evolcore 0.0.23 → 0.0.25

package/dist/core/auth/authorization-audit.js

@@ -10,6 +10,8 @@ export function auditCommandAuthorization(event) {
         (event.decision === 'allow' && event.dangerous) ||
         (event.source === 'agent-tool' && event.operation.startsWith('config.')) ||
         event.operation === 'codex.approval' ||
+        event.operation === 'permission.approval' ||
+        event.operation === 'permission.runtime' ||
         event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
         event.operation === 'cli.exec.raw';
@@ -198,33 +200,78 @@ export function auditCodexApprovalDecision(input) {
  * infrastructure denials without parsing localized log text.
  */
 export function auditPermissionDecision(input) {
-    auditCommandAuthorization({
-        ts: Date.now(),
-        callId: input.requestId,
-        correlationId: input.requestId,
-        requestId: input.requestId,
+    const requestId = input.requestId ?? `perm-audit-${crypto.randomUUID()}`;
+    auditPermissionLifecycle({
+        phase: 'final',
+        requestId,
         sessionId: input.sessionId,
         agentAid: input.agentAid,
         agentName: input.agentName,
         permissionMode: input.permissionMode,
         toolName: input.toolName,
+        decision: 'deny',
+        decisionSource: input.decisionSource,
+        policyCode: input.policyCode,
+        reason: input.reason,
+        role: input.role,
+        taskId: input.taskId,
+        summary: input.summary,
+        operation: 'permission.runtime',
+    });
+}
+/**
+ * Emit a canonical request/response/final lifecycle for runtime approvals.
+ * All three phases share one eventKey and complete correlation fields so
+ * daily analysis can group them without parsing runner-specific log text.
+ */
+export function auditPermissionLifecycle(input) {
+    const sessionId = input.sessionId ?? 'unknown';
+    auditCommandAuthorization({
+        ts: Date.now(),
+        eventKey: buildToolLifecycleEventKey({
+            sessionId,
+            callId: input.callId,
+            correlationId: input.correlationId,
+            requestId: input.requestId,
+        }),
+        eventPhase: input.phase,
+        callId: input.callId ?? input.requestId,
+        correlationId: input.correlationId ?? input.callId ?? input.requestId,
+        requestId: input.requestId,
+        sessionId,
+        agentAid: input.agentAid ?? 'unknown',
+        agentName: input.agentName,
+        permissionMode: input.permissionMode ?? 'unknown',
+        toolName: input.toolName,
+        approvalMethod: input.approvalMethod,
         policyCode: input.policyCode,
         decisionSource: input.decisionSource,
-        errorCode: input.decisionSource === 'approval'
-            ? 'USER_DENIED'
-            : input.decisionSource === 'policy'
-                ? 'POLICY_DENIED'
-                : infrastructureErrorCode(input.policyCode),
+        errorCode: input.decision === 'deny'
+            ? input.decisionSource === 'approval'
+                ? 'USER_DENIED'
+                : input.decisionSource === 'policy'
+                    ? 'POLICY_DENIED'
+                    : infrastructureErrorCode(input.policyCode)
+            : undefined,
         source: 'agent-tool',
-        operation: 'permission.runtime',
+        operation: input.operation ?? 'permission.approval',
         scope: 'filesystem',
         dangerous: false,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: input.summary ? { summary: input.summary } : undefined,
-        decision: 'deny',
+        argsSummary: input.summary || input.response
+            ? {
+                ...(input.summary ? { summary: input.summary } : {}),
+                ...(input.response ? { response: input.response } : {}),
+            }
+            : undefined,
+        decision: input.decision,
         executed: false,
-        executionState: 'blocked',
+        executionState: input.phase === 'request'
+            ? 'requested'
+            : input.phase === 'response'
+                ? 'responded'
+                : input.decision === 'deny' ? 'blocked' : 'authorized',
         reason: input.reason,
     });
 }
@@ -270,7 +317,7 @@ function infrastructureErrorCode(policyCode) {
 }
 function buildAuditRecord(event) {
     const executed = event.executed ?? false;
-    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : 'command');
+    const decisionSource = event.decisionSource ?? (event.decision === 'deny' ? 'policy' : event.decision === 'pending' ? 'approval' : 'command');
     const errorCode = event.errorCode ?? (event.decision === 'deny'
         ? decisionSource === 'approval'
             ? 'USER_DENIED'
@@ -281,9 +328,11 @@ function buildAuditRecord(event) {
     const executionState = event.executionState
         ?? (event.decision === 'deny'
             ? 'blocked'
-            : executed
-                ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
-                : 'authorized');
+            : event.decision === 'pending'
+                ? 'requested'
+                : executed
+                    ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
+                    : 'authorized');
     const lifecycleId = event.callId ?? event.correlationId ?? event.requestId;
     return {
         ts: event.ts,
@@ -386,7 +435,11 @@ function logAuditEvent(record) {
         : routineEcwebRoleRead
             ? 'debug'
             : 'info';
-    const marker = record.decision === 'deny' ? 'DENY' : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
+    const marker = record.decision === 'deny'
+        ? 'DENY'
+        : record.decision === 'pending'
+            ? 'PENDING'
+            : record.dangerous ? 'DANGEROUS_ALLOW' : 'ALLOW';
     const message = [
         `[CommandAudit:${marker}]`,
         `operation=${record.operation}`,

package/dist/core/auth/operation-authorizer.js

@@ -34,6 +34,9 @@ const DAEMON_SERVICE_OPERATIONS = new Set([
     'trigger.cancel',
     'trigger.delete',
     'trigger.run',
+    'agent.reload',
+    'system.restart',
+    'system.upgrade',
 ]);
 export function authorizeCommand(ctx) {
     return authorizeCommandInternal(ctx);
@@ -121,6 +124,47 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         return denyDecision(ctx, 'NOT_ALLOWED', `Operation ${operation} is not available from source ${ctx.source}`, operation, intent.scope, opMeta.dangerous);
     }
     if (ctx.processRole === 'daemon-service') {
+        // ECWeb uses the authenticated daemon service for its read-only menu
+        // bootstrap (model/effort, agent metadata, trigger views, etc.). These
+        // queries are safe to authorize by catalog category; mutating operations
+        // remain restricted to the explicit daemon-service allowlist below.
+        const ECWEB_SERVICE_READ_OPERATIONS = new Set([
+            'system.status', 'model.current', 'model.list', 'baseagent.models.list',
+            'model.effort.current', 'agent.baseagent.current', 'agent.baseagent.list',
+            'agent.show',
+            'agent.list',
+            'capability.read',
+            'gateway.read', 'stats.summary', 'stats.session', 'stats.context',
+            'role.policy.read', 'role.relation.read', 'config.read',
+            'model.info', 'model.check',
+            'trigger.list', 'trigger.show', 'trigger.history', 'trigger.eventCatalog',
+        ]);
+        if (ECWEB_SERVICE_READ_OPERATIONS.has(operation)) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-service',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'daemon-service-read',
+            };
+        }
+        // The in-process service may perform system lifecycle actions only when
+        // the request came through the authenticated ECWeb management surface.
+        // A raw daemon-service subject on the control source is not a human owner.
+        if ((operation === 'system.restart' || operation === 'system.upgrade') && ctx.source === 'control') {
+            return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
+        }
+        if (ctx.source !== 'control' && (operation === 'observable.current' || operation === 'observable.update')) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-service',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'ecweb-daemon-service-agent-management',
+            };
+        }
         if (!DAEMON_SERVICE_OPERATIONS.has(operation)) {
             return denyDecision(ctx, 'NOT_ALLOWED', `Daemon service is not authorized for ${operation}`, operation, intent.scope, opMeta.dangerous, 'daemon-service');
         }
@@ -148,7 +192,8 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         };
     }
     // Any authenticated role may inspect the current Agent through the daemon's
-    // redacted view. Cross-Agent inspection is handled by requiresDaemonOwner().
+    // redacted view. Management roles may inspect another Agent's redacted view;
+    // mutation and reload remain target-scoped below.
     if (operation === 'agent.show' && isCurrentAgentTarget(ctx)) {
         return {
             allow: true,
@@ -159,6 +204,17 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: 'self-agent-read',
         };
     }
+    if (operation === 'agent.persona' && isCurrentAgentTarget(ctx)
+        && (role === 'owner' || hasDaemonOwnerRole(ctx))) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: role === 'owner' ? 'agent-owner-persona' : 'daemon-owner-persona',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
@@ -171,7 +227,7 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (role === 'owner') {
+        if (role === 'owner' && isCurrentAgentTarget(ctx)) {
             return {
                 allow: true,
                 operation,
@@ -181,6 +237,22 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
                 matchedRule: 'agent-owner',
             };
         }
+        // The daemon control identity is allowed to inspect any Agent config,
+        // including sensitive fields. This is intentionally handled before
+        // role-definition matching because daemon-owner subjects do not need an
+        // Agent relation role to read the daemon's local configuration store.
+        if (resolvedConfigCommand.kind === 'field'
+            && resolvedConfigCommand.subcommand === 'get'
+            && hasDaemonOwnerRole(ctx)) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-owner',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'daemon-owner-config-read',
+            };
+        }
     }
     const roleDef = getRoleDefinition(role, ctx.selfAid);
     if (!roleDef) {
@@ -189,6 +261,20 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
     if (roleDef.allowAccess === false) {
         return denyDecision(ctx, 'ROLE_ACCESS_DENIED', `Role ${role} is not allowed to access commands`, operation, intent.scope, opMeta.dangerous);
     }
