evolcore 0.0.23 → 0.0.24

package/dist/core/message/response-engine.js

@@ -517,6 +517,7 @@ export class ResponseEngine {
     /** 已主动发送开始提示时，忽略 runner 对同一次 compact 的回调。 */
     announcedCompactStarts = new Set();
     agentMap;
+    legacySingleRunnerMode;
     primaryRunnerKey;
     interruptedSessions = new Map(); // sessionId → reason ('new_message' | 'stop' | ...)
     timeoutErrors = new Map();
@@ -552,27 +553,42 @@ export class ResponseEngine {
      * session/config mismatch and must not silently route to a different backend.
      */
     getAgent(channel, baseagent, selfAID) {
-        if (selfAID && baseagent) {
-            const key = `${selfAID}::${baseagent}`;
+        const requestedBaseagent = typeof baseagent === 'string' ? baseagent.trim() : '';
+        // Keep the explicit single-backend map shape usable by embedders and
+        // focused tests. This is an exact key lookup, not a cross-agent fallback.
+        if (requestedBaseagent && this.agentMap.has(requestedBaseagent)) {
+            return this.agentMap.get(requestedBaseagent);
+        }
+        // A caller that passed one runner explicitly has already selected the
+        // backend; this compatibility path does not exist for multi-agent maps.
+        if (this.legacySingleRunnerMode && this.agentMap.size === 1
+            && this.agentMap.values().next().value?.name === requestedBaseagent) {
+            return this.agentMap.values().next().value;
+        }
+        if (selfAID && requestedBaseagent) {
+            const key = `${selfAID}::${requestedBaseagent}`;
             if (this.agentMap.has(key))
                 return this.agentMap.get(key);
         }
-        if (channel && baseagent) {
+        if (channel && requestedBaseagent) {
             const owner = this.agentRegistry?.resolveByChannel(channel);
             const evolName = owner?.name || '<unknown>';
-            const key = `${evolName}::${baseagent}`;
+            const key = `${evolName}::${requestedBaseagent}`;
             if (this.agentMap.has(key))
                 return this.agentMap.get(key);
-            const singleRunnerKey = `<unknown>::${baseagent}`;
-            if (this.agentMap.has(singleRunnerKey))
-                return this.agentMap.get(singleRunnerKey);
             if (owner) {
-                throw new BaseagentRunnerUnavailableError(evolName, baseagent, this.getAvailableBaseagentsForOwner(evolName));
+                throw new BaseagentRunnerUnavailableError(evolName, requestedBaseagent, this.getAvailableBaseagentsForOwner(evolName));
             }
+            // Control/test channels may have no registry owner. Resolve only when
+            // exactly one loaded runner advertises this baseagent; never choose the
+            // primary runner or the first map entry as a backend substitute.
+            const matches = [...this.agentMap.entries()]
+                .filter(([runnerKey]) => runnerKey.endsWith(`::${requestedBaseagent}`));
+            if (matches.length === 1)
+                return matches[0][1];
+            throw new BaseagentRunnerUnavailableError('<unknown>', requestedBaseagent, [...new Set(matches.map(([runnerKey]) => runnerKey.slice(runnerKey.lastIndexOf('::') + 2)))]);
         }
-        if (this.agentMap.has(this.primaryRunnerKey))
-            return this.agentMap.get(this.primaryRunnerKey);
-        return this.agentMap.values().next().value;
+        throw new BaseagentRunnerUnavailableError('<unknown>', requestedBaseagent || '<missing>', []);
     }
     getTextInferenceProvider(channel, baseagent, selfAID) {
         if (!baseagent)
@@ -648,11 +664,13 @@ export class ResponseEngine {
         this.turnCoordinator = new SessionTurnCoordinator(sessionManager);
         if (agentRunnerOrMap instanceof Map) {
             this.agentMap = agentRunnerOrMap;
+            this.legacySingleRunnerMode = false;
             this.primaryRunnerKey = primaryRunnerKey || '<unknown>::claude';
         }
         else {
             // 测试 / 单 runner 路径：占位 agent name 用 '<unknown>'
             this.agentMap = new Map([[`<unknown>::${agentRunnerOrMap.name}`, agentRunnerOrMap]]);
+            this.legacySingleRunnerMode = true;
             this.primaryRunnerKey = `<unknown>::${agentRunnerOrMap.name}`;
         }
         // 监听中断事件，标记被中断的 session
@@ -907,14 +925,10 @@ export class ResponseEngine {
         if (owning)
             owning.lastActivity = Date.now();
     }
-    inferPrimaryBaseagent() {
-        const idx = this.primaryRunnerKey.lastIndexOf('::');
-        return idx >= 0 ? this.primaryRunnerKey.slice(idx + 2) : this.primaryRunnerKey || undefined;
-    }
     ensureSessionBaseagent(session, fallback) {
-        const legacyAgentId = typeof session.agentId === 'string' ? session.agentId : undefined;
-        if (!session.baseagent) {
-            session.baseagent = fallback || legacyAgentId || this.inferPrimaryBaseagent();
+        void fallback;
+        if (typeof session.baseagent !== 'string' || !session.baseagent.trim()) {
+            throw new Error(`[ResponseEngine] session ${session.id} has no baseagent binding; refusing implicit fallback`);
         }
     }
     inferDirectSessionIdentity(message, owningAgent) {
@@ -1647,6 +1661,19 @@ export class ResponseEngine {
                             totalToolCalls: result.state.totalToolCalls,
                             lastToolName: result.state.lastToolName,
                         });
+                        const idleNotice = timeoutControl.idleNotice;
+                        if (idleNotice) {
+                            void Promise.resolve(idleNotice({
+                                action: result.action,
+                                idleSec: result.idleSec,
