evolcore 0.0.22 → 0.0.24

package/dist/core/bootstrap-messages.js

@@ -18,8 +18,16 @@ export function bootstrapInitialMessageOperationPrefix(aid) {
 export function bootstrapInitialRetryOperationId(aid, at = Date.now()) {
     return `${bootstrapInitialMessageOperationPrefix(aid)}:${at}`;
 }
-export function postBootstrapWelcomeOperationId(aid) {
-    return `bootstrap-complete:v1:${aid}`;
+export function postBootstrapWelcomeOperationId(aid, owner) {
+    const normalizedAid = aid.replace(/^@/, '');
+    return owner ? `bootstrap-complete:v2:${normalizedAid}:${owner}` : `bootstrap-complete:v1:${normalizedAid}`;
+}
+export function isPostBootstrapWelcomeOperationId(operationId, aid) {
+    if (!operationId)
+        return false;
+    const normalizedAid = aid.replace(/^@/, '');
+    return operationId === postBootstrapWelcomeOperationId(normalizedAid)
+        || operationId.startsWith(`bootstrap-complete:v2:${normalizedAid}:`);
 }
 export function renderPostBootstrapWelcome(aid, owner, ownerName) {
     const mdPath = agentMdPath(aid);
@@ -36,9 +44,13 @@ export function renderPostBootstrapWelcome(aid, owner, ownerName) {
     });
 }
 export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, delivery = { chatType: 'private' }) {
-    const operationId = postBootstrapWelcomeOperationId(aid);
+    const operationId = postBootstrapWelcomeOperationId(aid, owner);
     const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
-    if (hasMessageLogOperation(chatDir, operationId))
+    const legacyOperationId = postBootstrapWelcomeOperationId(aid);
+    if (hasMessageLogOperation(chatDir, operationId) || hasMessageLogOperation(chatDir, legacyOperationId))
+        return;
+    const legacy = outbox.findByDedupeKey(aid, legacyOperationId);
+    if (legacy?.channelId === owner)
         return;
     const existing = outbox.findByDedupeKey(aid, operationId);
     if (existing
@@ -68,21 +80,30 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, deliver
     });
 }
 export function hasPendingPostBootstrapWelcomeOutbox(aid) {
-    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    return !!entry && outbox.isDeliveryForChannel(entry.delivery, entry.channelId);
+    return findPostBootstrapWelcomeOutbox(aid)
+        .some(entry => outbox.isDeliveryForChannel(entry.delivery, entry.channelId));
+}
+/** Keep pending welcomes from the single-owner v1 format retryable after upgrades. */
+export function findPostBootstrapWelcomeOutbox(aid, opts = {}) {
+    const normalizedAid = aid.replace(/^@/, '');
+    const entries = outbox.findByDedupePrefix(normalizedAid, `bootstrap-complete:v2:${normalizedAid}:`, opts);
+    const legacy = outbox.findByDedupeKey(normalizedAid, postBootstrapWelcomeOperationId(normalizedAid), opts);
+    return [...entries, ...(legacy ? [legacy] : [])];
+}
+export function pendingPostBootstrapWelcomeOwners(aid) {
+    return findPostBootstrapWelcomeOutbox(aid)
+        .filter(entry => outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
+        .map(entry => entry.channelId)
+        .filter((owner, index, all) => all.indexOf(owner) === index);
 }
 /** Bind the durable completion welcome to the fresh post-bootstrap session. */
-export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
-    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    if (!entry || !outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
+export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId, owner) {
+    const normalizedAid = aid.replace(/^@/, '');
+    const entries = findPostBootstrapWelcomeOutbox(normalizedAid)
+        .filter(entry => (!owner || entry.channelId === owner) && outbox.isDeliveryForChannel(entry.delivery, entry.channelId));
+    // A session is scoped to one peer: never silently pick an arbitrary Owner.
+    if (!entries.length || (!owner && new Set(entries.map(entry => entry.channelId)).size !== 1))
         return false;
-    if (entry.context?.sessionId === sessionId)
-        return true;
-    return outbox.replaceIfRouteMatches(aid, entry, {
-        ...entry,
-        context: {
-            ...(entry.context ?? {}),
-            sessionId,
-        },
-    }) === 'replaced';
+    return entries.every(entry => entry.context?.sessionId === sessionId
+        || outbox.replaceIfRouteMatches(normalizedAid, entry, { ...entry, context: { ...(entry.context ?? {}), sessionId } }) === 'replaced');
 }

package/dist/core/bootstrap-service.js

@@ -52,32 +52,38 @@ export async function completeBootstrapWithWelcome(service, aid, welcome, sessio
                 reloaded: false,
             };
         }
-        try {
-            mainSession = await sessions.ensurePostBootstrapMainSession();
-        }
-        catch (e) {
-            return {
-                ok: false,
-                code: 'MAIN_SESSION_CREATE_FAILED',
-                error: e instanceof Error ? e.message : `Failed to create the post-bootstrap main session for ${aid}`,
-                reloaded: false,
-            };
-        }
-        if (!mainSession.sessionId) {
-            return {
-                ok: false,
-                code: 'MAIN_SESSION_CREATE_FAILED',
-                error: `Failed to create the post-bootstrap main session for ${aid}`,
-                reloaded: false,
-            };
-        }
-        if (welcomePending && welcome && !await welcome.bindPostBootstrapWelcomeToSession(mainSession.sessionId)) {
-            return {
-                ok: false,
-                code: 'WELCOME_SESSION_BIND_FAILED',
-                error: `Failed to bind the post-bootstrap welcome to session ${mainSession.sessionId}`,
-                reloaded: false,
-            };
+        const pendingOwners = welcome?.pendingPostBootstrapWelcomeOwners?.();
+        const sessionOwners = pendingOwners?.length ? pendingOwners : [undefined];
+        for (const owner of sessionOwners) {
+            let ownerSession;
+            try {
+                ownerSession = await sessions.ensurePostBootstrapMainSession(owner);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    code: 'MAIN_SESSION_CREATE_FAILED',
+                    error: e instanceof Error ? e.message : `Failed to create the post-bootstrap main session for ${aid}`,
+                    reloaded: false,
+                };
+            }
+            if (!ownerSession.sessionId) {
+                return {
+                    ok: false,
+                    code: 'MAIN_SESSION_CREATE_FAILED',
+                    error: `Failed to create the post-bootstrap main session for ${aid}`,
+                    reloaded: false,
+                };
+            }
+            if (welcomePending && welcome && !await welcome.bindPostBootstrapWelcomeToSession(ownerSession.sessionId, owner)) {
+                return {
+                    ok: false,
+                    code: 'WELCOME_SESSION_BIND_FAILED',
+                    error: `Failed to bind the post-bootstrap welcome to session ${ownerSession.sessionId}`,
+                    reloaded: false,
+                };
+            }
+            mainSession ??= ownerSession;
         }
     }
     const result = service.completeBootstrap(aid);

package/dist/core/capability/capability-manager.js

@@ -13,10 +13,11 @@ function defaultTypeConfig() {
     return { mode: 'inherit', overrides: {} };
 }
 function resolveBaseagent(input) {
-    return input.baseagent
+    const value = input.baseagent
         || input.sessionBaseagent
-        || input.config?.active_baseagent
-        || 'claude';
+        || input.config?.active_baseagent;
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    return normalized || undefined;
 }
 export function resolveCapabilityContext(input) {
     const aid = input.aid || input.config?.aid;
@@ -25,9 +26,12 @@ export function resolveCapabilityContext(input) {
     const projectPath = input.config?.projects?.defaultPath || input.projectPath || input.sessionProjectPath || null;
     if (!projectPath)
         return { error: '无法解析当前 agent projectPath', code: 'NO_PROJECT' };
+    const baseagent = resolveBaseagent(input);
+    if (!baseagent)
+        return { error: '无法解析当前 agent 的 baseagent', code: 'BASEAGENT_REQUIRED' };
     return {
         aid,
-        baseagent: resolveBaseagent(input),
+        baseagent,
         projectPath,
     };
 }

package/dist/core/capability/providers/codex-capability-provider.js

@@ -1,6 +1,6 @@
 import os from 'os';
 import path from 'path';
-import { execCodexCliSync } from '../../../utils/codex-cli.js';
+import { execCodexCliSync } from '../../../agents/baseagent.js';
 import { discoverSkillDirectories } from '../skill-discovery.js';
 function discoverSkills(ctx) {
     const roots = [

package/dist/core/command/agent-control.js

@@ -1,4 +1,5 @@
-import { agentCreateNonInteractive, agentDelete, agentEnable, agentDisable, agentList, agentShow, agentSet, agentReload, } from '../../cli/agent.js';
+import { agentDelete, agentEnable, agentDisable, agentList, agentShow, agentSet, agentReload, } from '../../cli/agent.js';
+import { agentCreateNonInteractive } from '../../cli/agent-create.js';
 import { logger } from '../../utils/logger.js';
 import { resolvePaths, resolveRoot } from '../../paths.js';
 import path from 'path';
@@ -297,6 +298,7 @@ async function runCreateInBackground(opts, w, service) {
         const createOptions = {
             aid: opts.aid, name: opts.name, baseagent: opts.baseagent,
             project: opts.project, owner: opts.owner,
+            description: opts.description,
             onPhase: (phase, state, detail) => {
                 if (state === 'begin') {
                     curPhase = phase;
@@ -393,6 +395,9 @@ export async function execAgentAction(action, args, peerId, eventBus, service) {
         const model = typeof a.model === 'string' && a.model.trim() ? a.model.trim() : undefined;
         const rawEffort = typeof a.effort === 'string' && a.effort.trim() ? a.effort.trim() : undefined;
         const effort = rawEffort && rawEffort !== 'auto' ? rawEffort : undefined;
+        const description = typeof a.description === 'string' && a.description.trim()
+            ? a.description.trim()
+            : undefined;
         // D3: accepted=true 必须意味着后续 query 能查到该 AID 的创建状态。
         let progressWriter;
         try {
@@ -405,7 +410,7 @@ export async function execAgentAction(action, args, peerId, eventBus, service) {
         void runCreateInBackground({
             aid: a.aid, name: a.name, baseagent: a.baseagent,
             project: a.project, owner,
-            model, effort, chatmode: a.chatmode,
+            model, effort, description, chatmode: a.chatmode,
             eventBus,
         }, progressWriter, service).catch(e => logger.error(`[agent-control] runCreateInBackground unhandled ${a.aid}: ${e?.message || e}`));
         return { data: { accepted: true, aid: a.aid } };

package/dist/core/command/command-handler.js

@@ -22,7 +22,7 @@ import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
 import { hasTrustedFullAccessDelegation, trustedExecutionIdentityInput } from '../auth/agent-delegation.js';
-import { executeManagedAidOperation, ManagedAidOperationError, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
+import { executeManagedAidOperation, ManagedAidOperationError, managedAidShowViewForRole, resolveManagedAidOperation, } from '../../aun/aid/managed-operation.js';
 import { executeManagedGroupOperation, isManagedGroupRelationRead, ManagedGroupOperationError, resolveManagedGroupOperation, executeManagedMsgOperation, ManagedMsgOperationError, resolveManagedMsgOperation, executeManagedFsOperation, ManagedFsOperationError, resolveManagedFsOperation, } from '../../aun/msg/managed-operation.js';
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { isHClassPath, isLClassPath, isSameOrDescendant } from '../permission/protected-paths.js';
@@ -108,13 +108,19 @@ export class CommandHandler {
     interactionRouter;
     statsCollector;
     agentMap;
+    legacySingleRunnerMode;
     primaryRunnerKey;
     agentRegistry;
     agentApplicationService;
     triggerSchedulerResolver;
     triggerSchedulerFallback;
     triggerSchedulerFallbackAid;
+    /** Runtime-only owner for the daemon trigger scheduler. It is intentionally
+     * kept outside EvolAgentRegistry because the daemon channel is not an Agent. */
+    daemonTriggerOwnerAid;
+    daemonTriggerChannel = 'daemon';
     daemonStatusProvider;
+    daemonMonitorProvider;
     agentDelegationRegistry;
     handoffRuntime;
     contactRequestSubmitter;
@@ -126,23 +132,42 @@ export class CommandHandler {
      * different backend; that would corrupt session metadata.