+    // AID lookup and public agent.md reads are available to every accessible
+    // role and may target any AID that passed managed-command validation. The
+    // operation source is restricted to agent-tool by the catalog.
+    if ((operation === 'ec.aid.lookup' || operation === 'ec.aid.agentmd.get')
+        && (intent.scope === 'relation' || intent.scope === 'agent')) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'public-aid-read',
+        };
+    }
     let matchResult = matchCommandPermission(operation, opMeta.category, roleDef.commandPermissions || {}, opMeta.dangerous);
     // Agent self-service contact add deliberately reuses the same low-trust
     // relation boundary as ec.msg.send. Older per-Agent role files may still
@@ -299,10 +385,25 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
             || resolvedConfigCommand.configScope === 'process'
             || resolvedConfigCommand.configScope === 'defaults'))
         return true;
+    // Sensitive reads of another Agent's config are daemon-scoped. Agent
+    // owner/admin roles may inspect safe fields cross-Agent, but only the
+    // daemon control identity may access config.read targets that are not the
+    // current Agent.
+    if (operation === 'config.read'
+        && resolvedConfigCommand?.kind === 'field'
+        && resolvedConfigCommand.configScope === 'agent'
+        && !isCurrentAgentTarget(ctx)) {
+        return true;
+    }
     if (operation === 'agent.reload' && hasDaemonOwnerRole(ctx)) {
         return true;
     }
-    if (operation === 'agent.show' || operation === 'agent.reload') {
+    // Avatar publication is an Agent-scoped mutation for Agent channels, but
+    // the trusted control plane may publish it for a selected Agent target.
+    if (operation === 'ec.aid.avatar' && hasDaemonOwnerRole(ctx)) {
+        return true;
+    }
+    if (operation === 'agent.reload') {
         return !isCurrentAgentTarget(ctx);
     }
     if (operation.startsWith('trigger.')) {
@@ -317,7 +418,9 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
     return false;
 }
 function hasDaemonOwnerRole(ctx) {
-    return ctx.isDaemonOwner === true || ctx.processRole === 'daemon-owner';
+    return ctx.isDaemonOwner === true
+        || ctx.processRole === 'daemon-owner'
+        || ctx.processRole === 'daemon-service';
 }
 function daemonOwnerDenialReasonCode(ctx) {
     if ((ctx.intent.operation === 'agent.show' || ctx.intent.operation === 'agent.reload')
@@ -340,8 +443,8 @@ function isCurrentAgentTarget(ctx) {
     return !!ctx.selfAid && !!targetAid && targetAid === ctx.selfAid;
 }
 function daemonOwnerRequiredMessage(operation) {
-    return `${operation} is a daemon-level operation and requires DaemonOwner. `
-        + 'Agent owner/admin and permissionMode=bypass do not grant this permission.';
+    return `无权限：${operation} 是 daemon 级操作，需要 DaemonOwner。`
+        + 'Agent owner/admin 和 permissionMode=bypass 均不能授予此权限。';
 }
 function getRuleRank(rule, permission, operation, category, isDangerous) {
     const denyOffset = permission.allow ? 0 : 1;
@@ -469,6 +572,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
         return { ok: false, reason: 'Resolved config operation is required' };
     const field = resolvedConfigOp.field;
     if (!resolvedConfigOp.route || (resolvedConfigOp.fieldRule.class !== 'safe-scalar' && resolvedConfigOp.fieldRule.class !== 'safe-readonly-object')) {
+        if (policy === 'behavior-read'
+            && !isCurrentAgentTarget(ctx)
+            && hasDaemonOwnerRole(ctx)
+            && resolvedConfigOp.route) {
+            return { ok: true };
+        }
         return { ok: false, reason: `Config field ${field} is not available to user roles` };
     }
     if (policy === 'role-overridable-write'
@@ -481,8 +590,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     const fieldPermission = roleDef
         ? resolveRoleFieldPermission(roleDef.permissions || {}, field)
         : undefined;
-    if (policy === 'behavior-read')
+    if (policy === 'behavior-read') {
+        // Only the daemon control identity may read sensitive config fields from
+        // another Agent. Agent owners retain unrestricted reads for their own
+        // target via the self-target fast path above.
         return { ok: true };
+    }
     if (fieldPermission && !fieldPermission.allowOverride) {
         return { ok: false, reason: `Role ${ctx.role} cannot override ${field}` };
     }
@@ -519,6 +632,11 @@ function checkResolvedConfigTarget(ctx, command) {
         return { ok: true };
     }
     if (command.configScope === 'agent') {
+        // Management roles may read another Agent's non-sensitive config fields;
+        // sensitive fields are rejected by the field policy. Writes stay self-only.
+        if (command.subcommand === 'get' && (isManagementRole(ctx.role) || hasDaemonOwnerRole(ctx))) {
+            return { ok: true };
+        }
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent can be targeted' };
         }

