evolcore 0.0.24 → 0.0.26

package/dist/config/contact-operation-service.js

@@ -5,6 +5,8 @@ import { agentConfig } from '../paths.js';
 import { getContactSnapshot, resolveContactView } from './contact-book.js';
 import { ContactMutationError } from './contact-book-store.js';
 import { addContact, mutateContactWithOperation } from './contact-request-service.js';
+import { expirePendingContactRequests, reviewContactRequest } from './contact-request-service.js';
+import { listStaticAgentOwners } from './peer-role-resolver.js';
 export function resolveContactCommand(argv) {
     const args = argv[0] === 'contact' ? argv.slice(1) : [...argv];
     const selfAid = String(argValue(args, '--self') || '').trim();
@@ -15,12 +17,41 @@ export function resolveContactCommand(argv) {
     if (extra.length > 0)
         return invalid('INVALID_ARGUMENT', `Unexpected contact arguments: ${extra.join(' ')}`);
     if (command === 'list') {
-        if (subcommand !== undefined || !args.includes('--blocked')) {
-            return invalid('INVALID_ARGUMENT', 'Only ec contact list --blocked is currently supported');
+        if (subcommand !== undefined) {
+            return invalid('INVALID_ARGUMENT', 'contact list does not accept a positional argument');
         }
+        const filter = args.includes('--blocked')
+            ? 'blocked'
+            : args.includes('--pending')
+                ? 'pending'
+                : args.includes('--all') ? 'all' : undefined;
+        if (!filter)
+            return invalid('INVALID_ARGUMENT', 'contact list requires --blocked, --pending, or --all');
         return {
             ok: true,
-            command: { kind: 'list-blocked', operationId: 'contact.read', selfAid, canonicalArgv: canonicalArgv(argv) },
+            command: { kind: 'list-blocked', operationId: 'contact.read', selfAid, filter, canonicalArgv: canonicalArgv(argv) },
+        };
+    }
+    if (command === 'approve' || command === 'reject' || command === 'block-request') {
+        if (!isValidAid(subcommand || '') || isExplicitGroupId(subcommand || '')) {
+            return invalid('INVALID_AID', 'primaryId must be a valid individual AID');
+        }
+        const requestId = String(argValue(args, '--request-id') || '').trim();
+        if (!requestId)
+            return invalid('INVALID_ARGUMENT', `${command} requires --request-id <request-id>`);
+        const expectedContactRevision = argValue(args, '--contact-revision')?.trim() || undefined;
+        return {
+            ok: true,
+            command: {
+                kind: 'review-request',
+                operationId: 'contact.review',
+                selfAid,
+                primaryId: subcommand,
+                requestId,
+                decision: command === 'approve' ? 'approve' : command === 'reject' ? 'reject' : 'block',
+                expectedContactRevision,
+                canonicalArgv: canonicalArgv(argv),
+            },
         };
     }
     if (command === 'block' || command === 'unblock') {
@@ -62,13 +93,63 @@ export async function executeResolvedContactCommand(command, actor = 'local-cli'
     }
     try {
         if (command.kind === 'list-blocked') {
+            await expirePendingContactRequests(command.selfAid);
             const snapshot = getContactSnapshot(command.selfAid);
+            const ids = command.filter === 'blocked'
+                ? [...snapshot.blockedIndex]
+                : [...snapshot.contacts.entries()]
+                    .filter(([, entry]) => command.filter === 'all' || entry.status === 'pending')
+                    .map(([id]) => id);
+            const items = ids.sort().map(id => contactItem(command.selfAid, id));
+            if (command.filter === 'blocked') {
+                return {
+                    ok: true,
+                    operation: 'list-blocked',
+                    selfAid: command.selfAid,
+                    contactRevision: snapshot.contactRevision,
+                    items,
+                };
+            }
             return {
                 ok: true,
-                operation: 'list-blocked',
+                operation: 'list-contacts',
                 selfAid: command.selfAid,
+                filter: command.filter,
                 contactRevision: snapshot.contactRevision,
-                items: [...snapshot.blockedIndex].sort().map(id => resolveContactView(command.selfAid, id)),
+                items,
+            };
+        }
+        if (command.kind === 'review-request') {
+            const expectedContactRevision = command.expectedContactRevision ?? getContactSnapshot(command.selfAid).contactRevision;
+            const reviewerAid = actor === 'local-cli'
+                ? listStaticAgentOwners(command.selfAid)[0]
+                : actor;
+            if (!reviewerAid) {
+                return { ok: false, code: 'NO_OWNER', error: `Agent has no owner: ${command.selfAid}` };
+            }
+            const reviewed = await reviewContactRequest({
+                selfAid: command.selfAid,
+                primaryId: command.primaryId,
+                requestId: command.requestId,
+                expectedContactRevision,
+                approverId: reviewerAid,
+                actorId: reviewerAid,
+                decision: command.decision,
+            });
+            if (reviewed.code !== 'approved' && reviewed.code !== 'rejected' && reviewed.code !== 'blocked') {
+                const code = reviewed.code === 'request-expired' ? 'REQUEST_EXPIRED'
+                    : reviewed.code === 'revision-conflict' ? 'CONFLICT'
+                        : reviewed.code === 'forbidden' ? 'PERMISSION_DENIED' : 'REQUEST_STALE';
+                return { ok: false, code, error: reviewed.code, data: { contactRevision: reviewed.contactRevision } };
+            }
+            return {
+                ok: true,
+                operation: 'review-request',
+                selfAid: command.selfAid,
+                primaryId: command.primaryId,
+                requestId: command.requestId,
+                result: reviewed.code,
+                contactRevision: reviewed.contactRevision,
             };
         }
         if (command.kind === 'set-blocked') {
@@ -129,16 +210,24 @@ function stripOptions(args) {
     const result = [];
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
-        if (arg === '--self' || arg === '--format') {
+        if (arg === '--self' || arg === '--format' || arg === '--request-id' || arg === '--contact-revision') {
             index += 1;
             continue;
         }
-        if (arg === '--blocked')
+        if (arg === '--blocked' || arg === '--pending' || arg === '--all')
             continue;
         result.push(arg);
     }
     return result;
 }
+function contactItem(selfAid, primaryId) {
+    const view = resolveContactView(selfAid, primaryId);
+    const entry = getContactSnapshot(selfAid).contacts.get(primaryId);
+    return {
+        ...view,
+        ...(entry?.pendingRequest ? { pendingRequest: { ...entry.pendingRequest } } : {}),
+    };
+}
 function canonicalArgv(argv) {
     return argv[0] === 'contact' ? [...argv] : ['contact', ...argv];
 }