      */
     getAgent(channel, baseagent) {
-        if (channel && baseagent) {
+        const requestedBaseagent = typeof baseagent === 'string' ? baseagent.trim() : '';
+        // Support callers that intentionally provide a single-runner map keyed by
+        // the backend name. This exact lookup does not select another agent.
+        if (requestedBaseagent && this.agentMap.has(requestedBaseagent)) {
+            return this.agentMap.get(requestedBaseagent);
+        }
+        // A caller that passed one runner explicitly has already selected the
+        // backend; this compatibility path does not exist for multi-agent maps.
+        if (this.legacySingleRunnerMode && this.agentMap.size === 1
+            && this.agentMap.values().next().value?.name === requestedBaseagent) {
+            return this.agentMap.values().next().value;
+        }
+        if (channel && requestedBaseagent) {
             const owner = this.agentRegistry?.resolveByChannel(channel);
             const evolName = owner?.name || '<unknown>';
-            const key = `${evolName}::${baseagent}`;
+            const key = `${evolName}::${requestedBaseagent}`;
             if (this.agentMap.has(key))
                 return this.agentMap.get(key);
             if (owner) {
-                throw new BaseagentRunnerUnavailableError(evolName, baseagent, this.getAvailableBaseagentsForOwner(evolName));
+                throw new BaseagentRunnerUnavailableError(evolName, requestedBaseagent, this.getAvailableBaseagentsForOwner(evolName));
             }
-            const globalRunner = [...this.agentMap.entries()]
-                .find(([runnerKey]) => runnerKey === baseagent || runnerKey.endsWith(`::${baseagent}`));
-            if (globalRunner)
-                return globalRunner[1];
-        }
-        if (this.agentMap.has(this.primaryRunnerKey))
-            return this.agentMap.get(this.primaryRunnerKey);
-        return this.agentMap.values().next().value;
+            const matches = [...this.agentMap.entries()]
+                .filter(([runnerKey]) => runnerKey.endsWith(`::${requestedBaseagent}`));
+            if (matches.length === 1)
+                return matches[0][1];
+            logger.error(`[RunnerLookup] unavailable channel=${channel ?? '<none>'} baseagent=${requestedBaseagent} owner=${evolName} keys=${[...this.agentMap.keys()].join(',')}`);
+            throw new BaseagentRunnerUnavailableError('<unknown>', requestedBaseagent, []);
+        }
+        if (requestedBaseagent) {
+            const matches = [...this.agentMap.entries()]
+                .filter(([runnerKey]) => runnerKey.endsWith(`::${requestedBaseagent}`));
+            if (matches.length === 1)
+                return matches[0][1];
+        }
+        logger.error(`[RunnerLookup] unavailable channel=${channel ?? '<none>'} baseagent=${requestedBaseagent || '<missing>'} keys=${[...this.agentMap.keys()].join(',')}`);
+        throw new BaseagentRunnerUnavailableError('<unknown>', requestedBaseagent || '<missing>', []);
     }
     getAvailableBaseagentsForOwner(evolName) {
         const prefix = `${evolName}::`;
@@ -200,11 +225,13 @@ export class CommandHandler {
         this.eventBus = eventBus;
         if (agentRunnerOrMap instanceof Map) {
             this.agentMap = agentRunnerOrMap;
+            this.legacySingleRunnerMode = false;
             this.primaryRunnerKey = primaryRunnerKey || '<unknown>::claude';
         }
         else {
             // 测试 / 单 runner 路径：占位 agent name 用 '<unknown>'
             this.agentMap = new Map([[`<unknown>::${agentRunnerOrMap.name}`, agentRunnerOrMap]]);
+            this.legacySingleRunnerMode = true;
             this.primaryRunnerKey = `<unknown>::${agentRunnerOrMap.name}`;
         }
     }
@@ -219,6 +246,32 @@ export class CommandHandler {
     setTriggerSchedulerResolver(resolver) {
         this.triggerSchedulerResolver = resolver;
     }
+    /** Bind the virtual daemon channel to its trigger scheduler owner AID. */
+    setDaemonTriggerOwner(aid, channel = 'daemon') {
+        const normalizedAid = String(aid || '').trim();
+        if (!normalizedAid)
+            throw new Error('daemon trigger owner AID is required');
+        this.daemonTriggerOwnerAid = normalizedAid;
+        this.daemonTriggerChannel = String(channel || 'daemon').trim() || 'daemon';
+    }
+    /** Used by control-menu routing; daemon owner is not in the Agent registry. */
+    getDaemonTriggerOwnerAid(channel = 'daemon') {
+        if (channel !== this.daemonTriggerChannel)
+            return undefined;
+        if (this.daemonTriggerOwnerAid)
+            return this.daemonTriggerOwnerAid;
+        try {
+            const controlAid = String(loadDaemonConfig().aid || '__daemon__').trim() || '__daemon__';
+            const existing = this.agentRegistry?.get?.(controlAid);
+            // Match index.ts: only a runnable (pre-start `stopped`) Agent causes
+            // the daemon scheduler owner to receive the collision suffix.
+            const conflicts = !!existing && (existing.status === undefined || existing.status === 'stopped');
+            return conflicts ? `${controlAid}#daemon` : controlAid;
+        }
+        catch {
+            return undefined;
+        }
+    }
     /** Compatibility entrypoint for older tests/callers that inject a single scheduler. */
     setTriggerScheduler(scheduler, manager) {
         this.triggerSchedulerFallback = scheduler;
@@ -233,6 +286,9 @@ export class CommandHandler {
     setDaemonStatusProvider(provider) {
         this.daemonStatusProvider = provider;
     }
+    setDaemonMonitorProvider(provider) {
+        this.daemonMonitorProvider = provider;
+    }
     /** 返回管理当前通道的 EvolAgent，无则返回 null */
     getOwningAgent(channel) {
         if (!this.agentRegistry)
@@ -240,7 +296,9 @@ export class CommandHandler {
         return this.agentRegistry.resolveByChannel(channel);
     }
     getTriggerSchedulerForChannel(channel) {
-        const agentAid = this.getOwningAgent(channel)?.aid ?? tryParseChannelKey(channel)?.selfAID;
+        const agentAid = this.getOwningAgent(channel)?.aid
+            ?? this.getDaemonTriggerOwnerAid(channel)
+            ?? tryParseChannelKey(channel)?.selfAID;
         return agentAid ? this.triggerSchedulerResolver?.(agentAid) : this.triggerSchedulerFallback;
     }
     getTriggerSchedulerForAgent(agentAid) {
@@ -388,13 +446,13 @@ export class CommandHandler {
             return fallback;
         }
     }
-    validateTriggerPermissionModeForRole(mode, isAdmin, role, selfAid, isDaemonOwner = false) {
+    validateTriggerPermissionModeForRole(mode, isAdmin, role, selfAid, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         if (!mode)
             return undefined;
         if (mode === 'fullaccess') {
             if (!isFullAccessEnabled())
                 return 'fullaccess 功能未启用';
-            return isDaemonOwner ? undefined : '无权限：只有 daemon-owner 可以配置 fullaccess Trigger';
+            return canApprovePersistentFullAccess ? undefined : '无权限：只有 daemon-owner 可以配置 fullaccess Trigger';
         }
         if (!role) {
             if (mode === 'bypass' && !isAdmin)
@@ -450,7 +508,9 @@ export class CommandHandler {
                 return modelDecision.message || '当前角色不允许使用该 Trigger 模型';
         }
         if (definition.execution.effort) {
-            const base = executionBaseagent || 'claude';
+            if (!executionBaseagent)
+                return '无法确定 Trigger 会话的 baseagent';
+            const base = executionBaseagent;
             const effortDecision = validateRuntimeStringFieldOverride({
                 selfAid: definition.agentAid,
                 role,
@@ -539,7 +599,7 @@ export class CommandHandler {
         } : undefined;
         const permissionMode = this.triggerPermissionFromParsed(parsed);
         const triggerRole = this.triggerRoleContext(schedulerAid, channel, peerId, chatType);
-        const permissionError = this.validateTriggerPermissionModeForRole(permissionMode, isAdmin, triggerRole.role, schedulerAid, isDaemonOwner);
+        const permissionError = this.validateTriggerPermissionModeForRole(permissionMode, isAdmin, triggerRole.role, schedulerAid, isDaemonOwner, canApprovePersistentFullAccess);
         if (permissionError)
             return { error: permissionError };
         if (permissionMode === 'fullaccess' && !canApprovePersistentFullAccess) {
@@ -568,7 +628,7 @@ export class CommandHandler {
                 };
             }
         }
-        const authorizedBy = permissionMode === 'fullaccess' && isDaemonOwner
+        const authorizedBy = permissionMode === 'fullaccess' && canApprovePersistentFullAccess
             ? this.canonicalDaemonOwnerId(schedulerAid, channel, peerId, chatType)
             : undefined;
         const definition = {
@@ -964,8 +1024,8 @@ export class CommandHandler {
         return await menuExecMenuQuery.call(this, cmd, channel, channelId, userId, args, explicitChatType, fromControlChannel, overrideIdentity, authSubject, source);
     }
     /** menu.update — 写入新值。 */
-    async execMenuUpdate(cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel = false, args, authSubject, source = 'menu') {
-        return await menuExecMenuUpdate.call(this, cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel, args, authSubject, source);
+    async execMenuUpdate(cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel = false, args, authSubject, source = 'menu', transportReplyContext) {
+        return await menuExecMenuUpdate.call(this, cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel, args, authSubject, source, transportReplyContext);
     }
     /** menu.action — 触发动词。 */
     async execMenuAction(cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel = false, authSubject, source = 'menu', transportReplyContext, deferSideEffect) {
@@ -975,9 +1035,9 @@ export class CommandHandler {
     async execMenuForEcweb(payload, auth) {
         return await menuExecMenuForEcweb.call(this, payload, auth);
     }
-    /** 控制 AID channel 专用入口：peerId 须 ∈ evolcore.owners，全量权限。 */
-    async execMenuForControl(payload, peerId) {
-        return await menuExecMenuForControl.call(this, payload, peerId);
+    /** Control AID Menu entry: daemon-owner or validated remote-access token. */
+    async execMenuForControl(payload, peerId, auth) {
+        return await menuExecMenuForControl.call(this, payload, peerId, auth);
     }
     /**
      * CLI 透传执行：spawn `node dist/cli/index.js <argv>` 子进程，捕获输出回传。
@@ -1067,7 +1127,7 @@ export class CommandHandler {
     /** 把 menu.action 委派给已有 slash 命令处理逻辑，把 OutboundPayload 包成结构化结果。 */
     async delegateAsAction(action, slashCmd, channel, channelId, userId, opts = {}) {
         try {
-            const result = await this._handleInternal(slashCmd, channel, channelId, undefined, userId, undefined, undefined, undefined, undefined, undefined, opts.overrideIdentity, opts.authSubject);
+            const result = await this._handleInternal(slashCmd, channel, channelId, undefined, userId, opts.threadId, opts.chatType, undefined, undefined, undefined, opts.overrideIdentity, opts.authSubject, opts.replyContext);
             if (result == null) {
                 // null / undefined: 命令未识别或前置守卫拦截（如 idle 检查），视为失败
                 return { error: '命令未执行（可能被前置守卫拦截）', code: 'EXEC_FAILED' };
@@ -1344,7 +1404,7 @@ export class CommandHandler {
 /trigger list [--all] — 查看所有触发器
 /trigger create <参数> — 创建触发器（set 为兼容别名）
 /trigger update <名称|ID> <参数> — 修改触发器
-常用参数：--exec script|trigger-session|target-session（create 必填）、--delay/--at/--cron/--every、--prompt、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）
+常用参数：--delay/--at/--cron/--every、--prompt、--description、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）、--feedback、--target-channel/--target-channel-id、--trigger-thread、--baseagent、--on-error、--retry-attempts/--retry-backoff、--script-runtime/--script-args/--script-timeout
 /trigger enable <名称|ID> — 启用触发器
 /trigger disable <名称|ID> — 暂停触发器
 /trigger show <名称|ID> — 查看触发器详情
@@ -1396,7 +1456,7 @@ export class CommandHandler {
             return { ok: false, error: err?.message || String(err) };
         }
         if (updated.execution.permissionMode === 'fullaccess') {
-            if (!isDaemonOwner) {
+            if (!isDaemonOwner && !canApprovePersistentFullAccess) {
                 return { ok: false, code: 'FORBIDDEN', error: '无权限：只有 daemon-owner 可以配置 fullaccess Trigger' };
             }
             if (!canApprovePersistentFullAccess) {
@@ -1419,7 +1479,7 @@ export class CommandHandler {
             return { ok: false, error: '无权限：只有 owner/admin 可以修改 script trigger' };
         }
         const triggerRole = this.triggerRoleContext(definition.agentAid, definition.origin?.channelKey || channel, definition.origin?.peerId || peerId);
-        const permissionError = this.validateTriggerPermissionModeForRole(updated.execution.permissionMode, isAdmin, triggerRole.role, definition.agentAid, isDaemonOwner);
+        const permissionError = this.validateTriggerPermissionModeForRole(updated.execution.permissionMode, isAdmin, triggerRole.role, definition.agentAid, isDaemonOwner, canApprovePersistentFullAccess);
         if (permissionError) {
             return {
                 ok: false,
@@ -1886,7 +1946,10 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        if (parsed.command.aid !== grantSelfAid && !hasTrustedFullAccessDelegation(delegation.grant)) {
+        const requiresSelfAid = parsed.command.kind === 'show' || parsed.command.kind === 'agentmd.put';
+        if (requiresSelfAid
+            && parsed.command.aid !== grantSelfAid
+            && !hasTrustedFullAccessDelegation(delegation.grant)) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can be targeted' };
         }
         let conversationId;
@@ -1926,7 +1989,12 @@ export class CommandHandler {
         if (!decision.allow)
             return { ok: false, code: decision.code, error: decision.reason };
         try {
-            return { ok: true, result: await executeManagedAidOperation(parsed.command) };
+            return {
+                ok: true,
+                result: await executeManagedAidOperation(parsed.command, {
+                    showView: managedAidShowViewForRole(subject.role),
+                }),
+            };
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -2152,7 +2220,14 @@ export class CommandHandler {
             if (!hasTrustedFullAccessDelegation(grant) && (grant.channelType !== 'aun' || grant.chatType !== 'private')) {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'Managed msg reads require the current AUN private relation' };
             }
-            if (!hasTrustedFullAccessDelegation(grant) && parsed.command.target !== conversationId) {
+            // A management role may read history for any peer, one peer per query.
+            // `issuedRole` is resolved daemon-side from the persisted relation
+            // config, so it cannot be spoofed by the calling task. Narrower roles
+            // stay pinned here, and authorizeOperation below remains the authority
+            // for every role (member carries currentRelationOnly; visitor is denied).
+            const mayReadCrossPeer = hasTrustedFullAccessDelegation(grant)
+                || (parsed.command.kind === 'history' && isAdminRole(grant.issuedRole));
+            if (!mayReadCrossPeer && parsed.command.target !== conversationId) {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current AUN private relation can be targeted' };
             }
         }
@@ -2422,6 +2497,29 @@ export class CommandHandler {
         });
         if (!ctlDecision.allow)
             return { ok: false, code: ctlDecision.code, error: ctlDecision.reason };
+        if (cmd.startsWith('/status ') && cmd !== '/status --format json') {
+            return { ok: false, code: 'INVALID_ARGUMENT', error: 'status 仅支持可选参数 --format json' };
+        }
+        if (cmd === '/status --format json') {
+            const context = {
+                selfAid: grantSelfAid,
+                sessionId,
+                taskId: grant.taskId,
+                ...(grant.messageId ? { messageId: grant.messageId } : {}),
+                baseagent: session.baseagent,
+                channel: grant.channelType,
+                channelKey: grant.channel,
+                channelId: conversationId,
+                chatType: grant.chatType,
+                peerKey: grant.peerKey,
+                peerId: conversationId,
+                peerRole: ctlSubject.role,
+                permissionMode: grant.permissionMode ?? ctlSubject.permissionMode,
+                projectPath: path.resolve(session.projectPath),
+                ...(grant.sessionRuntimeDir ? { tmpDir: grant.sessionRuntimeDir } : {}),
+            };
+            return { ok: true, result: JSON.stringify(context, null, 2), data: context };
+        }
         if (cmd.startsWith('/model info ')) {
             const modelId = cmd.slice('/model info '.length).trim();
             if (!modelId || /\s/.test(modelId))