evolcore 0.0.25 → 0.0.26

package/dist/channels/aun.js

@@ -4,6 +4,7 @@ import { performance } from 'node:perf_hooks';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { logger, localTimestamp } from '../utils/logger.js';
 import { LogWriter } from '../utils/log-writer.js';
 import { middleOutputModePolicy, resolveShowActivities, showActivitiesPolicy } from '../core/channel-loader.js';
@@ -33,6 +34,7 @@ import { deriveCausation, normalizeCausation } from '../core/causation/context.j
 import { recordCausationSpan } from '../core/causation/audit.js';
 import { refreshAgentDisplayName, resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { readInstalledEvolcoreVersion } from '../utils/evolcore-version.js';
+import { ManagedMenuClient } from '../aun/menu-client.js';
 import { toolInputForDisplay } from '../utils/tool-summary.js';
 import { bindPostBootstrapWelcomeOutboxSession, hasPendingPostBootstrapWelcomeOutbox, pendingPostBootstrapWelcomeOwners, isPostBootstrapWelcomeOperationId, findPostBootstrapWelcomeOutbox, bootstrapInitialMessageOperationPrefix, postBootstrapWelcomeOperationId, preparePostBootstrapWelcomeOutbox, } from '../core/bootstrap-messages.js';
 import { hasMentionAll, mentionEntryAids, mentionEntryTargets, } from '../core/message/mention-schema.js';
@@ -52,6 +54,51 @@ const AUN_SEND_LOG_TEXT_MAX_LENGTH = 60;
 export function formatAunSendLogText(text) {
     return text.replace(/\s+/gu, ' ').trim().slice(0, AUN_SEND_LOG_TEXT_MAX_LENGTH);
 }
+/**
+ * Echo trace 行的墙钟前缀。
+ *
+ * 格式必须保持 `HH:MM:SS.mmm` 且毫秒后紧跟空格——Evol App 的
+ * `evol/lib/utils/echo_utils.dart` 用 `^(\d{2}):(\d{2}):(\d{2})\.(\d{3})\s` 匹配这一段，
+ * 在毫秒和空格之间插任何东西（比如时区偏移）都会让旧版 App 静默失配、不再显示 RTT。
+ * 时区信息改由行尾的 {@link echoTraceOriginLabel} 提供，前缀一字不动，两端发版顺序因此解耦。
+ */
+export function echoTraceClock(now = Date.now()) {
+    const d = new Date(now);
+    const pad = (n, width = 2) => String(n).padStart(width, '0');
+    return `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}.${pad(d.getMilliseconds(), 3)}`;
+}
+/**
+ * Echo trace 行尾的权威时间标记：`epoch=<ms> tz=<±HH:MM>`。
+ *
+ * 前缀的墙钟没有日期也没有时区，消费方只能按自己的本地时区解析，两端 TZ 不一致时算出的
+ * RTT 会整小时偏移（UTC 对 Asia/Shanghai 就是 +28800000ms），跨午夜还会得到负值。
+ * `epoch` 是绝对值，消费方应当用它相减算延迟；`tz` 仅供人工核对墙钟，不参与计算。
+ */
+export function echoTraceOriginLabel(now = Date.now()) {
+    const d = new Date(now);
+    const pad = (n, width = 2) => String(n).padStart(width, '0');
+    const offsetMinutes = -d.getTimezoneOffset();
+    const sign = offsetMinutes >= 0 ? '+' : '-';
+    const absOffset = Math.abs(offsetMinutes);
+    return ` epoch=${now} tz=${sign}${pad(Math.floor(absOffset / 60))}:${pad(absOffset % 60)}`;
+}
+/**
+ * 入站腿延迟（对端/网关发出 → 本进程收到）。
+ *
+ * `created_at` 由对端或网关打戳，因此结果含对端时钟漂移，只能当估算值——标签用
+ * `inbound_est` 而非 `inbound` 就是为了让消费方知道这点。负值说明对端时钟快于本机，
+ * 照实输出而不夹到 0：那本身就是有用的时钟偏移信号。
+ */
+export function echoInboundLegLabel(createdAt, receivedAt) {
+    if (typeof createdAt !== 'number' || !Number.isFinite(createdAt) || createdAt <= 0)
+        return '';
+    // 网关历史上有按秒打戳的实现，按量级归一到毫秒。
+    const createdMs = createdAt < 1e12 ? createdAt * 1000 : createdAt;
+    const delta = receivedAt - createdMs;
+    if (!Number.isFinite(delta))
+        return '';
+    return ` inbound_est=${Math.round(delta)}ms`;
+}
 function attachmentDownloadHost(url) {
     try {
         return new URL(url).host || '<unknown>';
@@ -431,6 +478,8 @@ export function aunOptsToInbound(opts, channel, channelType) {
         content: opts.content,
         chatType: opts.chatType || 'private',
         peerId: opts.peerId || '',
+        peerDeviceId: opts.peerDeviceId,
+        peerSlotId: opts.peerSlotId,
         peerName: opts.peerName,
         peerType: opts.peerType,
         sameDevice: opts.sameDevice,
@@ -502,9 +551,26 @@ function payloadTypeForObserver(value) {
