evolcore 0.0.24 → 0.0.26

package/dist/core/auth/remote-access-store.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { resolvePaths } from '../../paths.js';
 export const REMOTE_ACCESS_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const DIAGNOSTIC_TOKEN_TTL_MS = 60 * 60 * 1000;
 // 与 owner 绑定二维码（BindService）的默认有效期保持一致：10 分钟。
 export const REMOTE_ACCESS_PAIRING_TTL_MS = 10 * 60 * 1000;
 export function remoteAccessTokenStorePath() {
@@ -42,7 +43,8 @@ function pruneExpired(store, now) {
     const before = store.tokens.length;
     store.tokens = store.tokens.filter(record => typeof record?.token === 'string'
         && typeof record.lastActive === 'number'
-        && now - record.lastActive < REMOTE_ACCESS_TOKEN_TTL_MS);
+        && Number.isFinite(record.lastActive)
+        && now - record.lastActive < (record.diagnostic ? DIAGNOSTIC_TOKEN_TTL_MS : REMOTE_ACCESS_TOKEN_TTL_MS));
     return store.tokens.length !== before;
 }
 function validLabel(value) {
@@ -85,6 +87,43 @@ export class RemoteAccessService {
     pairingCode = '';
     pairingExpiresAt = 0;
     pairingAuthorizedBy;
+    /** Synchronous reservation: concurrent invitations cannot issue two grants. */
+    issueDiagnosticToken(controlAid, agentAid, ownerAid, now = Date.now()) {
+        const store = loadStore();
+        pruneExpired(store, now);
+        if (store.tokens.some(record => record.diagnostic?.controlAid === controlAid)) {
+            throw Object.assign(new Error('本机已有有效诊断授权，请先执行 /diag stop 或 ec diag stop。'), { code: 'DIAG_ALREADY_ACTIVE' });
+        }
+        const record = {
+            token: crypto.randomBytes(32).toString('hex'), createdAt: now, lastActive: now,
+            label: 'diagnostic', authorizedBy: ownerAid,
+            diagnostic: { controlAid, agentAid, ownerAid, caseId: crypto.randomUUID() },
+        };
+        store.tokens.push(record);
+        saveStore(store);
+        return record;
+    }
+    getDiagnosticToken(controlAid, now = Date.now()) {
+        const store = loadStore();
+        if (pruneExpired(store, now))
+            saveStore(store);
+        return store.tokens.find(record => record.diagnostic?.controlAid === controlAid);
+    }
+    /** Expected token prevents a failed older send from revoking a newer grant. */
+    revokeDiagnosticToken(controlAid, expectedToken) {
+        const store = loadStore();
+        const pruned = pruneExpired(store, Date.now());
+        const index = store.tokens.findIndex(record => record.diagnostic?.controlAid === controlAid
+            && (expectedToken === undefined || record.token === expectedToken));
+        if (index < 0) {
+            if (pruned)
+                saveStore(store);
+            return undefined;
+        }
+        const [record] = store.tokens.splice(index, 1);
+        saveStore(store);
+        return record;
+    }
     getPairingCode(authorizedBy, now = Date.now()) {
         if (!this.pairingCode || now >= this.pairingExpiresAt) {
             this.pairingCode = String(crypto.randomInt(0, 1_000_000)).padStart(6, '0');

package/dist/core/bootstrap-service.js

@@ -369,7 +369,7 @@ export class BootstrapService {
         const content = existing.trim() || buildInitialAgentMd({
             aid,
             name: fallbackName,
-            type: 'codeagent',
+            type: 'agent',
         });
         try {
             await adapter.uploadAgentMd(content);

package/dist/core/command/agent-control.js

@@ -6,11 +6,11 @@ import path from 'path';
 import { ConfigTarget, ensureFile as cfgEnsure, read as cfgRead, write as cfgWrite, } from '../../config/config-manager.js';
 import { CreateStatusWriter, readCreateStatus } from '../message/create-status.js';
 import { agentProjectRootFromDefaults, deriveAgentProjectPath } from '../../utils/project-path.js';
-import { uploadAvatar } from '../../utils/avatar-upload.js';
+import { uploadAvatar, uploadAvatarUrl } from '../../utils/avatar-upload.js';
