evolcore 0.0.24 → 0.0.25

package/dist/core/message/response-engine.js

@@ -2998,6 +2998,12 @@ export class ResponseEngine {
                         bootstrapAgentMdPath: agentMdPath(selfAid),
                     };
                 }
+                if (selfAid && peerRole === 'owner' && effectivePermissionMode !== 'readonly') {
+                    modelOverride = {
+                        ...(modelOverride || {}),
+                        personalMdPath: path.join(resolveRoot(), 'agents', selfAid, 'personal', 'personal.md'),
+                    };
+                }
                 if (normalizedBaseagent.canonical === 'claude') {
                     modelOverride = {
                         ...(modelOverride || {}),
@@ -4561,12 +4567,12 @@ export class ResponseEngine {
                 return undefined;
             const shouldClose = !writerDb;
             try {
-                const row = db.prepare(`SELECT model, input_tokens, cache_creation_tokens, cache_read_tokens,
-                  context_tokens, max_tokens, auto_compact_tokens
-             FROM model_calls
-            WHERE session_id = ?
-              AND agent_session_id = ?
-            ORDER BY ts DESC, call_index DESC
+                const row = db.prepare(`SELECT model, input_tokens, cache_creation_tokens, cache_read_tokens,
+                  context_tokens, max_tokens, auto_compact_tokens
+             FROM model_calls
+            WHERE session_id = ?
+              AND agent_session_id = ?
+            ORDER BY ts DESC, call_index DESC
             LIMIT 1`).get(sessionId, agentSessionId);
                 if (!row)
                     return undefined;

package/dist/core/permission/tool-policy.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import os from 'os';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
@@ -41,6 +42,14 @@ export function expandManagedTempPath(value, options = {}) {
 }
 const WRITE_INTENT_RE = /(?:^|[\s;&|])(?:mkdir|mktemp|touch|tee|cp|mv|install|chmod|chown|ln|rm)(?:[\s;&|]|$)|(?:^|[\s])(?:\d>>?|>>?)\s*/i;
 const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/tmp(?:\/|$)|\/var\/tmp(?:\/|$)|\/dev\/shm(?:\/|$))[^\s'";&|<>)]*/g;
+function windowsTempRoots(options) {
+    if (process.platform !== 'win32')
+        return [];
+    return [os.tmpdir(), options.env?.TEMP, options.env?.TMP, process.env.TEMP, process.env.TMP]
+        .filter((value) => typeof value === 'string' && path.isAbsolute(value))
+        .map(value => resolveProtectedCandidate(value))
+        .filter((value, index, values) => values.indexOf(value) === index);
+}
 /**
  * Inspect shell write targets that look like temporary paths. Ordinary
  * project writes are left to the existing workspace/H-class policy; any
@@ -52,19 +61,32 @@ export function checkManagedTempShellCommand(command, options = {}) {
     const root = resolveManagedTempDir(options.env);
     const normalized = substituteTmpDir(command, root);
     const candidates = [...normalized.matchAll(TEMP_TOKEN_RE)].map(match => match[0].replace(/[.,:]+$/, ''));
-    if (candidates.length === 0)
+    // Windows has no portable `/tmp` spelling. Treat absolute paths below the
+    // host temporary roots as temporary operands too, so a sibling session
+    // directory cannot bypass the managed TMPDIR check.
