evolcore 0.0.22 → 0.0.24

package/dist/cli/task-context.js

@@ -253,8 +253,18 @@ export function getManagedTaskTempDir(runtimeEnv) {
  * silently escape the session-owned temporary workspace.
  */
 export function ensureSessionRuntimeDir(sessionId) {
-    const base = process.env.TMPDIR?.trim();
-    if (!base || !path.isAbsolute(base) || !sessionId)
+    if (!sessionId)
+        return undefined;
+    let base = process.env.TMPDIR?.trim();
+    try {
+        if (!base || !path.isAbsolute(base) || !isPrivateDirectory(path.resolve(base))) {
+            base = ensureProcessManagedTempDir();
+        }
+    }
+    catch {
+        return undefined;
+    }
+    if (!base || !path.isAbsolute(base))
         return undefined;
     const root = path.resolve(base);
     const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);

package/dist/cli/trigger-command.js

@@ -121,12 +121,20 @@ Create 参数模式支持:
 通用输出参数:
   --json | --format json
 
-Update 仅支持常用字段:
+Update 参数:
   --once | --delay | --at | --cron | --every | --event [--tz]
   --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
+  --description <文本>  (空字符串删除)
   --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
   --max-runs <次数>  --max-duration <时长>
   --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
+  --feedback <origin|target|silent>
+  --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
+  --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
+  --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
+  --on-error <fail|retry>  --noop-sentinel <文本>
+  --retry-attempts <次数>  --retry-backoff <毫秒>
+  --script-runtime <node|python|bash>  --script-args <JSON>  --script-timeout <时长>
 
 省略 --agent 时使用当前 agent AID；无会话上下文或跨身份操作时需要显式指定。
 任务会话中的跨身份操作仅允许目标 Agent 上具备 owner/admin 权限的调用者执行 list/show/history；创建、修改、启停、删除和运行仍只允许当前 Agent。`);

package/dist/config/builtin-roles.js

@@ -48,6 +48,8 @@ export function getManagementCommandPermissions(role) {
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },
         'role.policy.write': { allow: true, dangerous: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'ec.aid.show': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.aid.lookup': { allow: true, scopes: ['agent'] },
+        'ec.aid.agentmd.get': { allow: true, scopes: ['agent'] },
         'ec.aid.agentmd.put': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
         'ec.fs.mkdir': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         'ec.fs.upload': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },

package/dist/config/schema-migration.js

@@ -342,8 +342,20 @@ function processIsAlive(pid) {
 function assertDaemonStopped(home) {
     const candidates = [];
     const pidFile = path.join(home, 'daemon.pid');
-    if (fs.existsSync(pidFile)) {
-        candidates.push({ pid: Number(fs.readFileSync(pidFile, 'utf8').trim()), source: pidFile });
+    try {
+        // daemon.pid was retired in favor of the instance registry.  It may still
+        // exist as a stale legacy file, but a Windows Codex sandbox can also leave
+        // a directory at this path when protecting a not-yet-created file.  Never
+        // feed a directory (or symlink) to readFileSync: that turns harmless
+        // legacy residue into an EISDIR startup failure.
+        const stat = fs.lstatSync(pidFile);
+        if (stat.isFile()) {
+            candidates.push({ pid: Number(fs.readFileSync(pidFile, 'utf8').trim()), source: pidFile });
+        }
+    }
+    catch (error) {
+        if (!isRecord(error) || error.code !== 'ENOENT')
+            throw error;
     }
     const instanceDir = path.join(home, 'data', 'instance');
     if (fs.existsSync(instanceDir)) {

