evolcore 0.0.20 → 0.0.22

package/dist/core/command/command-handler.js

@@ -1,8 +1,8 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
-import { buildEnvelope, deliveryTargetFromSession, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
+import { buildEnvelope, deliveryTargetFromSession, isInteractionSendAccepted, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
-import { loadDaemonConfig } from '../../config-store.js';
+import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
 import { logger } from '../../utils/logger.js';
 import { resolvePeerRoleDetail, roleToSessionIdentity } from '../../config/peer-role-resolver.js';
 import { isManagementRole } from '../../config/builtin-roles.js';
@@ -19,12 +19,13 @@ import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
 import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
-import { auditCommandAuthorization, hashArgv } from '../auth/authorization-audit.js';
+import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
+import { hasTrustedFullAccessDelegation, trustedExecutionIdentityInput } from '../auth/agent-delegation.js';
 import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
 import { executeManagedGroupOperation, isManagedGroupRelationRead, ManagedGroupOperationError, resolveManagedGroupOperation, executeManagedMsgOperation, ManagedMsgOperationError, resolveManagedMsgOperation, executeManagedFsOperation, ManagedFsOperationError, resolveManagedFsOperation, } from '../../aun/msg/managed-operation.js';
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
-import { isHClassPath, isLClassPath, isSameOrDescendant } from '../protected-paths.js';
+import { isHClassPath, isLClassPath, isSameOrDescendant } from '../permission/protected-paths.js';
 import { validateModelSelectionForRole } from '../model/model-permission.js';
 import { getModelInfo } from '../model/model-catalog.js';
 import { constrainRuntimePermissionMode, resolveRuntimePermissionMode, validateRuntimeStringFieldOverride } from '../role/runtime-policy.js';
@@ -79,6 +80,20 @@ function writeUserSettings(updates) {
 function isAdminRole(role) {
     return isManagementRole(role);
 }
+/**
+ * A cross-channel history selector is intentionally narrower than ordinary
+ * managed reads. The persisted session, rather than a caller-controlled
+ * runtime hint, proves that this command belongs to a daemon Trigger.
+ */
+function isTrustedDaemonTriggerSession(session, selfAid) {
+    const channelId = String(session.channelId || '');
+    return session.channel === 'daemon'
+        && session.channelType === 'daemon'
+        && channelId.startsWith('trigger:')
+        && session.selfAID?.replace(/^@/, '') === selfAid
+        && session.metadata?.channelKey === 'daemon'
+        && session.metadata?.peerId === channelId;
+}
 export class CommandHandler {
     sessionManager;
     messageCache;
@@ -95,12 +110,14 @@ export class CommandHandler {
     agentMap;
     primaryRunnerKey;
     agentRegistry;
+    agentApplicationService;
     triggerSchedulerResolver;
     triggerSchedulerFallback;
     triggerSchedulerFallbackAid;
     daemonStatusProvider;
     agentDelegationRegistry;
     handoffRuntime;
+    contactRequestSubmitter;
     /**
      * Get the runner for a (channel, baseagent) pair.
      *
@@ -195,6 +212,10 @@ export class CommandHandler {
     setAgentRegistry(registry) {
         this.agentRegistry = registry;
     }
+    /** Inject the Core-owned agent application facade after runtime hooks exist. */
+    setAgentApplicationService(service) {
+        this.agentApplicationService = service;
+    }
     setTriggerSchedulerResolver(resolver) {
         this.triggerSchedulerResolver = resolver;
     }
@@ -342,9 +363,39 @@ export class CommandHandler {
     triggerPermissionFromParsed(parsed) {
         return parsed.permissionMode ?? undefined;
     }
-    validateTriggerPermissionModeForRole(mode, isAdmin, role, selfAid) {
+    /**
+     * Persist fullaccess approval provenance as the canonical process owner,
+     * rather than the transport-specific peer id.  A Feishu/other-channel
+     * alias may authenticate as a daemon-owner while its raw peer id is not an
+     * entry in daemon.json.owners; storing that alias would make the Trigger
+     * fail its next scheduler-time owner check.
