evolcore 0.0.21 → 0.0.23

package/dist/cli/model.js

@@ -13,7 +13,7 @@
 import { isHelpFlag, wantsHelp, getArgValue } from './help.js';
 import { ModelScopeError, normalizePeer, determineScope, activeBaseagent, writeScope, clearScope, } from '../core/model/config-scope.js';
 import { resolveEffectiveFieldWithSource } from '../config/config-manager.js';
-import { getCatalog, getModelInfo } from '../core/model/model-catalog.js';
+import { getCatalog, getModelInfo, catalogEfforts, resolveCatalogModel, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { constrainResolvedModelForRole, filterModelsForRole, validateModelSelectionForRole, } from '../core/model/model-permission.js';
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
@@ -23,7 +23,7 @@ import { getFieldPermission } from '../config/roles.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
 import { formatModelCheck, runModelCheck } from '../core/model/model-diagnostics.js';
 import { validateRuntimeStringFieldOverride } from '../core/role/runtime-policy.js';
-const ALL_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'auto'];
+const ALL_EFFORTS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'auto'];
 const SCOPE_LABEL = {
     global: '全局', agent: 'agent级', role: '角色级', relation: '关系级',
 };
@@ -298,7 +298,7 @@ async function cmdList(args, formatJson) {
     const cat = await getCatalog(sel.self, ba);
     const resolved = resolveModelConfig(effectiveSel, ba);
     const allowedModelIds = role
-        ? filterModelsForRole(role, ba, cat.models.map(m => m.id), undefined, sel.self)
+        ? filterModelsForRole(role, ba, cat.models.map(m => m.id), model => resolveCatalogModel(cat, model), sel.self)
         : null;
     const models = allowedModelIds
         ? allowedModelIds.map(id => cat.models.find(m => m.id === id) ?? { id })
@@ -308,15 +308,21 @@ async function cmdList(args, formatJson) {
         effective: { model: resolved.model ?? null, source: resolved.source ?? null },
         role: role ?? null,
         catalogSource: cat.source,
+        freshness: cat.freshness,
+        revision: cat.revision,
+        fetchedAt: cat.fetchedAt,
+        diagnostics: cat.diagnostics,
         models,
     }, () => {
         const lines = [];
         lines.push(`当前生效: ${resolved.model ?? '(未设置，回落 SDK 默认)'}` +
             (resolved.source ? `  (来源: ${SCOPE_LABEL[resolved.source]})` : ''));
         lines.push('');
-        const srcTag = cat.source === 'mock' ? ' [mock]'
-            : cat.source === 'remote' ? ' [remote]'
-                : '';
+        if (resolved.model && !cat.models.some(m => m.id === resolved.model))
+            lines.push('当前配置未列入目录');
+        lines.push(...cat.diagnostics.map(d => d.message));
+        const srcTag = cat.freshness === 'fallback' ? ` [${cat.source}/unverified]`
+            : cat.freshness === 'stale' ? ' [stale]' : '';
         lines.push(`可用模型 (${models.length})${srcTag}:`);
         for (const e of models) {
             const live = resolved.model === e.id ? '✓' : ' ';
@@ -430,6 +436,7 @@ async function cmdUse(args, formatJson) {
     const ba = activeBaseagent(sel.self);
     // 校验模型在 catalog 中
     const cat = await getCatalog(sel.self, ba);
+    assertCatalogSelectable(cat);
     if (!cat.models.some(m => m.id === modelId)) {
         fail(formatJson, 'UNKNOWN_MODEL', `模型不在目录中: ${modelId}（model list 查看可用模型）`);
     }
@@ -439,14 +446,15 @@ async function cmdUse(args, formatJson) {
             baseagent: ba,
             requestedModel: modelId,
             models: cat.models.map(m => m.id),
+            resolveModelId: model => resolveCatalogModel(cat, model),
             selfAid: sel.self,
         });
         if (!decision.ok)
             fail(formatJson, decision.code || 'MODEL_NOT_ALLOWED', decision.message || `model not allowed: ${modelId}`);
     }
     const effort = getArgValue(args, '--effort');
-    if (effort !== undefined && !ALL_EFFORTS.includes(effort)) {
-        fail(formatJson, 'INVALID_EFFORT', `无效推理强度: ${effort}（${ALL_EFFORTS.join('/')})`);
+    if (effort !== undefined && effort !== 'auto' && !catalogEfforts(cat, modelId, ba).includes(effort)) {
+        fail(formatJson, 'INVALID_EFFORT', `当前模型目录未声明支持推理强度: ${effort}`);
     }
     const effortVal = effort === 'auto' ? null : (effort ?? undefined);
     if (isManagedTargetedWriteEnv(args)) {
@@ -492,6 +500,13 @@ async function cmdEffort(args, formatJson) {
     const scope = determineWriteScope(sel, formatJson);
     const ba = activeBaseagent(sel.self);
     const val = level === 'auto' ? null : level;
+    if (val) {
+        const cat = await getCatalog(sel.self, ba);
+        assertCatalogSelectable(cat);
+        const model = resolveModelConfig(selectorWithRole(sel, explicitOrDerivedRole(args, sel)), ba).model;
+        if (!model || !catalogEfforts(cat, model, ba).includes(val))
+            fail(formatJson, 'INVALID_EFFORT', `当前模型目录未声明支持推理强度: ${val}`);
+    }
     if (isManagedTargetedWriteEnv(args)) {
         const effortKey = 'effort';
         preflightManagedFieldOverride(sel, explicitOrDerivedRole(args, sel), `baseagents.${ba}.${effortKey}`, val, formatJson);