package/dist/core/auth/operation-catalog.js

@@ -116,6 +116,14 @@ const QUEUE_OPERATIONS = [['read', 'Read the current Agent message queue'], ['cl
  */
 const OPERATIONS = [
     // ── Model Operations ──
+    {
+        id: 'baseagent.models.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['process'],
+        description: '查询主机默认 Baseagent 模型目录',
+        sources: ['menu', 'ecweb', 'control'],
+    },
     {
         id: 'model.list',
         category: 'read',
@@ -593,6 +601,14 @@ const OPERATIONS = [
         description: '获取 agent 配置（含凭证）',
         sources: ['menu', 'menu.cli', 'control'],
     },
+    {
+        id: 'agent.persona',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '读取或更新当前 Agent 的 persona.md',
+        sources: ['agent-tool', 'control'],
+    },
     {
         id: 'agent.create',
         category: 'process',
@@ -917,7 +933,7 @@ const OPERATIONS = [
         category: 'read',
         dangerous: false,
         defaultScopes: ['relation', 'agent'],
-        description: 'Look up the current Agent public AID record',
+        description: 'Look up a public AID record',
         sources: ['agent-tool'],
     },
     {
@@ -925,7 +941,7 @@ const OPERATIONS = [
         category: 'read',
         dangerous: false,
         defaultScopes: ['relation', 'agent'],
-        description: 'Read and verify the current Agent public agent.md',
+        description: 'Read and verify a public Agent agent.md',
         sources: ['agent-tool'],
     },
     {
@@ -936,6 +952,14 @@ const OPERATIONS = [
         description: 'Sign and publish the current Agent local agent.md',
         sources: ['agent-tool'],
     },
+    {
+        id: 'ec.aid.avatar',
+        category: 'write-agent',
+        dangerous: true,
+        defaultScopes: ['agent'],
+        description: 'Upload and publish the current Agent avatar',
+        sources: ['agent-tool', 'menu', 'menu.cli'],
+    },
     {
         id: 'ec.msg.send',
         category: 'write-own',

