evolcore 0.0.20 → 0.0.22

package/dist/index.js

@@ -13,9 +13,11 @@ import { ClaudeSessionFileAdapter } from './core/session/adapters/claude-session
 import { CodexSessionFileAdapter } from './core/session/adapters/codex-session-file-adapter.js';
 import { GeminiSessionFileAdapter } from './core/session/adapters/gemini-session-file-adapter.js';
 import { EcagentSessionFileAdapter } from './core/session/adapters/ecagent-session-file-adapter.js';
-import { loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfig, initializeEckSnapshotsConfig } from './config-store.js';
+import { autoMigrateIfNeeded, loadDefaults, loadAllAgents, migrateIdentitiesIfNeeded, loadDaemonConfig, initializeEckSnapshotsConfig, isFullAccessEnabled } from './config-store.js';
+import { DEFAULT_ECWEB_PORT, ecwebService } from './config/daemon-services.js';
 import { ConfigTarget, initConfigManager, onConfigWrite, read as readConfig, shouldFailFastForMissingOwners } from './config/config-manager.js';
 import { ensureRoleConfigV4OnStartup, ensureRoleConfigV5OnStartup } from './config/role-migration-startup.js';
+import { ensureAuxiliaryModelMigrationOnStartup } from './config/schema-migration.js';
 import { ensureContactBookV2OnStartup } from './config/contact-book-v2-startup.js';
 import { resolvePeerDisplayLabel } from './config/contact-book.js';
 import { expirePendingContactRequests } from './config/contact-request-service.js';
@@ -42,6 +44,7 @@ import { buildEnvelope, isDeliveryTargetForChannel, replyContextFromSession } fr
 import { ResponseEngine } from './core/message/response-engine.js';
 import { MessageQueue } from './core/message/message-queue.js';
 import { MessageBridge } from './core/message/message-bridge.js';
+import { evaluateOutboundContactAdmission } from './core/message/message-admission.js';
 import { evaluateEvolMenuVersionGate, evolMenuResponseTransportMetadata, MenuRequestDeduper, hasValidMenuId, menuFailure, menuPayloadFingerprint, normalizeMenuResponseTiming, parseMenuControl, validateMenuRequest, withMenuProcessingTime, logMenuRequestCompleted, logMenuRequestReceived } from './core/command/menu-protocol.js';
 import { readInstalledEvolcoreVersion } from './utils/evolcore-version.js';
 import { recoverAllRoleMutationsSync } from './core/command/role-menu.js';
@@ -50,17 +53,19 @@ import { BootstrapService, completeBootstrapWithWelcome } from './core/bootstrap
 import { postBootstrapWelcomeOperationId } from './core/bootstrap-messages.js';
 import { MessageCache } from './core/message/message-cache.js';
 import { CommandHandler, isProcessLevelOwner } from './core/command/command-handler.js';
+import { AgentApplicationService } from './core/agent-application-service.js';
 import { EventBus } from './core/event-bus.js';
 import { eventPatternIncludesInternal, getEventCatalog } from './core/event-catalog.js';
 import { StatsCollector } from './utils/stats.js';
 import { AidStatsCollector } from './utils/stats.js';
 import { PermissionGateway } from './core/permission/approval-gateway.js';
 import { InteractionRouter, registerAdapterInteractions } from './core/interaction-router.js';
-import { AgentDelegationRegistry, authorizeDelegatedAunMsgSend } from './core/auth/agent-delegation.js';
-import { authorizeOperation, buildAuthSubject, isCrossAgentTriggerOperationAllowed, } from './core/auth/auth-gateway.js';
+import { AgentDelegationRegistry, authorizeDelegatedAunMsgSend, hasTrustedFullAccessDelegation, trustedExecutionIdentityInput, } from './core/auth/agent-delegation.js';
+import { authorizeOperation, buildAuthSubject, canApprovePersistentFullAccessTrigger, isCrossAgentTriggerOperationAllowed, } from './core/auth/auth-gateway.js';
 import { authorizationDenialData, formatAuthorizationDenial } from './core/auth/authorization-denial.js';
+import { auditFullAccessEvent } from './core/auth/authorization-audit.js';
 import { parsePeerKey } from './core/relation/peer-identity.js';
-import { isHClassPath } from './core/protected-paths.js';
+import { isHClassPath } from './core/permission/protected-paths.js';
 import { ChannelLoader, tryParseChannelKey } from './core/channel-loader.js';
 import { AgentLoader } from './core/baseagent-loader.js';
 import { EvolAgentRegistry } from './core/evolagent-registry.js';
@@ -83,12 +88,12 @@ import { TriggerFeedbackDispatcher } from './trigger/feedback.js';
 import { TriggerRuntimeScheduler } from './trigger/scheduler.js';
 import { TargetSessionLockRegistry } from './trigger/session-lock.js';
 import { DaemonChannel } from './channels/daemon.js';
-import { definitionRevision, normalizeTriggerDefinition } from './trigger/validation.js';
+import { definitionRevision, normalizeTriggerDefinition, splitScriptCommand } from './trigger/validation.js';
 import { applyTriggerPatch } from './trigger/patch.js';
 import { validateModelSelectionForRole } from './core/model/model-permission.js';
 import { constrainRuntimePermissionMode, validateRuntimeStringFieldOverride, } from './core/role/runtime-policy.js';
 import { atomicWriteJson } from './core/session/session-fs-store.js';
-import { ensureProcessManagedTempDir } from './cli/task-context.js';
+import { DAEMON_RUNTIME_EPOCH_ENV, ensureProcessManagedTempDir } from './cli/task-context.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from './core/message/message-log.js';
 import { normalizeAunMentionEntries } from './aun/msg/mention-schema.js';
 import { MAIN_PACKAGE_NAME } from './product.js';
@@ -785,11 +790,19 @@ async function main() {
             process.exit(1);
         }
     }
-    // 在登记 daemon 实例前自动备份并迁移旧角色配置；失败才阻止启动。
+    // 在登记 daemon 实例前自动备份并迁移旧配置；失败才阻止启动。
     try {
         // Crash recovery must precede schema gates and migrations so they never
         // inspect or migrate a partially applied Role Menu transaction.
