evolcore 0.0.20 → 0.0.22

package/dist/core/auth/agent-delegation.js

@@ -4,10 +4,17 @@ import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
 export class AgentDelegationRegistry {
+    runtimeEpoch = crypto.randomBytes(16).toString('hex');
     grantsByHash = new Map();
     activeHashBySession = new Map();
     approvedCommands = new Map();
+    getRuntimeEpoch() {
+        return this.runtimeEpoch;
+    }
     issue(input) {
+        if (input.executionIdentity && !isValidFullAccessExecutionIdentity(input.executionIdentity)) {
+            throw new Error('invalid fullaccess task execution identity');
+        }
         this.revokeSession(input.sessionId);
         const token = crypto.randomBytes(32).toString('base64url');
         const tokenHash = hashDelegationToken(token);
@@ -21,6 +28,7 @@ export class AgentDelegationRegistry {
                 ok: false,
                 code: 'DELEGATION_REQUIRED',
                 reason: 'An active task delegation token is required',
+                diagnosticCause: 'missing_token',
             };
         }
         const tokenHash = hashDelegationToken(token);
@@ -39,6 +47,13 @@ export class AgentDelegationRegistry {
             ok: false,
             code: 'INVALID_DELEGATION',
             reason: 'The task delegation token is invalid, revoked, or belongs to another session',
+            diagnosticCause: grant
+                ? grant.sessionId !== sessionId
+                    ? 'session_mismatch'
+                    : 'task_replaced'
+                : commandHash
+                    ? 'approved_command_unavailable'
+                    : 'unknown_token',
         };
     }
     armApprovedCommand(input) {
@@ -134,7 +149,7 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
     if (!validation.ok)
         return validation;
     const grant = validation.grant;
-    if (grant.selfAid !== input.aid) {
+    if (grant.selfAid !== input.aid && !hasTrustedFullAccessDelegation(grant)) {
         return { ok: false, code: 'INVALID_DELEGATION', reason: 'Delegation self agent does not match sender' };
     }
     if (grant.messageId && grant.messageId !== input.messageId) {
@@ -157,6 +172,7 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
         conversationId: channelId,
         processOwners: [],
         fromControlChannel: false,
+        ...trustedExecutionIdentityInput(grant),
     });
     const subject = { ...builtSubject, peerKey: grant.peerKey };
     const decision = authorizeOperation({
@@ -180,6 +196,32 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
     }
     return { ok: true, grant };
 }
+/** Build the only AuthGateway input shape accepted for a task-held fullaccess claim. */
+export function trustedExecutionIdentityInput(grant) {
+    return grant.executionIdentity && isValidFullAccessExecutionIdentity(grant.executionIdentity)
+        ? {
+            trustedProcessRole: 'fullaccess-run',
+            trustedFullAccessAuthorization: grant.executionIdentity,
+        }
+        : {};
+}
+export function hasTrustedFullAccessDelegation(grant) {
+    return !!grant.executionIdentity && isValidFullAccessExecutionIdentity(grant.executionIdentity);
+}
+function isValidFullAccessExecutionIdentity(identity) {
+    if (identity.permissionMode !== 'fullaccess'
+        || identity.processRole !== 'fullaccess-run'
+        || identity.dataScope !== 'daemon')
+        return false;
+    if (identity.source === 'fullaccess-command') {
+        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0;
+    }
+    return identity.source === 'trigger'
+        && typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
+        && typeof identity.triggerId === 'string' && identity.triggerId.length > 0
+        && typeof identity.runId === 'string' && identity.runId.length > 0
+        && typeof identity.attemptId === 'string' && identity.attemptId.length > 0;
+}
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }

package/dist/core/auth/auth-gateway.js

@@ -8,6 +8,11 @@ import { resolveRuntimePermissionMode } from '../role/runtime-policy.js';
 export function isCrossAgentTriggerOperationAllowed(input) {
     return input.control || input.daemonOwner === true || input.taskAgentAid === input.targetAgentAid;
 }
+/** A delegated identity may authorize ordinary work, but it is not a human approval for persistent host execution. */
+export function canApprovePersistentFullAccessTrigger(input) {
+    return input.daemonOwner
+        && (input.source === 'direct-user' || input.source === 'management-channel');
+}
 export function buildAuthSubject(input) {
     const chatType = input.chatType === 'group' ? 'group' : 'private';
     const actorId = input.actorId;
@@ -22,17 +27,31 @@ export function buildAuthSubject(input) {
         peerType: input.peerType,
     });
     const processOwners = input.processOwners ?? [];
+    const fullAccessAuthorization = input.trustedFullAccessAuthorization;
+    const isFullAccessRun = input.trustedProcessRole === 'fullaccess-run'
+        && fullAccessAuthorization?.permissionMode === 'fullaccess'
+        && fullAccessAuthorization.processRole === 'fullaccess-run'
+        && fullAccessAuthorization.dataScope === 'daemon';
     const isDaemonService = input.trustedProcessRole === 'daemon-service';
-    const isDaemonOwner = !isDaemonService && isProcessOwner({
+    const isDaemonOwner = !isDaemonService && !isFullAccessRun && isProcessOwner({
         actor: roleDetail.actor,
         processOwners,
     });
     const suppliedRole = input.identity?.role && input.identity.role !== 'none' ? input.identity.role : undefined;
     const role = suppliedRole ?? roleDetail.effectiveRole ?? 'none';
-    const processRole = isDaemonService ? 'daemon-service' : isDaemonOwner ? 'daemon-owner' : 'none';
+    const processRole = isFullAccessRun
+        ? 'fullaccess-run'
+        : isDaemonService ? 'daemon-service' : isDaemonOwner ? 'daemon-owner' : 'none';
+    const dataScope = processRole === 'fullaccess-run'
+        || processRole === 'daemon-service'
+        || processRole === 'daemon-owner'
+        ? 'daemon'
+        : role === 'owner' || role === 'admin' ? 'agent' : 'relation';
     return {
         selfAid: input.selfAid,
+        agentName: input.agentName,
         actorId,
+        principalId: roleDetail.actor.principalId,
         requestId: input.requestId,
         sessionId: input.sessionId,
         channel: input.channel,
@@ -44,6 +63,8 @@ export function buildAuthSubject(input) {
         role,
         relationRole: role,
         processRole,
+        dataScope,
+        authorizedBy: isFullAccessRun ? fullAccessAuthorization.authorizedBy : undefined,
         roleSource: roleDetail.source,
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
@@ -51,8 +72,12 @@ export function buildAuthSubject(input) {
         allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
-        permissionMode: input.permissionMode
-            ?? resolveRuntimePermissionMode({ selfAid: input.selfAid, role }).effectiveValue,
+        canApprovePersistentFullAccess: input.canApprovePersistentFullAccess
+            ?? (isDaemonOwner && !isDaemonService),
+        permissionMode: isFullAccessRun
+            ? 'fullaccess'
+            : input.permissionMode
+                ?? resolveRuntimePermissionMode({ selfAid: input.selfAid, role }).effectiveValue,
     };
 }
 function isProcessOwner(input) {
@@ -97,6 +122,7 @@ export function authorizeOperation(params) {
         peerKey: params.subject.peerKey,
         role: params.subject.role,
         processRole: params.subject.processRole,
+        dataScope: params.subject.dataScope,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         allowExplicitRelationTarget: params.allowExplicitRelationTarget,
@@ -162,9 +188,18 @@ function auditDecision(params, decision) {
         requestId: params.auditMetadata?.requestId ?? params.subject.requestId,