package/dist/cli/task-context.js

@@ -6,6 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
 export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
+export const DAEMON_RUNTIME_EPOCH_ENV = 'EVOLCORE_DAEMON_RUNTIME_EPOCH';
 export { RUNTIME_LOCK_DIR_ENV };
 const generatedProcessManagedTempDirs = new Set();
 let processTempCleanupRegistered = false;
@@ -32,11 +33,13 @@ function normalizeTaskRuntimeContext(value) {
         peerName: optionalString(value.peerName),
         peerType: optionalString(value.peerType),
         peerRole: optionalString(value.peerRole),
+        permissionMode: optionalString(value.permissionMode),
         processRole: optionalProcessRole(value.processRole),
         dataScope: optionalDataScope(value.dataScope),
         authorizedBy: optionalString(value.authorizedBy),
         executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
             ? value.executionSource : undefined,
+        daemonRuntimeEpoch: optionalString(value.daemonRuntimeEpoch),
         threadId: optionalString(value.threadId),
         sessionRuntimeDir: optionalAbsolutePath(value.sessionRuntimeDir),
         runtimeLockDir: optionalAbsolutePath(value.runtimeLockDir),
@@ -250,8 +253,18 @@ export function getManagedTaskTempDir(runtimeEnv) {
  * silently escape the session-owned temporary workspace.
  */
 export function ensureSessionRuntimeDir(sessionId) {
-    const base = process.env.TMPDIR?.trim();
-    if (!base || !path.isAbsolute(base) || !sessionId)
+    if (!sessionId)
+        return undefined;
+    let base = process.env.TMPDIR?.trim();
+    try {
+        if (!base || !path.isAbsolute(base) || !isPrivateDirectory(path.resolve(base))) {
+            base = ensureProcessManagedTempDir();
+        }
+    }
+    catch {
+        return undefined;
+    }
+    if (!base || !path.isAbsolute(base))
         return undefined;
     const root = path.resolve(base);
     const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
@@ -336,6 +349,7 @@ export function buildTaskRuntimeEnv(ctx) {
     const clean = normalizeTaskRuntimeContext(ctx);
     return {
         EVOLCORE_SESSION_ID: ctx.sessionId ?? '',
+        ...(ctx.daemonRuntimeEpoch ? { [DAEMON_RUNTIME_EPOCH_ENV]: ctx.daemonRuntimeEpoch } : {}),
         [TASK_RUNTIME_CONTEXT_ENV]: JSON.stringify(clean),
         // Every managed child receives the session directory as TMPDIR. This keeps
         // ordinary temporary files and runtime-only fallbacks out of shared agent