         recoverAllRoleMutationsSync();
+        autoMigrateIfNeeded();
+        const auxiliaryModelMigration = await ensureAuxiliaryModelMigrationOnStartup();
+        if (auxiliaryModelMigration) {
+            const msg = `✓ Session Renew auxiliary model migration applied automatically: ${auxiliaryModelMigration.changedFiles} file(s)`
+                + (auxiliaryModelMigration.backup ? `; backup: ${auxiliaryModelMigration.backup}` : '');
+            logger.info(msg);
+            console.error(msg);
+        }
         const migration = await ensureRoleConfigV4OnStartup();
         if (migration) {
             const msg = `✓ Role config v4 migration applied automatically: ${migration.changedFiles} file(s)` +
@@ -834,7 +847,7 @@ async function main() {
     }
     // ── 自动迁移 ──
     migrateIdentitiesIfNeeded();
-    // autoMigrateIfNeeded 已随配置体系 v2 退场（fresh init，不做兼容过渡）。
+    // daemon.json 的旧 ecweb/serviceProxy 结构已在启动前归一化为 services[]。
     // ── 配置体系初始化（schema 字段不相交硬约束校验）──
     try {
         initConfigManager();
@@ -897,9 +910,10 @@ async function main() {
     // instance just before spawning us; the supervisor adopts it when healthy,
     // otherwise starts one and keeps it alive for the daemon's lifetime.
     let ecwebSupervisor = null;
-    if (daemonCfg.ecweb?.enabled) {
+    const ecwebConfig = ecwebService(daemonCfg.services);
+    if (ecwebConfig?.enabled === true) {
         ecwebSupervisor = createEcwebSupervisor({
-            port: daemonCfg.ecweb.port ?? 42705,
+            port: ecwebConfig.port ?? DEFAULT_ECWEB_PORT,
             logger,
         });
         try {
@@ -1052,8 +1066,8 @@ async function main() {
     agentLoader.register(new EcagentAgentPlugin());
     const creationErrors = [];
     const agentInstances = agentLoader.createAll(agentRegistry, {
-        onSessionIdUpdate: async (sessionId, agentSessionId) => {
-            await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+        onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+            return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
         },
     }, creationErrors);
     // agentMap 复合键：${aid}::${baseagent}
@@ -1197,8 +1211,12 @@ async function main() {
         : null;
     bindService?.startCleanup();
     const agentDelegationRegistry = new AgentDelegationRegistry();
+    // Replace any inherited marker from a parent/previous daemon before child
+    // runners or in-process IPC clients are created.