package/dist/core/auth/agent-delegation.js

@@ -1,6 +1,7 @@
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+import { logger } from '../../utils/logger.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
 export class AgentDelegationRegistry {
@@ -43,17 +44,19 @@ export class AgentDelegationRegistry {
             : undefined;
         if (approved)
             return { ok: true, grant: approved };
+        const diagnosticCause = grant
+            ? grant.sessionId !== sessionId
+                ? 'session_mismatch'
+                : 'task_replaced'
+            : commandHash
+                ? 'approved_command_unavailable'
+                : 'unknown_token';
+        logger.warn(`[AgentDelegation] validate failed: cause=${diagnosticCause} session=${sessionId} grantSession=${grant?.sessionId ?? 'none'} taskId=${grant?.taskId ?? 'none'} hasCommandHash=${!!commandHash} tokenKnown=${!!grant} activeForSession=${this.activeHashBySession.get(sessionId) ?? 'none'} grantTokenHash=${grant?.tokenHash ?? 'none'}`);
         return {
             ok: false,
             code: 'INVALID_DELEGATION',
             reason: 'The task delegation token is invalid, revoked, or belongs to another session',
-            diagnosticCause: grant
-                ? grant.sessionId !== sessionId
-                    ? 'session_mismatch'
-                    : 'task_replaced'
-                : commandHash
-                    ? 'approved_command_unavailable'
-                    : 'unknown_token',
+            diagnosticCause,
         };
     }
     armApprovedCommand(input) {

package/dist/core/auth/auth-gateway.js

@@ -33,10 +33,11 @@ export function buildAuthSubject(input) {
         && fullAccessAuthorization.processRole === 'fullaccess-run'
         && fullAccessAuthorization.dataScope === 'daemon';
     const isDaemonService = input.trustedProcessRole === 'daemon-service';
-    const isDaemonOwner = !isDaemonService && !isFullAccessRun && isProcessOwner({
+    const isTrustedDaemonOwner = input.trustedProcessRole === 'daemon-owner';
+    const isDaemonOwner = !isDaemonService && !isFullAccessRun && (isTrustedDaemonOwner || isProcessOwner({
         actor: roleDetail.actor,
         processOwners,
-    });
+    }));
     const suppliedRole = input.identity?.role && input.identity.role !== 'none' ? input.identity.role : undefined;
     const role = suppliedRole ?? roleDetail.effectiveRole ?? 'none';
     const processRole = isFullAccessRun

package/dist/core/auth/authorization-audit.js

@@ -10,6 +10,8 @@ export function auditCommandAuthorization(event) {
         (event.decision === 'allow' && event.dangerous) ||
         (event.source === 'agent-tool' && event.operation.startsWith('config.')) ||
         event.operation === 'codex.approval' ||
+        event.operation === 'permission.approval' ||
+        event.operation === 'permission.runtime' ||
         event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
         event.operation === 'cli.exec.raw';
@@ -185,6 +187,9 @@ export function auditCodexApprovalDecision(input) {
         taskId: input.taskId,
         argsSummary: {
             method: input.method,
+            ...(input.summary ? { summary: input.summary } : {}),
+            ...(input.threadId ? { threadId: input.threadId } : {}),
+            ...(input.cwd ? { cwd: input.cwd } : {}),
             ...(input.parseFailure ? { parseFailure: input.parseFailure } : {}),
         },
     });
@@ -195,32 +200,78 @@ export function auditCodexApprovalDecision(input) {
  * infrastructure denials without parsing localized log text.
  */
 export function auditPermissionDecision(input) {
-    auditCommandAuthorization({
-        ts: Date.now(),
-        callId: input.requestId,
-        correlationId: input.requestId,
-        requestId: input.requestId,
+    const requestId = input.requestId ?? `perm-audit-${crypto.randomUUID()}`;
+    auditPermissionLifecycle({
+        phase: 'final',
+        requestId,
         sessionId: input.sessionId,
         agentAid: input.agentAid,
         agentName: input.agentName,
         permissionMode: input.permissionMode,
         toolName: input.toolName,
+        decision: 'deny',
+        decisionSource: input.decisionSource,
+        policyCode: input.policyCode,
+        reason: input.reason,
+        role: input.role,
+        taskId: input.taskId,
+        summary: input.summary,
+        operation: 'permission.runtime',
+    });
+}
+/**
+ * Emit a canonical request/response/final lifecycle for runtime approvals.
+ * All three phases share one eventKey and complete correlation fields so
+ * daily analysis can group them without parsing runner-specific log text.
+ */
+export function auditPermissionLifecycle(input) {
+    const sessionId = input.sessionId ?? 'unknown';
+    auditCommandAuthorization({
+        ts: Date.now(),
+        eventKey: buildToolLifecycleEventKey({
+            sessionId,
+            callId: input.callId,
+            correlationId: input.correlationId,
+            requestId: input.requestId,
+        }),
+        eventPhase: input.phase,
+        callId: input.callId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
+        requestId: input.requestId,
+        sessionId,
+        agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
+        permissionMode: input.permissionMode ?? 'unknown',
+        toolName: input.toolName,
+        approvalMethod: input.approvalMethod,
         policyCode: input.policyCode,
         decisionSource: input.decisionSource,
-        errorCode: input.decisionSource === 'approval'
-            ? 'USER_DENIED'
-            : input.decisionSource === 'policy'
-                ? 'POLICY_DENIED'
-                : infrastructureErrorCode(input.policyCode),
+        errorCode: input.decision === 'deny'
+            ? input.decisionSource === 'approval'
+                ? 'USER_DENIED'
+                : input.decisionSource === 'policy'
+                    ? 'POLICY_DENIED'
+                    : infrastructureErrorCode(input.policyCode)
+            : undefined,
         source: 'agent-tool',
-        operation: 'permission.runtime',
+        operation: input.operation ?? 'permission.approval',
         scope: 'filesystem',
         dangerous: false,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        decision: 'deny',
+        argsSummary: input.summary || input.response
+            ? {
+                ...(input.summary ? { summary: input.summary } : {}),
+                ...(input.response ? { response: input.response } : {}),
+            }
+            : undefined,
+        decision: input.decision,
         executed: false,
-        executionState: 'blocked',
+        executionState: input.phase === 'request'
+            ? 'requested'
+            : input.phase === 'response'
+                ? 'responded'
+                : input.decision === 'deny' ? 'blocked' : 'authorized',
         reason: input.reason,
     });
 }
@@ -266,7 +317,7 @@ function infrastructureErrorCode(policyCode) {
 }
 function buildAuditRecord(event) {
     const executed = event.executed ?? false;
-    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : 'command');
+    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : event.decision === 'pending' ? 'approval' : 'command');
     const errorCode = event.errorCode ?? (event.decision === 'deny'
         ? decisionSource === 'approval'
             ? 'USER_DENIED'
@@ -277,9 +328,11 @@ function buildAuditRecord(event) {
     const executionState = event.executionState
         ?? (event.decision === 'deny'
             ? 'blocked'
-            : executed
-                ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
-                : 'authorized');
+            : event.decision === 'pending'
+                ? 'requested'
+                : executed
+                    ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
+                    : 'authorized');
     const lifecycleId = event.callId ?? event.correlationId ?? event.requestId;
     return {
         ts: event.ts,
@@ -382,7 +435,11 @@ function logAuditEvent(record) {
         : routineEcwebRoleRead
             ? 'debug'
             : 'info';
-    const marker = record.decision === 'deny' ? 'DENY' : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
+    const marker = record.decision === 'deny'
+        ? 'DENY'
+        : record.decision === 'pending'
+            ? 'PENDING'
+            : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
     const message = [
         `[CommandAudit:${marker}]`,
         `operation=${record.operation}`,

package/dist/core/auth/operation-authorizer.js

@@ -34,6 +34,9 @@ const DAEMON_SERVICE_OPERATIONS = new Set([
     'trigger.cancel',
     'trigger.delete',
     'trigger.run',
+    'agent.reload',
+    'system.restart',
+    'system.upgrade',
 ]);
 export function authorizeCommand(ctx) {
     return authorizeCommandInternal(ctx);
@@ -121,6 +124,47 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is not available from source ${ctx.source}`, operation, intent.scope, opMeta.dangerous);
     }
     if (ctx.processRole === 'daemon-service') {
+        // ECWeb uses the authenticated daemon service for its read-only menu
+        // bootstrap (model/effort, agent metadata, trigger views, etc.). These
+        // queries are safe to authorize by catalog category; mutating operations
+        // remain restricted to the explicit daemon-service allowlist below.
+        const ECWEB_SERVICE_READ_OPERATIONS = new Set([
+            'system.status', 'model.current', 'model.list', 'baseagent.models.list',
+            'model.effort.current', 'agent.baseagent.current', 'agent.baseagent.list',
+            'agent.show',
+            'agent.list',
+            'capability.read',
+            'gateway.read', 'stats.summary', 'stats.session', 'stats.context',
+            'role.policy.read', 'role.relation.read', 'config.read',
+            'model.info', 'model.check',
+            'trigger.list', 'trigger.show', 'trigger.history', 'trigger.eventCatalog',
+        ]);
+        if (ECWEB_SERVICE_READ_OPERATIONS.has(operation)) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-service',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'daemon-service-read',
+            };
+        }
+        // The in-process service may perform system lifecycle actions only when
+        // the request came through the authenticated ECWeb management surface.
+        // A raw daemon-service subject on the control source is not a human owner.
+        if ((operation === 'system.restart' || operation === 'system.upgrade') && ctx.source === 'control') {
+            return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
+        }
+        if (ctx.source !== 'control' && (operation === 'observable.current' || operation === 'observable.update')) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-service',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'ecweb-daemon-service-agent-management',
+            };
+        }
         if (!DAEMON_SERVICE_OPERATIONS.has(operation)) {
             return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
         }
@@ -189,6 +233,20 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (roleDef.allowAccess === false) {
         return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Role ${role} is not allowed to access commands`, operation, intent.scope, opMeta.dangerous);
     }
+    // AID lookup and public agent.md reads are available to every accessible
+    // role and may target any AID that passed managed-command validation. The
+    // operation source is restricted to agent-tool by the catalog.
+    if ((operation === 'ec.aid.lookup' || operation === 'ec.aid.agentmd.get')
+        && (intent.scope === 'relation' || intent.scope === 'agent')) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'public-aid-read',
+        };
+    }
     let matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
     // Agent self-service contact add deliberately reuses the same low-trust
     // relation boundary as ec.msg.send. Older per-Agent role files may still
@@ -317,7 +375,9 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
     return false;
 }
 function hasDaemonOwnerRole(ctx) {
-    return ctx.isDaemonOwner === true || ctx.processRole === 'daemon-owner';
+    return ctx.isDaemonOwner === true
+        || ctx.processRole === 'daemon-owner'
+        || ctx.processRole === 'daemon-service';
 }
 function daemonOwnerDenialReasonCode(ctx) {
     if ((ctx.intent.operation === 'agent.show' || ctx.intent.operation === 'agent.reload')
@@ -340,8 +400,8 @@ function isCurrentAgentTarget(ctx) {
     return !!ctx.selfAid && !!targetAid && targetAid === ctx.selfAid;
 }
 function daemonOwnerRequiredMessage(operation) {
-    return `${operation} is a daemon-level operation and requires DaemonOwner. `
-        + 'Agent owner/admin and permissionMode=bypass do not grant this permission.';
+    return `无权限：${operation} 是 daemon 级操作，需要 DaemonOwner。`
+        + 'Agent owner/admin 和 permissionMode=bypass 均不能授予此权限。';
 }
 function getRuleRank(rule, permission, operation, category, isDangerous) {
     const denyOffset = permission.allow ? 0 : 1;