+     */
+    canonicalDaemonOwnerId(selfAid, channel, peerId, chatType) {
+        const fallback = String(peerId || '').trim();
+        try {
+            const detail = resolvePeerRoleDetail({
+                selfAid,
+                channelKey: channel,
+                channelType: this.resolveChannelType(channel),
+                chatType: chatType === 'group' ? 'group' : 'private',
+                actorId: fallback,
+                conversationId: fallback,
+            });
+            const principal = detail.actor.principalId?.trim();
+            return principal || fallback;
+        }
+        catch {
+            return fallback;
+        }
+    }
+    validateTriggerPermissionModeForRole(mode, isAdmin, role, selfAid, isDaemonOwner = false) {
         if (!mode)
             return undefined;
+        if (mode === 'fullaccess') {
+            if (!isFullAccessEnabled())
+                return 'fullaccess 功能未启用';
+            return isDaemonOwner ? undefined : '无权限：只有 daemon-owner 可以配置 fullaccess Trigger';
+        }
         if (!role) {
             if (mode === 'bypass' && !isAdmin)
                 return '无权限：只有 owner/admin 可以创建或修改 bypass trigger';
@@ -355,6 +406,19 @@ export class CommandHandler {
             return `无权限：角色 ${role} 不能使用 ${mode} trigger permissionMode`;
         return undefined;
     }
+    auditFullAccessTriggerConfiguration(input) {
+        auditFullAccessEvent({
+            event: input.event,
+            source: 'trigger',
+            actorId: input.actorId,
+            processRole: input.isDaemonOwner ? 'daemon-owner' : 'none',
+            agentAid: input.definition.agentAid,
+            messageId: input.messageId,
+            triggerId: input.definition.id,
+            authorizedBy: input.definition.authorizedBy,
+            reason: input.reason,
+        });
+    }
     triggerRoleContext(selfAid, channel, peerId, chatType) {
         const owning = this.getOwningAgent(channel);
         if (!owning || owning.aid !== selfAid)
@@ -404,7 +468,7 @@ export class CommandHandler {
             .find(definition => (definition.id === nameOrId || definition.name === nameOrId)
             && this.canAccessTriggerDefinition(definition, peerId, channel, isAdmin));
     }
-    async buildTriggerDefinitionFromParsed(parsed, channel, channelId, peerId, isAdmin, messageId, chatType, threadId) {
+    async buildTriggerDefinitionFromParsed(parsed, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         const now = Date.now();
         const id = `trig_${now}_${crypto.randomBytes(4).toString('hex')}`;
         const name = parsed.name ?? `trigger-${now.toString(36)}`;
@@ -475,9 +539,12 @@ export class CommandHandler {
         } : undefined;
         const permissionMode = this.triggerPermissionFromParsed(parsed);
         const triggerRole = this.triggerRoleContext(schedulerAid, channel, peerId, chatType);
-        const permissionError = this.validateTriggerPermissionModeForRole(permissionMode, isAdmin, triggerRole.role, schedulerAid);
+        const permissionError = this.validateTriggerPermissionModeForRole(permissionMode, isAdmin, triggerRole.role, schedulerAid, isDaemonOwner);
         if (permissionError)
             return { error: permissionError };
+        if (permissionMode === 'fullaccess' && !canApprovePersistentFullAccess) {
+            return { error: '当前认证通道不能批准持久 fullaccess Trigger' };
+        }
         if (parsed.baseagent !== undefined) {
             if (typeof parsed.baseagent !== 'string' || !parsed.baseagent.trim()) {
                 return { error: 'Trigger baseagent 不能为空' };
@@ -501,6 +568,9 @@ export class CommandHandler {
                 };
             }
         }
+        const authorizedBy = permissionMode === 'fullaccess' && isDaemonOwner
+            ? this.canonicalDaemonOwnerId(schedulerAid, channel, peerId, chatType)
+            : undefined;
         const definition = {
             $schema_version: 3.1,
             id,
@@ -509,6 +579,7 @@ export class CommandHandler {
             name,
             createdAt: now,
             updatedAt: now,
+            ...(authorizedBy ? { authorizedBy } : {}),
             origin,
             source,
             execution: {
@@ -665,8 +736,8 @@ export class CommandHandler {
                 replyContext: opts.replyCtx,
             });