+    process.env[DAEMON_RUNTIME_EPOCH_ENV] = agentDelegationRegistry.getRuntimeEpoch();
     // 创建命令处理器
     const cmdHandler = new CommandHandler(sessionManager, agentMap, messageCache, eventBus, primaryRunnerKey);
+    let agentApplicationService;
     cmdHandler.setAgentDelegationRegistry(agentDelegationRegistry);
     cmdHandler.setPermissionGateway(permissionGateway);
     cmdHandler.setInteractionRouter(interactionRouter);
@@ -1434,10 +1452,19 @@ async function main() {
             && definition.feedback.target?.channelKey === 'daemon') {
             return 'daemon-control feedback';
         }
+        if (definition.execution.permissionMode === 'fullaccess')
+            return 'persistent fullaccess Trigger';
         return undefined;
     };
-    const hasDaemonTriggerAuthority = (subject) => (subject.isDaemonOwner || subject.processRole === 'daemon-service');
+    const hasDaemonTriggerAuthority = (subject) => (subject.isDaemonOwner || subject.processRole === 'daemon-service' || subject.dataScope === 'daemon');
     const validateTriggerDefinitionForActor = (definition, actor) => {
+        if (definition.execution.permissionMode === 'fullaccess') {
+            if (!isFullAccessEnabled())
+                throw new Error('fullaccess is disabled by daemon.json');
+            if (!actor.daemonOwner && !actor.fullAccess) {
+                throw new Error('persistent fullaccess Trigger requires DaemonOwner or fullaccess-run');
+            }
+        }
         const privilegedReason = daemonPrivilegedTriggerReason(definition);
         if (privilegedReason && !actor.daemonPrivileged)
             throw new Error(`${privilegedReason} requires DaemonOwner`);
@@ -1488,9 +1515,30 @@ async function main() {
         }
     };
     const authorizeTriggerExecution = (definition) => {
+        if (definition.execution.permissionMode === 'fullaccess' && !isFullAccessEnabled()) {
+            return { allowed: false, reason: 'fullaccess is disabled by daemon.json' };
+        }
+        if (definition.execution.permissionMode === 'fullaccess') {
+            if (!definition.authorizedBy) {
+                return { allowed: false, reason: 'fullaccess Trigger approval provenance is missing' };
+            }
+            const owners = new Set(loadDaemonConfig().owners ?? []);
+            if (!owners.has(definition.authorizedBy)) {
+                return { allowed: false, reason: 'fullaccess Trigger approver is no longer a current daemon-owner' };
+            }
+        }
         const origin = definition.origin;
         if (!origin?.peerId)
             return { allowed: false, reason: 'trigger origin peer is missing' };
+        // A persistent fullaccess definition is an already-approved daemon-scope
+        // task. Its origin remains useful for audit and feedback routing, but a
+        // relation lookup on the origin actor would make a cross-Agent Trigger
+        // persist successfully and then fail on every fire after creation.
+        // Approval provenance and the feature flag above remain mandatory; only
+        // the ordinary creator relation gate is bypassed for this mode.
+        if (definition.execution.permissionMode === 'fullaccess') {
+            return { allowed: true };
+        }
         if (origin.channelKey === 'daemon') {
             const subject = buildAuthSubject({
                 selfAid: definition.agentAid,
@@ -1557,7 +1605,8 @@ async function main() {
             return { allowed: false, reason: operationDecision.reason };
         }
         const privilegedReason = daemonPrivilegedTriggerReason(definition);
-        if (privilegedReason && !hasDaemonTriggerAuthority(subject)) {
+        const persistedFullAccessApproval = privilegedReason === 'persistent fullaccess Trigger';
+        if (privilegedReason && !persistedFullAccessApproval && !hasDaemonTriggerAuthority(subject)) {
             return { allowed: false, reason: `${privilegedReason} requires current DaemonOwner` };
         }
         if (definition.feedback.strategy === 'target' && !isManagementRole(role)) {
@@ -1605,6 +1654,7 @@ async function main() {
                 management: true,
                 daemonOwner: false,
                 daemonPrivileged: true,
+                fullAccess: false,
                 control: true,
                 role: 'none',
                 subject,
@@ -1643,18 +1693,20 @@ async function main() {
             identity: roleToSessionIdentity(currentRole),
             processOwners: loadDaemonConfig().owners ?? [],
             fromControlChannel: false,
+            ...trustedExecutionIdentityInput(validation.grant),
         });
-        if (validation.grant.selfAid !== agentAid && !subject.isDaemonOwner) {
+        if (validation.grant.selfAid !== agentAid && subject.dataScope !== 'daemon') {
             throw new Error('cross-agent Trigger operations require DaemonOwner');
         }
-        if (!subject.isDaemonOwner && !checkRoleAccess(currentRole, agentAid)) {
+        if (subject.dataScope !== 'daemon' && !checkRoleAccess(currentRole, agentAid)) {
             throw new Error('trigger actor no longer has access to this agent');
         }
         return {
             origin: actorOrigin,
-            management: isManagementRole(currentRole) || subject.isDaemonOwner,
+            management: isManagementRole(currentRole) || subject.dataScope === 'daemon',
             daemonOwner: subject.isDaemonOwner,
-            daemonPrivileged: subject.isDaemonOwner,
+            daemonPrivileged: subject.isDaemonOwner || subject.dataScope === 'daemon',
+            fullAccess: subject.processRole === 'fullaccess-run',
             selfAid: validation.grant.selfAid,
             control: false,
             role: currentRole || 'none',
@@ -1797,6 +1849,7 @@ async function main() {
     msgBridge.setInteractionRouter(interactionRouter);
     msgBridge.setContactBindRuntimeChecker(isContactBindChannelReady);
     msgBridge.setAidStatsCollector(aidStatsCollector);
+    cmdHandler.setContactRequestSubmitter((input) => msgBridge.submitAgentContactRequest(input));
     bootstrapService = new BootstrapService(agentRegistry, eventBus);
     msgBridge.setBootstrapService(bootstrapService);
     msgBridge.setHandoffRuntime(handoffRuntime);
@@ -1818,7 +1871,14 @@ async function main() {
                 payload: summarizeOutboundPayload(payload),
             });
             const result = await originalSend(envelope, payload);
-            if (shouldCountSentPayload(payload)) {
+            // AUN adapters return an explicit receipt. Only a receipt with a remote
+            // message ID proves delivery; queued/failed results must not be emitted
+            // as `message:sent`. Legacy adapters that return void remain compatible.