+                                message: result.message,
+                                totalEvents: result.state.totalEvents,
+                                totalToolCalls: result.state.totalToolCalls,
+                                lastToolName: result.state.lastToolName,
+                            })).catch(error => {
+                                logger.debug(`[ResponseEngine] Idle notice send failed: ${error instanceof Error ? error.message : String(error)}`);
+                            });
+                        }
                     }
                     result = monitor.check();
                 }
@@ -2401,8 +2428,10 @@ export class ResponseEngine {
                         opts.title = '\u2705 \u6700\u7ec8\u56de\u590d:';
                     }
                     opts.metadata = withTaskMetadata(opts.metadata);
-                    if (payload.kind.startsWith('status.'))
+                    // status.notice is a diagnostic observation, not execution activity.
+                    if (payload.kind.startsWith('status.') && payload.kind !== 'status.notice') {
                         this.touchAgentActivity(channelKey);
+                    }
                     const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
                     return await adapter.send(enrichedEnvelope, payload);
@@ -2413,6 +2442,19 @@ export class ResponseEngine {
                 renderer,
                 suppressActivities: shouldSuppress(),
             });
+            // Idle notify/warn are operational diagnostic notices. Keep them on the
+            // current task's renderer so envelope, stale-turn, background, and
+            // channel-specific suppression rules remain identical to other sends.
+            if (timeoutControl) {
+                timeoutControl.idleNotice = async ({ action, idleSec, message: idleMessage, totalEvents, totalToolCalls, lastToolName }) => {
+                    await renderer.sendStatusNotice(idleMessage, action === 'warn' ? 'warn' : 'info', `idle-${action}`, {
+                        idleSec,
+                        totalEvents,
+                        totalToolCalls,
+                        lastToolName,
+                    });
+                };
+            }
             renderer.addLifecycle('started');
             if (isProactive) {
                 logger.info(`[ResponseEngine] proactive mode: outputs via thought.put task=${taskId}`);
@@ -3094,6 +3136,7 @@ export class ResponseEngine {
                         sessionId: session.id,
                         sessionName: session.name || undefined,
                         sessionCreatedAt: session.createdAt ? new Date(session.createdAt).toISOString() : undefined,
+                        managedTempDir: sessionRuntimeDir,
                         // 时区（把 ISO 时间戳转本地时间用）+ OS 环境
                         timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || undefined,
                         tzOffset: currentTzOffset(),
@@ -3142,7 +3185,10 @@ export class ResponseEngine {
                 try {
                     const estTokens = (s) => s ? Math.ceil(s.length / 4) : 0;
                     const cbModel = effectiveModel || agentModel || 'unknown';
-                    const cbMaxTokens = 200000; // 保守默认，后续可从 model-catalog 取
+                    // 从统一模型参数表获取模型的真实 context_window
+                    const { resolveModelSpec } = await import('../../stats/billing.js');
+                    const modelSpec = resolveModelSpec(resolveRoot(), cbModel);
+                    const cbMaxTokens = modelSpec.context_window;
                     const systemPromptTokens = estTokens(options?.systemPromptAppend);
                     const kitTokens = estTokens(kitContext);
                     const totalEst = estTokens(effectiveSystemPrompt);
@@ -3315,6 +3361,8 @@ export class ResponseEngine {
                         selfAid,
                         peerKey,
                         issuedRole: peerRole,
+                        permissionMode: effectivePermissionMode,
+                        ...(sessionRuntimeDir ? { sessionRuntimeDir } : {}),
                         ...(fullAccessAuthorization ? { executionIdentity: fullAccessAuthorization } : {}),
                     });
                     runtimeEnv[AGENT_DELEGATION_TOKEN_ENV] = delegationToken;
@@ -4572,7 +4620,7 @@ export class ResponseEngine {
             : undefined;
         const owningAgent = this.agentRegistry?.resolveByChannel(message.channel);
         const projectPath = owningAgent?.projectPath || process.cwd();
-        const resolvedBaseagent = message.baseagent || owningAgent?.baseagent || (!this.agentRegistry ? this.inferPrimaryBaseagent() : undefined);
+        const resolvedBaseagent = message.baseagent || owningAgent?.baseagent;
         // 优先复用 MessageBridge 入队前已解析的身份，避免二次独立解析产生角色漂移
         // （曾观测到瞬时竞态下把 owner 误判为 none，导致合法用户被静默拒绝）。
         // 仅当消息不经 MessageBridge.register()（如 trigger 直接投递）时才回退重新解析。
@@ -4762,6 +4810,10 @@ export class ResponseEngine {
                 // 每收到事件重置空闲超时
                 const toolName = event.type === 'tool_use' ? event.name : undefined;
                 resetTimer(event.type, toolName);
+                // Provider reasoning/thinking is an internal liveness signal only.
+                // It must never be projected as progress, activity, text, or transcript.
+                if (event.type === 'heartbeat')
+                    continue;
                 if (event.type === 'input_accepted') {
                     inputAccepted = !turnLease || event.inputId === turnLease.inputId;
                     logger.debug(`[ResponseEngine] Input accepted: session=${session.id} input=${event.inputId}`);