             const fallbackText = renderCommandCardAsText(card);
-            const messageId = await sendInteractionPayload(adapter, envelope, opts.interaction, fallbackText, opts.replyCtx);
-            if (messageId)
+            const receipt = await sendInteractionPayload(adapter, envelope, opts.interaction, fallbackText, opts.replyCtx);
+            if (isInteractionSendAccepted(receipt))
                 return null;
         }
         catch (e) {
@@ -711,6 +782,10 @@ export class CommandHandler {
     setInteractionRouter(router) {
         this.interactionRouter = router;
     }
+    /** Inject the daemon-owned contact request/card workflow for Agent self-service. */
+    setContactRequestSubmitter(submitter) {
+        this.contactRequestSubmitter = submitter;
+    }
     setStatsCollector(collector) {
         this.statsCollector = collector;
     }
@@ -1044,6 +1119,27 @@ export class CommandHandler {
     async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
         try {
             const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
+            // Lifecycle commands are control-plane operations. Their replies must
+            // use notification payloads so other agents in a group do not treat the
+            // text as ordinary model input. Normalize guard-path replies here too,
+            // since those return before slash-handler command-specific branches.
+            if (/^\/(?:new|renew)(?:\s|$)/i.test(content.trim())
+                && result && typeof result === 'object'
+                && (result.kind === 'command.result' || result.kind === 'command.error')) {
+                const isError = result.kind === 'command.error';
+                return isError
+                    ? {
+                        kind: 'system.error',
+                        text: result.text,
+                        subtype: `session.${content.trim().toLowerCase().startsWith('/new') ? 'new' : 'renew'}.error`,
+                        recoverable: true,
+                    }
+                    : {
+                        kind: 'system.notice',
+                        text: result.text,
+                        subtype: `session.${content.trim().toLowerCase().startsWith('/new') ? 'new' : 'renew'}.result`,
+                    };
+            }
             return result;
         }
         catch (error) {
@@ -1057,7 +1153,7 @@ export class CommandHandler {
     async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
         return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
     }
-    async handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId) {
+    async handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         if (content === '/trigger') {
             const visible = scheduler
                 .list()
@@ -1110,11 +1206,35 @@ export class CommandHandler {
             const prefix = sub.startsWith('delete ') ? 'delete ' : sub.startsWith('remove ') ? 'remove ' : 'rm ';
             const { definition } = extractAndFindTrigger(sub, prefix, 'delete');
             const deleted = scheduler.delete(definition.id);
+            if (deleted.execution.permissionMode === 'fullaccess') {
+                this.auditFullAccessTriggerConfiguration({
+                    event: 'fullaccess.trigger.deescalated', definition: deleted, actorId: peerId,
+                    messageId, isDaemonOwner, reason: 'fullaccess Trigger deleted',
+                });
+            }
             return `✅ 触发器已删除：**${deleted.name}**`;
         }
         if (sub.startsWith('enable ')) {
             const { definition } = extractAndFindTrigger(sub, 'enable ', 'enable');
-            scheduler.setEnabled(definition.id, true);
+            if (definition.execution.permissionMode === 'fullaccess' && (!isDaemonOwner || !isFullAccessEnabled())) {
+                return '❌ 只有 daemon-owner 可以启用 fullaccess Trigger，且 daemon.json.fullaccess.enabled 必须为 true';
+            }
+            if (definition.execution.permissionMode === 'fullaccess' && !canApprovePersistentFullAccess) {
+                return '❌ 当前认证通道不能批准持久 fullaccess Trigger';
+            }
+            if (definition.execution.permissionMode === 'fullaccess') {
+                const authorizedBy = this.canonicalDaemonOwnerId(definition.agentAid, definition.origin?.channelKey || channel, peerId);
+                if (!authorizedBy)
