evolcore 0.0.24 → 0.0.26

package/dist/core/handoff/store.js

@@ -33,6 +33,9 @@ function normalizeReturnContent(content) {
 function contentHash(content) {
     return crypto.createHash('sha256').update(content, 'utf8').digest('hex');
 }
+function newReturnResultId() {
+    return `hr-${crypto.randomBytes(8).toString('hex')}`;
+}
 function boundedQueryLimit(limit) {
     if (typeof limit !== 'number' || !Number.isInteger(limit))
         return HANDOFF_QUERY_DEFAULT_LIMIT;
@@ -111,6 +114,9 @@ export class HandoffStore {
         fs.renameSync(pendingPath, filePath);
     }
     create(input) {
+        if (input.handoffContext !== undefined && (typeof input.handoffContext !== 'string'
+            || !input.handoffContext.trim() || input.handoffContext.length > 64 * 1024))
+            throw new Error('invalid handoff context');
         const now = input.now ?? Date.now();
         const handoffId = newHandoffId();
         const instance = {
@@ -123,6 +129,7 @@ export class HandoffStore {
                 payload: clonePayload(input.payload),
                 encrypt: input.encrypt,
                 ...(input.contextOnly ? { contextOnly: true } : {}),
+                ...(input.handoffContext ? { context: input.handoffContext } : {}),
                 ...(input.delivery ? { delivery: input.delivery } : {}),
             },
             ...(input.originAuthorization
@@ -143,6 +150,7 @@ export class HandoffStore {
             return_content: null,
             return_content_hash: null,
             origin_delivery_message_id: null,
+            ...((input.returnPolicy ?? 'required') === 'required' && !input.contextOnly ? { return_results: [] } : {}),
             attention_required: false,
             attention_reason: null,
             version: 1,
@@ -401,7 +409,12 @@ export class HandoffStore {
         if ('ok' in selected)
             return selected;
         const { instance, selectedBy } = selected;
-        if (instance.target_session_id !== input.currentSessionId || instance.consumed_target_session_id !== input.currentSessionId) {
+        const directSessionMatch = instance.target_session_id === input.currentSessionId
+            && instance.consumed_target_session_id === input.currentSessionId;
+        const recoveryAuthorized = !!input.recovery
+            && input.recovery.recoverySessionId === input.currentSessionId
+            && input.recovery.actorId === instance.origin_authorization?.actorId;
+        if (!directSessionMatch && !recoveryAuthorized) {
             return {
                 ok: false,
                 code: 'HANDOFF_TARGET_SESSION_MISMATCH',
@@ -430,6 +443,110 @@ export class HandoffStore {
             };
         }
         const hash = contentHash(normalized);
+        const previousState = instance.state;
+        // New required handoffs expose an append-only result stream. The parent
+        // remains return_pending while each result is delivered and consumed.
+        if (instance.return_policy === 'required' && Array.isArray(instance.return_results)) {
+            if (instance.state !== 'return_pending' && instance.state !== 'completed') {
+                const existing = instance.return_results.find(result => result.content_hash === hash);
+                if (existing) {
+                    return {
+                        ok: true,
+                        code: 'HANDOFF_RETURN_ALREADY_APPLIED',
+                        handoff_id: instance.handoff_id,
+                        selected_by: selectedBy,
+                        previous_state: instance.state,
+                        state: instance.state,
+                        idempotent: true,
+                        result_id: existing.result_id,
+                    };
+                }
+                return {
+                    ok: false,
+                    code: 'HANDOFF_NOT_RETURNABLE',
+                    error: 'handoff is not return_pending',
+                    handoff_id: instance.handoff_id,
+                    state: instance.state,
+                };
+            }
+            if (!normalized.trim()) {
+                return {
+                    ok: false,
+                    code: 'HANDOFF_RETURN_CONTENT_REQUIRED',
+                    error: 'return content is required',
+                    handoff_id: instance.handoff_id,
+                    state: instance.state,
+                };
+            }
+            const existing = instance.return_results.find(result => result.content_hash === hash);
+            if (existing) {
+                return {
+                    ok: true,
+                    code: 'HANDOFF_RETURN_ALREADY_APPLIED',
+                    handoff_id: instance.handoff_id,
+                    selected_by: selectedBy,
+                    previous_state: instance.state,
+                    state: instance.state,
+                    idempotent: true,
+                    result_id: existing.result_id,
+                };
+            }
+            const now = input.now ?? Date.now();
+            const previousVersion = instance.version;
+            const result = {
+                result_id: newReturnResultId(),
+                seq: instance.return_results.reduce((max, item) => Math.max(max, item.seq), 0) + 1,
+                content: normalized,
+                content_hash: hash,
+                state: 'origin_queued',
+                origin_delivery_message_id: null,
+                return_causation: normalizeCausation(input.returnCausation),
+                created_at: now,
+                updated_at: now,
+                completed_at: null,
+            };
+            instance.return_results.push(result);
+            instance.return_causation = result.return_causation;
+            instance.version++;
+            instance.updated_at = now;
+            try {
+                this.appendEvent(input.selfAid, 'return_accepted', instance.handoff_id, {
+                    operationKey: `handoff-return:${instance.handoff_id}:${result.result_id}`,
+                    fromVersion: previousVersion,
+                    toVersion: instance.version,
+                    details: {
+                        return_policy: instance.return_policy,
+                        result_id: result.result_id,
+                        seq: result.seq,
+                        ...(recoveryAuthorized
+                            ? { recovery: true, recovery_session_id: input.currentSessionId, recovery_actor_id: input.recovery?.actorId }
+                            : {}),
+                    },
+                    now,
+                });
+                this.write(input.selfAid, instance);
+            }
+            catch {
+                return {
+                    ok: false,
+                    code: 'HANDOFF_STORE_WRITE_FAILED',
+                    error: 'failed to persist handoff return',
+                    handoff_id: instance.handoff_id,
+                    state: previousState,
+                    retryable: true,
+                };
+            }
+            return {
+                ok: true,
+                code: 'HANDOFF_RETURN_ACCEPTED',
+                handoff_id: instance.handoff_id,
+                selected_by: selectedBy,
+                previous_state: previousState,
+                state: instance.state,
+                idempotent: false,
+                result_id: result.result_id,
+            };
+        }
         if (instance.state !== 'return_pending') {
             if (instance.return_content_hash) {
                 if (instance.return_content_hash === hash) {
@@ -469,7 +586,6 @@ export class HandoffStore {
             };
         }
         const now = input.now ?? Date.now();
-        const previousState = instance.state;
         const previousVersion = instance.version;
         instance.state = instance.return_policy === 'none' ? 'completed' : 'origin_queued';
         instance.return_content = instance.return_policy === 'none' ? null : normalized;
@@ -483,7 +599,12 @@ export class HandoffStore {
                 operationKey: `handoff-return:${instance.handoff_id}`,
                 fromVersion: previousVersion,
                 toVersion: instance.version,
-                details: { return_policy: instance.return_policy },
+                details: {
+                    return_policy: instance.return_policy,
+                    ...(recoveryAuthorized
+                        ? { recovery: true, recovery_session_id: input.currentSessionId, recovery_actor_id: input.recovery?.actorId }
+                        : {}),
+                },
                 now,
             });
             this.write(input.selfAid, instance);
@@ -524,6 +645,31 @@ export class HandoffStore {
         this.write(selfAid, instance);
         return instance;
     }
+    recordOriginResultEnqueued(selfAid, handoffId, resultId, messageId, now = Date.now()) {
+        const instance = this.get(selfAid, handoffId);
+        if (!instance)
+            throw new Error('handoff not found');
+        const result = instance.return_results?.find(item => item.result_id === resultId);
+        if (!result)
+            throw new Error('handoff result not found');
+        if (result.state !== 'origin_queued')
+            throw new Error(`handoff result state ${result.state}, expected origin_queued`);
+        const previous = instance.version;
+        result.state = 'origin_delivered';
+        result.origin_delivery_message_id = messageId;
+        result.updated_at = now;
+        instance.version++;
+        instance.updated_at = now;
+        this.appendEvent(selfAid, 'origin_enqueue_succeeded', handoffId, {
+            operationKey: messageId,
+            fromVersion: previous,
+            toVersion: instance.version,
+            details: { result_id: resultId },
+            now,
+        });
+        this.write(selfAid, instance);
+        return instance;
+    }
     recordOriginEnqueueFailed(selfAid, handoffId, error, now = Date.now()) {
         const instance = this.requireState(selfAid, handoffId, 'origin_queued');
         this.appendEvent(selfAid, 'origin_enqueue_failed', handoffId, {
@@ -532,6 +678,19 @@ export class HandoffStore {
             now,
         });
     }
+    recordOriginResultEnqueueFailed(selfAid, handoffId, resultId, error, now = Date.now()) {
+        const instance = this.get(selfAid, handoffId);
+        if (!instance)
+            throw new Error('handoff not found');
+        if (!instance.return_results?.some(item => item.result_id === resultId)) {
+            throw new Error('handoff result not found');
+        }
+        this.appendEvent(selfAid, 'origin_enqueue_failed', handoffId, {
+            operationKey: `origin-deliver:${handoffId}:${resultId}:${instance.origin_session_id}`,
+            details: { error, result_id: resultId },
+            now,
+        });
+    }
     completeOriginContext(selfAid, handoffId, now = Date.now()) {
         const instance = this.requireState(selfAid, handoffId, 'origin_delivered');
         const previous = instance.version;
@@ -548,6 +707,35 @@ export class HandoffStore {
         this.write(selfAid, instance);
         return instance;
     }
+    completeOriginResult(selfAid, handoffId, resultId, now = Date.now()) {
+        const instance = this.get(selfAid, handoffId);
+        if (!instance)
+            throw new Error('handoff not found');
+        const result = instance.return_results?.find(item => item.result_id === resultId);
+        if (!result)
+            throw new Error('handoff result not found');
+        if (result.state !== 'origin_delivered')
+            throw new Error(`handoff result state ${result.state}, expected origin_delivered`);
+        const previous = instance.version;
+        result.state = 'completed';
+        result.updated_at = now;
+        result.completed_at = now;
+        if (instance.return_results.every(item => item.state === 'completed')) {
+            instance.state = 'completed';
+            instance.completed_at = now;
+        }
+        instance.version++;
+        instance.updated_at = now;
+        this.appendEvent(selfAid, 'origin_context_consumed', handoffId, {
+            operationKey: result.origin_delivery_message_id ?? undefined,
+            fromVersion: previous,
+            toVersion: instance.version,
+            details: { result_id: resultId },
+            now,
+        });
+        this.write(selfAid, instance);
+        return instance;
+    }
     discard(selfAid, handoffId, reason, details = {}, now = Date.now()) {
         const instance = this.get(selfAid, handoffId);
         if (!instance)
@@ -617,7 +805,8 @@ export class HandoffStore {
         };
     }
     requestSummary(instance) {
-        return classifyAunPayloadForLog(instance.request.payload).content || '[payload]';
+        const sent = classifyAunPayloadForLog(instance.request.payload).content || '[payload]';
+        return instance.request.context ? `${sent}\n\n[本地交接上下文]\n${instance.request.context}` : sent;
     }
     selectReturnCandidate(input) {
         if (input.handoffId) {

package/dist/core/message/im-renderer.js

@@ -1,6 +1,7 @@
 import { logger } from '../../utils/logger.js';
 import { summarizeToolInput, toolInputForDisplay } from '../../utils/tool-summary.js';
 import { getErrorMessage, isContextTooLongText } from '../../utils/error-utils.js';
+import { tagErrorTextWithEvolcoreVersion } from '../../utils/evolcore-version.js';
 import { DEFAULT_FLUSH_DELAY_MS } from '../../types.js';
 export class IMRenderer {
     opts;
@@ -79,9 +80,9 @@ export class IMRenderer {
     }
     /** 是否有会抑制兜底错误消息的正文/过程内容；lifecycle 边界不算。 */
     hasNonLifecycleContent() {
-        return this.textBuffer.length > 0 || this.itemsQueue.some(it => {
+        return this.textBuffer.trim().length > 0 || this.itemsQueue.some(it => {
             if (it.kind === 'text')
-                return it.text.length > 0;
+                return it.text.trim().length > 0;
             return it.kind !== 'started' && it.kind !== 'completed';
         });
     }
@@ -95,6 +96,21 @@ export class IMRenderer {
             return;
         if (this.textBuffer.length === 0)
             return;
+        // 文件标记过滤后若只剩空白，应立即消费并告警；尤其避免 final-only
+        // 模式把工具调用前的空白继续带到最终回复。
+        const rawText = this.opts.fileMarkerPattern
+            ? this.textBuffer.replace(this.opts.fileMarkerPattern, '')
+            : this.textBuffer;
+        if (!rawText.trim()) {
+            if (this.timer) {
+                clearTimeout(this.timer);
+                this.timer = undefined;
+            }
+            this.textBuffer = '';
+            this.itemsQueue = this.itemsQueue.filter(it => it.kind !== 'text');
+            this.hasSendableText(rawText, 'flushText');
+            return;
+        }
         if (this.suppressIntermediateText()) {
             this.itemsQueue = this.itemsQueue.filter(it => it.kind !== 'text');
             return;
@@ -103,14 +119,8 @@ export class IMRenderer {
             clearTimeout(this.timer);
             this.timer = undefined;
         }
-        // 文件标记过滤：tool_use 前的文本块也不能把 marker 暴露给用户
-        const rawText = this.opts.fileMarkerPattern
-            ? this.textBuffer.replace(this.opts.fileMarkerPattern, '')
-            : this.textBuffer;
         this.textBuffer = '';
-        if (!rawText)
-            return;
-        // 清掉 itemsQueue 中的 text items（已发出）
+        // 清掉已消费的 text items，包括被拦截的纯空白正文。
         this.itemsQueue = this.itemsQueue.filter(it => it.kind !== 'text');
         const payload = { kind: 'result.text', text: rawText, isFinal: false };
         this.sentContent = true;
@@ -164,6 +174,7 @@ export class IMRenderer {
         this.emitProgress('text', outputTokens, turn);
         if (!text)
             return;
+        // 保留流式片段之间的空格/换行；仅在发送完整正文时判定是否纯空白。
         // 同一窗口内连续 text delta 合并到最后一个 text item
         const last = this.itemsQueue[this.itemsQueue.length - 1];
         if (last && last.kind === 'text') {
@@ -302,6 +313,8 @@ export class IMRenderer {
     async sendOperationalNoticeAsText(text) {
         if (!this.opts.operationalNoticesAsText || this.opts.envelope.chatmode === 'proactive' || !text)
             return false;
+        if (!this.hasSendableText(text, 'operational-notice'))
+            return false;
         // 保持与流式正文的到达顺序：先发出已缓冲的正文，再投影运行状态。
         await this.flushText();
         const payload = { kind: 'result.text', text, isFinal: false };
@@ -315,6 +328,17 @@ export class IMRenderer {
     synthCallId() {
         return `synth-${this.opts.envelope.taskId}-${++this.syntheticCallSeq}`;
     }
+    /** Reject blank bodies before sending, without trimming meaningful formatting. */
+    hasSendableText(text, source) {
+        if (text.trim())
+            return true;
+        // An unused buffer is normal. A nonempty whitespace body is diagnostic evidence.
+        if (text.length > 0) {
+            const { envelope, agentAid } = this.opts;
+            logger.warn(`[IMRenderer] Attempted to send empty message, skipping: code=EMPTY_MESSAGE source=${source} task=${envelope.taskId} session=${envelope.sessionId ?? '<none>'} agent=${agentAid ?? envelope.agentName} textLength=${text.length} text=${JSON.stringify(text.slice(0, 80))}`);
+        }
+        return false;
+    }
     /** Convert a structured failed receipt into the same error shape as a rejected sender. */
     receiptError(receipt) {
         return Object.assign(new Error(receipt.error), {
@@ -331,6 +355,18 @@ export class IMRenderer {
             : undefined;
         return value.code === 'OUTBOX_FULL' || cause?.code === 'OUTBOX_FULL';
     }
+    isPermanentActivityError(error) {
+        const value = error && typeof error === 'object' ? error : {};
+        const cause = value.cause && typeof value.cause === 'object'
+            ? value.cause
+            : undefined;
+        const code = String(value.code ?? cause?.code ?? '');
+        return value.permanent === true
+            || value.status === 'failed'
+            || code === 'AUN_SEND_FAILED'
+            || code === '-1'
+            || /payload is too large/i.test(String(value.message ?? value.error ?? ''));
+    }
     /**
      * Serialize durable sends while keeping the chain usable after a rejected
      * operation. Activity queue saturation is best-effort: it is logged, but
@@ -344,9 +380,19 @@ export class IMRenderer {
             }
         });
         const handled = operation.catch(error => {
-            if (payload.kind === 'activity.batch' && this.isOutboxFull(error)) {
-                logger.warn(`[IMRenderer] activity outbox full; continuing without activity batch: ${error instanceof Error ? error.message : String(error)}`);
-                return;
+            if (payload.kind === 'activity.batch') {
+                const detail = error instanceof Error ? error.message : String(error);
+                if (this.isOutboxFull(error)) {
+                    logger.warn(`[IMRenderer] activity outbox full; continuing without activity batch: ${detail}`);
+                    return;
+                }
+                if (this.isPermanentActivityError(error)) {
+                    // Activity is best-effort. A permanent structured-send failure (for
+                    // example an AUN payload-size rejection) must not requeue the same
+                    // item indefinitely or prevent the final result.text from flushing.
+                    logger.warn(`[IMRenderer] activity delivery failed; dropping activity batch and continuing: ${detail}`);
+                    return;
+                }
             }
             throw error;
         });
@@ -432,22 +478,25 @@ export class IMRenderer {
         // 文件标记过滤：marker 任何时候都不该出现在用户文本里，必须在 *每次* flush
         // （含非最终的定时 flush）执行。否则文本块若滞留 buffer 后被定时器触发，会走
         // 下方非-final 的 result.text 路径，把 [SEND_FILE:...] 原样发给用户。
-        // 非最终 flush 不做 trim，避免 trim 掉 Markdown 块级换行。
+        // 先保留空白，以便空正文告警仍能记录原长度。
         if (this.opts.fileMarkerPattern) {
-            const strip = (s) => {
-                const replaced = s.replace(this.opts.fileMarkerPattern, '');
-                return isFinal ? replaced.trim() : replaced;
-            };
-            this.textBuffer = strip(this.textBuffer);
+            this.textBuffer = this.textBuffer.replace(this.opts.fileMarkerPattern, '');
             for (const item of this.itemsQueue) {
                 if (item.kind === 'text')
                     item.text = item.text.replace(this.opts.fileMarkerPattern, '');
             }
         }
+        if (!this.hasSendableText(this.textBuffer, isFinal ? 'final' : 'flush')) {
+            this.textBuffer = '';
+        }
+        else if (isFinal && this.opts.fileMarkerPattern) {
+            // 保持既有最终文件标记过滤语义；中间文本的格式原样保留。
+            this.textBuffer = this.textBuffer.trim();
+        }
         // 清掉空 text items
         const items = this.itemsQueue.filter(it => {
             if (it.kind === 'text')
-                return it.text.length > 0;
+                return it.text.trim().length > 0;
             return true;
         });
         this.itemsQueue = [];
@@ -544,6 +593,8 @@ export class IMRenderer {
         if (!item)
             return;
         if (item.kind === 'text') {
+            if (!this.hasSendableText(item.text, 'proactive'))
+                return;
             this.hasEmittedText = true;
             this.allText += item.text;
         }
@@ -633,7 +684,7 @@ export class IMRenderer {
                 if (isContextTooLongText(event.error || ''))
                     return null;
                 const text = getErrorMessage(new Error(event.error || '任务执行失败'), undefined, false);
-                return { kind: 'notice', text, severity: 'warn' };
+                return { kind: 'notice', text: tagErrorTextWithEvolcoreVersion(text), severity: 'warn' };
             }
             case 'complete': {
                 if (event.queryFinal === false)
@@ -650,7 +701,7 @@ export class IMRenderer {
                     const text = getErrorMessage(new Error(errText), event.terminalReason, false);
                     const item = {
                         kind: 'summary',
-                        text,
+                        text: tagErrorTextWithEvolcoreVersion(text),
                         is_error: true,
                     };
                     if (event.subtype !== undefined)

package/dist/core/message/message-bridge.js

@@ -25,7 +25,7 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationSpan } from '../causation/audit.js';
 import { renderActionAsText } from '../interaction-router.js';
 import { planApprovalRoute } from '../permission/approval-gateway.js';
-import { parseFullAccessCommand } from '../command/slash-gate.js';
+import { guardGroupSlashCommand, parseFullAccessCommand } from '../command/slash-gate.js';
 import { isFullAccessEnabled } from '../../config-store.js';
 import { auditFullAccessEvent } from '../auth/authorization-audit.js';
 import { consumeAdmissionReplyBudget, clearAdmissionReplyBudgets, evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission, } from './message-admission.js';
@@ -500,9 +500,31 @@ export class MessageBridge {
     async sendAdmissionControlReply(context, msg, sendReply, text) {
         if (!text || !consumeAdmissionReplyBudget(context))
             return false;
-        await sendReply(msg.channelId, text, msg.replyContext);
+        if (context.chatType === 'group' && /^\s*\/(?:bind|request)(?:\s|$)/i.test(msg.content)) {
+            await this.sendSlashControlReply(context.channelKey, msg, sendReply, { kind: 'command.error', text });
+        }
+        else {
+            await sendReply(msg.channelId, text, msg.replyContext);
+        }
         return true;
     }
+    /** Controls handled before the normal slash handler still need structured group feedback. */
+    async sendSlashControlReply(channel, msg, sendReply, payload, adapter = this.processor.getChannelInfo?.(channel)?.adapter) {
+        if (msg.chatType === 'group' && adapter?.send) {
+            await adapter.send(buildEnvelope({
+                taskId: `cmd-${randomBytes(5).toString('hex')}`,
+                channel,
+                channelId: msg.channelId,
+                chatmode: 'interactive',
+                replyContext: {
+                    ...msg.replyContext,
+                    ...(msg.threadId ? { threadId: msg.threadId } : {}),
+                },
+            }), payload);
+            return;
+        }
+        await sendReply(msg.channelId, payload.text, msg.replyContext);
+    }
     admissionDeniedNotice(context, channelType) {
         if (context.contactStatus === 'pending') {
             return '联系人申请审核中；可再次发送 /request 更新说明。';
@@ -801,6 +823,16 @@ export class MessageBridge {
                     : { isMenu: false };
                 let menuResponseWarning;
                 if (menuControl.isMenu) {
+                    // Menu is an AUN private control plane. Group messages must never
+                    // execute Menu commands or participate in token issuance/rotation.
+                    if (msg.chatType === 'group') {
+                        this.logMenuDiagnostic('unsupported-chat-type', channelName, msg, menuControl, 'MENU_PRIVATE_ONLY');
+                        logMenuRequestCompleted(menuControl.request, undefined, this.menuFlowContext(channelName, msg), {
+                            delivery: 'dropped',
+                            reason: 'unsupported-chat-type',
+                        });
+                        return;
+                    }
                     // AUN captures this mark at its adapter boundary. Legacy/test
                     // adapters fall back to the bridge entry mark captured above.
                     Object.assign(msg, menuTiming);
@@ -837,7 +869,10 @@ export class MessageBridge {
                         const tokenSupplied = Object.prototype.hasOwnProperty.call(menuControl.request, 'menu_token');
                         const tokenValid = (menuTokenRequired || tokenSupplied)
                             && !!tokenOwnerAid
-                            && this.menuTokenStore.use(tokenOwnerAid, msg.peerId, menuControl.request.menu_token);
+                            && this.menuTokenStore.use(tokenOwnerAid, msg.peerId, menuControl.request.menu_token, {
+                                deviceId: msg.peerDeviceId,
+                                slotId: msg.peerSlotId,
+                            });
                         if (menuTokenRequired && !tokenValid) {
                             this.logMenuDiagnostic('token-required', channelName, msg, menuControl, 'MENU_TOKEN_REQUIRED');
                             await this.sendMenuResponse(adapter, channelName, msg, menuFailure(header, {
@@ -915,6 +950,11 @@ export class MessageBridge {
                 // internal per-call authorization carried into ResponseEngine.
                 const fullAccessCommand = parseFullAccessCommand(content);
                 if (fullAccessCommand.matched) {
+                    const groupGuard = guardGroupSlashCommand(content, chatType);
+                    if (groupGuard?.kind === 'command.error') {
+                        await this.sendSlashControlReply(channelName, msg, sendReply, groupGuard, adapter);
+                        return;
+                    }
                     const reject = async (text) => {
                         logger.warn(`[MessageBridge] fullaccess command rejected: channel=${channelName} `
                             + `actor=${authSubject.principalId ?? authSubject.actorId ?? '<none>'} reason=${text}`);
@@ -1002,6 +1042,13 @@ export class MessageBridge {
                 // 2. 命令快速路径（去除引用前缀后检查，兼容话题中引用上文的情况）
                 const contentForCmd = content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
                 const cmdContent = contentForCmd || content;
+                if (msg.source !== 'handoff' && !executionPermissionOverride) {
+                    const groupGuard = guardGroupSlashCommand(cmdContent, chatType);
+                    if (groupGuard?.kind === 'command.error') {
+                        await this.sendSlashControlReply(channelName, msg, sendReply, groupGuard, adapter);
+                        return;
+                    }
+                }
                 const isCmd = msg.source !== 'handoff'
                     // Once /fa has been accepted, its remainder is always model input.
                     // A prompt such as `/fa /status` must not be re-routed as the
@@ -1411,7 +1458,10 @@ export class MessageBridge {
             }
         }
         const scope = msg.chatType === 'group' ? (msg.groupId || msg.channelId) : msg.peerId;
-        const dedupKey = [msg.selfAID || channel, channelType, msg.chatType || 'private', scope, msg.peerId, msg.threadId || '', parsed.id].join('\u001f');
+        // Separate installations can generate identical request IDs. Token
+        // issuance and replay must remain scoped to the authenticated requester.
+        const dedupKey = [msg.selfAID || channel, channelType, msg.chatType || 'private', scope, msg.peerId,
+            msg.peerDeviceId || '', msg.peerSlotId || '', msg.threadId || '', parsed.id].join('\u001f');
         let afterResponse;
         const deduped = await this.menuDeduper.execute(dedupKey, menuPayloadFingerprint(parsed.raw), () => isTokenRequest
             ? this.issueMenuTokenResponse(header, channel, msg)
@@ -1452,7 +1502,9 @@ export class MessageBridge {
                 case 'menu.list':
                     if (args?.view === 'catalog') {
                         validateMenuCatalogArgs(args);
-                        const data = await this.cmdHandler.getMenuCatalog(channel, msg.channelId, authSubject, args.context, msg.isControlChannel ? 'control' : 'agent');
+                        const data = await this.cmdHandler.getMenuCatalog(channel, msg.channelId, authSubject, args.context, msg.isControlChannel ? 'control' : 'agent', !msg.isControlChannel || (msg.encrypted === true
+                            && msg.protectedHeaders?.auth_method !== 'remote-access-token'
+                            && msg.protectedHeaders?.auth_method !== 'ecweb-token'));
                         return menuSuccess(header, data);
                     }
                     if (args?.view !== undefined) {
@@ -1615,6 +1667,9 @@ export class MessageBridge {
             clientName: this.menuTokenHeaderValue(headers.client_name ?? headers.app_name),
             clientVersion: this.menuTokenHeaderValue(headers.client_version ?? headers.app_version),
             evolVersion: this.menuTokenHeaderValue(headers.evol_version),
+        }, {
+            deviceId: msg.peerDeviceId,
+            slotId: msg.peerSlotId,
         });
         if (!issued) {
             return menuFailure(header, { code: 'MENU_TOKEN_REJECTED', message: '授权申请未通过' });
@@ -1732,20 +1787,25 @@ export class MessageBridge {
         logger.info(`[${channel}] ${channelId}: ${content}${source === 'card-trigger' ? ' [card]' : ''}`);
         const adapter = this.processor.getChannelInfo?.(channel)?.adapter;
         const cmdResult = await this.cmdHandler.handle(content, channel, channelId, async (_cid, text, opts, updatePayload) => {
-            if (updatePayload && adapter?.send) {
+            const payload = updatePayload ?? (chatType === 'group' ? { kind: 'command.result', text } : undefined);
+            if (payload && adapter?.send) {
                 const envelope = buildEnvelope({
                     taskId: `cmd-update-${randomBytes(5).toString('hex')}`,
                     channel,
                     channelId,
                     agentName: this.agentRegistry?.resolveByChannel(channel)?.name ?? '<unknown>',
                     chatmode: 'interactive',
-                    replyContext: opts ?? replyContext,
+                    replyContext: {
+                        ...(opts ?? {}),
+                        ...(replyContext ?? {}),
+                        metadata: { ...opts?.metadata, ...replyContext?.metadata },
+                    },
                 });
-                await adapter.send(envelope, updatePayload);
+                await adapter.send(envelope, payload);
                 return;
             }
             await sendReply(text, opts, updatePayload);
-        }, userId, threadId, chatType, source, messageId, selfAID, authSubject?.identity, authSubject, replyContext);
+        }, userId, threadId, chatType, source, messageId, selfAID, authSubject?.identity, authSubject, replyContext, true);
         logger.debug(`[MessageBridge] handleCommand: result type=${typeof cmdResult}`);
         if (cmdResult === undefined)
             return false;