package/dist/core/model/catalog-service.js

@@ -43,7 +43,9 @@ export function parseModelList(json, _url) {
         const rawId = typeof item === 'string' ? item : item?.id ?? item?.slug ?? item?.name ?? item?.model;
         if (typeof rawId !== 'string' || !rawId.trim())
             continue;
-        const id = rawId.trim();
+        // 规范化模型 ID：去掉 Claude Code SDK 的上下文窗口后缀 [1m]/[200k]
+        // 这些后缀只在传给 claude baseagent 时由 applyContextWindow 添加
+        const id = rawId.trim().replace(/\[(?:1m|200k)\]$/i, '');
         if (out.has(id))
             continue;
         const rawLevels = item?.reasoningLevels ?? item?.supportedReasoningEfforts ?? item?.supported_reasoning_levels;

package/dist/core/model/model-catalog.js

@@ -106,6 +106,16 @@ export function resolveCatalogContext(self, ba) {
     }
     return context;
 }
+const HOST_BASEAGENTS = ['claude', 'codex', 'ecagent', 'gemini'];
+/** Query the catalog for a host-level default connection, without Agent scope. */
+export async function getBaseagentCatalog(baseagent, options = {}) {
+    if (!HOST_BASEAGENTS.includes(baseagent)) {
+        throw Object.assign(new Error(`Invalid baseagent: ${baseagent}. Valid: ${HOST_BASEAGENTS.join(', ')}`), { code: 'INVALID_ARGUMENT' });
+    }
+    const normalized = baseagent;
+    const snapshot = await getCatalog(undefined, normalized, options.refresh === true);
+    return { ...snapshot, baseagent: normalized };
+}
 /** Used by the IPC handler and the owner process. Never calls IPC recursively. */
 export async function getLocalCatalog(self, ba, refresh = false) {
     return service.get(resolveCatalogContext(self, ba), refresh);

package/dist/core/model/model-permission.js

@@ -7,12 +7,15 @@ export function isModelAllowedByPatterns(model, allowedModels) {
         : model === pattern);
 }
 function normalizeBaseagent(baseagent) {
-    return (baseagent || 'claude').trim() || 'claude';
+    const normalized = typeof baseagent === 'string' ? baseagent.trim() : '';
+    return normalized || undefined;
 }
 export function getRoleModelPermission(role, baseagent, selfAid) {
     const ba = normalizeBaseagent(baseagent);
     if (!role)
         return { allowOverride: false, constrained: true };
+    if (!ba)
+        return { allowOverride: false, constrained: true, allowedModels: [] };
     const selected = getFieldPermission(role, `baseagents.${ba}.model`, selfAid);
     if (!selected || !Array.isArray(selected.allowedModels)) {
         return { allowOverride: true, constrained: false };