package/dist/config/resolved-config-op.js

@@ -2,6 +2,7 @@ import { normalizeCliArgv } from '../cli/cli-argv.js';
 import { parseConfigSelector } from '../cli/config-selector.js';
 import { parseConfigFieldValue, resolveConfigFieldRule, } from './config-field-policy.js';
 import { ConfigError, routeFieldPath } from './config-manager.js';
+import { isValidAid } from '../aun/aid/validation.js';
 const SELECTOR_OPTIONS = {
     '--self': 'value',
     '--peer': 'value',
@@ -96,11 +97,12 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: 'permissionMode is defined by roles; use the role policy editor',
         };
     }
-    if (field === 'role') {
+    const isRelationRole = field === 'role';
+    if (isRelationRole && selector.scope !== 'relation') {
         return {
             ok: false,
-            code: 'ROLE_POLICY_MANAGED',
-            reason: 'Relation role assignments are managed through the role assignment service',
+            code: 'RELATION_SELECTOR_REQUIRED',
+            reason: `config ${subcommand} role needs a relation target: --self <aid> --peer <peer-aid>`,
         };
     }
     if (subcommand !== 'get' && (field === 'roles' || field.startsWith('roles.'))) {
@@ -128,12 +130,14 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: `Config field ${field} does not support object writes`,
         };
     }
-    const commandScope = selector.scope === 'defaults' ? 'process' : selector.scope;
+    const commandScope = isRelationRole ? 'agent' : selector.scope === 'defaults' ? 'process' : selector.scope;
     const isSafe = fieldRule.class === 'safe-scalar' || fieldRule.class === 'safe-readonly-object';
     const isManagementOperation = commandScope === 'process' || !isSafe;
-    const operationId = isManagementOperation
-        ? subcommand === 'get' ? 'config.read' : 'config.write'
-        : `config.${subcommand}`;
+    const operationId = isRelationRole
+        ? subcommand === 'get' ? 'role.relation.read' : subcommand === 'set' ? 'role.assign' : 'role.revoke'
+        : isManagementOperation
+            ? subcommand === 'get' ? 'config.read' : 'config.write'
+            : `config.${subcommand}`;
     let route;
     const routeRequired = subcommand !== 'get' || !isManagementOperation;
     try {
@@ -166,7 +170,30 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
     const rawValue = subcommand === 'set' ? business.values[1] : undefined;
     let value;
     if (subcommand === 'set') {
-        if (fieldRule.class === 'safe-scalar') {
+        if (field === 'owners') {
+            const parsedOwners = parseOwnersValue(rawValue);
+            if (!parsedOwners.ok)
+                return parsedOwners;
+            value = parsedOwners.value;
+        }
+        else if (isRelationRole) {
+            const raw = rawValue.trim();
+            if (!raw)
+                return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'Config field role cannot be empty' };
+            try {
+                const parsed = JSON.parse(raw);
+                if (typeof parsed === 'string')
+                    value = parsed;
+                else if (parsed === null)
+                    return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'config set role requires a role ID; use config unset role to revoke it' };
+                else
+                    return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'Config field role must be a role ID or null' };
+            }
+            catch {
+                value = raw;
+            }
+        }
+        else if (fieldRule.class === 'safe-scalar') {
             const parsedValue = parseConfigFieldValue(field, rawValue);
             if (!parsedValue.ok)
                 return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: parsedValue.reason };
@@ -486,6 +513,37 @@ function coerceConfigValue(raw, route) {
         return Number(raw);
     return raw;
 }
+function parseOwnersValue(raw) {
+    let values;
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('[')) {
+        try {
+            values = JSON.parse(trimmed);
+        }
+        catch {
+            return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'owners must be a valid JSON array of AIDs' };
+        }
+        if (!Array.isArray(values)) {
+            return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'owners must be a JSON array of AIDs' };
+        }
+    }
+    else {
+        values = [raw];
+    }
+    if (!Array.isArray(values) || values.length === 0) {
+        return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'owners must contain at least one AID' };
+    }
+    const owners = [];
+    for (const value of values) {
+        if (typeof value !== 'string' || !value.trim() || !isValidAid(value.trim())) {
+            return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: `Invalid owner AID: ${JSON.stringify(value)}` };
+        }
+        const owner = value.trim();
+        if (!owners.includes(owner))
+            owners.push(owner);
+    }
+    return { ok: true, value: owners };
+}
 function configErrorResult(error) {
     if (error instanceof ConfigError)
         return { ok: false, code: error.code, reason: error.message };

package/dist/core/agent-application-service.js

@@ -85,13 +85,14 @@ export class AgentApplicationService {
                 unique_peer_count: stats?.uniquePeerCount ?? 0,
             }
             : null;
-        const config = agent.config;
+        const config = (loadAgent(aid) ?? agent.config);
         const identity = readAgentMdIdentity(aid);
         const paths = resolvePaths();
         return {
             ok: true,
             aid,
             status: info.status || 'stopped',
+            lifecycle: config?.lifecycle ?? null,
             identity,
             config: {
                 baseagent: info.baseagent || null,

package/dist/core/auth/authorization-audit.js

@@ -333,23 +333,31 @@ function buildAuditRecord(event) {
                 : executed
                     ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
                     : 'authorized');
-    const lifecycleId = event.callId ?? event.correlationId ?? event.requestId;
+    const ecwebRequestId = event.source === 'ecweb' ? event.ecwebRequestId : undefined;
+    const requestId = event.requestId ?? ecwebRequestId;
+    const correlationId = event.correlationId ?? requestId;
+    const lifecycleId = event.callId ?? correlationId ?? requestId;
     return {
         ts: event.ts,
-        eventKey: event.eventKey ?? (lifecycleId
-            ? buildAuthorizationEventKey({
-                sessionId: event.sessionId,
-                callId: event.callId,
-                correlationId: event.correlationId,
-                requestId: event.requestId,
-                operation: event.operation,
-            })
-            : undefined),
+        eventKey: event.eventKey ?? (ecwebRequestId
+            ? `ecweb:${crypto.createHash('sha256').update(JSON.stringify([
+                ecwebRequestId, event.targetAgentAid ?? event.selfAid, event.operation,
+            ])).digest('hex').slice(0, 20)}`
+            : lifecycleId
+                ? buildAuthorizationEventKey({
+                    sessionId: event.sessionId,
+                    callId: event.callId,
+                    correlationId,
+                    requestId,
+                    operation: event.operation,
+                })
+                : undefined),
         eventPhase: event.eventPhase,
         callId: event.callId,
-        correlationId: event.correlationId ?? event.requestId,
-        requestId: event.requestId,
+        correlationId,
+        requestId,
         sessionId: event.sessionId,
+        ...(event.source === 'ecweb' && !event.sessionId ? { sessionScope: 'not_applicable' } : {}),
         agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
         agentName: resolveAgentName(event),
         permissionMode: normalizeAuditPermissionMode(event.permissionMode),

package/dist/core/auth/operation-authorizer.js

@@ -13,6 +13,7 @@ const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
     'agent.disable',
     'system.restart',
     'system.upgrade',
+    'system.paircode',
     'gateway.read',
     'gateway.write',
     'stats.peers',
@@ -192,7 +193,8 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         };
     }
     // Any authenticated role may inspect the current Agent through the daemon's
-    // redacted view. Cross-Agent inspection is handled by requiresDaemonOwner().
+    // redacted view. Management roles may inspect another Agent's redacted view;
+    // mutation and reload remain target-scoped below.
     if (operation === 'agent.show' && isCurrentAgentTarget(ctx)) {
         return {
             allow: true,
@@ -203,6 +205,25 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: 'self-agent-read',
         };
     }
+    // Cross-Agent reads are a management/control-plane capability. A custom
+    // role must not widen this boundary merely by granting itself agent.show.
+    if (operation === 'agent.show'
+        && !isCurrentAgentTarget(ctx)
+        && !isManagementRole(role)
+        && !hasDaemonOwnerRole(ctx)) {
+        return denyDecision(ctx, 'NOT_ALLOWED', `${operation} may only target the current Agent from a managed Agent task.`, operation, intent.scope, opMeta.dangerous, undefined, 'TARGET_SELF_ONLY');
+    }
+    if (operation === 'agent.persona' && isCurrentAgentTarget(ctx)
+        && (role === 'owner' || hasDaemonOwnerRole(ctx))) {
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: role === 'owner' ? 'agent-owner-persona' : 'daemon-owner-persona',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
@@ -215,7 +236,7 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (role === 'owner') {
+        if (role === 'owner' && isCurrentAgentTarget(ctx)) {
             return {
                 allow: true,
                 operation,
@@ -225,6 +246,22 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
                 matchedRule: 'agent-owner',
             };
         }
+        // The daemon control identity is allowed to inspect any Agent config,
+        // including sensitive fields. This is intentionally handled before
+        // role-definition matching because daemon-owner subjects do not need an
+        // Agent relation role to read the daemon's local configuration store.
+        if (resolvedConfigCommand.kind === 'field'
+            && resolvedConfigCommand.subcommand === 'get'
+            && hasDaemonOwnerRole(ctx)) {
+            return {
+                allow: true,
+                operation,
+                scope: intent.scope,
+                role: 'daemon-owner',
+                dangerous: opMeta.dangerous,
+                matchedRule: 'daemon-owner-config-read',
+            };
+        }
     }
     const roleDef = getRoleDefinition(role, ctx.selfAid);
     if (!roleDef) {
@@ -357,10 +394,25 @@ function requiresDaemonOwner(ctx, resolvedConfigCommand) {
             || resolvedConfigCommand.configScope === 'process'
             || resolvedConfigCommand.configScope === 'defaults'))
         return true;
+    // Sensitive reads of another Agent's config are daemon-scoped. Agent
+    // owner/admin roles may inspect safe fields cross-Agent, but only the
+    // daemon control identity may access config.read targets that are not the
+    // current Agent.
+    if (operation === 'config.read'
+        && resolvedConfigCommand?.kind === 'field'
+        && resolvedConfigCommand.configScope === 'agent'
+        && !isCurrentAgentTarget(ctx)) {
+        return true;
+    }
     if (operation === 'agent.reload' && hasDaemonOwnerRole(ctx)) {
         return true;
     }
-    if (operation === 'agent.show' || operation === 'agent.reload') {
+    // Avatar publication is an Agent-scoped mutation for Agent channels, but
+    // the trusted control plane may publish it for a selected Agent target.
+    if (operation === 'ec.aid.avatar' && hasDaemonOwnerRole(ctx)) {
+        return true;
+    }
+    if (operation === 'agent.reload') {
         return !isCurrentAgentTarget(ctx);
     }
     if (operation.startsWith('trigger.')) {
@@ -529,6 +581,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
         return { ok: false, reason: 'Resolved config operation is required' };
     const field = resolvedConfigOp.field;
     if (!resolvedConfigOp.route || (resolvedConfigOp.fieldRule.class !== 'safe-scalar' && resolvedConfigOp.fieldRule.class !== 'safe-readonly-object')) {
+        if (policy === 'behavior-read'
+            && !isCurrentAgentTarget(ctx)
+            && hasDaemonOwnerRole(ctx)
+            && resolvedConfigOp.route) {
+            return { ok: true };
+        }
         return { ok: false, reason: `Config field ${field} is not available to user roles` };
     }
     if (policy === 'role-overridable-write'
@@ -541,8 +599,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     const fieldPermission = roleDef
         ? resolveRoleFieldPermission(roleDef.permissions || {}, field)
         : undefined;
-    if (policy === 'behavior-read')
+    if (policy === 'behavior-read') {
+        // Only the daemon control identity may read sensitive config fields from
+        // another Agent. Agent owners retain unrestricted reads for their own
+        // target via the self-target fast path above.
         return { ok: true };
+    }
     if (fieldPermission && !fieldPermission.allowOverride) {
         return { ok: false, reason: `Role ${ctx.role} cannot override ${field}` };
     }
@@ -579,12 +641,19 @@ function checkResolvedConfigTarget(ctx, command) {
         return { ok: true };
     }
     if (command.configScope === 'agent') {
+        // Management roles may read another Agent's non-sensitive config fields;
+        // sensitive fields are rejected by the field policy. Writes stay self-only.
+        if (command.subcommand === 'get' && (isManagementRole(ctx.role) || hasDaemonOwnerRole(ctx))) {
+            return { ok: true };
+        }
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent can be targeted' };
         }
         return { ok: true };
     }
-    if (ctx.allowExplicitRelationTarget && ctx.role === 'owner') {
+    if (ctx.allowExplicitRelationTarget
+        && (ctx.role === 'owner' || ctx.role === 'admin')
+        && (command.kind === 'field' && command.operationId.startsWith('role.'))) {
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent relation can be targeted' };
         }
@@ -748,10 +817,10 @@ function checkOwnPeer(ctx) {
     }
     if (ctx.actorId) {
         if (requestedPeerId && requestedPeerId !== ctx.actorId) {
-            return { ok: false, reason: 'Only the actor peer can be targeted' };
+            return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerId) };
         }
         if (requestedPeerKeyId && requestedPeerKeyId !== ctx.actorId) {
-            return { ok: false, reason: 'Only the actor peer can be targeted' };
+            return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerKeyId) };
         }
     }
     if (!expectedPeerKey)
@@ -769,10 +838,20 @@ function checkOwnPeer(ctx) {
             candidateKeys.add(`${legacyChannelType}::${argPeer}`);
     }
     if (!candidateKeys.has(expectedPeerKey)) {
-        return { ok: false, reason: 'Only the actor peer can be targeted' };
+        return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerId ?? requestedPeerKeyId) };
     }
     return { ok: true };
 }
+function ownPeerOnlyDenialReason(ctx, requestedPeer) {
+    if (ctx.intent.operation !== 'ec.msg.send' && ctx.intent.operation !== 'ec.msg.file') {
+        return 'Only the actor peer can be targeted';
+    }
+    const currentPeer = ctx.actorId || peerIdFromArg(ctx.peerKey || '') || '当前私聊对端';
+    const target = requestedPeer || '指定目标';
+    return `当前托管会话只能联系当前私聊对端（${currentPeer}），不能联系第三方目标（${target}）。`
+        + ' 如果本次请求来自 handoff，请执行 ec handoff return <handoff-id> "<失败原因>"（已有命令）将失败原因反馈给原会话；'
+        + '否则请让目标先直接发起会话，或由 Agent owner 为当前角色配置允许 relay/第三方外联后再发送。';
+}
 function peerIdFromArg(value) {
     try {
         return parsePeerKey(value).channelId;