+                    return '❌ 无法确认 fullaccess Trigger 的批准者';
+                scheduler.update(definition.id, { ...definition, authorizedBy });
+            }
+            const enabled = scheduler.setEnabled(definition.id, true);
+            if (enabled.execution.permissionMode === 'fullaccess') {
+                this.auditFullAccessTriggerConfiguration({
+                    event: 'fullaccess.trigger.configured', definition: enabled, actorId: peerId,
+                    messageId, isDaemonOwner, reason: 'fullaccess Trigger enabled',
+                });
+            }
             return `✅ 触发器已启用：**${definition.name}**`;
         }
         if (sub.startsWith('disable ')) {
@@ -1197,7 +1317,7 @@ export class CommandHandler {
             const result = parseTriggerUpdate(args);
             if (!result.ok)
                 return `❌ ${result.error}`;
-            const updated = await this.updateTriggerFromPatch(scheduler, result.nameOrId, result.value, channel, channelId, peerId, isAdmin, messageId, threadId);
+            const updated = await this.updateTriggerFromPatch(scheduler, result.nameOrId, result.value, channel, channelId, peerId, isAdmin, messageId, threadId, isDaemonOwner, canApprovePersistentFullAccess);
             if (!updated.ok)
                 return `❌ ${updated.error}`;
             const nextStr = updated.trigger.nextFireAt ? new Date(updated.trigger.nextFireAt).toLocaleString() : '未计算';
@@ -1213,7 +1333,7 @@ export class CommandHandler {
             const result = parseTriggerSet(args);
             if (!result.ok)
                 return `❌ ${result.error}`;
-            const reg = await this.registerTriggerFromParsed(result.value, channel, channelId, peerId, messageId, chatType, threadId, isAdmin);
+            const reg = await this.registerTriggerFromParsed(result.value, channel, channelId, peerId, messageId, chatType, threadId, isAdmin, isDaemonOwner, canApprovePersistentFullAccess);
             if (!reg.ok)
                 return `❌ ${reg.error}`;
             const nextStr = reg.trigger.nextFireAt ? new Date(reg.trigger.nextFireAt).toLocaleString() : '未计算';
@@ -1232,13 +1352,13 @@ export class CommandHandler {
 /trigger cancel <名称|ID> — 禁用触发器（disable 的兼容别名）
 /trigger delete <名称|ID> — 删除触发器`;
     }
-    async handleTrigger(content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId) {
+    async handleTrigger(content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         const scheduler = this.getTriggerSchedulerForChannel(channel);
         if (!scheduler)
             return '⚠️ 触发器功能未启用';
-        return await this.handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId);
+        return await this.handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner, canApprovePersistentFullAccess);
     }
-    async updateTriggerFromPatch(scheduler, nameOrId, patch, channel, channelId, peerId, isAdmin, messageId, threadId) {
+    async updateTriggerFromPatch(scheduler, nameOrId, patch, channel, channelId, peerId, isAdmin, messageId, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         const definition = this.findTriggerDefinition(scheduler, nameOrId, peerId, channel, isAdmin);
         if (!definition) {
             return { ok: false, error: isAdmin ? `未找到触发器：${nameOrId}` : `未找到触发器 "${nameOrId}"，或无权限修改` };
@@ -1275,6 +1395,22 @@ export class CommandHandler {
         catch (err) {
             return { ok: false, error: err?.message || String(err) };
         }
+        if (updated.execution.permissionMode === 'fullaccess') {
+            if (!isDaemonOwner) {
+                return { ok: false, code: 'FORBIDDEN', error: '无权限：只有 daemon-owner 可以配置 fullaccess Trigger' };
+            }
+            if (!canApprovePersistentFullAccess) {
+                return { ok: false, error: '当前认证通道不能批准持久 fullaccess Trigger', code: 'FORBIDDEN' };
+            }
+            updated = {
+                ...updated,
+                authorizedBy: this.canonicalDaemonOwnerId(definition.agentAid, definition.origin?.channelKey || channel, peerId),
+            };
+        }
+        else {
+            const { authorizedBy: _authorizedBy, ...deescalated } = updated;
+            updated = deescalated;
+        }
         const target = this.primaryFeedbackTarget(updated);
         if (!isAdmin && target && !sameFeedbackTarget(target, definition.origin)) {