     const type = payload.type;
     return typeof type === 'string' ? type : undefined;
 }
+function errorCodeForLog(error) {
+    if (!error || typeof error !== 'object')
+        return '';
+    const value = error;
+    return typeof value.code === 'string' || typeof value.code === 'number' ? String(value.code) : '';
+}
 export class AUNChannel {
     config;
+    managedMenuClient = new ManagedMenuClient(params => {
+        if (!this.connected || !this.client)
+            return Promise.reject(new Error('AUN channel is not connected'));
+        return this.callAndTrace('message.send', params);
+    });
+    requestRemoteMenu(options) {
+        if (options.fromAid !== (this._aid || this.config.aid))
+            throw new Error('Menu sender does not match channel identity');
+        return this.managedMenuClient.request(options);
+    }
     client = null;
+    localSenderInstallation;
     store = null;
     /** 实际连接的网关 URL（来自 authenticate() 返回值 / connection.state 事件），替代旧 (client as any)._gatewayUrl。 */
     gatewayUrl = '';
@@ -562,46 +628,88 @@ export class AUNChannel {
      * 统一的 RPC 调用包装：自动记录 OUT 发送、.ok 结果、.error 错误（含 trace + daemon.log 失败日志）。
      * 所有 client.call() 都应通过此方法调用，保证 aun-trace 里每个 OUT 调用都有"发+收/错"成对记录。
      */
-    callClient(method, params) {
-        return this.withOutboundSendGate(method, () => (this.client.call(method, params).then(value => value)));
+    callClient(method, params, lane = 'normal', onStart) {
+        return this.withOutboundSendGate(method, () => (this.client.call(method, params).then(value => value)), lane, onStart);
     }
-    withOutboundSendGate(method, run) {
-        if (!AUNChannel.OUTBOUND_SEND_METHODS.has(method))
+    withOutboundSendGate(method, run, lane = 'normal', onStart) {
+        if (!AUNChannel.OUTBOUND_SEND_METHODS.has(method)) {
+            onStart?.();
             return run();
+        }
+        const queue = lane === 'observer' ? this.observerSendQueue : this.outboundSendQueue;
+        if (lane === 'observer' && queue.length >= AUNChannel.OBSERVER_SEND_QUEUE_MAX) {
+            this.noteObserverQueueDrop();
+            const error = Object.assign(new Error('observer send queue is full'), {
+                code: 'AUN_OBSERVER_QUEUE_FULL',
+            });
+            return Promise.reject(error);
+        }
         return new Promise((resolve, reject) => {
-            this.outboundSendQueue.push({
+            queue.push({
                 run: run,
                 resolve: resolve,
                 reject,
+                onStart,
             });
             this.pumpOutboundSendGate();
         });
     }
     pumpOutboundSendGate() {
-        while (this.outboundSendActive < AUNChannel.OUTBOUND_SEND_CONCURRENCY
-            && this.outboundSendQueue.length > 0) {
-            const job = this.outboundSendQueue.shift();
+        while (this.outboundSendActive + this.observerSendActive < AUNChannel.OUTBOUND_SEND_CONCURRENCY && this.outboundSendQueue.length > 0) {
+            this.startOutboundSendJob(this.outboundSendQueue.shift(), 'normal');
+        }
+        while (this.outboundSendActive + this.observerSendActive < AUNChannel.OUTBOUND_SEND_CONCURRENCY
+            && this.observerSendActive < AUNChannel.OBSERVER_SEND_CONCURRENCY
+            && this.outboundSendQueue.length === 0
+            && this.observerSendQueue.length > 0) {
+            this.startOutboundSendJob(this.observerSendQueue.shift(), 'observer');
+        }
+    }
+    clearQueuedObserverSends(reason) {
+        if (this.observerSendQueue.length === 0)
+            return;
+        const error = Object.assign(new Error(`observer send discarded while ${reason}`), {
+            code: 'AUN_OBSERVER_QUEUE_DROPPED',
+        });
+        const queued = this.observerSendQueue.splice(0);