+            const deliveryConfirmed = result === undefined
+                || (result && typeof result === 'object' && result.status === 'sent'
+                    && typeof result.messageId === 'string'
+                    && result.messageId.length > 0);
+            if (shouldCountSentPayload(payload) && deliveryConfirmed) {
                 if ((inst.channelType || inst.adapter.channelName) !== 'aun') {
                     try {
                         const logPayload = outboundPayloadToLogText(payload);
@@ -2248,6 +2308,7 @@ async function main() {
             return { ok: false, code: delegation.code, error: delegation.reason };
         return cmdHandler.handleCtl(cmd, sessionId, delegation.grant);
     });
+    ipcServer.setDaemonRuntimeEpoch(agentDelegationRegistry.getRuntimeEpoch());
     // Register every IPC executor/provider before exposing the endpoint. The
     // function declaration is hoisted, while its invocation remains here so a
     // failed bind still aborts before any AUN connection is attempted.
@@ -2403,8 +2464,8 @@ async function main() {
                     return;
                 }
                 if (text.toLowerCase() === '/pair') {
-                    const port = daemonCfg.ecweb?.port ?? 42705;
-                    const pair = await fetchEcwebPairCode(port);
+                    const port = ecwebService(loadDaemonConfig().services)?.port ?? DEFAULT_ECWEB_PORT;
+                    const pair = await fetchEcwebPairCode(port, opts.peerId);
                     let reply;
                     if (pair) {
                         const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
@@ -2467,11 +2528,12 @@ async function main() {
         // ── Service Proxy：把本地服务（ecweb 等）通过控制 AID 暴露到 AUN 网络 ──
         // 挂在控制 AUNChannel 上，动态解引用其 client（规避重连换 client）。
         // 失败只 warn，不影响 daemon 主流程。
-        if (daemonCfg.serviceProxy?.enabled && daemonCfg.aid) {
+        const proxyServices = (daemonCfg.services ?? []).filter((service) => service.enabled === true && service.proxy?.enabled === true);
+        if (proxyServices.length > 0 && daemonCfg.aid) {
             // 短暂延迟确保控制 channel 完全就绪
             const channel = controlChannel;
             const aid = daemonCfg.aid;
-            const config = daemonCfg.serviceProxy;
+            const config = proxyServices;
             setTimeout(() => {
                 if (!channel)
                     return;
@@ -2778,7 +2840,7 @@ async function main() {
             for (const runner of new Set(agentMap.values())) {
                 if (typeof runner?.evaluatePreToolUse !== 'function')
                     continue;
-                const result = await runner.evaluatePreToolUse(params.threadId, params.toolName, params.toolInput, params.signal);
+                const result = await runner.evaluatePreToolUse(params.threadId, params.toolName, params.toolInput, params.signal, params.callId);
                 if (result.applicable)
                     return result;
             }
@@ -2802,7 +2864,7 @@ async function main() {
             if (delegation.grant.selfAid !== selfAid) {
                 return { ok: false, code: 'INVALID_DELEGATION', error: 'delegation self agent does not match current session' };
             }
-            if (params.agent && params.agent !== selfAid) {
+            if (params.agent && params.agent !== selfAid && !hasTrustedFullAccessDelegation(delegation.grant)) {
                 return { ok: false, code: 'HANDOFF_AGENT_SCOPE_MISMATCH', error: 'agent does not match the current session' };
             }
             let conversationId;
@@ -2821,8 +2883,9 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
-            const managementRole = isManagementRole(subject.role);
+            const managementRole = isManagementRole(subject.role) || subject.dataScope === 'daemon';
             const decision = authorizeOperation({
                 source: 'agent-tool',
                 subject,
@@ -2945,6 +3008,12 @@ async function main() {
             if (!ch) {
                 return { ok: false, error: `AUN channel not found for ${params.aid}`, code: 'AUN_CHANNEL_NOT_FOUND' };
             }
+            if (params.scope === 'msg') {
+                const admission = await evaluateOutboundContactAdmission({ selfAid: params.aid, targetAid: params.to });
+                if (!admission.allow) {
+                    return { ok: false, error: admission.error, code: admission.code };
+                }
+            }
             // The IPC command already carries the caller-selected transport scope.
             // Never reclassify the target by parsing its AID string: a private AID may
             // look group-like and a group identifier may use a future format.