package/dist/core/auth/remote-access-store.js

@@ -2,8 +2,9 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolvePaths } from '../../paths.js';
-export const REMOTE_ACCESS_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-export const REMOTE_ACCESS_PAIRING_TTL_MS = 5 * 60 * 1000;
+export const REMOTE_ACCESS_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// 与 owner 绑定二维码（BindService）的默认有效期保持一致：10 分钟。
+export const REMOTE_ACCESS_PAIRING_TTL_MS = 10 * 60 * 1000;
 export function remoteAccessTokenStorePath() {
     return path.join(resolvePaths().instanceDir, 'control-access-tokens.json');
 }

package/dist/core/baseagent-loader.js

@@ -20,16 +20,16 @@ export class AgentLoader {
      * Iterate over all EvolAgents in the registry × all registered plugins.
      * Each successful (agent, plugin) pair yields one runner instance.
      */
-    createAll(registry, callbacks, creationErrors) {
+    async createAll(registry, callbacks, creationErrors) {
         const instances = [];
         const allAgents = registry.runnableAgents();
         for (const agent of allAgents) {
-            instances.push(...this.createForAgent(agent, callbacks, creationErrors));
+            instances.push(...await this.createForAgent(agent, callbacks, creationErrors));
         }
         return instances;
     }
     /** Create runners for one EvolAgent, used by runtime hot-load. */
-    createForAgent(agent, callbacks, creationErrors) {
+    async createForAgent(agent, callbacks, creationErrors) {
         const instances = [];
         for (const [pluginName, plugin] of this.plugins) {
             if (!plugin.isEnabled(agent)) {
@@ -37,7 +37,7 @@ export class AgentLoader {
                 continue;
             }
             try {
-                const instance = plugin.createAgent(agent, callbacks);
+                const instance = await plugin.createAgent(agent, callbacks);
                 if (!instance) {
                     logger.debug(`Plugin '${pluginName}' returned null for agent '${agent.name}', skipping`);
                     continue;

