evolcore 0.0.20 → 0.0.21

package/dist/cli/daemon-commands.js

@@ -18,7 +18,7 @@ import { tryUpgrade, tryUpgradeGlobalPkg, resolveGlobalPkg } from '../utils/npm-
 import { ecwebVersionRequirementError, fetchEcwebPairCode, resolveEcwebLaunchCommand } from '../utils/ecweb-utils.js';
 import { isHostChinese } from '../utils/locale.js';
 import { scanInstances, cleanupInstances, findOrphanProcesses, killOrphans } from '../utils/instance-registry.js';
-import { filterLogFiles, deriveLogTypes, computePreChecked, validateLogTypes, shortLogName as shortLogNameLocal } from './watch-logs.js';
+import { filterLogFiles, deriveLogTypes, computePreChecked, validateLogTypes, shortLogName as shortLogNameLocal, isWatchLogFile } from './watch-logs.js';
 import { displaySessionTitle } from '../core/session/session-title.js';
 import { isNonAgentSessionChannel } from '../core/system-channels.js';
 import { printCodeStats } from './code-stats.js';
@@ -29,6 +29,7 @@ import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
 import { listCodexAppServerProcesses, unregisterCodexAppServerProcess } from '../utils/codex-app-server-registry.js';
+import { DEFAULT_ECWEB_PORT, ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
 const execFileAsync = promisify(execFile);
 async function runAutomaticInit(action) {
     try {
@@ -146,11 +147,6 @@ function buildDaemonEnv(p, opts) {
         ...(opts.bindBootstrap ? { EVOLCORE_BIND_BOOTSTRAP: '1' } : {}),
     };
 }
-export function serviceProxyNeedsEcweb(cfg) {
-    if (!cfg.serviceProxy?.enabled)
-        return false;
-    return (cfg.serviceProxy.services ?? []).some(s => s.enabled !== false && s.source === 'ecweb');
-}
 function latestSourceMtime(dir) {
     let latest = 0;
     try {
@@ -437,8 +433,6 @@ export async function cmdStart(opts = {}) {
         console.log(`  Rotated: stdout.log -> ${path.basename(stdoutRotation.rotatedPath)}`);
     }
     cleanEnv();
-    // 在启动前确保 serviceProxy 配置完整（如果 ecweb 启用但 serviceProxy 未配置）
-    ensureServiceProxyConfigBeforeStart(p);
     // 删除旧的 ready signal
     try {
         fs.unlinkSync(p.readySignal);
@@ -567,7 +561,7 @@ export async function cmdStart(opts = {}) {
             }
             console.log('');
             // 代码统计仅在开发环境显示（EVOLCORE_HOME 指向包目录）
-            if (resolveRoot() === getPackageRoot()) {
+            if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
                 printCodeStats(getPackageRoot(), p.logs);
             }
             console.log(`⏱ done in ${((Date.now() - cmdStartedAt) / 1000).toFixed(1)}s`);
@@ -808,7 +802,7 @@ export async function cmdRestart(opts = {}) {
     console.log('🔄 Restart monitor started, waiting for service to come back online...');
     await sleep(2000);
     // 代码统计（开发环境）
-    if (resolveRoot() === getPackageRoot()) {
+    if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
         console.log('');
         printCodeStats(getPackageRoot(), resolvePaths().logs);
     }
@@ -975,7 +969,17 @@ export async function cmdStatus() {
     const p = resolvePaths();
     const status = scanInstances();
     const aliveMains = status.mains.filter(m => m.alive);
-    const ping = await probeDaemon(p.socket);
+    // Start all read-only daemon queries together. On a busy Windows host each
+    // query can otherwise wait behind the same IPC/event-loop delay and make the
+    // total `ec status` time the sum of several individual timeouts.
+    const pingPromise = probeDaemon(p.socket).catch(() => null);
+    const statusPromise = ipcQuery(p.socket, { type: 'status' }).catch(() => null);
+    const aidsPromise = ipcQuery(p.socket, { type: 'aun-aids' }).catch(() => null);
+    const agentsPromise = ipcQuery(p.socket, { type: 'evolagent.list' }).catch(() => null);
+    // Only the ping is needed to decide whether to show the live-daemon
+    // sections. The remaining responses continue in parallel while local
+    // process/session information is rendered.