 import { agentmdGet, agentmdPut, updateAgentMdFrontmatterName } from '../../aun/aid/agentmd.js';
 import { isValidAid } from '../../aun/aid/validation.js';
 import { isSupportedBaseagent } from '../../agents/baseagent.js';
-const SUPPORTED_AGENT_PATCH_FIELDS = new Set(['aid', 'name', 'avatar', 'active_baseagent', 'baseagents', 'projects', 'owners', 'chatmode', 'channels', 'channelOwners']);
+const SUPPORTED_AGENT_PATCH_FIELDS = new Set(['aid', 'name', 'active_baseagent', 'baseagents', 'projects', 'owners', 'chatmode', 'channels', 'channelOwners']);
 const HIDDEN_VALUE = '[hidden]';
 const SENSITIVE_CONFIG_KEYS = new Set([
     'apikey',
@@ -48,6 +48,42 @@ function classifyAgentMdError(error) {
         return 'INVALID_ARGS';
     return 'UPLOAD_FAILED';
 }
+/** Canonical avatar mutation for the `aid.avatar` menu action. */
+export async function execAidAvatar(args) {
+    const a = args ?? {};
+    const aid = typeof a.aid === 'string' ? a.aid.trim().replace(/^@/, '') : '';
+    if (!aid)
+        return { error: '缺少 aid', code: 'INVALID_ARGS' };
+    if (!isValidAid(aid))
+        return { error: `无效 aid: ${aid}`, code: 'INVALID_ARGS' };
+    const hasData = a.data !== undefined;
+    const hasUrl = a.url !== undefined;
+    if ((hasData ? 1 : 0) + (hasUrl ? 1 : 0) > 1) {
+        return { error: '头像数据源必须在 data 与 url 中二选一', code: 'INVALID_ARGS' };
+    }
+    if (!hasData && !hasUrl) {
+        return { error: '缺少头像数据源：需要 data 或 url', code: 'INVALID_ARGS' };
+    }
+    const result = hasUrl
+        ? await uploadAvatarUrl(aid, a.url, { aunPath: resolveRoot() })
+        : await uploadAvatar(aid, a.data, { aunPath: resolveRoot() });
+    if (!result.ok) {
+        return { error: `头像上传失败: ${result.error}`, code: result.code ?? 'UPLOAD_FAILED' };
+    }
+    return {
+        data: {
+            aid,
+            avatar: result.publicUrl,
+            objectKey: result.objectKey,
+            sha256: result.sha256,
+            mime: result.mime,
+            width: result.width,
+            height: result.height,
+            aspectRatio: result.aspectRatio,
+            saved: true,
+        },
+    };
+}
 async function updateAgentMdName(aid, value) {
     const name = typeof value === 'string' ? value.trim() : '';
     if (!name)
@@ -299,6 +335,7 @@ async function runCreateInBackground(opts, w, service) {
             aid: opts.aid, name: opts.name, baseagent: opts.baseagent,
             project: opts.project, owner: opts.owner,
             description: opts.description,
+            tags: opts.tags,
             onPhase: (phase, state, detail) => {
                 if (state === 'begin') {
                     curPhase = phase;
@@ -398,6 +435,7 @@ export async function execAgentAction(action, args, peerId, eventBus, service) {
         const description = typeof a.description === 'string' && a.description.trim()
             ? a.description.trim()
             : undefined;
+        const tags = Array.isArray(a.tags) ? a.tags : undefined;
         // D3: accepted=true 必须意味着后续 query 能查到该 AID 的创建状态。
         let progressWriter;
         try {
@@ -410,7 +448,7 @@ export async function execAgentAction(action, args, peerId, eventBus, service) {
         void runCreateInBackground({
             aid: a.aid, name: a.name, baseagent: a.baseagent,
             project: a.project, owner,
-            model, effort, description, chatmode: a.chatmode,
+            model, effort, description, tags, chatmode: a.chatmode,
             eventBus,
         }, progressWriter, service).catch(e => logger.error(`[agent-control] runCreateInBackground unhandled ${a.aid}: ${e?.message || e}`));
         return { data: { accepted: true, aid: a.aid } };
@@ -461,14 +499,6 @@ export async function execAgentAction(action, args, peerId, eventBus, service) {
     if (action === 'update') {
         const result = await execAgentUpdate(a);
         if (!('error' in result)) {
-            if (result.data?.avatar) {
-                eventBus?.publish({
-                    type: 'agent:avatar_updated',