package/dist/core/permission/approval-gateway.js

@@ -8,7 +8,7 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
 import { resolveProtectedCandidate } from './protected-paths.js';
-import { auditPermissionDecision } from '../auth/authorization-audit.js';
+import { auditPermissionDecision, auditPermissionLifecycle } from '../auth/authorization-audit.js';
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -448,22 +448,40 @@ export class PermissionGateway {
         if (sessionGrant)
             this.addTemporaryGrant(pending, decisionCausation);
         pending.resolve(decision);
-        if (!approved) {
-            auditPermissionDecision({
-                requestId,
-                sessionId,
-                toolName: pending.toolName,
-                decisionSource: 'approval',
-                policyCode: 'user_approval_denied',
-                reason: 'owner approval denied',
-                permissionMode: pending.permissionMode,
-                agentAid: pending.selfAid,
-                agentName: pending.agentName,
-                role: pending.role,
-                taskId: pending.taskId,
-                summary: pending.auditSummary,
-            });
-        }
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: approved ? 'allow' : 'deny',
+            decisionSource: 'approval',
+            policyCode: approved ? undefined : 'user_approval_denied',
+            reason: approved ? 'owner approval accepted' : 'owner approval denied',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: action,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: approved ? 'allow' : 'deny',
+            decisionSource: 'approval',
+            policyCode: approved ? undefined : 'user_approval_denied',
+            reason: approved ? 'owner approval accepted' : 'owner approval denied',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: action,
+        });
         void this.notifyPermissionState(pending, approved
             ? { state: 'approved', requestId, toolName: pending.toolName }
             : {
@@ -502,6 +520,23 @@ export class PermissionGateway {
         pending.resolve('deny');
         const decisionSource = 'infrastructure';
         const policyCode = cancelled ? 'approval_cancelled' : `approval_${reason}`;
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: 'deny',
+            decisionSource,
+            policyCode,
+            reason,
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: reason,
+        });
         auditPermissionDecision({
             requestId,
             sessionId,
@@ -565,7 +600,25 @@ export class PermissionGateway {
         const auditSummary = summarizeToolInputForAudit(challenge.toolName, challenge.toolInput).slice(0, 512);
         if (!approval || !interactionRouter) {
             await sendPrompt('当前会话权限不足，且没有可用的 owner 审批通道。');
+            auditPermissionLifecycle({
+                phase: 'response',
+                requestId: challenge.id,
+                sessionId,
+                toolName: challenge.toolName,
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_route_unavailable',
+                reason: 'owner approval routing context is unavailable',
+                permissionMode: context.permissionMode,
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                role: context.role,
+                taskId: context.taskId,
+                summary: auditSummary,
+                response: 'unavailable',
+            });
             auditPermissionDecision({
+                requestId: challenge.id,
                 sessionId,
                 toolName: challenge.toolName,
                 decisionSource: 'infrastructure',
@@ -783,6 +836,23 @@ export class PermissionGateway {
         this.syncManagementRevalidationTimer();
         pending.resolve('deny');
         const decisionSource = reason === 'denied' ? 'approval' : 'infrastructure';
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: 'deny',
+            decisionSource,
+            policyCode: `approval_${reason}`,
+            reason,
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: reason,
+        });
         auditPermissionDecision({
             requestId,
             sessionId,
@@ -915,6 +985,20 @@ export class PermissionGateway {
             refs: { permissionRequestId: requestId, taskId: context.taskId, sessionId },
         });
         this.eventBus?.publish({ type: 'permission:requested', sessionId, requestId, toolName, input: displaySummary, causation: requestCausation });
+        auditPermissionLifecycle({
+            phase: 'request',
+            requestId,
+            sessionId,
+            toolName,
+            decision: 'pending',
+            decisionSource: 'approval',
+            permissionMode: context?.permissionMode,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+        });
         const route = planApprovalRoute(challenge, context);
         logger.info(`[PermissionGateway] approval_route request=${requestId} policy=${challenge.approverPolicy}`
             + ` route=${route.kind}`
@@ -955,6 +1039,23 @@ export class PermissionGateway {
                 taskId: context.taskId,
                 summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
             });
+            auditPermissionLifecycle({
+                phase: 'response',
+                requestId,
+                sessionId,
+                toolName,
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_route_unavailable',
+                reason: route.reason,
+                permissionMode: context.permissionMode,
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                role: context.role,
+                taskId: context.taskId,
+                summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                response: 'unavailable',
+            });
             return 'deny';
         }
         if (route.kind === 'handoff') {
@@ -1125,6 +1226,40 @@ export class PermissionGateway {
         pending.resolve(normalizedDecision === 'deny' ? 'deny' : 'allow');
         this.pending.delete(requestId);
         this.syncManagementRevalidationTimer();
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: normalizedDecision === 'deny' ? 'deny' : 'allow',
+            decisionSource: 'approval',
+            policyCode: normalizedDecision === 'deny' ? 'user_approval_denied' : undefined,
+            reason: normalizedDecision === 'deny' ? 'user approval denied' : 'user approval accepted',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: normalizedDecision,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: normalizedDecision === 'deny' ? 'deny' : 'allow',
+            decisionSource: 'approval',
+            policyCode: normalizedDecision === 'deny' ? 'user_approval_denied' : undefined,
+            reason: normalizedDecision === 'deny' ? 'user approval denied' : 'user approval accepted',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: normalizedDecision,
+        });
         const decisionCausation = deriveCausation(pending.causation);
         if (normalizedDecision === 'always') {
             this.addTemporaryGrant(pending, decisionCausation);
@@ -1136,22 +1271,6 @@ export class PermissionGateway {
         });
         const decisionSource = 'approval';
         const policyCode = normalizedDecision === 'deny' ? 'user_approval_denied' : undefined;
-        if (normalizedDecision === 'deny') {
-            auditPermissionDecision({
-                requestId,
-                sessionId,
-                toolName: pending.toolName,
-                decisionSource,
-                policyCode: 'user_approval_denied',
-                reason: 'user approval denied',
-                permissionMode: pending.permissionMode,
-                agentAid: pending.selfAid,
-                agentName: pending.agentName,
-                role: pending.role,
-                taskId: pending.taskId,
-                summary: pending.auditSummary,
-            });
-        }
         this.eventBus?.publish({ type: 'permission:resolved', sessionId, requestId, toolName: pending.toolName, approved: normalizedDecision !== 'deny', ...(policyCode ? { decisionSource, policyCode } : { decisionSource }), causation: decisionCausation });
         return true;
     }
@@ -1215,6 +1334,23 @@ export class PermissionGateway {
                 this.clearPendingResources(pending);
                 pending.interactionRouter?.cancel(requestId, reason);
                 pending.resolve('deny');
+                auditPermissionLifecycle({
+                    phase: 'response',
+                    requestId,
+                    sessionId,
+                    toolName: pending.toolName,
+                    decision: 'deny',
+                    decisionSource: 'infrastructure',
+                    policyCode: `approval_${reason}`,
+                    reason,
+                    permissionMode: pending.permissionMode,
+                    agentAid: pending.selfAid,
+                    agentName: pending.agentName,
+                    role: pending.role,
+                    taskId: pending.taskId,
+                    summary: pending.auditSummary,
+                    response: reason,
+                });
                 auditPermissionDecision({
                     requestId,
                     sessionId,