package/dist/cli/trigger-command.js

@@ -32,7 +32,7 @@ export async function cmdTrigger(args) {
         return;
     }
     if (process.env.EVOLCORE_SESSION_ID
-        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path'))) {
+        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path') || hasOption(rest, '--script-file'))) {
         throw new Error('Managed tasks cannot read trigger definitions, prompts, or scripts from local files; use inline prompt content');
     }
     try {
@@ -121,12 +121,20 @@ Create 参数模式支持:
 通用输出参数:
   --json | --format json
 
-Update 仅支持常用字段:
+Update 参数:
   --once | --delay | --at | --cron | --every | --event [--tz]
-  --prompt <文本> | --prompt-file <路径>  --name <名称>
+  --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
+  --description <文本>  (空字符串删除)
   --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
   --max-runs <次数>  --max-duration <时长>
   --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
+  --feedback <origin|target|silent>
+  --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
+  --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
+  --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
+  --on-error <fail|retry>  --noop-sentinel <文本>
+  --retry-attempts <次数>  --retry-backoff <毫秒>
+  --script-runtime <node|python|bash>  --script-args <JSON>  --script-timeout <时长>
 
 省略 --agent 时使用当前 agent AID；无会话上下文或跨身份操作时需要显式指定。
 任务会话中的跨身份操作仅允许目标 Agent 上具备 owner/admin 权限的调用者执行 list/show/history；创建、修改、启停、删除和运行仍只允许当前 Agent。`);
@@ -399,19 +407,28 @@ function shellQuoteArg(value) {
 }
 async function updateTrigger(args, json) {
     const agentAid = resolveAgentAid(args);
-    const triggerId = positional(args, 0, ['--agent', '--format', '--if-revision', '--prompt-file']);
+    const triggerId = positional(args, 0, ['--agent', '--format', '--if-revision', '--prompt-file', '--script-file']);
     const usesPromptFile = hasOption(args, '--prompt-file');
+    const usesScriptFile = hasOption(args, '--script-file');
+    const scriptFilePath = usesScriptFile ? requireFlag(args, '--script-file') : undefined;
     const { parseTriggerUpdateArgv } = await import('../trigger/parser.js');
     const parsed = parseTriggerUpdateArgv(triggerId, withPromptFromFile(triggerUpdateArgs(args)), { allowLongPrompt: usesPromptFile });
     if (!parsed.ok)
         throw new Error(parsed.error);
+    const scriptFileRequested = parsed.value.scriptFile !== undefined;
+    const { scriptFile: _scriptFile, ...patchFields } = parsed.value;
+    const patch = scriptFileRequested ? { ...patchFields, scriptFile: true } : patchFields;
     const expectedRevision = flagValue(args, '--if-revision');
+    const scriptFileBase64 = scriptFilePath
+        ? fs.readFileSync(scriptFilePath).toString('base64')
+        : undefined;
     const res = await request({
         type: 'trigger.update',
         agentAid,
         triggerId,
-        patch: parsed.value,
+        patch,
         ...(usesPromptFile ? { promptFile: true } : {}),
+        ...(scriptFileBase64 !== undefined ? { scriptFileBase64 } : {}),
         ...(expectedRevision ? { expectedRevision } : {}),
     }, 30_000);
     if (json)

package/dist/config/config-field-policy.js

@@ -2,6 +2,7 @@ const BEHAVIOR_TOP_FIELDS = new Set([
     'active_baseagent',
     'chatmode',
     'mentionMode',
+    'groupSlashRequireMentions',
     'responseMode',
     'responseModeParams',
     'flush_delay',
@@ -110,6 +111,8 @@ export function resolveConfigFieldRule(fieldPath) {
         return scalar(field, 'nonnegative-number');
     if (field === 'mentionMode')
         return scalar(field, 'mention-mode');
+    if (field === 'groupSlashRequireMentions')
+        return scalar(field, 'boolean');
     if (field === 'show_activities')
         return scalar(field, 'show-activities');
     if (field === 'enable_rich_content')

package/dist/config/config-manager.js

@@ -933,7 +933,10 @@ function acquireConfigMutationLock(file) {
                 return () => releaseConfigMutationLock(lockDir, ownerFile, token);
             }
             catch (error) {
-                if (error?.code !== 'EEXIST' && error?.code !== 'ENOTEMPTY')
+                const lockMayAlreadyExist = error?.code === 'EEXIST'
+                    || error?.code === 'ENOTEMPTY'
+                    || (process.platform === 'win32' && error?.code === 'EPERM' && fs.existsSync(lockDir));
+                if (!lockMayAlreadyExist)
                     throw error;
                 if (reclaimStaleConfigMutationLock(lockDir, ownerFile))
                     continue;
@@ -957,10 +960,10 @@ function reclaimStaleConfigMutationLock(lockDir, ownerFile) {
         pid = Number(JSON.parse(raw).pid);
     }
     catch {
-        return false;
+        return reclaimCorruptConfigMutationLock(lockDir);
     }
     if (!Number.isInteger(pid) || pid <= 0)
-        return false;
+        return reclaimCorruptConfigMutationLock(lockDir);
     try {
         process.kill(pid, 0);
         return false;
@@ -979,6 +982,24 @@ function reclaimStaleConfigMutationLock(lockDir, ownerFile) {
         }
     }
 }
+function reclaimCorruptConfigMutationLock(lockDir) {
+    try {
+        const stat = fs.statSync(lockDir);
+        if (Date.now() - stat.mtimeMs < CONFIG_MUTATION_LOCK_WAIT_MS)
+            return false;
+        const reclaimed = `${lockDir}.reclaimed-corrupt-${crypto.randomBytes(8).toString('hex')}`;
+        fs.renameSync(lockDir, reclaimed);
+        fs.rmSync(reclaimed, { recursive: true, force: true });
+        return true;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return true;
+        if (error?.code === 'EEXIST' || error?.code === 'ENOTEMPTY' || error?.code === 'EPERM')
+            return false;
+        throw error;
+    }
+}
 function releaseConfigMutationLock(lockDir, ownerFile, token) {
     try {
         const owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8'));
@@ -1289,9 +1310,13 @@ function stripStaticOwnerField(config) {
         return config;
     if (!Object.prototype.hasOwnProperty.call(config, 'owners')
         && !Object.prototype.hasOwnProperty.call(config, 'admins')
-        && !Object.prototype.hasOwnProperty.call(config, 'access'))
+        && !Object.prototype.hasOwnProperty.call(config, 'access')
+        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions'))
         return config;
-    const { owners: _owners, admins: _admins, access: _access, ...rest } = config;
+    // groupSlashRequireMentions is intentionally Agent-only. Relation/defaults
+    // files allow forward-compatible unknown properties, so strip it before the
+    // generic merge chain can treat a manually written value as an override.
+    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -1330,6 +1355,7 @@ export function resolveEffective(sel, opts = {}) {
         baseagents: config.baseagents,
         chatmode: config.chatmode,
         mentionMode: config.mentionMode,
+        groupSlashRequireMentions: config.groupSlashRequireMentions ?? true,
         model: config.model,
         responseMode: config.responseMode,
         responseModeParams: config.responseModeParams,
@@ -1361,6 +1387,7 @@ const EFFECTIVE_BEHAVIOR_FIELDS = [
     'baseagents',
     'chatmode',
     'mentionMode',
+    'groupSlashRequireMentions',
     'flush_delay',
     'debounce',
     'show_activities',

package/dist/config/contact-book-store.js

@@ -14,6 +14,7 @@ const LOCK_NAME = '.contact-book-mutation.lock';
 const JOURNAL_NAME = '.contact-book-mutation.json';
 const LOCK_WAIT_MS = 5_000;
 const LOCK_RETRY_MS = 20;
+const CORRUPT_LOCK_STALE_MS = LOCK_WAIT_MS;
 export const EMPTY_CONTACT_REVISION = crypto.createHash('sha256').update('').digest('hex');
 export class ContactMutationError extends Error {
     code;
@@ -454,7 +455,10 @@ function acquireAgentLock(selfAid) {
                 return () => releaseAgentLock(lockDir, ownerFile, lockToken);
             }
             catch (error) {
-                if (error?.code !== 'EEXIST' && error?.code !== 'ENOTEMPTY')
+                const lockMayAlreadyExist = error?.code === 'EEXIST'
+                    || error?.code === 'ENOTEMPTY'
+                    || (process.platform === 'win32' && error?.code === 'EPERM' && fs.existsSync(lockDir));
+                if (!lockMayAlreadyExist)
                     throw error;
                 if (removeStaleLock(lockDir, ownerFile))
                     continue;
@@ -478,10 +482,10 @@ function removeStaleLock(lockDir, ownerFile) {
         pid = Number(JSON.parse(rawOwner).pid);
     }
     catch {
-        return false;
+        return reclaimCorruptLock(lockDir);
     }
     if (!Number.isInteger(pid) || pid <= 0)
-        return false;
+        return reclaimCorruptLock(lockDir);
     try {
         process.kill(pid, 0);
         return false;
@@ -503,6 +507,24 @@ function removeStaleLock(lockDir, ownerFile) {
         }
     }
 }
+function reclaimCorruptLock(lockDir) {
+    try {
+        const stat = fs.statSync(lockDir);
+        if (Date.now() - stat.mtimeMs < CORRUPT_LOCK_STALE_MS)
+            return false;
+        const staleClaim = `${lockDir}.reclaimed-corrupt-${crypto.randomBytes(8).toString('hex')}`;
+        fs.renameSync(lockDir, staleClaim);
+        fs.rmSync(staleClaim, { recursive: true, force: true });
+        return true;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return true;
+        if (error?.code === 'EEXIST' || error?.code === 'ENOTEMPTY' || error?.code === 'EPERM')
+            return false;
+        throw error;
+    }
+}
 function releaseAgentLock(lockDir, ownerFile, lockToken) {
     try {
         const owner = JSON.parse(fs.readFileSync(ownerFile, 'utf8'));

package/dist/config/schema-migration.js

@@ -342,8 +342,20 @@ function processIsAlive(pid) {
 function assertDaemonStopped(home) {
     const candidates = [];
     const pidFile = path.join(home, 'daemon.pid');
-    if (fs.existsSync(pidFile)) {
-        candidates.push({ pid: Number(fs.readFileSync(pidFile, 'utf8').trim()), source: pidFile });
+    try {
+        // daemon.pid was retired in favor of the instance registry.  It may still
+        // exist as a stale legacy file, but a Windows Codex sandbox can also leave
+        // a directory at this path when protecting a not-yet-created file.  Never
+        // feed a directory (or symlink) to readFileSync: that turns harmless
+        // legacy residue into an EISDIR startup failure.
+        const stat = fs.lstatSync(pidFile);
+        if (stat.isFile()) {
+            candidates.push({ pid: Number(fs.readFileSync(pidFile, 'utf8').trim()), source: pidFile });
+        }
+    }
+    catch (error) {
+        if (!isRecord(error) || error.code !== 'ENOENT')
+            throw error;
     }
     const instanceDir = path.join(home, 'data', 'instance');
     if (fs.existsSync(instanceDir)) {

package/dist/core/auth/agent-delegation.js

@@ -1,12 +1,17 @@
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+import { logger } from '../../utils/logger.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
 export class AgentDelegationRegistry {
+    runtimeEpoch = crypto.randomBytes(16).toString('hex');
     grantsByHash = new Map();
     activeHashBySession = new Map();
     approvedCommands = new Map();
+    getRuntimeEpoch() {
+        return this.runtimeEpoch;
+    }
     issue(input) {
         if (input.executionIdentity && !isValidFullAccessExecutionIdentity(input.executionIdentity)) {
             throw new Error('invalid fullaccess task execution identity');
@@ -24,6 +29,7 @@ export class AgentDelegationRegistry {
                 ok: false,
                 code: 'DELEGATION_REQUIRED',
                 reason: 'An active task delegation token is required',
+                diagnosticCause: 'missing_token',
             };
         }
         const tokenHash = hashDelegationToken(token);
@@ -38,10 +44,19 @@ export class AgentDelegationRegistry {
             : undefined;
         if (approved)
             return { ok: true, grant: approved };
+        const diagnosticCause = grant
+            ? grant.sessionId !== sessionId
+                ? 'session_mismatch'
+                : 'task_replaced'
+            : commandHash
+                ? 'approved_command_unavailable'
+                : 'unknown_token';
+        logger.warn(`[AgentDelegation] validate failed: cause=${diagnosticCause} session=${sessionId} grantSession=${grant?.sessionId ?? 'none'} taskId=${grant?.taskId ?? 'none'} hasCommandHash=${!!commandHash} tokenKnown=${!!grant} activeForSession=${this.activeHashBySession.get(sessionId) ?? 'none'} grantTokenHash=${grant?.tokenHash ?? 'none'}`);
         return {
             ok: false,
             code: 'INVALID_DELEGATION',
             reason: 'The task delegation token is invalid, revoked, or belongs to another session',
+            diagnosticCause,
         };
     }
     armApprovedCommand(input) {

package/dist/core/auth/auth-gateway.js

@@ -192,6 +192,14 @@ function auditDecision(params, decision) {
         permissionMode: params.auditMetadata?.permissionMode
             ?? (decision.allow ? decision.permissionMode ?? params.subject.permissionMode : params.subject.permissionMode),
         toolName: params.auditMetadata?.toolName,
+        errorCode: params.auditMetadata?.errorCode
+            ?? (decision.allow
+                ? undefined
+                : params.auditMetadata?.decisionSource === 'approval'
+                    ? 'USER_DENIED'
+                    : params.auditMetadata?.decisionSource === 'infrastructure'
+                        ? 'EXECUTION_FAILED'
+                        : 'POLICY_DENIED'),
         policyCode: params.auditMetadata?.policyCode ?? (decision.allow ? undefined : decision.code),
         decisionSource: params.auditMetadata?.decisionSource ?? (decision.allow ? 'command' : 'policy'),
         source: params.source,

package/dist/core/auth/authorization-audit.js

@@ -2,7 +2,7 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
-import { buildAuthorizationEventKey } from '../audit/event-key.js';
+import { buildAuthorizationEventKey, buildToolLifecycleEventKey } from '../audit/event-key.js';
 import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
@@ -95,10 +95,20 @@ export function auditFullAccessEvent(input) {
  * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
  */
 export function auditToolPreflightDenial(input) {
+    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        callId: input.requestId,
-        correlationId: input.requestId,
+        ...(lifecycleId ? {
+            eventKey: buildToolLifecycleEventKey({
+                sessionId: input.sessionId,
+                callId: input.callId,
+                correlationId: input.correlationId,
+                requestId: input.requestId,
+            }),
+            eventPhase: 'preflight',
+        } : {}),
+        callId: input.callId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
@@ -107,6 +117,7 @@ export function auditToolPreflightDenial(input) {
         executed: false,
         executionState: 'blocked',
         decisionSource: 'policy',
+        errorCode: 'POLICY_DENIED',
         toolName: input.toolName,
         policyCode: input.policyCode,
         protectionClass: input.protectionClass ?? protectionClassForPolicy(input.policyCode),
@@ -135,9 +146,19 @@ export function auditToolPreflightDenial(input) {
  * decision source make policy, user, and infrastructure denials distinct.
  */
 export function auditCodexApprovalDecision(input) {
+    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        callId: input.correlationId ?? input.requestId,
+        ...(lifecycleId ? {
+            eventKey: buildToolLifecycleEventKey({
+                sessionId: input.sessionId,
+                callId: input.callId,
+                correlationId: input.correlationId,
+                requestId: input.requestId,
+            }),
+            eventPhase: 'approval',
+        } : {}),
+        callId: input.callId ?? input.correlationId ?? input.requestId,
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
@@ -146,8 +167,11 @@ export function auditCodexApprovalDecision(input) {
         executed: false,
         executionState: input.decision === 'allow' ? 'authorized' : 'blocked',
         decisionSource: input.decisionSource,
+        errorCode: input.decision === 'deny'
+            ? input.decisionSource === 'approval' ? 'USER_DENIED' : input.decisionSource === 'policy' ? 'POLICY_DENIED' : infrastructureErrorCode(input.policyCode)
+            : undefined,
         requestId: input.requestId,
-        correlationId: input.correlationId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -161,6 +185,9 @@ export function auditCodexApprovalDecision(input) {
         taskId: input.taskId,
         argsSummary: {
             method: input.method,
+            ...(input.summary ? { summary: input.summary } : {}),
+            ...(input.threadId ? { threadId: input.threadId } : {}),
+            ...(input.cwd ? { cwd: input.cwd } : {}),
             ...(input.parseFailure ? { parseFailure: input.parseFailure } : {}),
         },
     });
@@ -183,12 +210,18 @@ export function auditPermissionDecision(input) {
         toolName: input.toolName,
         policyCode: input.policyCode,
         decisionSource: input.decisionSource,
+        errorCode: input.decisionSource === 'approval'
+            ? 'USER_DENIED'
+            : input.decisionSource === 'policy'
+                ? 'POLICY_DENIED'
+                : infrastructureErrorCode(input.policyCode),
         source: 'agent-tool',
         operation: 'permission.runtime',
         scope: 'filesystem',
         dangerous: false,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
+        argsSummary: input.summary ? { summary: input.summary } : undefined,
         decision: 'deny',
         executed: false,
         executionState: 'blocked',
@@ -205,6 +238,7 @@ export function auditToolInfrastructureFailure(input) {
         dangerous: false,
         decision: 'deny',
         decisionSource: 'infrastructure',
+        errorCode: infrastructureErrorCode(input.policyCode),
         executed: false,
         executionState: 'blocked',
         callId: input.callId,
@@ -224,8 +258,26 @@ export function auditToolInfrastructureFailure(input) {
             : undefined,
     });
 }
+function infrastructureErrorCode(policyCode) {
+    const code = String(policyCode ?? '').toLowerCase();
+    if (/delegat|carrier|not.?armed/.test(code))
+        return 'DELEGATION_FAILED';
+    if (/capability|sandbox|unavailable|workspace_unknown/.test(code))
+        return 'CAPABILITY_UNAVAILABLE';
+    if (/argument|canonical|quote|shell|parse|invalid/.test(code))
+        return 'INVALID_ARGUMENT';
+    return 'EXECUTION_FAILED';
+}
 function buildAuditRecord(event) {
     const executed = event.executed ?? false;
+    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : 'command');
+    const errorCode = event.errorCode ?? (event.decision === 'deny'
+        ? decisionSource === 'approval'
+            ? 'USER_DENIED'
+            : decisionSource === 'policy'
+                ? 'POLICY_DENIED'
+                : 'EXECUTION_FAILED'
+        : undefined);
     const executionState = event.executionState
         ?? (event.decision === 'deny'
             ? 'blocked'
@@ -244,6 +296,7 @@ function buildAuditRecord(event) {
                 operation: event.operation,
             })
             : undefined),
+        eventPhase: event.eventPhase,
         callId: event.callId,
         correlationId: event.correlationId ?? event.requestId,
         requestId: event.requestId,
@@ -253,10 +306,15 @@ function buildAuditRecord(event) {
         permissionMode: normalizeAuditPermissionMode(event.permissionMode),
         toolName: event.toolName,
         approvalMethod: event.approvalMethod,
+        errorCode,
         policyCode: event.policyCode ?? event.code,
         protectionClass: event.protectionClass,
         matchedPath: event.matchedPath,
-        decisionSource: event.decisionSource,
+        decisionSource,
+        ecwebRequestId: event.ecwebRequestId,
+        targetAgentAid: redactIdentifier(event.targetAgentAid),
+        endpoint: event.endpoint,
+        logicalToolName: event.logicalToolName,
         source: event.source,
         operation: event.operation,
         scope: event.scope,
@@ -343,11 +401,17 @@ function logAuditEvent(record) {
         record.callId ? `call=${record.callId}` : null,
         record.correlationId ? `correlation=${record.correlationId}` : null,
         record.eventKey ? `eventKey=${record.eventKey}` : null,
+        record.eventPhase ? `eventPhase=${record.eventPhase}` : null,
         record.sessionId ? `session=${record.sessionId}` : null,
         record.agentName ? `agentName=${JSON.stringify(record.agentName)}` : null,
         record.agentAid ? `agent=${record.agentAid}` : null,
         record.permissionMode ? `permissionMode=${record.permissionMode}` : null,
         record.toolName ? `tool=${record.toolName}` : null,
+        record.errorCode ? `errorCode=${record.errorCode}` : null,
+        record.ecwebRequestId ? `ecwebRequest=${record.ecwebRequestId}` : null,
+        record.targetAgentAid ? `targetAgent=${record.targetAgentAid}` : null,
+        record.endpoint ? `endpoint=${JSON.stringify(record.endpoint)}` : null,
+        record.logicalToolName ? `logicalTool=${record.logicalToolName}` : null,
         record.policyCode ? `policy=${record.policyCode}` : null,
         record.protectionClass ? `protectionClass=${record.protectionClass}` : null,
         record.matchedPath ? `matchedPath=${JSON.stringify(record.matchedPath)}` : null,

package/dist/core/auth/operation-catalog.js

@@ -38,6 +38,10 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     ['ec.group.join', 'write-agent', ['agent'], 'Request to join a group'],
     ['ec.group.leave', 'write-agent', ['agent'], 'Leave a group'],
     ['ec.group.invite', 'write-agent', ['agent'], 'Invite group members'],
+    ['ec.group.invites', 'read', ['agent'], 'List pending targeted group invitations'],
+    ['ec.group.accept-invite', 'write-agent', ['agent'], 'Accept a targeted group invitation'],
+    ['ec.group.reject-invite', 'write-agent', ['agent'], 'Reject a targeted group invitation'],
+    ['ec.group.revoke-invite', 'write-agent', ['agent'], 'Revoke a targeted group invitation'],
     ['ec.group.kick', 'write-agent', ['agent'], 'Remove a group member'],
     ['ec.group.role', 'write-agent', ['agent'], 'Change a group member role'],
     ['ec.group.owner', 'write-agent', ['agent'], 'Transfer group ownership'],