             return { ok: false, error: '无权限：非 admin 只能把 trigger 投递到来源会话' };
@@ -1283,14 +1419,35 @@ export class CommandHandler {
             return { ok: false, error: '无权限：只有 owner/admin 可以修改 script trigger' };
         }
         const triggerRole = this.triggerRoleContext(definition.agentAid, definition.origin?.channelKey || channel, definition.origin?.peerId || peerId);
-        const permissionError = this.validateTriggerPermissionModeForRole(updated.execution.permissionMode, isAdmin, triggerRole.role, definition.agentAid);
-        if (permissionError)
-            return { ok: false, error: permissionError };
+        const permissionError = this.validateTriggerPermissionModeForRole(updated.execution.permissionMode, isAdmin, triggerRole.role, definition.agentAid, isDaemonOwner);
+        if (permissionError) {
+            return {
+                ok: false,
+                error: permissionError,
+                code: /fullaccess 功能未启用/.test(permissionError) ? 'NOT_SUPPORTED'
+                    : /无权限|只有 daemon-owner/.test(permissionError) ? 'FORBIDDEN'
+                        : undefined,
+            };
+        }
         const runtimeFieldError = this.validateTriggerRuntimeFields(updated, triggerRole.role, triggerRole.baseagent);
         if (runtimeFieldError)
             return { ok: false, error: runtimeFieldError };
         try {
             const saved = scheduler.update(definition.id, updated);
+            if (saved.execution.permissionMode === 'fullaccess') {
+                this.auditFullAccessTriggerConfiguration({
+                    event: 'fullaccess.trigger.configured', definition: saved, actorId: peerId,
+                    messageId, isDaemonOwner, reason: definition.execution.permissionMode === 'fullaccess'
+                        ? 'fullaccess Trigger updated'
+                        : 'Trigger elevated to fullaccess',
+                });
+            }
+            else if (definition.execution.permissionMode === 'fullaccess') {
+                this.auditFullAccessTriggerConfiguration({
+                    event: 'fullaccess.trigger.deescalated', definition, actorId: peerId,
+                    messageId, isDaemonOwner, reason: 'Trigger permissionMode changed from fullaccess',
+                });
+            }
             return {
                 ok: true,
                 trigger: this.definitionToTriggerView(saved, scheduler),
@@ -1304,12 +1461,18 @@ export class CommandHandler {
     /** 从已解析的 trigger 参数组装 definition 并注册。文本路径（handleTrigger）与 menu 路径共用。
      *  parsed 形状 = parseTriggerSet 的 result.value（ParsedTriggerSet）。
      *  失败 return { ok:false, error }；成功 return { ok:true, trigger }。 */
-    async registerTriggerFromParsed(parsed, channel, channelId, peerId, messageId, chatType, threadId, isAdmin = false) {
-        const built = await this.buildTriggerDefinitionFromParsed(parsed, channel, channelId, peerId, isAdmin, messageId, chatType, threadId);
+    async registerTriggerFromParsed(parsed, channel, channelId, peerId, messageId, chatType, threadId, isAdmin = false, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
+        const built = await this.buildTriggerDefinitionFromParsed(parsed, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner, canApprovePersistentFullAccess);
         if ('error' in built)
             return { ok: false, error: built.error };
         try {
             const created = built.scheduler.create(built.definition, [], { enable: true });
+            if (created.execution.permissionMode === 'fullaccess') {
+                this.auditFullAccessTriggerConfiguration({
+                    event: 'fullaccess.trigger.configured', definition: created, actorId: peerId,
+                    messageId, isDaemonOwner, reason: 'fullaccess Trigger created',
+                });
+            }
             return { ok: true, trigger: this.definitionToTriggerView(created, built.scheduler) };
         }
         catch (err) {
@@ -1534,6 +1697,7 @@ export class CommandHandler {
             chatType: grant.chatType,
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
         const executeOne = (fieldArgv) => {
             const resolved = resolveConfigCommand(fieldArgv, {
@@ -1606,9 +1770,19 @@ export class CommandHandler {
         const resolved = resolveContactCommand(argv);
         if (!resolved.ok)
             return { ok: false, code: resolved.code, error: resolved.reason };
-        if (resolved.command.selfAid !== grant.selfAid) {
+        if (resolved.command.selfAid !== grant.selfAid && !hasTrustedFullAccessDelegation(grant)) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent contact book can be targeted' };
         }
+        const selfServiceAdd = resolved.command.kind === 'add';
+        const primaryId = 'primaryId' in resolved.command ? resolved.command.primaryId : undefined;
+        if (selfServiceAdd && !hasTrustedFullAccessDelegation(grant)) {
+            if (grant.channelType !== 'aun' || grant.chatType !== 'private') {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'contact add requires the current AUN private relation' };
+            }
+            if (primaryId !== conversationId) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'contact add may only target the current private peer' };
+            }
+        }
         const subject = buildAuthSubject({
             selfAid: grant.selfAid,
             actorId: grant.actorId,
@@ -1618,17 +1792,25 @@ export class CommandHandler {
             chatType: grant.chatType,
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
         const decision = authorizeOperation({
             source: 'agent-tool',
             subject,
             intent: {
                 operation: resolved.command.operationId,
-                scope: 'agent',
+                scope: selfServiceAdd ? 'relation' : 'agent',
                 source: 'agent-tool',
                 args: {
                     self: resolved.command.selfAid,
-                    ...('primaryId' in resolved.command ? { primaryId: resolved.command.primaryId } : {}),
+                    ...(primaryId ? { primaryId } : {}),
+                    ...(selfServiceAdd
+                        ? {
+                            targetId: primaryId,
+                            peer: primaryId,
+                            peerKey: `aun#${primaryId}`,
+                        }
+                        : {}),
                 },
             },
             auditMetadata: {
@@ -1639,6 +1821,47 @@ export class CommandHandler {
         });
         if (!decision.allow)
             return { ok: false, code: decision.code, error: decision.reason };
+        if (selfServiceAdd) {
+            if (!this.contactRequestSubmitter) {
+                return { ok: false, code: 'CONTACT_REQUEST_UNAVAILABLE', error: 'Contact request workflow is not configured' };
+            }
+            try {
+                const submission = await this.contactRequestSubmitter({
+                    selfAid: grant.selfAid,
+                    applicantAid: primaryId,
+                    sourceChannelKey: grant.channel,
+                });
+                if (submission.code === 'blocked') {
+                    return {
+                        ok: false,
+                        code: 'CONTACT_BLOCKED',
+                        error: `目标联系人 ${primaryId} 已被拉黑。请先解除拉黑：ec contact unblock ${primaryId} --self ${grant.selfAid}`,
+                    };
+                }
+                return {
+                    ok: true,
+                    result: {
+                        ok: true,
+                        operation: 'add',
+                        selfAid: grant.selfAid,
+                        primaryId: primaryId,
+                        status: submission.code,
+                        changed: submission.code === 'submitted' || submission.code === 'resubmitted',
+                        requestId: submission.requestId,
+                        expiresAt: submission.expiresAt,
+                        contactRevision: submission.contactRevision,
+                        reviewCardSent: submission.reviewCardSent === true,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    code: error?.code ?? 'CONTACT_REQUEST_FAILED',
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        }
         const result = await executeResolvedContactCommand(resolved.command, grant.actorId);
         return result.ok
             ? { ok: true, result }
@@ -1663,7 +1886,7 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        if (parsed.command.aid !== grantSelfAid) {
+        if (parsed.command.aid !== grantSelfAid && !hasTrustedFullAccessDelegation(delegation.grant)) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can be targeted' };