-                    aid: a.aid,
-                    avatar: result.data.avatar,
-                    timestamp: Date.now(),
-                });
-            }
             eventBus?.publish({
                 type: 'agent:updated',
                 aid: a.aid,
@@ -501,12 +531,6 @@ export async function execAgentUpdate(args) {
     if (p.aid !== undefined) {
         return { error: 'aid 不可修改（AUN 身份绑定，如需换 AID 请删除后重建）', code: 'INVALID_ARGS' };
     }
-    if (p.avatar !== undefined) {
-        const otherKeys = Object.keys(p).filter(k => k !== 'avatar');
-        if (otherKeys.length > 0) {
-            return { error: 'avatar 不能与其他 patch 字段同时提交，请拆分为两次 update', code: 'INVALID_ARGS' };
-        }
-    }
     if (p.name !== undefined) {
         const otherKeys = Object.keys(p).filter(k => k !== 'name');
         if (otherKeys.length > 0) {
@@ -522,13 +546,6 @@ export async function execAgentUpdate(args) {
     const config = cfgRead(ConfigTarget.Agent, { self: a.aid });
     if (!config)
         return { error: `Agent "${a.aid}" not found`, code: 'NOT_FOUND' };
-    if (p.avatar !== undefined) {
-        const result = await uploadAvatar(a.aid, p.avatar, { aunPath: resolveRoot() });
-        if (!result.ok) {
-            return { error: `头像上传失败: ${result.error}`, code: result.code ?? 'UPLOAD_FAILED' };
-        }
-        return { data: { aid: a.aid, avatar: result.publicUrl, saved: true } };
-    }
     let touched = false;
     const data = { aid: a.aid };
     const hasConfigPatch = p.active_baseagent !== undefined || p.baseagents !== undefined || p.projects !== undefined || p.owners !== undefined || p.chatmode !== undefined || p.channels !== undefined || p.channelOwners !== undefined;
@@ -564,7 +581,19 @@ export async function execAgentUpdate(args) {
             delete config.projects;
     }
     if (p.owners !== undefined) {
-        config.owners = p.owners;
+        if (!Array.isArray(p.owners) || p.owners.length === 0) {
+            return { error: 'owners must contain at least one owner', code: 'LAST_OWNER_PROTECTED' };
+        }
+        const owners = [];
+        for (const rawOwner of p.owners) {
+            if (typeof rawOwner !== 'string' || !rawOwner.trim() || !isValidAid(rawOwner.trim())) {
+                return { error: `Invalid owner AID: ${JSON.stringify(rawOwner)}`, code: 'INVALID_ARGS' };
+            }
+            const owner = rawOwner.trim();
+            if (!owners.includes(owner))
+                owners.push(owner);
+        }
+        config.owners = owners;
         touched = true;
     }
     if (p.chatmode !== undefined) {

package/dist/core/command/cli-intent-parser.js

@@ -156,6 +156,14 @@ function parseStatsCommand(argv, source) {
 }
 function parseAgentCommand(argv, source) {
     const subcmd = argv[1];
+    if (subcmd === 'persona') {
+        const tail = argv.at(-2) === '--format' && argv.at(-1) === 'json' ? argv.slice(0, -2) : argv;
+        const isShow = tail.length === 3 && tail[2] === 'show';
+        const isWrite = tail.length === 4 && (tail[2] === '--text' || tail[2] === '--file');
+        return isShow || isWrite
+            ? recognized('agent.persona', 'agent', source, {}, argv)
+            : raw(source, argv, 'Invalid agent persona command');
+    }
     const parsed = parseArgs(argv.slice(2));
     const args = parsed.args;
     if (parsed.positionals.length > 0)
@@ -170,6 +178,16 @@ function parseAgentCommand(argv, source) {
 }
 function parseAidCommand(argv, source) {
     const subcmd = argv[1];
+    if (subcmd === 'avatar') {
+        const tail = argv.slice(2);
+        const aid = tail[0];
+        const sourceFlag = tail[1];
+        if (!aid || (sourceFlag !== '--file' && sourceFlag !== '--url') || !tail[2] || tail[2].startsWith('-')
+            || (tail.length !== 3 && !(tail.length === 5 && tail[3] === '--format' && tail[4] === 'json'))) {
+            return raw(source, argv, 'Invalid aid avatar command');
+        }