package/dist/core/bootstrap-messages.js

@@ -18,8 +18,16 @@ export function bootstrapInitialMessageOperationPrefix(aid) {
 export function bootstrapInitialRetryOperationId(aid, at = Date.now()) {
     return `${bootstrapInitialMessageOperationPrefix(aid)}:${at}`;
 }
-export function postBootstrapWelcomeOperationId(aid) {
-    return `bootstrap-complete:v1:${aid}`;
+export function postBootstrapWelcomeOperationId(aid, owner) {
+    const normalizedAid = aid.replace(/^@/, '');
+    return owner ? `bootstrap-complete:v2:${normalizedAid}:${owner}` : `bootstrap-complete:v1:${normalizedAid}`;
+}
+export function isPostBootstrapWelcomeOperationId(operationId, aid) {
+    if (!operationId)
+        return false;
+    const normalizedAid = aid.replace(/^@/, '');
+    return operationId === postBootstrapWelcomeOperationId(normalizedAid)
+        || operationId.startsWith(`bootstrap-complete:v2:${normalizedAid}:`);
 }
 export function renderPostBootstrapWelcome(aid, owner, ownerName) {
     const mdPath = agentMdPath(aid);
@@ -36,9 +44,13 @@ export function renderPostBootstrapWelcome(aid, owner, ownerName) {
     });
 }
 export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, delivery = { chatType: 'private' }) {
-    const operationId = postBootstrapWelcomeOperationId(aid);
+    const operationId = postBootstrapWelcomeOperationId(aid, owner);
     const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
-    if (hasMessageLogOperation(chatDir, operationId))
+    const legacyOperationId = postBootstrapWelcomeOperationId(aid);
+    if (hasMessageLogOperation(chatDir, operationId) || hasMessageLogOperation(chatDir, legacyOperationId))
+        return;
+    const legacy = outbox.findByDedupeKey(aid, legacyOperationId);
+    if (legacy?.channelId === owner)
         return;
     const existing = outbox.findByDedupeKey(aid, operationId);
     if (existing
@@ -68,21 +80,30 @@ export function preparePostBootstrapWelcomeOutbox(aid, owner, ownerName, deliver
     });
 }
 export function hasPendingPostBootstrapWelcomeOutbox(aid) {
-    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    return !!entry && outbox.isDeliveryForChannel(entry.delivery, entry.channelId);
+    return findPostBootstrapWelcomeOutbox(aid)
+        .some(entry => outbox.isDeliveryForChannel(entry.delivery, entry.channelId));
+}
+/** Keep pending welcomes from the single-owner v1 format retryable after upgrades. */
+export function findPostBootstrapWelcomeOutbox(aid, opts = {}) {
+    const normalizedAid = aid.replace(/^@/, '');
+    const entries = outbox.findByDedupePrefix(normalizedAid, `bootstrap-complete:v2:${normalizedAid}:`, opts);
+    const legacy = outbox.findByDedupeKey(normalizedAid, postBootstrapWelcomeOperationId(normalizedAid), opts);
+    return [...entries, ...(legacy ? [legacy] : [])];
+}
+export function pendingPostBootstrapWelcomeOwners(aid) {
+    return findPostBootstrapWelcomeOutbox(aid)
+        .filter(entry => outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
+        .map(entry => entry.channelId)
+        .filter((owner, index, all) => all.indexOf(owner) === index);
 }
 /** Bind the durable completion welcome to the fresh post-bootstrap session. */
-export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId) {
-    const entry = outbox.findByDedupeKey(aid, postBootstrapWelcomeOperationId(aid));
-    if (!entry || !outbox.isDeliveryForChannel(entry.delivery, entry.channelId))
+export function bindPostBootstrapWelcomeOutboxSession(aid, sessionId, owner) {
+    const normalizedAid = aid.replace(/^@/, '');
+    const entries = findPostBootstrapWelcomeOutbox(normalizedAid)
+        .filter(entry => (!owner || entry.channelId === owner) && outbox.isDeliveryForChannel(entry.delivery, entry.channelId));
+    // A session is scoped to one peer: never silently pick an arbitrary Owner.
+    if (!entries.length || (!owner && new Set(entries.map(entry => entry.channelId)).size !== 1))
         return false;
-    if (entry.context?.sessionId === sessionId)
-        return true;
-    return outbox.replaceIfRouteMatches(aid, entry, {
-        ...entry,
-        context: {
-            ...(entry.context ?? {}),
-            sessionId,
-        },
-    }) === 'replaced';
+    return entries.every(entry => entry.context?.sessionId === sessionId
+        || outbox.replaceIfRouteMatches(normalizedAid, entry, { ...entry, context: { ...(entry.context ?? {}), sessionId } }) === 'replaced');
 }