         }
         let conversationId;
@@ -1682,6 +1905,7 @@ export class CommandHandler {
             chatType: delegation.grant.chatType,
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(delegation.grant),
         });
         const managementRole = isManagementRole(subject.role);
         const decision = authorizeOperation({
@@ -1733,7 +1957,7 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        if (parsed.command.from !== grantSelfAid) {
+        if (parsed.command.from !== grantSelfAid && !hasTrustedFullAccessDelegation(grant)) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can perform managed group operations' };
         }
         let conversationId;
@@ -1752,12 +1976,16 @@ export class CommandHandler {
             chatType: grant.chatType,
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
-        const managementRole = isManagementRole(subject.role);
-        if (!managementRole && (grant.channelType !== 'aun' || !isManagedGroupRelationRead(parsed.command))) {
+        const managementRole = isManagementRole(subject.role) || subject.dataScope === 'daemon';
+        if (subject.dataScope !== 'daemon'
+            && !managementRole
+            && (grant.channelType !== 'aun' || !isManagedGroupRelationRead(parsed.command))) {
             return { ok: false, code: 'ROLE_ACCESS_DENIED', error: `Role ${subject.role} cannot manage Agent group membership or settings` };
         }
-        if ((parsed.command.kind === 'dissolve' || parsed.command.kind === 'owner') && subject.role !== 'owner') {
+        if ((parsed.command.kind === 'dissolve' || parsed.command.kind === 'owner')
+            && subject.dataScope !== 'daemon' && subject.role !== 'owner') {
             return { ok: false, code: 'ROLE_ACCESS_DENIED', error: `${parsed.command.kind} requires Agent owner permission` };
         }
         const decision = authorizeOperation({
@@ -1849,7 +2077,7 @@ export class CommandHandler {
             };
         }
     }
-    /** Agent-managed private msg read entrypoint. AUN credentials and history roots remain daemon-owned. */
+    /** Agent-managed msg read entrypoint. AUN credentials and history roots remain daemon-owned. */
     async handleMsgOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
@@ -1902,28 +2130,53 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        if (grant.channelType !== 'aun' || grant.chatType !== 'private') {
-            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed msg reads require the current AUN private relation' };
+        if (parsed.command.from !== grantSelfAid && !hasTrustedFullAccessDelegation(grant)) {
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can be targeted' };
         }
-        let peerAid;
+        const isSelectorHistory = parsed.command.kind === 'history'
+            && !!parsed.command.channelKey
+            && !!parsed.command.peerId;
+        let conversationId;
         try {
-            peerAid = parsePeerKey(grant.peerKey).channelId.replace(/^@/, '');
+            conversationId = parsePeerKey(grant.peerKey).channelId.replace(/^@/, '');
         }
         catch {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
         }
-        if (parsed.command.from !== grantSelfAid || parsed.command.target !== peerAid) {
-            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN private relation can be targeted' };
+        if (isSelectorHistory) {
+            if (!hasTrustedFullAccessDelegation(grant) && !isTrustedDaemonTriggerSession(session, grantSelfAid)) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'Cross-channel history selectors require a trusted daemon Trigger session' };
+            }
+        }
+        else {
+            if (!hasTrustedFullAccessDelegation(grant) && (grant.channelType !== 'aun' || grant.chatType !== 'private')) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed msg reads require the current AUN private relation' };
+            }
+            if (!hasTrustedFullAccessDelegation(grant) && parsed.command.target !== conversationId) {
+                return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN private relation can be targeted' };
+            }
+        }
+        const selectorChannel = isSelectorHistory
+            ? tryParseChannelKey(parsed.command.channelKey)
+            : undefined;
+        if (isSelectorHistory && !selectorChannel) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: 'Invalid channel selector' };
         }
+        const targetId = isSelectorHistory ? parsed.command.peerId : parsed.command.target;
+        const targetPeerKey = isSelectorHistory
+            ? formatPeerKey(selectorChannel.type, targetId)
+            : formatPeerKey('aun', targetId);
         const subject = buildAuthSubject({
             selfAid: grant.selfAid,
             actorId: grant.actorId,
             channel: grant.channel,
             channelType: grant.channelType,
-            channelId: peerAid,
+            channelId: conversationId,
             chatType: grant.chatType,
-            conversationId: peerAid,
+            conversationId,
+            ...(isSelectorHistory ? { identity: roleToSessionIdentity(grant.issuedRole) } : {}),
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
         const decision = authorizeOperation({
             source: 'agent-tool',
@@ -1934,9 +2187,15 @@ export class CommandHandler {
                 source: 'agent-tool',
                 args: {
                     self: parsed.command.from,
-                    targetId: parsed.command.target,
-                    peer: parsed.command.target,
-                    peerKey: formatPeerKey('aun', parsed.command.target),
+                    targetId,
+                    peer: targetId,
+                    peerKey: targetPeerKey,
+                    ...(isSelectorHistory ? {
+                        channelKey: parsed.command.channelKey,
+                        peerId: parsed.command.peerId,
+                        selectorPeerKey: targetPeerKey,
+                        triggerSessionId: session.id,
+                    } : {}),
                     ...(parsed.command.session ? { session: parsed.command.session } : {}),
                     ...(parsed.command.limit !== undefined ? { limit: parsed.command.limit } : {}),
                     ...(parsed.command.before !== undefined ? { before: parsed.command.before } : {}),
@@ -1949,6 +2208,9 @@ export class CommandHandler {
                 argvHash: hashArgv(parsed.command.canonicalArgv),
                 taskId: grant.taskId,
                 messageId: grant.messageId,
+                sessionId,
+                agentAid: grant.selfAid,
+                toolName: 'ec.msg',
             },
         });
         if (!decision.allow)
@@ -1984,7 +2246,7 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== actorAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        if (grant.channelType !== 'aun' || grant.chatType !== 'group') {
+        if (!hasTrustedFullAccessDelegation(grant) && (grant.channelType !== 'aun' || grant.chatType !== 'group')) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed fs operations require the current AUN group relation' };
         }
         let currentGroup;
@@ -1994,10 +2256,13 @@ export class CommandHandler {
         catch {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
         }
-        if ((parsed.command.actorAid && parsed.command.actorAid !== actorAid) || parsed.command.groupId !== currentGroup) {
+        if (!hasTrustedFullAccessDelegation(grant)
+            && ((parsed.command.actorAid && parsed.command.actorAid !== actorAid) || parsed.command.groupId !== currentGroup)) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN group can be targeted' };
         }
-        parsed.command.actorAid = actorAid;
+        parsed.command.actorAid = hasTrustedFullAccessDelegation(grant)
+            ? (parsed.command.actorAid ?? actorAid)
+            : actorAid;
         const subject = buildAuthSubject({
             selfAid: grant.selfAid,
             actorId: grant.actorId,
@@ -2007,6 +2272,7 @@ export class CommandHandler {
             chatType: grant.chatType,
             conversationId: currentGroup,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
         const intentArgs = {
             self: actorAid,
@@ -2139,6 +2405,7 @@ export class CommandHandler {
             chatType: grant.chatType,
             conversationId,
             processOwners: loadDaemonConfig().owners ?? [],
+            ...trustedExecutionIdentityInput(grant),
         });
         const ctlIntent = this.resolveCtlIntent(cmd, grantSelfAid, grant.peerKey);
         if (!ctlIntent)