+        return recognized('ec.aid.avatar', 'agent', source, { aid, ...(sourceFlag === '--file' ? { file: tail[2] } : { url: tail[2] }) }, argv, true);
+    }
     const parsed = parseArgs(argv.slice(2));
     const args = parsed.args;
     if (parsed.positionals.length > 0)

package/dist/core/command/command-handler.js

@@ -1,4 +1,5 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
+import { parseMenuClientArgs } from '../../cli/menu-client.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
 import { buildEnvelope, deliveryTargetFromSession, isInteractionSendAccepted, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
@@ -17,7 +18,7 @@ import { tryParseChannelKey } from '../channel-loader.js';
 import { displaySessionTitle } from '../session/session-title.js';
 import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
-import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
+import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommandAsync } from '../../config/config-operation-service.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
@@ -123,6 +124,43 @@ export class CommandHandler {
     daemonMonitorProvider;
     agentDelegationRegistry;
     handoffRuntime;
+    diagService;
+    setDiagService(service) { this.diagService = service; }
+    async handleMenuClientOperation(argv, sessionId, delegationToken, delegationCommandHash, send) {
+        const validation = this.agentDelegationRegistry?.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!validation?.ok)
+            return { ok: false, code: validation?.code ?? 'DELEGATION_REQUIRED', error: validation?.reason ?? 'Task delegation is required' };
+        const grant = validation.grant;
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session || session.selfAID !== grant.selfAid || argv[0] !== 'request' || argv[1] !== grant.selfAid)
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Menu requests must use the current Agent identity and session' };
+        try {
+            const channelId = parsePeerKey(grant.peerKey).channelId;
+            const subject = buildAuthSubject({ selfAid: grant.selfAid, actorId: grant.actorId, channel: grant.channel,
+                channelType: grant.channelType, channelId, chatType: grant.chatType, conversationId: channelId,
+                processOwners: [], ...trustedExecutionIdentityInput(grant) });
+            const decision = authorizeOperation({ source: 'agent-tool', subject,
+                intent: { operation: 'ec.menu.request', scope: 'relation', source: 'agent-tool', args: { self: grant.selfAid, peer: argv[2], targetId: argv[2] } },
+                auditMetadata: { taskId: grant.taskId, sessionId, messageId: grant.messageId } });
+            if (!decision.allow)
+                return { ok: false, code: decision.code, error: decision.reason };
+            const options = parseMenuClientArgs(argv, file => {
+                const target = fs.realpathSync(path.resolve(session.projectPath, file));
+                const roots = [session.projectPath, this.getManagedSessionTempDir(session)].filter((v) => !!v)
+                    .map(root => fs.realpathSync(root));
+                if (!roots.some(root => isSameOrDescendant(target, root)) || isHClassPath(target) || isLClassPath(target))
+                    throw new Error('Menu request file must be an unprotected file in the project or session TMPDIR');
+                const stat = fs.statSync(target);
+                if (!stat.isFile() || stat.nlink > 1 || stat.size > 128 * 1024)
+                    throw new Error('Menu request file must be a regular file of at most 128 KiB');
+                return fs.readFileSync(target, 'utf8');
+            });
+            return { ok: true, response: await send(options) };
+        }
+        catch (error) {
+            return { ok: false, code: error.code ?? 'MENU_REQUEST_FAILED', error: error.message };
+        }
+    }
     contactRequestSubmitter;
     /**
      * Get the runner for a (channel, baseagent) pair.
@@ -983,13 +1021,14 @@ export class CommandHandler {
     getMenuItems(role, chatType = 'private', scope = 'agent', authSubject) {
         return menuGetMenuItems.call(this, role, chatType, scope, authSubject);
     }
-    async getMenuCatalog(channel, channelId, subject, request, channelScope = 'agent') {
+    async getMenuCatalog(channel, channelId, subject, request, channelScope = 'agent', paircodeAllowed) {
         return await getMenuCatalog({
             subject,
             channelType: this.resolveChannelType(channel),
             channelScope,
             channelId,
             request,
+            ...(paircodeAllowed === undefined ? {} : { paircodeAllowed }),
         });
     }
     async execMenuValueBatch(channel, channelId, subject, args, request, channelScope = 'agent') {
@@ -1176,9 +1215,9 @@ export class CommandHandler {
     /**
      * 主命令处理入口
      */
-    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
+    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, enforceGroupSlashPolicy = false) {
         try {
-            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
+            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, enforceGroupSlashPolicy);
             // Lifecycle commands are control-plane operations. Their replies must
             // use notification payloads so other agents in a group do not treat the
             // text as ordinary model input. Normalize guard-path replies here too,
@@ -1210,8 +1249,10 @@ export class CommandHandler {
             throw error;
         }
     }
-    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
-        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
+    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, 
+    // Menu and delegated CLI operations reuse this implementation without the chat-only policy.
+    applyGroupSlashPolicy = false) {
+        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, applyGroupSlashPolicy);
     }
     async handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         if (content === '/trigger') {
@@ -1677,8 +1718,9 @@ export class CommandHandler {
     buildCtlReplyContext(session) {
         const ctx = { delivery: deliveryTargetFromSession(session) };
         const meta = session.metadata;
-        if (meta?.replyContext?.threadId)
-            ctx.threadId = meta.replyContext.threadId;
+        const threadId = session.threadId || meta?.replyContext?.threadId;
+        if (threadId)
+            ctx.threadId = threadId;
         if (meta?.replyContext?.peerId)
             ctx.peerId = meta.replyContext.peerId;
         if (!ctx.peerId && meta?.peerId)
@@ -1759,7 +1801,7 @@ export class CommandHandler {
             processOwners: loadDaemonConfig().owners ?? [],
             ...trustedExecutionIdentityInput(grant),
         });
-        const executeOne = (fieldArgv) => {
+        const executeOne = async (fieldArgv) => {
             const resolved = resolveConfigCommand(fieldArgv, {
                 defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
             });
@@ -1780,6 +1822,7 @@ export class CommandHandler {
                     dangerous: resolved.command.dangerous,
                 },
                 resolvedConfigCommand: resolved.command,
+                allowExplicitRelationTarget: true,
                 auditMetadata: {
                     argvHash: hashArgv(resolved.command.canonicalArgv),
                     taskId: grant.taskId,
@@ -1788,22 +1831,35 @@ export class CommandHandler {
             });
             if (!decision.allow)
                 return { ok: false, code: decision.code, error: decision.reason };
-            return executeResolvedConfigCommand(resolved.command, { role: subject.role });
+            const roleContext = {
+                self: grant.selfAid,
+                actorRole: subject.role,
+                actorRoleSource: subject.roleSource,
+                actorAllowAccess: subject.allowAccess,
+                actorAid: grant.actorId,
+                isDaemonOwner: subject.isDaemonOwner,
+                fromControlChannel: subject.fromControlChannel,
+                chatType: grant.chatType,
+            };
+            return await executeResolvedConfigCommandAsync(resolved.command, {
+                role: subject.role,
+                roleContext,
+            });
         };
         const batch = splitConfigBatchGetArgv(argv);
         if (batch && batch.fields.length > 1) {
-            const results = batch.fields.map(field => {
-                const result = executeOne(['config', 'get', field, ...batch.rest]);
+            const results = await Promise.all(batch.fields.map(async (field) => {
+                const result = await executeOne(['config', 'get', field, ...batch.rest]);
                 if (!result.ok)
                     return { ok: false, field, code: result.code, error: result.error };
                 if (result.subcommand !== 'get') {
                     return { ok: false, field, code: 'UNEXPECTED_RESULT', error: `config get ${field} produced a non-get result` };
                 }
                 return result;
-            });
+            }));
             return { ok: true, result: { ok: true, subcommand: 'batch-get', results } };
         }
-        const result = executeOne(argv);
+        const result = await executeOne(argv);
         return result.ok
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
@@ -1827,7 +1883,8 @@ export class CommandHandler {
         catch {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
         }
-        const resolved = resolveContactCommand(argv);
+        const resolvedArgv = argv.includes('--self') ? argv : [...argv, '--self', grant.selfAid];
+        const resolved = resolveContactCommand(resolvedArgv);
         if (!resolved.ok)
             return { ok: false, code: resolved.code, error: resolved.reason };
         if (resolved.command.selfAid !== grant.selfAid && !hasTrustedFullAccessDelegation(grant)) {
@@ -1946,10 +2003,10 @@ export class CommandHandler {
         if (sessionSelfAid && sessionSelfAid !== grantSelfAid) {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation self agent does not match the active session' };
         }
-        const requiresSelfAid = parsed.command.kind === 'show' || parsed.command.kind === 'agentmd.put';
+        const requiresSelfAid = parsed.command.kind === 'show' || parsed.command.kind === 'agentmd.put' || parsed.command.kind === 'avatar';
         if (requiresSelfAid
             && parsed.command.aid !== grantSelfAid
-            && !hasTrustedFullAccessDelegation(delegation.grant)) {
+            && (parsed.command.kind === 'avatar' || !hasTrustedFullAccessDelegation(delegation.grant))) {
             return { ok: false, code: 'SCOPE_MISMATCH', error: 'Only the current Agent AID can be targeted' };
         }
         let conversationId;
@@ -1988,12 +2045,87 @@ export class CommandHandler {
         });
         if (!decision.allow)
             return { ok: false, code: decision.code, error: decision.reason };
+        let avatarBuffer;
+        if (parsed.command.kind === 'avatar' && parsed.command.filePath) {
+            const filePath = String(parsed.command.filePath || '').trim();
+            if (typeof session.projectPath !== 'string' || !session.projectPath.trim()) {
+                return { ok: false, code: 'INVALID_AVATAR_PATH', error: 'Avatar file requires a current session project path' };
+            }
+            const projectPath = path.resolve(session.projectPath);
+            const managedTempPath = this.getManagedSessionTempDir(session);
+            const resolvedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(projectPath, filePath);
+            const allowedRoots = [projectPath, managedTempPath].filter((value) => !!value);
+            if (!filePath || !allowedRoots.some(root => isSameOrDescendant(resolvedPath, root))) {
+                return { ok: false, code: 'INVALID_AVATAR_PATH', error: 'Avatar file must be inside the current session project or managed TMPDIR' };
+            }
+            if (isHClassPath(resolvedPath) || isLClassPath(resolvedPath)) {
+                return { ok: false, code: 'PROTECTED_AVATAR_PATH', error: 'Avatar file cannot be read from a protected EvolCore path' };
+            }
+            let fd;
+            try {
+                const realProjectPath = fs.realpathSync(projectPath);
+                const realPath = fs.realpathSync(resolvedPath);
+                let realManagedTempPath;
+                try {
+                    realManagedTempPath = managedTempPath ? fs.realpathSync(managedTempPath) : undefined;
+                }
+                catch { }
+                const realAllowedRoots = [realProjectPath, realManagedTempPath].filter((value) => !!value);
+                if (!realAllowedRoots.some(root => isSameOrDescendant(realPath, root))) {
+                    return { ok: false, code: 'INVALID_AVATAR_PATH', error: 'Avatar file resolves outside the current session project or managed TMPDIR' };
+                }
+                if (isHClassPath(realPath) || isLClassPath(realPath)) {
+                    return { ok: false, code: 'PROTECTED_AVATAR_PATH', error: 'Avatar file cannot be read from a protected EvolCore path' };
+                }
+                const stat = fs.lstatSync(resolvedPath);
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    return { ok: false, code: 'INVALID_AVATAR_FILE', error: 'Avatar source must be a regular non-symlink file' };
+                }
+                if (realManagedTempPath && isSameOrDescendant(realPath, realManagedTempPath) && stat.nlink > 1) {
+                    return { ok: false, code: 'INVALID_AVATAR_PATH', error: 'Avatar source cannot be a hard link inside managed TMPDIR' };
+                }
+                if (stat.size < 1 || stat.size > 500 * 1024) {
+                    return { ok: false, code: 'INVALID_AVATAR_FILE', error: 'Avatar source must be between 1 byte and 500KB' };
+                }
+                // Open the user-supplied node with no-follow semantics after checking
+                // its canonical ancestors; the bytes passed to the uploader come from
+                // this descriptor rather than from a second path lookup.
+                fd = fs.openSync(resolvedPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+                const finalStat = fs.fstatSync(fd);
+                if (!finalStat.isFile() || finalStat.size < 1 || finalStat.size > 500 * 1024 || finalStat.nlink !== stat.nlink) {
+                    return { ok: false, code: 'INVALID_AVATAR_FILE', error: 'Avatar source changed during validation' };
+                }
+                avatarBuffer = fs.readFileSync(fd);
+            }
+            catch (error) {
+                return { ok: false, code: 'INVALID_AVATAR_FILE', error: error instanceof Error ? error.message : String(error) };
+            }
+            finally {
+                if (fd !== undefined)
+                    fs.closeSync(fd);
+            }
+        }
         try {
+            const result = await executeManagedAidOperation(parsed.command, {
+                showView: managedAidShowViewForRole(subject.role),
+                ...(avatarBuffer ? { avatarBuffer } : {}),
+            });
+            if (result.kind === 'avatar' && result.avatar) {
+                this.eventBus.publish({
+                    type: 'agent:avatar_updated',
+                    aid: result.aid,
+                    avatar: result.avatar,
+                    ...(result.sha256 ? { sha256: result.sha256 } : {}),
+                    ...(result.mime ? { mime: result.mime } : {}),
+                    ...(result.width ? { width: result.width } : {}),
+                    ...(result.height ? { height: result.height } : {}),
+                    ...(result.aspectRatio ? { aspectRatio: result.aspectRatio } : {}),
+                    timestamp: Date.now(),
+                });
+            }
             return {
                 ok: true,
-                result: await executeManagedAidOperation(parsed.command, {
-                    showView: managedAidShowViewForRole(subject.role),
-                }),
+                result,
             };
         }
         catch (error) {

package/dist/core/command/diag-service.js

@@ -0,0 +1,118 @@
+import { isValidAid } from '../../aun/aid/validation.js';
+import { remoteAccessService } from '../auth/remote-access-store.js';
+export const DIAGNOSTIC_AGENT_AID = 'diag.agentid.cn';
+/** IPC verifies local control authority; managed calls must independently prove their actor. */
+export async function executeDiagIpc(service, registry, owners, cmd) {
+    if (cmd.sessionId !== undefined) {
+        if (typeof cmd.sessionId !== 'string' || !cmd.sessionId)
+            return { ok: false, code: 'INVALID_SESSION', message: '无效托管会话' };
+        const auth = registry.validate(cmd.delegationToken, cmd.sessionId, cmd.delegationCommandHash);
+        if (!auth.ok)
+            return { ok: false, code: auth.code, message: auth.reason };
+        if (auth.grant.channelType !== 'aun' || !owners.includes(auth.grant.actorId))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '托管诊断发起需要本机 AUN DaemonOwner' };
+    }
+    try {
+        if (!Array.isArray(cmd.argv) || cmd.argv.some((v) => typeof v !== 'string'))
+            throw new Error('Invalid diag argv');
+        return await service.execute(parseDiagArgs(cmd.argv));
+    }
+    catch (error) {
+        return { ok: false, code: error.code ?? 'INVALID_ARGUMENT', message: error.message };
+    }
+}
+export function parseDiagArgs(args) {
+    const words = [];
+    let ownerAid;
+    let literal = false;
+    for (let i = 0; i < args.length; i++) {
+        const word = args[i];
+        if (!literal && word === '--') {
+            literal = true;
+            continue;
+        }
+        if (!literal && word === '--owner') {
+            if (ownerAid || !args[i + 1] || !isValidAid(args[i + 1]))
+                throw new Error('--owner 需要一个有效 AID');
+            ownerAid = args[++i];
+        }
+        else if (!literal && word.startsWith('--'))
+            throw new Error(`不支持的参数：${word}`);
+        else
+            words.push(word);
+    }
+    const problem = words.join(' ').trim();
+    if (problem.toLowerCase() === 'stop') {
+        if (ownerAid)
+            throw new Error('diag stop 不需要指定对象');
+        return { action: 'stop' };
+    }
+    if (!problem || problem.length > 16_000)
+        throw new Error('请提供 1 到 16000 字符的问题描述');
+    return { action: 'start', problem, ...(ownerAid ? { ownerAid } : {}) };
+}
+export class DiagService {
+    context;
+    send;
+    tokens;
+    constructor(context, send, tokens = remoteAccessService) {
+        this.context = context;
+        this.send = send;
+        this.tokens = tokens;
+    }
+    /** Local CLI authority is checked by IPC; slash identity is authenticated AUN peerId. */
+    async execute(command, actorAid) {
+        const { controlAid, owners } = this.context();
+        if (!controlAid || !isValidAid(controlAid))
+            return { ok: false, code: 'CONTROL_AID_REQUIRED', message: '本机尚未配置 Control AID' };
+        if (actorAid !== undefined && !owners.includes(actorAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '只有本机 DaemonOwner 可以发起或停止诊断' };
+        if (command.action === 'stop') {
+            const previous = this.tokens.revokeDiagnosticToken(controlAid);
+            if (!previous)
+                return { ok: true, message: '当前没有诊断授权' };
+            const diag = previous.diagnostic;
+            try {
+                await this.send(diag.agentAid, `诊断授权已取消。目标 daemon：${controlAid}；case：${diag.caseId}；沟通 Owner：${diag.ownerAid}。请停止这次诊断的后续访问，并告知 Owner。`);
+                return { ok: true, message: '诊断授权已撤销，已通知诊断 Agent' };
+            }
+            catch {
+                return { ok: true, code: 'DIAG_STOP_NOTICE_FAILED', message: '诊断授权已撤销；取消通知发送失败，诊断 Agent 后续访问将被拒绝' };
+            }
+        }
+        const ownerAid = actorAid ?? command.ownerAid ?? owners[0];
+        if (!ownerAid || !isValidAid(ownerAid) || !owners.includes(ownerAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '请配置本机 owners，或指定其中一个有效 Owner AID' };
+        if (!command.problem?.trim() || command.problem.length > 16_000)
+            return { ok: false, code: 'INVALID_ARGUMENT', message: '请提供 1 到 16000 字符的问题描述' };
+        let record;
+        try {
+            record = this.tokens.issueDiagnosticToken(controlAid, DIAGNOSTIC_AGENT_AID, ownerAid);
+        }
+        catch (error) {
+            return { ok: false, code: error.code ?? 'DIAG_AUTH_FAILED', message: error.message };
+        }
+        const caseId = record.diagnostic.caseId;
+        const invitation = [
+            '请协助诊断以下主机，并主动联系指定 Owner 展示进展、追问和报告。',
+            `目标 daemon Control AID：${controlAid}`, `沟通 Owner AID：${ownerAid}`, `case：${caseId}`,
+            `远程访问 Token：${record.token}`,
+            '请通过标准 Menu 调用诊断；Token 放入 E2EE 受保护头。权限复用该主机既有 Control Menu，包含 restart。有效访问滑动续期，空闲 60 分钟失效。',
+            '先给 Owner 发开始消息，使用通用 handoff 保留目标、Token、问题和发现；无需等待 Owner 回复即可开始。授权失效后停止访问。',
+            `问题描述：\n${command.problem.trim()}`,
+        ].join('\n');
+        try {
+            await this.send(DIAGNOSTIC_AGENT_AID, invitation);
+        }
+        catch (error) {
+            this.tokens.revokeDiagnosticToken(controlAid, record.token);
+            const reason = error instanceof Error ? error.message : String(error);
+            return { ok: false, code: 'DIAG_INVITATION_FAILED', message: `未能确认诊断邀请发送成功：${reason}。本次授权已撤销，请重试` };
+        }
+        // A stop may race with delivery; never report an already revoked grant as active.
+        if (this.tokens.getDiagnosticToken(controlAid)?.token !== record.token)
+            return { ok: false, code: 'DIAG_CANCELLED', message: '邀请发送期间授权已撤销，本次诊断已取消' };
+        return { ok: true, caseId, ownerAid, agentAid: DIAGNOSTIC_AGENT_AID,
+            message: `诊断邀请已发出，远程诊断 Agent 将联系 ${ownerAid}，请在与 ${DIAGNOSTIC_AGENT_AID} 的会话中查看处理过程。` };
+    }
+}