package/dist/core/auth/operation-catalog.js

@@ -38,6 +38,10 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     ['ec.group.join', 'write-agent', ['agent'], 'Request to join a group'],
     ['ec.group.leave', 'write-agent', ['agent'], 'Leave a group'],
     ['ec.group.invite', 'write-agent', ['agent'], 'Invite group members'],
+    ['ec.group.invites', 'read', ['agent'], 'List pending targeted group invitations'],
+    ['ec.group.accept-invite', 'write-agent', ['agent'], 'Accept a targeted group invitation'],
+    ['ec.group.reject-invite', 'write-agent', ['agent'], 'Reject a targeted group invitation'],
+    ['ec.group.revoke-invite', 'write-agent', ['agent'], 'Revoke a targeted group invitation'],
     ['ec.group.kick', 'write-agent', ['agent'], 'Remove a group member'],
     ['ec.group.role', 'write-agent', ['agent'], 'Change a group member role'],
     ['ec.group.owner', 'write-agent', ['agent'], 'Transfer group ownership'],
@@ -112,6 +116,14 @@ const QUEUE_OPERATIONS = [['read', 'Read the current Agent message queue'], ['cl
  */
 const OPERATIONS = [
     // ── Model Operations ──
+    {
+        id: 'baseagent.models.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['process'],
+        description: '查询主机默认 Baseagent 模型目录',
+        sources: ['menu', 'ecweb', 'control'],
+    },
     {
         id: 'model.list',
         category: 'read',
@@ -913,7 +925,7 @@ const OPERATIONS = [
         category: 'read',
         dangerous: false,
         defaultScopes: ['relation', 'agent'],
-        description: 'Look up the current Agent public AID record',
+        description: 'Look up a public AID record',
         sources: ['agent-tool'],
     },
     {
@@ -921,7 +933,7 @@ const OPERATIONS = [
         category: 'read',
         dangerous: false,
         defaultScopes: ['relation', 'agent'],
-        description: 'Read and verify the current Agent public agent.md',
+        description: 'Read and verify a public Agent agent.md',
         sources: ['agent-tool'],
     },
     {