@@ -3113,8 +3182,8 @@ async function main() {
                 const staged = candidate.config.enabled === false
                     ? []
                     : agentLoader.createForAgent(candidate, {
-                        onSessionIdUpdate: async (sessionId, agentSessionId) => {
-                            await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+                        onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+                            return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
                         },
                     }, creationErrors);
                 const onDisposeError = (instance, error) => {
@@ -3213,8 +3282,8 @@ async function main() {
                 }
                 const creationErrors = [];
                 const newAgentInstances = agentLoader.createForAgent(agent, {
-                    onSessionIdUpdate: async (sessionId, agentSessionId) => {
-                        await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId);
+                    onSessionIdUpdate: async (sessionId, agentSessionId, context) => {
+                        return await sessionManager.updateAgentSessionIdBySessionId(sessionId, agentSessionId, context?.turn);
                     },
                 }, creationErrors);
                 for (const inst of newAgentInstances) {
@@ -3381,6 +3450,41 @@ async function main() {
                     resyncInFlight = undefined;
             }
         };
+        // Core-owned agent application facade. Menu/slash/managed-task callers use
+        // this in-process service after their own authorization checks; standalone
+        // CLI commands continue to reach these operations through IPC.
+        const coreHotLoadAgent = async (aid) => {
+            const hotLoad = globalThis.__evolcore_hotLoadAgent;
+            if (typeof hotLoad !== 'function')
+                throw new Error('Hot-load handler not initialized');
+            await hotLoad(aid);
+        };
+        const coreResyncAgents = async () => {
+            const resync = globalThis.__evolcore_resyncAgents;
+            if (typeof resync !== 'function')
+                throw new Error('Resync handler not initialized');
+            return await resync();
+        };
+        agentApplicationService = new AgentApplicationService({
+            registry: agentRegistry,
+            reload: (aid, options) => reloadCoordinator.reload(aid, options),
+            hooks: reloadHooks,
+            hotLoad: coreHotLoadAgent,
+            resync: coreResyncAgents,
+            create: async (options) => {
+                const { agentCreateNonInteractive } = await import('./cli/agent.js');
+                return await agentCreateNonInteractive(options, { hotLoadAgent: coreHotLoadAgent });
+            },
+            aunAids: () => channelInstances.flatMap((inst) => {
+                if (inst.channelType !== 'aun')
+                    return [];
+                const state = inst.channel?.getAidState?.();
+                return state ? [state] : [];
+            }),
+            aunAidStats: () => aidStatsCollector.getAllSnapshots(),
+        });
+        cmdHandler.setAgentApplicationService(agentApplicationService);
+        ipcServer.setAgentApplicationService(agentApplicationService);
         ipcServer.setStatsProvider(() => statsCollector.getSnapshot());
         ipcServer.setAgentStatsProvider(() => {
             const agents = agentRegistry.list();
@@ -3458,8 +3562,11 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
-            if (params.targetAid && params.targetAid !== delegation.grant.selfAid && !subject.isDaemonOwner) {
+            if (params.targetAid
+                && params.targetAid !== delegation.grant.selfAid
+                && subject.dataScope !== 'daemon') {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'only the current Agent can be targeted' };
             }
             const decision = authorizeOperation({
@@ -3474,7 +3581,10 @@ async function main() {
                 auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
             });
             return decision.allow
-                ? { ok: true, aid: delegation.grant.selfAid }
+                ? {
+                    ok: true,
+                    aid: subject.dataScope === 'daemon' ? (params.targetAid ?? delegation.grant.selfAid) : delegation.grant.selfAid,
+                }
                 : { ok: false, code: decision.code, error: decision.reason };
         }
         ipcServer.setAgentOperationExecutor(async (argv, sessionId, delegationToken, delegationCommandHash) => {
@@ -3539,6 +3649,7 @@ async function main() {
                 chatType: delegation.grant.chatType,
                 conversationId,
                 processOwners: loadDaemonConfig().owners ?? [],
+                ...trustedExecutionIdentityInput(delegation.grant),
             });
             const decision = authorizeOperation({
                 source: 'agent-tool',
@@ -3566,7 +3677,7 @@ async function main() {
             }
             const { execAgentAction, execAgentOptions, execAgentQuery } = await import('./core/command/agent-control.js');
             if (operation === 'agent.list') {
-                const result = await execAgentOptions({ options: 'all' });
+                const result = await execAgentOptions({ options: 'all' }, agentApplicationService);
                 if ('error' in result)
                     return fail(result.code, result.error);
                 const agents = Array.isArray(result.data?.agents) ? result.data.agents.map((agent) => ({
@@ -3583,7 +3694,7 @@ async function main() {
                 return { ok: true, result: { ok: true, agents, redacted: true } };
             }
             if (operation === 'agent.show') {
-                const result = await execAgentQuery({ aid: targetAid });
+                const result = await execAgentQuery({ aid: targetAid }, agentApplicationService);
                 if ('error' in result)
                     return fail(result.code, result.error);
                 const agent = result.data ?? {};
@@ -3625,7 +3736,7 @@ async function main() {
                     return fail('INVALID_ARGS', validationError);