package/dist/core/auth/operation-catalog.js

@@ -100,6 +100,13 @@ const HANDOFF_WRITE_OPERATIONS = [{
         defaultScopes: ['relation', 'agent'],
         description: 'Return the current handoff result',
         sources: ['agent-tool'],
+    }, {
+        id: 'ec.handoff.recover',
+        category: 'write-agent',
+        dangerous: true,
+        defaultScopes: ['agent'],
+        description: 'Recover an open handoff after its target session changed',
+        sources: ['agent-tool'],
     }];
 const QUEUE_OPERATIONS = [['read', 'Read the current Agent message queue'], ['clear', 'Clear the current Agent message queue'], ['cancel', 'Cancel a current Agent queued message'], ['interrupt', 'Interrupt a current Agent session']].map(([kind, description]) => ({
     id: `ec.queue.${kind}`,
@@ -446,7 +453,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['agent'],
         description: 'Assign a role to a private or group relation',
-        sources: ['menu', 'ecweb', 'control'],
+        sources: ['menu', 'menu.cli', 'ecweb', 'control', 'agent-tool'],
     },
     {
         id: 'role.revoke',
@@ -454,7 +461,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['agent'],
         description: 'Revoke a private or group relation role assignment',
-        sources: ['menu', 'ecweb', 'control'],
+        sources: ['menu', 'menu.cli', 'ecweb', 'control', 'agent-tool'],
     },
     {
         id: 'role.policy.read',
@@ -470,7 +477,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['agent'],
         description: 'Read private and group relation role assignments',
-        sources: ['menu', 'ecweb', 'control'],
+        sources: ['menu', 'menu.cli', 'ecweb', 'control', 'agent-tool'],
     },
     {
         id: 'role.policy.write',
@@ -485,7 +492,7 @@ const OPERATIONS = [
         category: 'read',
         dangerous: false,
         defaultScopes: ['agent'],
-        description: 'Read the Agent contact block list',
+        description: 'Read Agent contacts, pending requests, and blocked contacts',
         sources: ['agent-tool'],
     },
     {
@@ -504,6 +511,14 @@ const OPERATIONS = [
         description: 'Block or unblock a canonical contact across bound private channels',
         sources: ['agent-tool'],
     },
+    {
+        id: 'contact.review',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Review pending Agent contact requests',
+        sources: ['agent-tool'],
+    },
     {
         id: 'connect.read',
         category: 'read',
@@ -601,6 +616,14 @@ const OPERATIONS = [
         description: '获取 agent 配置（含凭证）',
         sources: ['menu', 'menu.cli', 'control'],
     },
+    {
+        id: 'agent.persona',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '读取或更新当前 Agent 的 persona.md',
+        sources: ['agent-tool', 'control'],
+    },
     {
         id: 'agent.create',
         category: 'process',
@@ -658,6 +681,14 @@ const OPERATIONS = [
         description: '查看系统状态（敏感信息）',
         sources: ['slash', 'menu', 'menu.cli', 'agent-tool'],
     },
+    {
+        id: 'system.paircode',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['process'],
+        description: '获取 daemon 远程控制配对码',
+        sources: ['menu', 'control'],
+    },
     {
         id: 'activity.current',
         category: 'read',
@@ -944,6 +975,14 @@ const OPERATIONS = [
         description: 'Sign and publish the current Agent local agent.md',
         sources: ['agent-tool'],
     },
+    {
+        id: 'ec.aid.avatar',
+        category: 'write-agent',
+        dangerous: true,
+        defaultScopes: ['agent'],
+        description: 'Upload and publish the current Agent avatar',
+        sources: ['agent-tool', 'menu', 'menu.cli'],
+    },
     {
         id: 'ec.msg.send',
         category: 'write-own',
@@ -952,6 +991,14 @@ const OPERATIONS = [
         description: '通过 ec msg send 发送私聊消息',
         sources: ['agent-tool'],
     },
+    {
+        id: 'ec.menu.request',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['relation'],
+        description: 'Send an authenticated remote Control Menu request through the current Agent daemon channel',
+        sources: ['agent-tool'],
+    },
     {
         id: 'ec.msg.file',
         category: 'write-own',