+    const ping = await pingPromise;
     const pid = ping?.pid ?? (aliveMains.length > 0 ? aliveMains[0].record.pid : null);
     const processVisible = !!pid && aliveMains.some(entry => entry.record.pid === pid);
     if (aliveMains.length > 1) {
@@ -1131,42 +1135,47 @@ export async function cmdStatus() {
     }
     // Channel status. A running daemon is authoritative and avoids reading
     // protected config files from the CLI's potentially sandboxed process.
+    let agentsResponse = null;
     if (pid) {
         console.log('');
-        const status = await ipcQuery(p.socket, { type: 'status' });
-        if (status) {
+        const [statusResponse, aidsResponse, agentResponse] = await Promise.all([
+            statusPromise,
+            aidsPromise,
+            agentsPromise,
+        ]);
+        agentsResponse = agentResponse;
+        if (statusResponse) {
             // 🔑 AUN AIDs 表格（详细 AUN 实例状态）
             try {
-                const aidsResp = await ipcQuery(p.socket, { type: 'aun-aids' });
-                if (aidsResp?.ok && aidsResp.aids?.length > 0) {
+                if (aidsResponse?.ok && aidsResponse.aids?.length > 0) {
                     console.log('🔑 AUN AIDs:');
-                    renderAunAidsTable(aidsResp.aids);
+                    renderAunAidsTable(aidsResponse.aids);
                 }
             }
             catch { /* ignore */ }
             // 控制 AID（daemon 进程身份）状态
-            if (status.controlAid) {
-                const state = status.controlAid.connected ? 'connected' : 'disconnected';
-                console.log(`control: ${status.controlAid.aid}  [${state}]`);
+            if (statusResponse.controlAid) {
+                const state = statusResponse.controlAid.connected ? 'connected' : 'disconnected';
+                console.log(`control: ${statusResponse.controlAid.aid}  [${state}]`);
             }
             else {
                 console.log('control: not configured');
             }
-            if (status.stats) {
+            if (statusResponse.stats) {
                 console.log('');
                 console.log('📊 Last hour:');
-                console.log(`  Messages: ${status.stats.received} received, ${status.stats.completed} completed`);
-                if (status.stats.errors > 0)
-                    console.log(`  Errors: ${status.stats.errors}`);
-                if (status.stats.completed > 0)
-                    console.log(`  Avg response: ${(status.stats.avgResponseMs / 1000).toFixed(1)}s`);
+                console.log(`  Messages: ${statusResponse.stats.received} received, ${statusResponse.stats.completed} completed`);
+                if (statusResponse.stats.errors > 0)
+                    console.log(`  Errors: ${statusResponse.stats.errors}`);
+                if (statusResponse.stats.completed > 0)
+                    console.log(`  Avg response: ${(statusResponse.stats.avgResponseMs / 1000).toFixed(1)}s`);
             }
         }
         else {
             // IPC unreachable but PID exists — fall back to local config if readable.
             const config = readStatusDefaultsConfig(p.defaultsConfig);
             if (config) {
-                console.log('🔌 Channels (IPC unreachable):');
+                console.log('🔌 Channels (live status unavailable; configuration is stale):');
                 showConfigChannels(config);
             }
         }
@@ -1182,7 +1191,7 @@ export async function cmdStatus() {
     // EvolAgent summary (via IPC, only when running)
     if (pid) {
         try {
-            const agentResult = await ipcQuery(p.socket, { type: 'evolagent.list' });
+            const agentResult = agentsResponse;
             if (agentResult?.ok && agentResult.agents?.length > 0) {
                 const agents = agentResult.agents;
                 if (agents.length > 0) {
@@ -1196,6 +1205,22 @@ export async function cmdStatus() {
                     }
                 }
             }
+            else {
+                const { EvolAgentRegistry } = await import('../core/evolagent-registry.js');
+                const diskRegistry = new EvolAgentRegistry(p.agentsDir);
+                diskRegistry.loadAll();
+                const agents = diskRegistry.list();
+                if (agents.length > 0) {
+                    console.log('');
+                    console.log('🤖 EvolAgents (live status unavailable; stale configuration):');
+                    for (const a of agents) {
+                        const diskStatus = a.status === 'disabled' || a.status === 'error' ? a.status : 'unknown';
+                        const channels = summarizeChannelFingerprints(a.channels || []);
+                        const shortName = a.name.replace(/\.agentid\.pub$/, '');
+                        console.log(`  ? ${shortName.padEnd(20)} ${`${diskStatus} (stale)`.padEnd(18)} ${channels}`);
+                    }
+                }
+            }
         }
         catch {
             // IPC query for agents failed — skip section
@@ -1789,10 +1814,10 @@ async function cmdWatchLogsFlow() {
         console.log(`❌ Log directory not found: ${p.logs}`);
         process.exit(1);
     }
-    const files = fs.readdirSync(p.logs).filter(f => f.endsWith('.log'));
+    const files = fs.readdirSync(p.logs).filter(isWatchLogFile);
     const types = deriveLogTypes(files);
     if (types.length === 0) {
-        console.log(`⚠ ${p.logs} 下暂无 .log 文件`);
+        console.log(`⚠ ${p.logs} 下暂无可监听日志文件`);
         return;
     }
     const fileCount = new Map();
@@ -1863,7 +1888,7 @@ function cmdWatch(filterTypes) {
         return c;
     };
     const listLogs = () => {
-        const all = fs.readdirSync(p.logs).filter(f => f.endsWith('.log')).map(f => path.join(p.logs, f));
+        const all = fs.readdirSync(p.logs).filter(isWatchLogFile).map(f => path.join(p.logs, f));
         return filterLogFiles(all, filterTypes);
     };
     const shortName = shortLogNameLocal;
@@ -1885,7 +1910,7 @@ function cmdWatch(filterTypes) {
         const content = formatWatchContent(line);
         return `${timeStr} ${paddedName} ${content}`;
     };
-    console.log(`🔭 Watching ${p.logs}/*.log (ESC to stop)\n`);
+    console.log(`🔭 Watching ${p.logs}/* log files (ESC to stop)\n`);
     // 显示当前实例信息和 AID 状态
     const instStatus = scanInstances();
     const aliveMainEntries = instStatus.mains.filter(m => m.alive);
@@ -2508,9 +2533,9 @@ async function waitForExistingEcweb(p, timeoutMs = 3_000) {
 async function printEcwebStatus(p) {
     try {
         const cfg = loadDaemonConfig();
-        if (cfg.ecweb?.enabled === false) {
+        if (ecwebService(cfg.services)?.enabled === false) {
             console.log('');
-            console.log('🔭 ECWeb: 已禁用 (daemon.json → ecweb.enabled: false)');
+            console.log('🔭 ECWeb: 已禁用 (daemon.json → services[name=ecweb].enabled: false)');
             return;
         }
     }
@@ -2608,7 +2633,7 @@ export function stopCodexAppServerOrphans() {
 /** 若 ecweb 在运行则杀掉并确认 pid/端口都已释放。 */
 async function stopEcwebIfRunning(p) {
     const alive = findAliveEcweb(p);
-    const port = loadDaemonConfig().ecweb?.port ?? 42705;
+    const port = ecwebService(loadDaemonConfig().services)?.port ?? DEFAULT_ECWEB_PORT;
     const pids = new Set([
         ...(alive ? [alive.pid] : []),
         ...platform.findProcessByPort(port),
@@ -2634,78 +2659,6 @@ async function waitForPortRelease(port, timeoutMs) {
     }
     return platform.findProcessByPort(port).length === 0;