                 if (argv.includes('--dry-run'))
                     return { ok: true, result: { ok: true, dryRun: true, plan } };
-                const result = await agentCreateNonInteractive({
+                const createOptions = {
                     aid: plan.aid,
                     project: plan.project,
                     baseagent: plan.baseagent,
@@ -3633,22 +3744,33 @@ async function main() {
                     name: plan.name,
                     description: plan.description,
                     force: argv.includes('--force'),
-                });
+                };
+                const result = agentApplicationService
+                    ? await agentApplicationService.create(createOptions)
+                    : await agentCreateNonInteractive(createOptions);
                 return !result.ok
                     ? fail(result.code ?? 'INTERNAL', result.error)
                     : { ok: true, result: { ...result, configPath: '[redacted]' } };
             }
             if (operation === 'agent.delete') {
-                const { agentDelete } = await import('./cli/agent.js');
-                const result = await agentDelete(targetAid ?? '', argv.includes('--purge'));
+                const result = agentApplicationService
+                    ? await agentApplicationService.delete(targetAid ?? '', argv.includes('--purge'))
+                    : await (async () => {
+                        const { agentDelete } = await import('./cli/agent.js');
+                        return await agentDelete(targetAid ?? '', argv.includes('--purge'));
+                    })();
                 return 'error' in result ? fail(result.code ?? 'INTERNAL', result.error) : { ok: true, result };
             }
             if (operation === 'agent.reload' && !targetAid) {
-                const { agentReload } = await import('./cli/agent.js');
-                const result = await agentReload();
+                const result = agentApplicationService
+                    ? await agentApplicationService.reload()
+                    : await (async () => {
+                        const { agentReload } = await import('./cli/agent.js');
+                        return await agentReload();
+                    })();
                 return !result.ok ? fail(result.code ?? 'INTERNAL', result.error) : { ok: true, result };
             }
-            const result = await execAgentAction(sub, { aid: targetAid ?? taskAid, force: argv.includes('--force') }, delegation.grant.actorId, eventBus);
+            const result = await execAgentAction(sub, { aid: targetAid ?? taskAid, force: argv.includes('--force') }, delegation.grant.actorId, eventBus, agentApplicationService);
             return 'error' in result ? fail(result.code, result.error) : { ok: true, result: { ok: true, ...(result.data ?? {}) } };
         });
         ipcServer.setQueueOperationExecutor(async (params) => {
@@ -3707,12 +3829,51 @@ async function main() {
                     throw new Error(`agent not found: ${agentAid}`);
                 return agentAid;
             };
+            const auditFullAccessTriggerConfiguration = (event, definition, actor, reason) => {
+                auditFullAccessEvent({
+                    event,
+                    source: 'trigger',
+                    actorId: actor.origin.peerId,
+                    processRole: actor.daemonOwner ? 'daemon-owner' : actor.subject.processRole,
+                    authorizedBy: definition.authorizedBy,
+                    agentAid: definition.agentAid,
+                    triggerId: definition.id,
+                    reason,
+                });
+            };
+            const rejectUnapprovedFullAccessConfiguration = (definition, actor) => {
+                // A managed Agent task may carry a daemon-owner identity for ordinary
+                // scoped operations. That delegation is never a human approval for a
+                // persistent host-level Trigger; only the explicit user/menu paths may
+                // create or retain this mode.
+                const approvalSource = actor.control ? 'daemon-service' : 'agent-delegation';
+                if (definition.execution.permissionMode === 'fullaccess'
+                    && !actor.fullAccess
+                    && !canApprovePersistentFullAccessTrigger({
+                        daemonOwner: actor.daemonOwner,
+                        source: approvalSource,
+                    })) {
+                    throw new Error('persistent fullaccess Trigger requires an explicit user or management-channel action');
+                }
+            };
+            const withFullAccessConfigurationProvenance = (definition, actor) => {
+                if (definition.execution.permissionMode !== 'fullaccess') {
+                    const { authorizedBy: _authorizedBy, ...deescalated } = definition;
+                    return deescalated;
+                }
+                const authorizedBy = actor.fullAccess
+                    ? actor.subject.authorizedBy
+                    : actor.subject.principalId ?? actor.origin.peerId;
+                if (!authorizedBy)
+                    throw new Error('fullaccess Trigger approval provenance is unavailable');
+                return { ...definition, authorizedBy };
+            };
             const authorizeTrigger = async (agentAid, operation, triggerId) => {
                 const actor = await authenticatedTriggerActor(agentAid, cmd.actorSessionId, cmd.delegationToken, cmd.delegationCommandHash, cmd.controlToken);
                 const isCrossAgent = !actor.control && actor.selfAid !== agentAid;
                 if (!isCrossAgentTriggerOperationAllowed({
                     control: actor.control,
-                    daemonOwner: actor.daemonOwner,
+                    daemonOwner: actor.daemonOwner || actor.fullAccess,
                     taskAgentAid: actor.selfAid,
                     targetAgentAid: agentAid,
                     targetManagement: actor.management,
@@ -3745,7 +3906,12 @@ async function main() {
                     return actor;
                 const definition = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === triggerId);