package/dist/core/bootstrap-service.js

@@ -52,32 +52,38 @@ export async function completeBootstrapWithWelcome(service, aid, welcome, sessio
                 reloaded: false,
             };
         }
-        try {
-            mainSession = await sessions.ensurePostBootstrapMainSession();
-        }
-        catch (e) {
-            return {
-                ok: false,
-                code: 'MAIN_SESSION_CREATE_FAILED',
-                error: e instanceof Error ? e.message : `Failed to create the post-bootstrap main session for ${aid}`,
-                reloaded: false,
-            };
-        }
-        if (!mainSession.sessionId) {
-            return {
-                ok: false,
-                code: 'MAIN_SESSION_CREATE_FAILED',
-                error: `Failed to create the post-bootstrap main session for ${aid}`,
-                reloaded: false,
-            };
-        }
-        if (welcomePending && welcome && !await welcome.bindPostBootstrapWelcomeToSession(mainSession.sessionId)) {
-            return {
-                ok: false,
-                code: 'WELCOME_SESSION_BIND_FAILED',
-                error: `Failed to bind the post-bootstrap welcome to session ${mainSession.sessionId}`,
-                reloaded: false,
-            };
+        const pendingOwners = welcome?.pendingPostBootstrapWelcomeOwners?.();
+        const sessionOwners = pendingOwners?.length ? pendingOwners : [undefined];
+        for (const owner of sessionOwners) {
+            let ownerSession;
+            try {
+                ownerSession = await sessions.ensurePostBootstrapMainSession(owner);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    code: 'MAIN_SESSION_CREATE_FAILED',
+                    error: e instanceof Error ? e.message : `Failed to create the post-bootstrap main session for ${aid}`,
+                    reloaded: false,
+                };
+            }
+            if (!ownerSession.sessionId) {
+                return {
+                    ok: false,
+                    code: 'MAIN_SESSION_CREATE_FAILED',
+                    error: `Failed to create the post-bootstrap main session for ${aid}`,
+                    reloaded: false,
+                };
+            }
+            if (welcomePending && welcome && !await welcome.bindPostBootstrapWelcomeToSession(ownerSession.sessionId, owner)) {
+                return {
+                    ok: false,
+                    code: 'WELCOME_SESSION_BIND_FAILED',
+                    error: `Failed to bind the post-bootstrap welcome to session ${ownerSession.sessionId}`,
+                    reloaded: false,
+                };
+            }
+            mainSession ??= ownerSession;
         }
     }
     const result = service.completeBootstrap(aid);

package/dist/core/capability/capability-manager.js

@@ -13,10 +13,11 @@ function defaultTypeConfig() {
     return { mode: 'inherit', overrides: {} };
 }
 function resolveBaseagent(input) {
-    return input.baseagent
+    const value = input.baseagent
         || input.sessionBaseagent
-        || input.config?.active_baseagent
-        || 'claude';
+        || input.config?.active_baseagent;
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    return normalized || undefined;
 }
 export function resolveCapabilityContext(input) {
     const aid = input.aid || input.config?.aid;
@@ -25,9 +26,12 @@ export function resolveCapabilityContext(input) {
     const projectPath = input.config?.projects?.defaultPath || input.projectPath || input.sessionProjectPath || null;
     if (!projectPath)
         return { error: '无法解析当前 agent projectPath', code: 'NO_PROJECT' };
+    const baseagent = resolveBaseagent(input);
+    if (!baseagent)
+        return { error: '无法解析当前 agent 的 baseagent', code: 'BASEAGENT_REQUIRED' };
     return {
         aid,
-        baseagent: resolveBaseagent(input),
+        baseagent,
         projectPath,
     };
 }

package/dist/core/capability/providers/codex-capability-provider.js

@@ -1,6 +1,6 @@
 import os from 'os';
 import path from 'path';
-import { execCodexCliSync } from '../../../utils/codex-cli.js';
+import { execCodexCliSync } from '../../../agents/baseagent.js';
 import { discoverSkillDirectories } from '../skill-discovery.js';
 function discoverSkills(ctx) {
     const roots = [