 }
-/**
- * 后台 detached 启动 ecweb；若已运行则先停再启（确保加载最新代码）。
- * 启动后轮询端口确认 HTTP 服务真正就绪，打印明确的成功/失败结论（而非模糊的「已在后台启动」状态描述）。
- * 返回 true=本次确实启动成功，false=未启用/未安装/启动失败。
- */
-/**
- * 启动前检查并补全 serviceProxy 配置（如果 ecweb 启用但 serviceProxy 未配置）
- */
-function ensureServiceProxyConfigBeforeStart(p) {
-    const cfg = loadDaemonConfig();
-    // 仅在 ecweb 启用 + 控制 AID 已配置 + serviceProxy 未配置 ecweb 时自动添加
-    if (!cfg.ecweb?.enabled || !cfg.aid)
-        return;
-    const hasEcwebService = (cfg.serviceProxy?.services ?? []).some(s => s.name === 'ecweb' || s.source === 'ecweb');
-    if (!hasEcwebService) {
-        const updatedCfg = {
-            ...cfg,
-            serviceProxy: {
-                enabled: true,
-                ...(cfg.serviceProxy ?? {}),
-                services: [
-                    ...(cfg.serviceProxy?.services ?? []),
-                    {
-                        name: 'ecweb',
-                        source: 'ecweb',
-                        serviceType: 'http',
-                        visibility: 'public',
-                        enabled: true,
-                        metadata: {
-                            label: 'EvolCore Dashboard',
-                        },
-                    },
-                ],
-            },
-        };
-        saveDaemonConfig(updatedCfg);
-        console.log(`✓ 自动配置 Service Proxy: https://${cfg.aid}/proxy/ecweb/`);
-    }
-}
-/**
- * 确保 serviceProxy 配置包含 ecweb 服务（ECWeb 启动成功后自动配置）
- */
-function ensureServiceProxyConfig(cfg, port) {
-    // 仅在控制 AID 已配置时自动添加 serviceProxy
-    if (!cfg.aid)
-        return;
-    const hasEcwebService = (cfg.serviceProxy?.services ?? []).some(s => s.name === 'ecweb' || s.source === 'ecweb');
-    if (!hasEcwebService) {
-        const updatedCfg = {
-            ...cfg,
-            serviceProxy: {
-                enabled: true,
-                ...(cfg.serviceProxy ?? {}),
-                services: [
-                    ...(cfg.serviceProxy?.services ?? []),
-                    {
-                        name: 'ecweb',
-                        source: 'ecweb',
-                        serviceType: 'http',
-                        visibility: 'public',
-                        enabled: true,
-                        metadata: {
-                            label: 'EvolCore Dashboard',
-                        },
-                    },
-                ],
-            },
-        };
-        saveDaemonConfig(updatedCfg);
-        console.log(`   自动配置 Service Proxy: https://${cfg.aid}/proxy/ecweb/`);
-    }
-}
 /**
  * Start the separately installed `ec-web` process for a configured runtime.
  * Kept public for restart-monitor, which launches the daemon directly and
@@ -2713,7 +2666,8 @@ function ensureServiceProxyConfig(cfg, port) {
  */
 export async function startEcwebIfEnabled(p, options = {}) {
     const cfg = loadDaemonConfig();
-    if (!cfg.ecweb?.enabled)
+    const service = ecwebService(cfg.services);
+    if (!service?.enabled)
         return false;
     // The daemon is the lifecycle owner.  CLI callers normally only need to
     // ensure ECWeb is available, so adopt a healthy process instead of killing
@@ -2750,7 +2704,7 @@ export async function startEcwebIfEnabled(p, options = {}) {
         console.log(`❌ EC Web 旧进程未清理干净，取消启动: ${error instanceof Error ? error.message : String(error)}`);
         return false;
     }
-    const port = cfg.ecweb.port ?? 42705;
+    const port = service.port ?? DEFAULT_ECWEB_PORT;
     const args = ['--home', p.root, '--port', String(port)];
     const launch = resolveEcwebLaunchCommand(args, { installedPkg });
     if (!launch) {
@@ -2880,10 +2834,9 @@ async function cmdWatchWeb() {
     }
     // 2. 启动（后台）并同步配置。默认行为是替换旧实例，确保新配置/新版静态资源生效。
     const cfg = loadDaemonConfig();
-    const port = cfg.ecweb?.port ?? 42705;
-    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: true, port } });
-    // 自动配置 serviceProxy（如果控制 AID 已配置）
-    ensureServiceProxyConfigBeforeStart(p);
+    const currentService = ecwebService(cfg.services);
+    const port = currentService?.port ?? DEFAULT_ECWEB_PORT;
+    saveDaemonConfig({ ...cfg, services: setEcwebEnabled(cfg.services, true, port) });
     const ok = await startEcwebIfEnabled(p, { forceRestart: true });
     if (!ok)
         process.exit(1); // 失败原因已由 startEcwebIfEnabled 打印
@@ -3011,8 +2964,9 @@ export async function cmdDiagnose() {
     // 6. 检查 EC Web 端口与实例记录是否一致。
     try {
         const cfg = loadDaemonConfig();
-        if (cfg.ecweb?.enabled) {
-            const port = cfg.ecweb.port ?? 42705;
+        const service = ecwebService(cfg.services);
+        if (service?.enabled) {
+            const port = service.port ?? DEFAULT_ECWEB_PORT;
             const portPids = platform.findProcessByPort(port);
             const recordedPids = new Set(readEcwebInstanceEntries(p).map(entry => entry.record.pid));
             const unregisteredPids = portPids.filter(pid => !recordedPids.has(pid));
@@ -3083,7 +3037,7 @@ export async function cmdWatchCommand(args) {
         if (requested.length > 0) {
             const p2 = resolvePaths();
             const avail = fs.existsSync(p2.logs)
-                ? deriveLogTypes(fs.readdirSync(p2.logs).filter(f => f.endsWith('.log')))
+                ? deriveLogTypes(fs.readdirSync(p2.logs).filter(isWatchLogFile))
                 : [];
             const invalid = validateLogTypes(requested, avail);
             if (invalid.length > 0) {

package/dist/cli/init.js

@@ -6,6 +6,7 @@ import { resolvePaths, ensureDataDirs } from '../paths.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { scanInstances } from '../utils/instance-registry.js';
 import { saveDefaultsSafe, loadAllAgents, loadDaemonConfig, saveDaemonConfig } from '../config-store.js';
+import { ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
 import { generateControlAid, resolveControlAidDomain } from '../aun/aid/control-aid.js';
 import { getCodexAppServerAvailability } from '../agents/codex-runner.js';
 import { DEFAULT_ECAGENT_BASE_URL, resolveEcagentConfig } from '../agents/baseagent.js';
@@ -421,6 +422,12 @@ export async function cmdInit(options) {
                 const lower = normalized.toLowerCase();
                 return !lower.includes('your-') && !lower.includes('placeholder');
             };
+            const configuredBaseUrl = [
+                configured?.baseUrl,
+                process.env.ECAGENT_BASE_URL,
+                DEFAULT_ECAGENT_BASE_URL,
+            ].find(usable) || DEFAULT_ECAGENT_BASE_URL;
+            const baseUrl = (await ask(rl, `ecagent Base URL [${configuredBaseUrl}]: `)).trim() || configuredBaseUrl;
             const configuredApiKey = usable(configured?.apiKey) ? configured.apiKey.trim() : undefined;
             const environmentApiKeyName = !configuredApiKey
                 ? (usable(process.env.ECAGENT_API_KEY)
@@ -435,12 +442,6 @@ export async function cmdInit(options) {
                 if (!apiKey)
                     console.log('  API Key 不能为空，请重新输入');
             }
-            const configuredBaseUrl = [
-                configured?.baseUrl,
-                process.env.ECAGENT_BASE_URL,
-                DEFAULT_ECAGENT_BASE_URL,
-            ].find(usable) || DEFAULT_ECAGENT_BASE_URL;
-            const baseUrl = (await ask(rl, `ecagent Base URL [${configuredBaseUrl}]: `)).trim() || configuredBaseUrl;
             return { apiKey, baseUrl };
         }
         try {
@@ -618,25 +619,34 @@ export async function initTail(options = {}) {
     }
     async function handleEcwebPrompt(rl) {
         const daemonConfigForEcweb = loadDaemonConfig();
-        if (daemonConfigForEcweb.ecweb?.enabled === undefined) {
+        if (ecwebService(daemonConfigForEcweb.services)?.enabled === undefined) {
             const ans = (await ask(rl, '\n是否在 ec start 时自动启动 ECWeb 控制台？[y/N] ')).trim().toLowerCase();
             if (ans === 'y' || ans === 'yes') {
                 const installResult = await ensureEcwebInstalledForInit();
                 if (installResult.ok) {
                     const cfg = loadDaemonConfig();
-                    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: true } });
+                    saveDaemonConfig({
+                        ...cfg,
+                        services: setEcwebEnabled(cfg.services, true),
+                    });
                     console.log('  ✓ 已启用 ECWeb（ec start 将自动在后台启动）');
                     console.log('  提示：首次访问运行 ec watch web 查看配对码和 URL');
                 }
                 else {
                     const cfg = loadDaemonConfig();
-                    saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: false } });
+                    saveDaemonConfig({
+                        ...cfg,
+                        services: setEcwebEnabled(cfg.services, false),
+                    });
                     console.log('  提示：安装完成后运行 ec start；如需立即打开控制台，运行 ec watch web');
                 }
             }
             else {
                 const cfg = loadDaemonConfig();
-                saveDaemonConfig({ ...cfg, ecweb: { ...(cfg.ecweb ?? {}), enabled: false } });
+                saveDaemonConfig({
+                    ...cfg,
+                    services: setEcwebEnabled(cfg.services, false),
+                });
                 console.log('  已跳过（可日后运行 ec watch web 手动启动，或编辑 daemon.json）');
             }
         }
@@ -658,7 +668,7 @@ export async function initTail(options = {}) {
     const finalCfg = loadDaemonConfig();
     console.log(`  控制 AID: ${finalCfg.aid || '(未配置)'}`);
     console.log(`  管理者: ${finalCfg.owners?.join(', ') || '(未配置)'}`);
-    console.log(`  ECWeb 自启动: ${finalCfg.ecweb?.enabled ? '已启用' : '已禁用'}`);
+    console.log(`  ECWeb 自启动: ${ecwebService(finalCfg.services)?.enabled ? '已启用' : '已禁用'}`);
     const { agents: finalAgents } = loadAllAgents();
     if (finalAgents.length === 0) {
         console.log('\n📌 下一步：创建 agent');
@@ -826,11 +836,11 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
         const ensureEcweb = dependencies.ensureEcweb ?? (() => ensureEcwebInstalledForInit({ quiet: true }));
         const installResult = await ensureEcweb();
         if (!installResult.ok) {
-            if (existingCfg.ecweb?.enabled === true) {
+            if (ecwebService(existingCfg.services)?.enabled === true) {
                 try {
                     saveDaemonConfig({
                         ...existingCfg,
-                        ecweb: { ...(existingCfg.ecweb ?? {}), enabled: false },
+                        services: setEcwebEnabled(existingCfg.services, false),
                     });
                 }
                 catch (e) {
@@ -866,7 +876,9 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
             $schema_version: existingCfg.$schema_version ?? 1,
             aid: controlAid,
             owners: [ownerAid],
-            ...(opts.ecweb === true ? { ecweb: { ...(existingCfg.ecweb ?? {}), enabled: true } } : {}),
+            ...(opts.ecweb === true
+                ? { services: setEcwebEnabled(existingCfg.services, true) }
+                : {}),
         };
         saveDaemonConfig(next);
     }
@@ -894,7 +906,7 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
         controlAid: controlAid,
         ownerAid,
         owners: [ownerAid],
-        ecwebEnabled: opts.ecweb === true || existingCfg.ecweb?.enabled === true,
+        ecwebEnabled: opts.ecweb === true || ecwebService(existingCfg.services)?.enabled === true,
         baseagent: chosenBaseagent,
         projectsDefaultPath: projectsDefaultPath ?? null,
         defaultsPath: p.defaultsConfig,

package/dist/cli/task-context.js

@@ -32,6 +32,11 @@ function normalizeTaskRuntimeContext(value) {
         peerName: optionalString(value.peerName),
         peerType: optionalString(value.peerType),
         peerRole: optionalString(value.peerRole),
+        processRole: optionalProcessRole(value.processRole),
+        dataScope: optionalDataScope(value.dataScope),
+        authorizedBy: optionalString(value.authorizedBy),
+        executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
+            ? value.executionSource : undefined,
         threadId: optionalString(value.threadId),
         sessionRuntimeDir: optionalAbsolutePath(value.sessionRuntimeDir),
         runtimeLockDir: optionalAbsolutePath(value.runtimeLockDir),
@@ -39,6 +44,13 @@ function normalizeTaskRuntimeContext(value) {
         causation: normalizeCausation(value.causation),
     };
 }
+function optionalProcessRole(value) {
+    return value === 'daemon-owner' || value === 'daemon-service' || value === 'fullaccess-run' || value === 'none'
+        ? value : undefined;
+}
+function optionalDataScope(value) {
+    return value === 'relation' || value === 'agent' || value === 'daemon' ? value : undefined;
+}
 /**
  * Codex's shell carrier can leave one JSON-style escape layer in a message
  * argument (for example, the two characters `\\` and `n`). Decode only that
@@ -198,6 +210,40 @@ export function isManagedSessionRuntimeDir(directory, managedRoot) {
         return false;
     return isPrivateDirectory(root) && isPrivateDirectory(resolved);
 }
+/**
+ * Resolve the session-owned temporary root for a managed child process.