                 const privilegedReason = definition ? daemonPrivilegedTriggerReason(definition) : undefined;
-                if (privilegedReason && !actor.daemonPrivileged) {
+                const persistedFullAccessApproval = privilegedReason === 'persistent fullaccess Trigger';
+                const deescalationOperation = operation === 'trigger.update'
+                    || operation === 'trigger.setEnabled'
+                    || operation === 'trigger.cancel'
+                    || operation === 'trigger.delete';
+                if (privilegedReason && !persistedFullAccessApproval && !actor.daemonPrivileged && !deescalationOperation) {
                     throw new Error(`${privilegedReason} requires DaemonOwner`);
                 }
                 if (actor.management)
@@ -3762,7 +3928,9 @@ async function main() {
                     const agentAid = requireAgent(cmd.agentAid);
                     const actor = await authorizeTrigger(agentAid, 'trigger.list');
                     const scheduler = schedulerFor(agentAid);
-                    const definitions = scheduler.list({ all: cmd.all === true }).filter(trigger => ((actor.daemonPrivileged || !daemonPrivilegedTriggerReason(trigger))
+                    const definitions = scheduler.list({ all: cmd.all === true }).filter(trigger => ((actor.daemonPrivileged
+                        || !daemonPrivilegedTriggerReason(trigger)
+                        || daemonPrivilegedTriggerReason(trigger) === 'persistent fullaccess Trigger')
                         && (actor.management
                             || (trigger.origin?.peerId === actor.origin?.peerId && trigger.origin?.channelKey === actor.origin?.channelKey))));
                     return { ok: true, triggers: scheduler.listItems(definitions) };
@@ -3819,11 +3987,16 @@ async function main() {
                     const agentAid = requireAgent(rawDefinition.agentAid);
                     const actor = await authorizeTrigger(agentAid, 'trigger.create');
                     const materialized = materializeTriggerCreateBaseagent({ ...rawDefinition, origin: actor.origin }, agentAid);
-                    const definition = normalizeTriggerDefinition(materialized);
+                    let definition = normalizeTriggerDefinition(materialized);
+                    rejectUnapprovedFullAccessConfiguration(definition, actor);
+                    definition = withFullAccessConfigurationProvenance(definition, actor);
                     validateTriggerDefinitionForActor(definition, actor);
                     requireAgent(definition.agentAid);
                     validateTriggerFeedbackChannels(definition);
                     const trigger = schedulerFor(definition.agentAid).create(definition, cmd.files ?? [], { enable: cmd.enable });
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, 'fullaccess Trigger created through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.update': {
@@ -3834,15 +4007,67 @@ async function main() {
                     const existing = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === cmd.triggerId);
                     if (!existing)
                         throw new Error(`trigger not found: ${cmd.triggerId}`);
+                    const rawPatch = cmd.patch && typeof cmd.patch === 'object' && !Array.isArray(cmd.patch)
+                        ? cmd.patch
+                        : {};
+                    const rawScriptFile = rawPatch.scriptFile;
+                    if (rawScriptFile !== undefined && rawScriptFile !== true) {
+                        throw new Error('scriptFile must be true');
+                    }
+                    const patchScriptFile = rawScriptFile === true;
+                    const { scriptFile: _scriptFile, ...definitionPatch } = rawPatch;
+                    const scriptFileBase64 = cmd.scriptFileBase64;
+                    if (patchScriptFile && scriptFileBase64 === undefined) {
+                        throw new Error('--script-file requires scriptFileBase64');
+                    }
+                    if (!patchScriptFile && scriptFileBase64 !== undefined) {
+                        throw new Error('scriptFileBase64 requires --script-file');
+                    }
+                    if (scriptFileBase64 !== undefined) {
+                        if (typeof scriptFileBase64 !== 'string') {
+                            throw new Error('scriptFileBase64 must be a base64 string');
+                        }
+                        if (!actor.daemonPrivileged) {
+                            throw new Error('updating a script Trigger requires DaemonOwner');
+                        }
+                        if (existing.execution.type !== 'script' || !existing.execution.script) {
+                            throw new Error('--script-file only applies to script Triggers');
+                        }
+                        if (scriptFileBase64.length > 6 * 1024 * 1024
+                            || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(scriptFileBase64)) {
+                            throw new Error('scriptFileBase64 is invalid or exceeds the 4 MiB limit');
+                        }
+                        const scriptBytes = Buffer.from(scriptFileBase64, 'base64');
+                        if (scriptBytes.length > 4 * 1024 * 1024)
+                            throw new Error('script file exceeds the 4 MiB limit');
+                    }
                     const currentRevision = definitionRevision(existing);
                     if (cmd.expectedRevision !== undefined && cmd.expectedRevision !== currentRevision) {
                         throw new Error(`trigger revision conflict: expected ${cmd.expectedRevision}, current ${currentRevision}`);
                     }
-                    const definition = applyTriggerPatch(existing, cmd.patch, { fromPromptFile: cmd.promptFile === true });
+                    let definition = Object.keys(definitionPatch).length > 0
+                        ? applyTriggerPatch(existing, definitionPatch, { fromPromptFile: cmd.promptFile === true })
+                        : existing;
+                    rejectUnapprovedFullAccessConfiguration(definition, actor);