         sessionId: params.auditMetadata?.sessionId ?? params.subject.sessionId,
         agentAid: params.auditMetadata?.agentAid ?? params.subject.selfAid,
+        agentName: params.auditMetadata?.agentName ?? params.subject.agentName ?? params.subject.selfAid,
         permissionMode: params.auditMetadata?.permissionMode
             ?? (decision.allow ? decision.permissionMode ?? params.subject.permissionMode : params.subject.permissionMode),
         toolName: params.auditMetadata?.toolName,
+        errorCode: params.auditMetadata?.errorCode
+            ?? (decision.allow
+                ? undefined
+                : params.auditMetadata?.decisionSource === 'approval'
+                    ? 'USER_DENIED'
+                    : params.auditMetadata?.decisionSource === 'infrastructure'
+                        ? 'EXECUTION_FAILED'
+                        : 'POLICY_DENIED'),
         policyCode: params.auditMetadata?.policyCode ?? (decision.allow ? undefined : decision.code),
         decisionSource: params.auditMetadata?.decisionSource ?? (decision.allow ? 'command' : 'policy'),
         source: params.source,
@@ -178,6 +213,8 @@ function auditDecision(params, decision) {
         channelId: params.subject.channelId,
         role: decision.allow ? decision.role : params.subject.role,
         processRole: params.subject.processRole,
+        dataScope: params.subject.dataScope,
+        authorizedBy: params.subject.authorizedBy,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         decision: decision.allow ? 'allow' : 'deny',

package/dist/core/auth/authorization-audit.js

@@ -2,13 +2,15 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
-import { buildAuthorizationEventKey } from '../audit/event-key.js';
+import { buildAuthorizationEventKey, buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
         event.decision === 'deny' ||
         (event.decision === 'allow' && event.dangerous) ||
         (event.source === 'agent-tool' && event.operation.startsWith('config.')) ||
         event.operation === 'codex.approval' ||
+        event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
         event.operation === 'cli.exec.raw';
     if (!shouldAudit)
@@ -16,16 +18,97 @@ export function auditCommandAuthorization(event) {
     const auditRecord = buildAuditRecord(event);
     logAuditEvent(auditRecord);
 }
+export function auditFullAccessEvent(input) {
+    const configurationEvent = input.event === 'fullaccess.trigger.configured'
+        || input.event === 'fullaccess.trigger.deescalated';
+    const executionEvent = input.event === 'fullaccess.execution.started'
+        || input.event === 'fullaccess.execution.ended'
+        || input.event === 'fullaccess.trigger.execution.started'
+        || input.event === 'fullaccess.trigger.execution.ended';
+    // The scheduler triggers a run, but the executing subject is the task-bound
+    // fullaccess identity. Keep the original owner/configuration provenance in
+    // a separate field rather than reporting the model task as a human owner.
+    const processRole = input.processRole
+        ?? (executionEvent ? 'fullaccess-run' : input.source === 'trigger' ? 'daemon-service' : 'none');
+    const actorRole = processRole === 'daemon-owner' ? 'daemon-owner' : processRole;
+    const runnerProfileActive = executionEvent && input.executionState !== 'blocked';
+    const completedEvent = input.event.endsWith('.ended') || configurationEvent;
+    auditCommandAuthorization({
+        ts: Date.now(),
+        callId: input.attemptId ?? input.runId ?? input.taskId ?? input.messageId,
+        correlationId: input.runId ?? input.taskId,
+        source: input.source === 'trigger' ? 'agent-tool' : 'slash',
+        operation: input.event,
+        // CommandScope has no separate daemon value; process is the closest
+        // existing scope for daemon-owner authorization and keeps audit records
+        // compatible with the established command-audit schema.
+        scope: 'process',
+        dangerous: true,
+        decision: input.decision ?? 'allow',
+        executed: input.executed ?? completedEvent,
+        executionState: input.executionState
+            ?? (input.decision === 'deny' ? 'blocked' : completedEvent ? 'completed' : 'authorized'),
+        decisionSource: input.decision === 'deny'
+            ? 'policy'
+            : configurationEvent
+                ? processRole === 'daemon-owner' ? 'daemon-owner' : 'policy'
+                : processRole === 'fullaccess-run'
+                    ? 'fullaccess-run'
+                    : input.source === 'trigger'
+                        ? 'trigger-definition'
+                        : 'daemon-owner',
+        actorId: input.actorId,
+        processRole,
+        dataScope: input.dataScope ?? (executionEvent ? 'daemon' : undefined),
+        authorizedBy: input.authorizedBy,
+        isDaemonOwner: processRole === 'daemon-owner',
+        agentAid: input.agentAid,
+        agentName: input.agentName,
+        sessionId: input.sessionId,
+        taskId: input.taskId,
+        messageId: input.messageId,
+        permissionMode: 'fullaccess',
+        role: actorRole,
+        reason: input.reason ?? input.result ?? input.event,
+        durationMs: input.durationMs,
+        argsSummary: {
+            source: input.source,
+            triggerId: input.triggerId,
+            runId: input.runId,
+            attemptId: input.attemptId,
+            baseagent: input.baseagent,
+            model: input.model,
+            dataScope: input.dataScope ?? (executionEvent ? 'daemon' : undefined),
+            authorizedBy: input.authorizedBy,
+            ...(runnerProfileActive ? {
+                sandbox: 'off',
+                approval: 'bypassed',
+                applicationPolicy: 'bypassed',
+            } : {}),
+            result: input.result,
+        },
+    });
+}
 /**
  * Record a tool-level preflight denial (e.g. protected-path block) in the
  * structured command-audit log. This covers interactive sessions whose
  * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
  */
 export function auditToolPreflightDenial(input) {
+    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        callId: input.requestId,
-        correlationId: input.requestId,
+        ...(lifecycleId ? {
+            eventKey: buildToolLifecycleEventKey({
+                sessionId: input.sessionId,
+                callId: input.callId,
+                correlationId: input.correlationId,
+                requestId: input.requestId,
+            }),
+            eventPhase: 'preflight',
+        } : {}),
+        callId: input.callId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
@@ -34,6 +117,7 @@ export function auditToolPreflightDenial(input) {
         executed: false,
         executionState: 'blocked',
         decisionSource: 'policy',
+        errorCode: 'POLICY_DENIED',
         toolName: input.toolName,
         policyCode: input.policyCode,
         protectionClass: input.protectionClass ?? protectionClassForPolicy(input.policyCode),
@@ -45,6 +129,7 @@ export function auditToolPreflightDenial(input) {
         argsSummary: input.summary ? { summary: input.summary } : undefined,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         channel: input.channel,
         actorId: input.actorId,
@@ -61,9 +146,19 @@ export function auditToolPreflightDenial(input) {
  * decision source make policy, user, and infrastructure denials distinct.
  */
 export function auditCodexApprovalDecision(input) {
+    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        callId: input.correlationId ?? input.requestId,
+        ...(lifecycleId ? {
+            eventKey: buildToolLifecycleEventKey({
+                sessionId: input.sessionId,
+                callId: input.callId,
+                correlationId: input.correlationId,
+                requestId: input.requestId,
+            }),
+            eventPhase: 'approval',
+        } : {}),
+        callId: input.callId ?? input.correlationId ?? input.requestId,
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
@@ -72,10 +167,14 @@ export function auditCodexApprovalDecision(input) {
         executed: false,
         executionState: input.decision === 'allow' ? 'authorized' : 'blocked',
         decisionSource: input.decisionSource,
+        errorCode: input.decision === 'deny'
+            ? input.decisionSource === 'approval' ? 'USER_DENIED' : input.decisionSource === 'policy' ? 'POLICY_DENIED' : infrastructureErrorCode(input.policyCode)
+            : undefined,
         requestId: input.requestId,
-        correlationId: input.correlationId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         toolName: input.toolName,
         approvalMethod: input.method,
@@ -84,7 +183,45 @@ export function auditCodexApprovalDecision(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: { method: input.method },
+        argsSummary: {
+            method: input.method,
+            ...(input.parseFailure ? { parseFailure: input.parseFailure } : {}),
+        },
+    });
+}
+/**
+ * Record a runtime permission decision outside a Codex app-server approval.
+ * The shared command-audit stream distinguishes policy, human, and
+ * infrastructure denials without parsing localized log text.
+ */
+export function auditPermissionDecision(input) {
+    auditCommandAuthorization({
+        ts: Date.now(),
+        callId: input.requestId,
+        correlationId: input.requestId,
+        requestId: input.requestId,
+        sessionId: input.sessionId,
+        agentAid: input.agentAid,
+        agentName: input.agentName,
+        permissionMode: input.permissionMode,
+        toolName: input.toolName,
+        policyCode: input.policyCode,
+        decisionSource: input.decisionSource,
+        errorCode: input.decisionSource === 'approval'
+            ? 'USER_DENIED'
+            : input.decisionSource === 'policy'
+                ? 'POLICY_DENIED'
+                : infrastructureErrorCode(input.policyCode),
+        source: 'agent-tool',
+        operation: 'permission.runtime',
+        scope: 'filesystem',
+        dangerous: false,
+        role: input.role ?? 'unknown',
+        taskId: input.taskId,
+        decision: 'deny',
+        executed: false,
+        executionState: 'blocked',
+        reason: input.reason,
     });
 }
 /** Record a fail-closed infrastructure condition before a tool can execute. */
@@ -97,6 +234,7 @@ export function auditToolInfrastructureFailure(input) {
         dangerous: false,
         decision: 'deny',
         decisionSource: 'infrastructure',
+        errorCode: infrastructureErrorCode(input.policyCode),
         executed: false,
         executionState: 'blocked',
         callId: input.callId,
@@ -104,6 +242,7 @@ export function auditToolInfrastructureFailure(input) {
         requestId: input.callId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
         permissionMode: input.permissionMode ?? 'unknown',
         toolName: input.toolName,
         policyCode: input.policyCode,
@@ -115,8 +254,26 @@ export function auditToolInfrastructureFailure(input) {
             : undefined,
     });
 }
+function infrastructureErrorCode(policyCode) {
+    const code = String(policyCode ?? '').toLowerCase();
+    if (/delegat|carrier|not.?armed/.test(code))
+        return 'DELEGATION_FAILED';
+    if (/capability|sandbox|unavailable|workspace_unknown/.test(code))
+        return 'CAPABILITY_UNAVAILABLE';
+    if (/argument|canonical|quote|shell|parse|invalid/.test(code))
+        return 'INVALID_ARGUMENT';
+    return 'EXECUTION_FAILED';
+}
 function buildAuditRecord(event) {
     const executed = event.executed ?? false;
+    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : 'command');
+    const errorCode = event.errorCode ?? (event.decision === 'deny'
+        ? decisionSource === 'approval'
+            ? 'USER_DENIED'
+            : decisionSource === 'policy'
+                ? 'POLICY_DENIED'
+                : 'EXECUTION_FAILED'
+        : undefined);
     const executionState = event.executionState
         ?? (event.decision === 'deny'
             ? 'blocked'
@@ -135,18 +292,25 @@ function buildAuditRecord(event) {
                 operation: event.operation,
             })
             : undefined),
+        eventPhase: event.eventPhase,
         callId: event.callId,
         correlationId: event.correlationId ?? event.requestId,
         requestId: event.requestId,
         sessionId: event.sessionId,
         agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
-        permissionMode: event.permissionMode,
+        agentName: resolveAgentName(event),
+        permissionMode: normalizeAuditPermissionMode(event.permissionMode),
         toolName: event.toolName,
         approvalMethod: event.approvalMethod,
+        errorCode,
         policyCode: event.policyCode ?? event.code,
         protectionClass: event.protectionClass,
         matchedPath: event.matchedPath,
-        decisionSource: event.decisionSource,
+        decisionSource,
+        ecwebRequestId: event.ecwebRequestId,
+        targetAgentAid: redactIdentifier(event.targetAgentAid),
+        endpoint: event.endpoint,
+        logicalToolName: event.logicalToolName,
         source: event.source,
         operation: event.operation,
         scope: event.scope,
@@ -161,6 +325,8 @@ function buildAuditRecord(event) {
         channelId: redactIdentifier(event.channelId),
         role: event.role,
         processRole: event.processRole,
+        dataScope: event.dataScope,
+        authorizedBy: redactIdentifier(event.authorizedBy),
         isDaemonOwner: event.isDaemonOwner,
         fromControlChannel: event.fromControlChannel,
         taskId: event.taskId,
@@ -177,6 +343,26 @@ function buildAuditRecord(event) {
         exitCode: event.exitCode,
     };
 }
+function resolveAgentName(event) {
+    const displayName = typeof event.agentName === 'string' ? event.agentName.trim() : '';
+    if (displayName && !isUnknownAgentLabel(displayName))
+        return displayName;
+    const aid = typeof event.agentAid === 'string' ? event.agentAid.trim() : '';
+    if (aid && aid !== 'unknown')
+        return aid;
+    const selfAid = typeof event.selfAid === 'string' ? event.selfAid.trim() : '';
+    if (selfAid && selfAid !== 'unknown')
+        return selfAid;
+    return aid === 'unknown' || selfAid === 'unknown' ? 'unknown' : undefined;
+}
+function isUnknownAgentLabel(value) {
+    return value === 'unknown' || value === '<unknown>' || value === '<none>' || value === 'undefined' || value === 'null';
+}
+function normalizeAuditPermissionMode(value) {
+    if (!value || value === 'unknown')
+        return value;
+    return normalizeExecutionPermissionMode(value);
+}
 function redactIdentifier(value) {
     if (!value)
         return undefined;
@@ -211,10 +397,17 @@ function logAuditEvent(record) {
         record.callId ? `call=${record.callId}` : null,
         record.correlationId ? `correlation=${record.correlationId}` : null,
         record.eventKey ? `eventKey=${record.eventKey}` : null,
+        record.eventPhase ? `eventPhase=${record.eventPhase}` : null,
         record.sessionId ? `session=${record.sessionId}` : null,
+        record.agentName ? `agentName=${JSON.stringify(record.agentName)}` : null,
         record.agentAid ? `agent=${record.agentAid}` : null,
         record.permissionMode ? `permissionMode=${record.permissionMode}` : null,
         record.toolName ? `tool=${record.toolName}` : null,
+        record.errorCode ? `errorCode=${record.errorCode}` : null,
+        record.ecwebRequestId ? `ecwebRequest=${record.ecwebRequestId}` : null,
+        record.targetAgentAid ? `targetAgent=${record.targetAgentAid}` : null,
+        record.endpoint ? `endpoint=${JSON.stringify(record.endpoint)}` : null,
+        record.logicalToolName ? `logicalTool=${record.logicalToolName}` : null,
         record.policyCode ? `policy=${record.policyCode}` : null,
         record.protectionClass ? `protectionClass=${record.protectionClass}` : null,
         record.matchedPath ? `matchedPath=${JSON.stringify(record.matchedPath)}` : null,
@@ -296,6 +489,21 @@ function summarizeAuthorizationArgs(operation, args) {
     for (const [key, value] of Object.entries(args)) {
         if (value === undefined)
             continue;
+        if (key === 'parseFailure' && value && typeof value === 'object' && !Array.isArray(value)) {
+            const diagnostic = value;
+            const issue = typeof diagnostic.issue === 'string' ? diagnostic.issue : undefined;
+            const offset = typeof diagnostic.offset === 'number' && Number.isFinite(diagnostic.offset)
+                ? Math.max(0, Math.floor(diagnostic.offset)) : undefined;
+            const tokenIndex = typeof diagnostic.tokenIndex === 'number' && Number.isFinite(diagnostic.tokenIndex)
+                ? Math.max(0, Math.floor(diagnostic.tokenIndex)) : undefined;
+            const dialect = typeof diagnostic.dialect === 'string' ? diagnostic.dialect : undefined;
+            const inputLength = typeof diagnostic.inputLength === 'number' && Number.isFinite(diagnostic.inputLength)
+                ? Math.max(0, Math.floor(diagnostic.inputLength)) : undefined;
+            if (issue && offset !== undefined && tokenIndex !== undefined && dialect && inputLength !== undefined) {
+                summary.parseFailure = { issue, offset, tokenIndex, dialect, inputLength };
+            }
+            continue;
+        }
         if (/^(?:self|peer|peerKey|target|targetId|session|sessionId|channelId)$/i.test(key)) {
             summary[key] = typeof value === 'string' ? redactIdentifier(value) : '[redacted]';
             continue;

package/dist/core/auth/operation-authorizer.js

@@ -95,6 +95,20 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
         return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
     }
+    // A fullaccess task is deliberately a daemon-scoped runtime identity. It
+    // still has to name a known operation and pass structural command parsing,
+    // but relation/Agent role rules, source lists, and daemon-owner gates are
+    // not meaningful limits for code already approved for host-level execution.
+    if (ctx.processRole === 'fullaccess-run' && ctx.dataScope === 'daemon') {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role: 'fullaccess-run',
+            dangerous: opMeta.dangerous,
+            matchedRule: 'fullaccess-run-daemon-scope',
+        };
+    }
     if (ctx.chatType === 'group'
         && (resolvedConfigCommand ? isResolvedConfigMutation(resolvedConfigCommand) : isConfigMutationOperation(operation))
         && intent.scope !== 'relation') {
@@ -175,7 +189,31 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (roleDef.allowAccess === false) {
         return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Role ${role} is not allowed to access commands`, operation, intent.scope, opMeta.dangerous);
     }
-    const matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    let matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
+    // Agent self-service contact add deliberately reuses the same low-trust
+    // relation boundary as ec.msg.send. Older per-Agent role files may still
+    // contain the historical contact.* deny without an explicit contact.add
+    // entry; preserve their safe current-peer/private-only send capability while
+    // allowing this new request workflow. An explicit contact.add rule wins.
+    if (operation === 'contact.add'
+        && !Object.prototype.hasOwnProperty.call(roleDef.commandPermissions || {}, 'contact.add')) {
+        const sendPermission = roleDef.commandPermissions?.['ec.msg.send'];
+        if (sendPermission?.allow) {
+            matchResult = {
+                permission: {
+                    ...sendPermission,
+                    scopes: ['relation'],
+                    constraints: {
+                        ...(sendPermission.constraints ?? {}),
+                        ownPeerOnly: true,
+                        privateOnly: true,
+                    },
+                },
+                matchedRule: 'ec.msg.send',
+                rank: 1000,
+            };
+        }
+    }
     if (!matchResult) {
         return denyDecision(ctx, 'NO_PERMISSION', `Role ${role} has no permission for ${operation}`, operation, intent.scope, opMeta.dangerous);
     }
@@ -274,6 +312,8 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
         const targetAgentAid = stringArg(args.targetAgentAid) ?? stringArg(args.self);
         return !!taskAgentAid && !!targetAgentAid && taskAgentAid !== targetAgentAid;
     }
+    if (operation.startsWith('role.') && ctx.fromControlChannel)
+        return true;
     return false;
 }
 function hasDaemonOwnerRole(ctx) {

package/dist/core/auth/operation-catalog.js

@@ -55,7 +55,7 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     sources: ['agent-tool'],
 }));
 const MSG_READ_OPERATIONS = [
-    ['ec.msg.history', 'Read message history for an AUN private relation'],
+    ['ec.msg.history', 'Read message history for a controlled private relation'],
     ['ec.msg.online', 'Read online status for an AUN private relation'],
 ].map(([id, description]) => ({
     id,
@@ -476,6 +476,14 @@ const OPERATIONS = [
         description: 'Read the Agent contact block list',
         sources: ['agent-tool'],
     },
+    {
+        id: 'contact.add',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['relation'],
+        description: 'Request adding the current private relation as an Agent contact',
+        sources: ['agent-tool'],
+    },
     {
         id: 'contact.block',
         category: 'write-agent',

package/dist/core/bootstrap-messages.js

@@ -7,9 +7,17 @@ import { chatDirPath } from './session/session-fs-store.js';
 import { hasMessageLogOperation } from './message/message-log.js';
 import { isDeliveryTarget, sameDeliveryTarget } from './message/message-utils.js';
 export const BOOTSTRAP_MESSAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const BOOTSTRAP_NOTIFICATION_WINDOW_MS = 24 * 60 * 60 * 1000;
 export function bootstrapInitialMessageOperationId(aid) {
     return `bootstrap-initial:v1:${aid}`;
 }
+export function bootstrapInitialMessageOperationPrefix(aid) {
+    return `bootstrap-initial:v1:${aid}`;
+}
+/** A new operation ID is required after the notification window expires. */
+export function bootstrapInitialRetryOperationId(aid, at = Date.now()) {
+    return `${bootstrapInitialMessageOperationPrefix(aid)}:${at}`;
+}
 export function postBootstrapWelcomeOperationId(aid) {
     return `bootstrap-complete:v1:${aid}`;
 }