package/dist/core/permission/tool-policy.js

@@ -2161,10 +2161,11 @@ export function evaluateToolPreflight(toolName, input, context) {
             : command;
         const tempCheck = checkManagedTempShellCommand(commandForPolicy, managedTempOptions(context));
         if (tempCheck.kind === 'deny') {
+            const currentTmpDir = resolveManagedTempDir(managedTempOptions(context).env);
             return {
                 behavior: 'deny',
                 input,
-                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内：${tempCheck.reason}`,
+                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${tempCheck.reason}`,
                 policyCode: 'temporary_path_outside_tmpdir',
             };
         }
@@ -2215,14 +2216,20 @@ export function evaluateToolPreflight(toolName, input, context) {
         const ownAid = !!managedAidArgv
             && !!context.selfAid
             && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
-        const isSelfManagedAidRead = !!managedAidArgv
+        const isManagedAidPublicRead = !!context.selfAid
+            && !!managedAidArgv
             && managedAidArgv[0] === 'ec'
             && managedAidArgv[1] === 'aid'
-            && ownAid
-            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+            && ((managedAidArgv.length === 4 && managedAidArgv[2] === 'lookup')
                 || (managedAidArgv.length === 5
                     && managedAidArgv[2] === 'agentmd'
                     && managedAidArgv[3] === 'get'));
+        const isSelfManagedAidShow = !!managedAidArgv
+            && managedAidArgv.length === 4
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'show'
+            && ownAid;
         const isSelfAgentMdPublish = !!managedAidArgv
             && managedAidArgv.length === 5
             && managedAidArgv[0] === 'ec'
@@ -2232,14 +2239,14 @@ export function evaluateToolPreflight(toolName, input, context) {
             && ownAid;
         const canPublishSelfAgentMd = isSelfAgentMdPublish
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
-        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd;
         if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
                 message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
                     ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
-                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                    : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put。',
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }