => {
-            const actor = await authenticatedTriggerActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.controlToken);
-            if (!actor.control && actor.selfAid !== agentAid) {
+            const actor = await authenticatedTriggerActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.delegationCommandHash, cmd.controlToken);
+            const isCrossAgent = !actor.control && actor.selfAid !== agentAid;
+            if (!isCrossAgentTriggerOperationAllowed({
+                control: actor.control,
+                taskAgentAid: actor.selfAid,
+                targetAgentAid: agentAid,
+                targetManagement: actor.management,
+                operation,
+            })) {
+                if (isCrossAgent && !actor.management) {
+                    throw new Error('cross-agent trigger audit requires owner/admin access on the target agent');
+                }
+                if (isCrossAgent && !isCrossAgentTriggerReadOperation(operation)) {
+                    throw new Error('cross-agent trigger operations are limited to list, show, and history');
+                }
                 throw new Error('trigger agent does not match authenticated task agent');
             }
             const operationDecision = authorizeOperation({
@@ -2708,7 +2864,8 @@ async function main() {
                 }
                 const agentAid = requireAgent(rawDefinition.agentAid);
                 const actor = await authorizeTrigger(agentAid, 'trigger.create');
-                const definition = normalizeTriggerDefinition({ ...rawDefinition, origin: actor.origin });
+                const materialized = materializeTriggerCreateBaseagent({ ...rawDefinition, origin: actor.origin }, agentAid);
+                const definition = normalizeTriggerDefinition(materialized);
                 validateTriggerDefinitionForActor(definition, actor);
                 requireAgent(definition.agentAid);
                 validateTriggerFeedbackChannels(definition);
@@ -2727,7 +2884,7 @@ async function main() {
                 if (cmd.expectedRevision !== undefined && cmd.expectedRevision !== currentRevision) {
                     throw new Error(`trigger revision conflict: expected ${cmd.expectedRevision}, current ${currentRevision}`);
                 }
-                const definition = applyTriggerPatch(existing, cmd.patch);
+                const definition = applyTriggerPatch(existing, cmd.patch, { fromPromptFile: cmd.promptFile === true });
                 validateTriggerDefinitionForActor(definition, actor);
                 validateTriggerFeedbackChannels(definition);
                 const scheduler = schedulerFor(agentAid);
@@ -2797,7 +2954,11 @@ async function main() {
     // 显式触发更可控。
     // 优雅关闭
     let shutdownSignal = 'unknown';
+    let shutdownInProgress = false;
     const shutdown = async (signal) => {
+        if (shutdownInProgress)
+            return;
+        shutdownInProgress = true;
         if (signal)
             shutdownSignal = signal;
         const pid = process.pid;
@@ -2806,30 +2967,60 @@ async function main() {
         ipcServer.stopCpuTracking();
         ipcServer.stop();
         bindService?.stopCleanup();
-        await permissionGateway.cancelAllPending('daemon_restart');
-        await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.waitForIdle(5_000)));
-        await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.stop()));
-        eventBus.publish({
-            type: 'system:shutdown',
-            timestamp: Date.now()
-        });
-        // 断开插件系统的渠道
-        await channelLoader.disconnectAll(channelInstances);
-        for (const inst of channelInstances) {
-            const type = inst.channelType || inst.adapter.channelName;
-            eventBus.publish({ type: 'channel:disconnected', channel: type, channelName: inst.adapter.channelName, reason: 'shutdown' });
+        // 必须在第一个 await 之前同步冻结 active batch、发布 task:interrupted，
+        // 否则 handler continuation 可能先提交完成并清掉待恢复的主消息。
+        const shutdownStep = async (label, operation) => {
+            try {
+                await operation();
+            }
+            catch (error) {
+                logger.error(`[Shutdown] ${label} failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
+        try {
+            const queueShutdown = messageQueue.shutdownGracefully();
+            await shutdownStep('cancel pending permissions', () => permissionGateway.cancelAllPending('daemon_restart'));
+            await shutdownStep('wait for trigger schedulers', async () => {
+                await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.waitForIdle(5_000)));
+            });
+            await shutdownStep('suspend trigger schedulers', async () => {
+                await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.suspendForDaemonExit()));
+            });
+            await shutdownStep('interrupt active message queue tasks', async () => { await queueShutdown; });
+            eventBus.publish({
+                type: 'system:shutdown',
+                timestamp: Date.now()
+            });
+            // 断开插件系统的渠道
+            await shutdownStep('disconnect channels', () => channelLoader.disconnectAll(channelInstances));
+            for (const inst of channelInstances) {
+                const type = inst.channelType || inst.adapter.channelName;
+                eventBus.publish({ type: 'channel:disconnected', channel: type, channelName: inst.adapter.channelName, reason: 'shutdown' });
+            }
+            // 断开控制 AID（daemon 进程身份）
+            if (controlChannel) {
+                await shutdownStep('disconnect control AID', () => controlChannel.disconnect());
+            }
         }
-        // 断开控制 AID（daemon 进程身份）
-        if (controlChannel) {
+        catch (error) {
+            logger.error(`[Shutdown] Unexpected shutdown failure: ${error instanceof Error ? error.stack || error.message : String(error)}`);
+        }
+        finally {
             try {
-                await controlChannel.disconnect();
+                sessionManager.close();
             }
-            catch { /* ignore */ }
+            catch (error) {
+                logger.error(`[Shutdown] session manager close failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            try {
+                removeAll();
+            }
+            catch (error) {
+                logger.error(`[Shutdown] instance cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            logger.info('✓ Shutdown complete');
+            process.exit(0);
         }
-        sessionManager.close();
-        removeAll();
-        logger.info('✓ Shutdown complete');
-        process.exit(0);
     };
     process.on('SIGINT', () => shutdown('SIGINT'));
     process.on('SIGTERM', () => shutdown('SIGTERM'));