+    if (process.platform === 'win32') {
+        const roots = windowsTempRoots(options);
+        const windowsCandidates = normalized.match(/[A-Za-z]:[\\/][^\s'";&|<>)]*/g) ?? [];
+        for (const candidate of windowsCandidates) {
+            const canonical = resolveProtectedCandidate(candidate.replace(/[.,:]+$/, ''), options.cwd);
+            if (roots.some(root => isSameOrDescendant(canonical, root)))
+                candidates.push(candidate.replace(/[.,:]+$/, ''));
+        }
+    }
+    const uniqueCandidates = [...new Set(candidates)];
+    if (uniqueCandidates.length === 0)
         return { kind: 'none' };
     if (!root) {
-        return { kind: 'deny', paths: candidates, reason: 'TMPDIR is unset or not an absolute managed path' };
+        return { kind: 'deny', paths: uniqueCandidates, reason: 'TMPDIR is unset or not an absolute managed path' };
     }
-    const outside = candidates.filter(candidate => !isManagedTempPath(candidate, {
+    const outside = uniqueCandidates.filter(candidate => !isManagedTempPath(candidate, {
         ...options,
         env: { ...(options.env ?? process.env), TMPDIR: root },
     }));
     if (outside.length > 0) {
         return { kind: 'deny', paths: outside, reason: 'temporary write target is outside the session-managed TMPDIR' };
     }
-    return { kind: 'allow', paths: candidates };
+    return { kind: 'allow', paths: uniqueCandidates };
 }
 /**
  * Replace only already-validated temporary path operands before a second
@@ -2237,16 +2259,33 @@ export function evaluateToolPreflight(toolName, input, context) {
             && managedAidArgv[2] === 'agentmd'
             && managedAidArgv[3] === 'put'
             && ownAid;
+        const avatarFileIndex = managedAidArgv?.indexOf('--file') ?? -1;
+        const avatarUrlIndex = managedAidArgv?.indexOf('--url') ?? -1;
+        const avatarSourceIndex = avatarFileIndex >= 0 ? avatarFileIndex : avatarUrlIndex;
+        const isSelfAvatarUpload = !!managedAidArgv
+            && (avatarSourceIndex === 4)
+            && managedAidArgv.length === 6
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'avatar'
+            && !!context.selfAid
+            && managedAidArgv[3]?.replace(/^@/, '') === context.selfAid.replace(/^@/, '')
+            && !!managedAidArgv[5]
+            && !managedAidArgv[5].startsWith('-');
         const canPublishSelfAgentMd = isSelfAgentMdPublish
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
-        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd;
+        const canUploadSelfAvatar = isSelfAvatarUpload
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd || canUploadSelfAvatar;
         if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
                 message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
                     ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
-                    : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put。',
+                    : isSelfAvatarUpload && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                        ? `🔒 ${context.permissionMode} 模式禁止上传头像；请切换到 request 或 bypass 后再执行 \`ec aid avatar <当前 self AID> (--file <path> 或 --url <https-url>)\`。`
+                        : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 及 `ec aid avatar` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put/avatar。',
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }

package/dist/index.js

@@ -333,153 +333,153 @@ function seedUpgradeCheckTrigger(manager, owner) {
     // take the watchdog down with it.
     const monitorEntry = platform.resolveCliEntry(packageRoot);
     const stageParent = path.join(resolvePaths().root, 'data', 'monitor-stage');
-    fs.writeFileSync(scriptPath, `#!/usr/bin/env node
-const fs = require('node:fs');
-const path = require('node:path');
-const { existsSync, readFileSync } = fs;
-const { spawn } = require('node:child_process');
-
-const CLI_PATH = ${JSON.stringify(monitorEntry.entry)};
-const CLI_ARGS = ${JSON.stringify(monitorEntry.args)};
-const PACKAGE_ROOT = ${JSON.stringify(packageRoot)};
-const STAGE_PARENT = ${JSON.stringify(stageParent)};
-const PACKAGE_JSON = ${JSON.stringify(packageJsonPath)};
-const PACKAGE_NAME = ${JSON.stringify(MAIN_PACKAGE_NAME)};
-const DEV_MODE = ${devMode ? 'true' : 'false'};
-
-function emit(outcome, text) {
-  process.stdout.write(JSON.stringify({ outcome, text, files: [] }));
-}
-
-function compareVersions(a, b) {
-  const pa = a.split('-')[0].split('.').map(Number);
-  const pb = b.split('-')[0].split('.').map(Number);
-  const count = Math.max(pa.length, pb.length);
-  for (let i = 0; i < count; i += 1) {
-    const av = Number.isFinite(pa[i]) ? pa[i] : 0;
-    const bv = Number.isFinite(pb[i]) ? pb[i] : 0;
-    if (av < bv) return -1;
-    if (av > bv) return 1;
-  }
-  return 0;
-}
-
-async function latestVersion() {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 10_000);
-  try {
-    const response = await fetch('https://registry.npmjs.org/' + encodeURIComponent(PACKAGE_NAME) + '/latest', {
-      signal: controller.signal,
-      headers: { Accept: 'application/json' },
-    });
-    if (!response.ok) return null;
-    const data = await response.json();
-    return typeof data.version === 'string' ? data.version : null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-async function main() {
-  if (DEV_MODE) {
-    emit('noop', 'upgrade check skipped in dev mode');
-    return;
-  }
-
-  let localVersion;
-  try {
-    localVersion = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version;
-  } catch {
-    emit('error', 'failed to read local ec version');
-    return;
-  }
-  if (typeof localVersion !== 'string' || !localVersion) {
-    emit('error', 'failed to read local ec version');
-    return;
-  }
-
-  let remoteVersion;
-  try {
-    remoteVersion = await latestVersion();
-  } catch {
-    remoteVersion = null;
-  }
-  if (!remoteVersion) {
-    emit('error', 'failed to check evolcore latest version');
-    return;
-  }
-  if (compareVersions(localVersion, remoteVersion) >= 0) {
-    emit('noop', 'evolcore is already up to date (' + localVersion + '; latest ' + remoteVersion + ')');
-    return;
-  }
-  if (!existsSync(CLI_PATH)) {
-    emit('error', 'restart-monitor entry not found: ' + CLI_PATH);
-    return;
-  }
-
-  // Installed mode: copy the monitor out of the package before it upgrades that
-  // same package. Mirrors prepareMonitorStage(); kept inline because this file
-  // is generated standalone CJS. Any failure degrades to launching in place —
-  // losing upgrade isolation beats losing the upgrade.
-  let launchArgs = CLI_ARGS;
-  const launchEnv = { ...process.env };
-  if (!DEV_MODE && STAGE_PARENT) {
-    try {
-      const stageDir = path.join(STAGE_PARENT, 'upgrade-' + process.pid + '-' + Date.now());
-      fs.mkdirSync(stageDir, { recursive: true });
-      fs.cpSync(path.join(PACKAGE_ROOT, 'dist'), path.join(stageDir, 'dist'), { recursive: true });
-      if (existsSync(PACKAGE_JSON)) fs.copyFileSync(PACKAGE_JSON, path.join(stageDir, 'package.json'));
-      const modulesSource = path.join(PACKAGE_ROOT, 'node_modules');
-      if (existsSync(modulesSource)) {
-        const staged = path.join(stageDir, 'node_modules');
-        try {
-          // junction works unelevated on Windows; dir symlink elsewhere.
-          fs.symlinkSync(modulesSource, staged, process.platform === 'win32' ? 'junction' : 'dir');
-          fs.readdirSync(staged);
-        } catch (linkError) {
-          fs.rmSync(staged, { recursive: true, force: true });
-          fs.cpSync(modulesSource, staged, { recursive: true });
-        }
-      }
-      const stagedEntry = path.join(stageDir, 'dist', 'cli', 'index.js');
-      if (existsSync(stagedEntry)) {
-        launchArgs = [stagedEntry];
-        launchEnv.EVOLCORE_TARGET_PACKAGE_ROOT = PACKAGE_ROOT;
-        launchEnv.EVOLCORE_MONITOR_STAGE = stageDir;
-      }
-    } catch (stageError) {
-      // Fall through with the in-place entry.
-    }
-  }
-
-  try {
-    const child = spawn(process.execPath, [...launchArgs, 'restart-monitor'], {
-      detached: true,
-      stdio: 'ignore',
-      windowsHide: process.platform === 'win32',
-      env: launchEnv,
-    });
-    child.unref();
-    const pid = child.pid;
-    // The daemon is still running here — the monitor is what stops it. So a
-    // monitor that dies on load costs the upgrade, not the service; still,
-    // report it accurately instead of claiming success.
-    await new Promise(resolve => setTimeout(resolve, 3000));
-    let alive = false;
-    try { process.kill(pid, 0); alive = true; } catch (e) { alive = false; }
-    if (!alive) {
-      emit('error', 'restart-monitor exited during startup; upgrade to ' + remoteVersion + ' not applied');
-      return;
-    }
-    emit('success', 'evolcore upgrade available: ' + localVersion + ' -> ' + remoteVersion + '; restart-monitor started');
-  } catch (error) {
-    emit('error', 'failed to start restart-monitor: ' + (error && error.message ? error.message : String(error)));
-  }
-}
-
-main().catch((error) => {
-  emit('error', 'upgrade check failed: ' + (error && error.message ? error.message : String(error)));
-});
+    fs.writeFileSync(scriptPath, `#!/usr/bin/env node
+const fs = require('node:fs');
+const path = require('node:path');
+const { existsSync, readFileSync } = fs;
+const { spawn } = require('node:child_process');
+
+const CLI_PATH = ${JSON.stringify(monitorEntry.entry)};
+const CLI_ARGS = ${JSON.stringify(monitorEntry.args)};
+const PACKAGE_ROOT = ${JSON.stringify(packageRoot)};
+const STAGE_PARENT = ${JSON.stringify(stageParent)};
+const PACKAGE_JSON = ${JSON.stringify(packageJsonPath)};
+const PACKAGE_NAME = ${JSON.stringify(MAIN_PACKAGE_NAME)};
+const DEV_MODE = ${devMode ? 'true' : 'false'};
+
+function emit(outcome, text) {
+  process.stdout.write(JSON.stringify({ outcome, text, files: [] }));
+}
+
+function compareVersions(a, b) {
+  const pa = a.split('-')[0].split('.').map(Number);
+  const pb = b.split('-')[0].split('.').map(Number);
+  const count = Math.max(pa.length, pb.length);
+  for (let i = 0; i < count; i += 1) {
+    const av = Number.isFinite(pa[i]) ? pa[i] : 0;
+    const bv = Number.isFinite(pb[i]) ? pb[i] : 0;
+    if (av < bv) return -1;
+    if (av > bv) return 1;
+  }
+  return 0;
+}
+
+async function latestVersion() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 10_000);
+  try {
+    const response = await fetch('https://registry.npmjs.org/' + encodeURIComponent(PACKAGE_NAME) + '/latest', {
+      signal: controller.signal,
+      headers: { Accept: 'application/json' },
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return typeof data.version === 'string' ? data.version : null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function main() {
+  if (DEV_MODE) {
+    emit('noop', 'upgrade check skipped in dev mode');
+    return;
+  }
+
+  let localVersion;
+  try {
+    localVersion = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version;
+  } catch {
+    emit('error', 'failed to read local ec version');
+    return;
+  }
+  if (typeof localVersion !== 'string' || !localVersion) {
+    emit('error', 'failed to read local ec version');
+    return;
+  }
+
+  let remoteVersion;
+  try {
+    remoteVersion = await latestVersion();
+  } catch {
+    remoteVersion = null;
+  }
+  if (!remoteVersion) {
+    emit('error', 'failed to check evolcore latest version');
+    return;
+  }
+  if (compareVersions(localVersion, remoteVersion) >= 0) {
+    emit('noop', 'evolcore is already up to date (' + localVersion + '; latest ' + remoteVersion + ')');
+    return;
+  }
+  if (!existsSync(CLI_PATH)) {
+    emit('error', 'restart-monitor entry not found: ' + CLI_PATH);
+    return;
+  }
+
+  // Installed mode: copy the monitor out of the package before it upgrades that
+  // same package. Mirrors prepareMonitorStage(); kept inline because this file
+  // is generated standalone CJS. Any failure degrades to launching in place —
+  // losing upgrade isolation beats losing the upgrade.
+  let launchArgs = CLI_ARGS;
+  const launchEnv = { ...process.env };
+  if (!DEV_MODE && STAGE_PARENT) {
+    try {
+      const stageDir = path.join(STAGE_PARENT, 'upgrade-' + process.pid + '-' + Date.now());
+      fs.mkdirSync(stageDir, { recursive: true });
+      fs.cpSync(path.join(PACKAGE_ROOT, 'dist'), path.join(stageDir, 'dist'), { recursive: true });
+      if (existsSync(PACKAGE_JSON)) fs.copyFileSync(PACKAGE_JSON, path.join(stageDir, 'package.json'));
+      const modulesSource = path.join(PACKAGE_ROOT, 'node_modules');
+      if (existsSync(modulesSource)) {
+        const staged = path.join(stageDir, 'node_modules');
+        try {
+          // junction works unelevated on Windows; dir symlink elsewhere.
+          fs.symlinkSync(modulesSource, staged, process.platform === 'win32' ? 'junction' : 'dir');
+          fs.readdirSync(staged);
+        } catch (linkError) {
+          fs.rmSync(staged, { recursive: true, force: true });
+          fs.cpSync(modulesSource, staged, { recursive: true });
+        }
+      }
+      const stagedEntry = path.join(stageDir, 'dist', 'cli', 'index.js');
+      if (existsSync(stagedEntry)) {
+        launchArgs = [stagedEntry];
+        launchEnv.EVOLCORE_TARGET_PACKAGE_ROOT = PACKAGE_ROOT;
+        launchEnv.EVOLCORE_MONITOR_STAGE = stageDir;
+      }
+    } catch (stageError) {
+      // Fall through with the in-place entry.
+    }
+  }
+
+  try {
+    const child = spawn(process.execPath, [...launchArgs, 'restart-monitor'], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: process.platform === 'win32',
+      env: launchEnv,
+    });
+    child.unref();
+    const pid = child.pid;
+    // The daemon is still running here — the monitor is what stops it. So a
+    // monitor that dies on load costs the upgrade, not the service; still,
+    // report it accurately instead of claiming success.
+    await new Promise(resolve => setTimeout(resolve, 3000));
+    let alive = false;
+    try { process.kill(pid, 0); alive = true; } catch (e) { alive = false; }
+    if (!alive) {
+      emit('error', 'restart-monitor exited during startup; upgrade to ' + remoteVersion + ' not applied');
+      return;
+    }
+    emit('success', 'evolcore upgrade available: ' + localVersion + ' -> ' + remoteVersion + '; restart-monitor started');
+  } catch (error) {
+    emit('error', 'failed to start restart-monitor: ' + (error && error.message ? error.message : String(error)));
+  }
+}
+
+main().catch((error) => {
+  emit('error', 'upgrade check failed: ' + (error && error.message ? error.message : String(error)));
+});
 `);
     // Remove the pre-Node script left by older installations so it cannot be
     // selected by a stale trigger definition or run manually by accident.
@@ -3663,7 +3663,8 @@ async function main() {
             });
             if (params.targetAid
                 && params.targetAid !== delegation.grant.selfAid
-                && subject.dataScope !== 'daemon') {
+                && subject.dataScope !== 'daemon'
+                && !(operation === 'agent.show' && isManagementRole(subject.role))) {
                 return { ok: false, code: 'SCOPE_MISMATCH', error: 'only the current Agent can be targeted' };
             }
             const decision = authorizeOperation({
@@ -3710,18 +3711,21 @@ async function main() {
             const taskAid = delegation.grant.selfAid;
             const targetAid = sub === 'list'
                 ? undefined
-                : sub === 'show'
-                    ? (argv[2] && !argv[2].startsWith('--') ? argv[2] : taskAid)
-                    : sub === 'reload'
-                        ? (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined)
-                        : (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined);
+                : sub === 'persona'
+                    ? taskAid
+                    : sub === 'show'
+                        ? (argv[2] && !argv[2].startsWith('--') ? argv[2] : taskAid)
+                        : sub === 'reload'
+                            ? (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined)
+                            : (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined);
             const operation = sub === 'list' ? 'agent.list'
                 : sub === 'show' ? 'agent.show'
-                    : sub === 'new' ? 'agent.create'
-                        : sub === 'enable' ? 'agent.enable'
-                            : sub === 'disable' ? 'agent.disable'
-                                : sub === 'reload' ? 'agent.reload'
-                                    : sub === 'delete' ? 'agent.delete' : undefined;
+                    : sub === 'persona' ? 'agent.persona'
+                        : sub === 'new' ? 'agent.create'
+                            : sub === 'enable' ? 'agent.enable'
+                                : sub === 'disable' ? 'agent.disable'
+                                    : sub === 'reload' ? 'agent.reload'
+                                        : sub === 'delete' ? 'agent.delete' : undefined;
             if (!operation)
                 return fail('INVALID_ARGS', `unsupported managed agent command: ${sub}`);
             if (sub === 'new' && !argv.includes('--non-interactive')) {
@@ -3753,7 +3757,7 @@ async function main() {
                 subject,
                 intent: {
                     operation,
-                    scope: operation === 'agent.show'
+                    scope: operation === 'agent.show' || operation === 'agent.persona'
                         ? 'agent'
                         : operation === 'agent.reload' && targetAid
                             ? 'agent'
@@ -3809,16 +3813,50 @@ async function main() {
                         },
                         connection: agent.connection ?? null,
                         sessions: agent.sessions ?? { active: 0, last_activity: null },
-                        paths: { config: null, agent_md: null, project: null, data: null },
-                        redacted: true,
+                        paths: subject.dataScope === 'daemon'
+                            ? (agent.paths ?? { config: null, agent_md: null, project: null, data: null })
+                            : { config: null, agent_md: null, project: null, data: null },
+                        ...(subject.dataScope === 'daemon' ? {} : { redacted: true }),
                         ...(agent.createProgress ? { createProgress: agent.createProgress } : {}),
                     } };
             }
+            if (operation === 'agent.persona') {
+                const rawPersonaArgs = argv.slice(2);
+                const hasFormatSuffix = rawPersonaArgs.length >= 2
+                    && rawPersonaArgs.at(-2) === '--format'
+                    && rawPersonaArgs.at(-1) === 'json';
+                const personaArgs = hasFormatSuffix ? rawPersonaArgs.slice(0, -2) : rawPersonaArgs;
+                if (!hasFormatSuffix && rawPersonaArgs.includes('--format')) {
+                    return fail('INVALID_ARGS', 'persona 仅支持末尾的 --format json');
+                }
+                if (personaArgs.length === 2 && personaArgs[0] === '--file') {
+                    return fail('INVALID_ARGS', '托管 persona --file 必须由 CLI 读取后作为文本提交');
+                }
+                const wantsShow = personaArgs.length === 1 && personaArgs[0] === 'show';
+                const text = personaArgs.length === 2 && personaArgs[0] === '--text'
+                    ? personaArgs[1]
+                    : undefined;
+                if (!wantsShow && !(personaArgs.length === 2 && personaArgs[0] === '--text')) {
+                    return fail('INVALID_ARGS', '用法: ec agent persona show | --text <text>');
+                }
+                if (text === undefined && !wantsShow)
+                    return fail('INVALID_ARGS', 'persona --text 缺少参数');
+                const { agentPersona } = await import('./cli/agent.js');
+                const result = await agentPersona(taskAid, wantsShow ? { trustedLocal: true } : { text, trustedLocal: true });
+                if (!result.ok)
+                    return fail(result.code ?? 'INTERNAL', result.error);
+                return { ok: true, result: {
+                        ok: true,
+                        aid: taskAid,
+                        content: result.content,
+                        ...(result.saved ? { saved: true } : {}),
+                    } };
+            }
             if (operation === 'agent.create') {
                 const aid = argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined;
                 if (!aid)
                     return fail('INVALID_ARGS', 'ec agent new requires an AID');
-                const { agentCreateNonInteractive, resolveAgentCreatePlan, validateAgentCreatePlan, parseAgentOwnerArgs } = await import('./cli/agent-create.js');
+                const { agentCreateNonInteractive, resolveAgentCreatePlan, validateAgentCreatePlan, parseAgentOwnerArgs, parseAgentTags } = await import('./cli/agent-create.js');
                 let ownerOptions;
                 try {
                     ownerOptions = parseAgentOwnerArgs(argv);
@@ -3826,6 +3864,13 @@ async function main() {
                 catch (error) {
                     return fail('INVALID_ARGS', error instanceof Error ? error.message : String(error));
                 }
+                let tags;
+                try {
+                    tags = parseAgentTags(value('--tags'));
+                }
+                catch (error) {
+                    return fail('INVALID_ARGS', error instanceof Error ? error.message : String(error));
+                }
                 const plan = resolveAgentCreatePlan({
                     aid,
                     project: value('--project'),
@@ -3834,6 +3879,7 @@ async function main() {
                     handoff: value('--handoff'),
                     name: value('--name'),
                     description: value('--description'),
+                    tags,
                     force: argv.includes('--force'),
                 });
                 const validationError = validateAgentCreatePlan(plan);
@@ -3890,6 +3936,7 @@ async function main() {
                     owners: plan.owners,
                     name: plan.name,
                     description: plan.description,
+                    tags: plan.tags,
                     force: argv.includes('--force'),
                 };
                 try {