+                    definition = withFullAccessConfigurationProvenance(definition, actor);
                     validateTriggerDefinitionForActor(definition, actor);
                     validateTriggerFeedbackChannels(definition);
                     const scheduler = schedulerFor(agentAid);
-                    const trigger = scheduler.update(cmd.triggerId, definition);
+                    const files = scriptFileBase64 !== undefined && existing.execution.script
+                        ? [{
+                                relativePath: splitScriptCommand(existing.execution.script.path).path,
+                                contentBase64: scriptFileBase64,
+                            }]
+                        : [];
+                    const trigger = scheduler.update(cmd.triggerId, definition, files);
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, existing.execution.permissionMode === 'fullaccess'
+                            ? 'fullaccess Trigger updated through IPC'
+                            : 'Trigger elevated to fullaccess through IPC');
+                    }
+                    else if (existing.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.deescalated', existing, actor, 'Trigger permissionMode changed from fullaccess through IPC');
+                    }
                     return { ok: true, trigger: scheduler.listItem(trigger), revision: definitionRevision(trigger) };
                 }
                 case 'trigger.setEnabled': {
@@ -3851,8 +4076,26 @@ async function main() {
                         throw new Error('missing triggerId');
                     if (typeof cmd.enabled !== 'boolean')
                         throw new Error('missing enabled');
-                    await authorizeTrigger(agentAid, 'trigger.setEnabled', cmd.triggerId);
-                    const trigger = schedulerFor(agentAid).setEnabled(cmd.triggerId, cmd.enabled);
+                    const actor = await authorizeTrigger(agentAid, 'trigger.setEnabled', cmd.triggerId);
+                    const existing = schedulerFor(agentAid).list({ all: true }).find(trigger => trigger.id === cmd.triggerId);
+                    if (!existing)
+                        throw new Error(`trigger not found: ${cmd.triggerId}`);
+                    if (cmd.enabled && existing.execution.permissionMode === 'fullaccess') {
+                        rejectUnapprovedFullAccessConfiguration(existing, actor);
+                        if (!isFullAccessEnabled())
+                            throw new Error('fullaccess is disabled by daemon.json');
+                        if (!actor.daemonOwner && !actor.fullAccess) {
+                            throw new Error('enabling a fullaccess Trigger requires a DaemonOwner or fullaccess-run');
+                        }
+                    }
+                    const scheduler = schedulerFor(agentAid);
+                    if (cmd.enabled && existing.execution.permissionMode === 'fullaccess') {
+                        scheduler.update(cmd.triggerId, withFullAccessConfigurationProvenance(existing, actor));
+                    }
+                    const trigger = scheduler.setEnabled(cmd.triggerId, cmd.enabled);
+                    if (cmd.enabled && trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.configured', trigger, actor, 'fullaccess Trigger enabled through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.cancel': {
@@ -3867,8 +4110,11 @@ async function main() {
                     const agentAid = requireAgent(cmd.agentAid);
                     if (!cmd.triggerId)
                         throw new Error('missing triggerId');
-                    await authorizeTrigger(agentAid, 'trigger.delete', cmd.triggerId);
+                    const actor = await authorizeTrigger(agentAid, 'trigger.delete', cmd.triggerId);
                     const trigger = schedulerFor(agentAid).delete(cmd.triggerId);
+                    if (trigger.execution.permissionMode === 'fullaccess') {
+                        auditFullAccessTriggerConfiguration('fullaccess.trigger.deescalated', trigger, actor, 'fullaccess Trigger deleted through IPC');
+                    }
                     return { ok: true, trigger };
                 }
                 case 'trigger.run': {
@@ -3936,6 +4182,13 @@ async function main() {
             }
         };
         try {
+            // ECWeb is owned by the daemon.  Stop it from the unified shutdown
+            // path as well as the signal handler so an IPC-driven `ec restart`
+            // cannot leave the old ECWeb process running after its package was
+            // upgraded on disk.
+            await shutdownStep('stop ECWeb supervisor', async () => {
+                await ecwebSupervisor?.stop();
+            });
             const queueShutdown = messageQueue.shutdownGracefully();
             await shutdownStep('cancel pending permissions', () => permissionGateway.cancelAllPending('daemon_restart'));
             await shutdownStep('wait for trigger schedulers', async () => {
@@ -3945,6 +4198,19 @@ async function main() {
                 await Promise.all([...triggerSchedulers.values()].map(scheduler => scheduler.suspendForDaemonExit()));
             });
             await shutdownStep('interrupt active message queue tasks', async () => { await queueShutdown; });
+            await shutdownStep('dispose agent runners', async () => {
+                const currentInstances = [...agentMap.entries()].map(([key, agent]) => {
+                    const split = key.lastIndexOf('::');
+                    return {
+                        evolagentName: split > 0 ? key.slice(0, split) : '<unknown>',
+                        baseagent: split > 0 ? key.slice(split + 2) : 'unknown',
+                        agent,
+                    };
+                });
+                await disposeAgentInstances(currentInstances, (instance, error) => {
+                    logger.warn(`[Shutdown] Failed to dispose runner ${instance.evolagentName}::${instance.baseagent}: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            });
             eventBus.publish({
                 type: 'system:shutdown',
                 timestamp: Date.now()