package/dist/core/auth/remote-access-store.js

@@ -0,0 +1,136 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolvePaths } from '../../paths.js';
+export const REMOTE_ACCESS_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// 与 owner 绑定二维码（BindService）的默认有效期保持一致：10 分钟。
+export const REMOTE_ACCESS_PAIRING_TTL_MS = 10 * 60 * 1000;
+export function remoteAccessTokenStorePath() {
+    return path.join(resolvePaths().instanceDir, 'control-access-tokens.json');
+}
+function loadStore() {
+    try {
+        const value = JSON.parse(fs.readFileSync(remoteAccessTokenStorePath(), 'utf8'));
+        if (Array.isArray(value.tokens))
+            return value;
+    }
+    catch { }
+    return { tokens: [] };
+}
+function saveStore(store) {
+    const file = remoteAccessTokenStorePath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(temporary, JSON.stringify(store, null, 2) + '\n', { mode: 0o600 });
+        fs.renameSync(temporary, file);
+        try {
+            fs.chmodSync(file, 0o600);
+        }
+        catch { }
+    }
+    finally {
+        if (fs.existsSync(temporary)) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch { }
+        }
+    }
+}
+function pruneExpired(store, now) {
+    const before = store.tokens.length;
+    store.tokens = store.tokens.filter(record => typeof record?.token === 'string'
+        && typeof record.lastActive === 'number'
+        && now - record.lastActive < REMOTE_ACCESS_TOKEN_TTL_MS);
+    return store.tokens.length !== before;
+}
+function validLabel(value) {
+    if (typeof value !== 'string')
+        return 'remote';
+    const normalized = value.trim().replace(/[\r\n]/g, ' ').slice(0, 256);
+    return normalized || 'remote';
+}
+function validOwner(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim();
+    if (!normalized || normalized.length > 512 || /[\r\n]/.test(normalized))
+        return undefined;
+    return normalized;
+}
+/** Validate and slide the expiry window of a daemon-owned remote token. */
+export function validateAndRenewRemoteAccessToken(token, now = Date.now()) {
+    if (typeof token !== 'string' || !token || token.length > 512)
+        return { valid: false };
+    try {
+        const store = loadStore();
+        const changed = pruneExpired(store, now);
+        const record = store.tokens.find(candidate => candidate.token === token);
+        if (!record) {
+            if (changed)
+                saveStore(store);
+            return { valid: false };
+        }
+        record.lastActive = now;
+        saveStore(store);
+        const authorizedBy = validOwner(record.authorizedBy);
+        return { valid: true, ...(authorizedBy ? { authorizedBy } : {}) };
+    }
+    catch {
+        return { valid: false };
+    }
+}
+export class RemoteAccessService {
+    pairingCode = '';
+    pairingExpiresAt = 0;
+    pairingAuthorizedBy;
+    getPairingCode(authorizedBy, now = Date.now()) {
+        if (!this.pairingCode || now >= this.pairingExpiresAt) {
+            this.pairingCode = String(crypto.randomInt(0, 1_000_000)).padStart(6, '0');
+            this.pairingExpiresAt = now + REMOTE_ACCESS_PAIRING_TTL_MS;
+            this.pairingAuthorizedBy = undefined;
+        }
+        const owner = validOwner(authorizedBy);
+        if (!this.pairingAuthorizedBy && owner)
+            this.pairingAuthorizedBy = owner;
+        return { code: this.pairingCode, expiresAt: this.pairingExpiresAt };
+    }
+    redeemPairingCode(code, label, authorizedBy, now = Date.now()) {
+        if (typeof code !== 'string' || !/^\d{6}$/.test(code)) {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: 'pairing code must be six digits' };
+        }
+        if (!this.pairingCode || now >= this.pairingExpiresAt) {
+            return { ok: false, code: 'PAIRING_EXPIRED', error: 'pairing code has expired' };
+        }
+        if (code !== this.pairingCode) {
+            return { ok: false, code: 'PAIRING_INVALID', error: 'pairing code is invalid' };
+        }
+        const createdAt = now;
+        const token = crypto.randomBytes(32).toString('hex');
+        const store = loadStore();
+        pruneExpired(store, now);
+        const owner = validOwner(authorizedBy) ?? this.pairingAuthorizedBy;
+        store.tokens.push({
+            token,
+            createdAt,
+            lastActive: createdAt,
+            label: validLabel(label),
+            ...(owner ? { authorizedBy: owner } : {}),
+        });
+        saveStore(store);
+        return { ok: true, token, expiresAt: createdAt + REMOTE_ACCESS_TOKEN_TTL_MS };
+    }
+    issueLocalToken(label, now = Date.now()) {
+        const token = crypto.randomBytes(32).toString('hex');
+        const store = loadStore();
+        pruneExpired(store, now);
+        store.tokens.push({ token, createdAt: now, lastActive: now, label: validLabel(label) });
+        saveStore(store);
+        return { ok: true, token, expiresAt: now + REMOTE_ACCESS_TOKEN_TTL_MS };
+    }
+    validateToken(token, now = Date.now()) {
+        return validateAndRenewRemoteAccessToken(token, now);
+    }
+}
+export const remoteAccessService = new RemoteAccessService();

package/dist/core/baseagent-loader.js

@@ -20,16 +20,16 @@ export class AgentLoader {
      * Iterate over all EvolAgents in the registry × all registered plugins.
      * Each successful (agent, plugin) pair yields one runner instance.
      */
-    createAll(registry, callbacks, creationErrors) {
+    async createAll(registry, callbacks, creationErrors) {
         const instances = [];
         const allAgents = registry.runnableAgents();
         for (const agent of allAgents) {
-            instances.push(...this.createForAgent(agent, callbacks, creationErrors));
+            instances.push(...await this.createForAgent(agent, callbacks, creationErrors));
         }
         return instances;
     }
     /** Create runners for one EvolAgent, used by runtime hot-load. */
-    createForAgent(agent, callbacks, creationErrors) {
+    async createForAgent(agent, callbacks, creationErrors) {
         const instances = [];
         for (const [pluginName, plugin] of this.plugins) {
             if (!plugin.isEnabled(agent)) {
@@ -37,7 +37,7 @@ export class AgentLoader {
                 continue;
             }
             try {
-                const instance = plugin.createAgent(agent, callbacks);
+                const instance = await plugin.createAgent(agent, callbacks);
                 if (!instance) {
                     logger.debug(`Plugin '${pluginName}' returned null for agent '${agent.name}', skipping`);
                     continue;