+ *
+ * A direct runner call without task context is intentionally left alone for
+ * backwards-compatible tests and low-level integrations. Once the daemon has
+ * injected the task-context marker, however, falling back to the daemon's
+ * process-wide TMPDIR would break session isolation. Require the injected
+ * value to be present, identical to TMPDIR, and still owned by a trusted
+ * managed namespace before any runner-side helper writes a file.
+ */
+export function getManagedTaskTempDir(runtimeEnv) {
+    if (typeof runtimeEnv?.[TASK_RUNTIME_CONTEXT_ENV] !== 'string')
+        return undefined;
+    const configured = runtimeEnv[SESSION_RUNTIME_DIR_ENV]?.trim();
+    const inherited = runtimeEnv.TMPDIR?.trim();
+    const context = parseTaskRuntimeContext(runtimeEnv[TASK_RUNTIME_CONTEXT_ENV]);
+    const contextDir = context?.sessionRuntimeDir;
+    const processRoot = process.env.TMPDIR?.trim();
+    const trusted = configured
+        && inherited
+        && path.isAbsolute(configured)
+        && path.isAbsolute(inherited)
+        && path.resolve(configured) === path.resolve(inherited)
+        // The process root is shared by all sessions. It may contain a session
+        // directory, but must never itself become the task's TMPDIR capability.
+        && (!processRoot || !path.isAbsolute(processRoot) || path.resolve(configured) !== path.resolve(processRoot))
+        && contextDir
+        && path.resolve(contextDir) === path.resolve(configured)
+        && (isManagedSessionRuntimeDir(configured) || isRunnerOwnedSessionRuntimeDir(configured));
+    if (!trusted) {
+        throw new Error('managed session TMPDIR is unavailable or untrusted');
+    }
+    return path.resolve(configured);
+}
 /**
  * Create a private runtime directory below the process-provided TMPDIR.
  * There is deliberately no os.tmpdir() fallback: managed sessions must not

package/dist/cli/trigger-command.js

@@ -110,7 +110,7 @@ Create 参数模式支持:
   --baseagent <name>  (仅 --exec trigger-session)
   --model <模型>  --effort <low|medium|high|xhigh|max>
   --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
-  --permission <readonly|auto|request|bypass>（省略则继承当前身份配置）
+  --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
   --tz <时区> (仅 cron)
   --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
   --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)

package/dist/cli/watch-logs.js

@@ -1,15 +1,22 @@
 import path from 'path';
+const WATCH_LOG_FILE = /\.(?:log|jsonl|out)(?:\..+)?$/;
+/** Whether a file is a supported input for the interactive log watcher. */
+export function isWatchLogFile(file) {
+    return WATCH_LOG_FILE.test(path.basename(file));
+}
 /** 去掉轮转后缀（按小时、按日及旧版带连字符日期）。入参可为文件名或绝对路径。 */
 export function shortLogName(file) {
-    return path.basename(file, '.log')
+    const baseName = path.basename(file);
+    const stem = baseName.replace(WATCH_LOG_FILE, '');
+    return stem
         .replace(/-\d{8}(?:-\d{2})?$/, '') // -YYYYMMDD[-HH]（按日/小时轮转）
         .replace(/-\d{4}-\d{2}-\d{2}$/, ''); // -YYYY-MM-DD（按日轮转，如 ts-sdk）
 }
-/** 从 .log 文件名列表推导去重、字母序的类型列表。 */
+/** 从支持的日志文件名列表推导去重、字母序的类型列表。 */
 export function deriveLogTypes(files) {
     const set = new Set();
     for (const f of files) {
-        if (!f.endsWith('.log'))
+        if (!isWatchLogFile(f))
             continue;
         set.add(shortLogName(f));
     }

package/dist/config/builtin-roles.js

@@ -32,6 +32,7 @@ export function getBuiltinRolesConfig() {
 export function getManagementCommandPermissions(role) {
     return {
         'contact.read': { allow: true, scopes: ['agent'] },
+        'contact.add': { allow: true, scopes: ['relation'], constraints: { ownPeerOnly: true, privateOnly: true } },
         'contact.block': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'connect.write': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'connect.access.write': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },

package/dist/config/config-field-policy.js

@@ -17,6 +17,8 @@ const BEHAVIOR_TOP_FIELDS = new Set([
 const BASEAGENT_BEHAVIOR_FIELDS = new Set([
     'model',
     'effort',
+    'auxiliaryModel',
+    'auxiliaryEffort',
     'reasoning',
     'agentProgressSummaries',
     'excludeDynamicSections',
@@ -25,7 +27,7 @@ const BASEAGENT_BEHAVIOR_FIELDS = new Set([
     'mode',
     'useVertex',
 ]);
-const SUPPORTED_BASEAGENTS = new Set(['claude', 'codex', 'gemini', 'ecagent', 'hermes']);
+const SUPPORTED_BASEAGENTS = new Set(['claude', 'codex', 'gemini', 'ecagent']);
 const SENSITIVE_TOP_FIELDS = new Set([
     '$schema_version',
     'aid',
@@ -75,10 +77,17 @@ export function resolveConfigFieldRule(fieldPath) {
         const [, baseagent, leaf] = parts;
         if (!SUPPORTED_BASEAGENTS.has(baseagent))
             return { class: 'unknown' };
-        const permissionKey = `baseagents.${baseagent}.${leaf === 'reasoning' ? 'effort' : leaf}`;
-        if (leaf === 'model' && parts.length === 3)
+        const normalizedLeaf = leaf === 'reasoning'
+            ? 'effort'
+            : leaf === 'auxiliaryModel'
+                ? 'model'
+                : leaf === 'auxiliaryEffort'
+                    ? 'effort'
+                    : leaf;
+        const permissionKey = `baseagents.${baseagent}.${normalizedLeaf}`;
+        if ((leaf === 'model' || leaf === 'auxiliaryModel') && parts.length === 3)
             return scalar(permissionKey, 'string');
-        if ((leaf === 'effort' || leaf === 'reasoning') && parts.length === 3)
+        if ((leaf === 'effort' || leaf === 'reasoning' || leaf === 'auxiliaryEffort') && parts.length === 3)
             return scalar(permissionKey, 'effort');
         if (baseagent === 'claude' && (leaf === 'agentProgressSummaries' || leaf === 'excludeDynamicSections') && parts.length === 3) {
             return scalar(permissionKey, 'boolean');
@@ -199,7 +208,9 @@ export function relationFieldWriteOperation(fieldPath) {
         return 'mentionmode.update';
     if (/^baseagents\.[^.]+\.model$/.test(field))
         return 'model.use';
-    if (/^baseagents\.[^.]+\.(?:effort|reasoning)$/.test(field)) {
+    if (/^baseagents\.[^.]+\.auxiliaryModel$/.test(field))
+        return 'model.use';
+    if (/^baseagents\.[^.]+\.(?:effort|reasoning|auxiliaryEffort)$/.test(field)) {
         return 'model.effort';
     }
     return undefined;