+        for (const job of queued)
+            job.reject(error);
+        this.noteObserverQueueDrop(queued.length);
+    }
+    startOutboundSendJob(job, lane) {
+        if (lane === 'observer')
+            this.observerSendActive++;
+        else
             this.outboundSendActive++;
-            Promise.resolve()
-                .then(job.run)
-                .then(job.resolve, job.reject)
-                .finally(() => {
+        Promise.resolve()
+            .then(() => {
+            job.onStart?.();
+            return job.run();
+        })
+            .then(job.resolve, job.reject)
+            .finally(() => {
+            if (lane === 'observer')
+                this.observerSendActive--;
+            else
                 this.outboundSendActive--;
-                this.pumpOutboundSendGate();
-            });
-        }
+            this.pumpOutboundSendGate();
+        });
     }
     async callAndTrace(method, params, opts) {
         this.trace('OUT', method, params);
-        // RPC 往返计时：区分「网关慢」与「本地队列堵塞」。message.send/group.send 的
-        // duration 若普遍逼近 SDK 的 rpc 超时（默认 10s），说明发送管线已饱和或链路抖动，
-        // 是 /evolhelp 等命令「回复慢/无回复」的直接可观测信号。
+        // 计时同时覆盖排队和 SDK 往返；callStartedAt 让日志能区分「本地队列堵塞」
+        // 与「网关慢」。两者对 /evolhelp 等命令的回复延迟都有直接影响。
         const rpcStart = Date.now();
         // SLOW_RPC_WARN_MS 需明显低于 SDK 默认 10s 超时，以便在真正超时前提前告警。
         const SLOW_RPC_WARN_MS = 3000;
+        let callStartedAt = rpcStart;
         try {
-            const result = await this.callClient(method, params);
+            const result = await this.callClient(method, params, opts?.lane ?? 'normal', () => {
+                callStartedAt = Date.now();
+            });
             const durationMs = Date.now() - rpcStart;
+            const rpcDurationMs = Date.now() - callStartedAt;
+            const queueWaitMs = Math.max(0, callStartedAt - rpcStart);
             if (!opts?.silentOk) {
                 const r = result;
                 const snap = r && typeof r === 'object'
@@ -609,25 +717,66 @@ export class AUNChannel {
                     : { duration_ms: durationMs };
                 this.trace('OUT', `${method}.ok`, snap);
             }
-            if (durationMs >= SLOW_RPC_WARN_MS) {
-                logger.warn(`${this.logPrefix()} rpc ${method} SLOW: duration=${durationMs}ms (发送管线可能饱和或链路抖动)`);
-            }
+            if (durationMs >= SLOW_RPC_WARN_MS)
+                this.logRpcWarning('slow', method, params, durationMs, queueWaitMs, rpcDurationMs);
             return result;
         }
         catch (e) {
             const durationMs = Date.now() - rpcStart;
+            const queueWaitMs = Math.max(0, callStartedAt - rpcStart);
+            const rpcDurationMs = Math.max(0, Date.now() - callStartedAt);
             this.trace('OUT', `${method}.error`, {
                 error: e?.message ?? String(e),
                 code: e?.code,
                 name: e?.name,
                 duration_ms: durationMs,
             });
-            if (!opts?.silentError) {
-                logger.warn(`${this.logPrefix()} rpc ${method} failed after ${durationMs}ms: ${e?.name ?? ''}(${e?.code ?? ''}) ${e?.message ?? e}`);
+            if (!opts?.silentError && e?.code !== 'AUN_OBSERVER_QUEUE_FULL' && e?.code !== 'AUN_OBSERVER_QUEUE_DROPPED') {
+                this.logRpcWarning('failed', method, params, durationMs, queueWaitMs, rpcDurationMs, e);
             }
             throw e;
         }
     }
+    logRpcWarning(kind, method, params, durationMs, queueWaitMs, rpcDurationMs, error) {
+        const payloadType = payloadTypeForObserver(params) ?? 'unknown';
+        const code = kind === 'failed' ? errorCodeForLog(error) : '';
+        const key = `${kind}|${method}|${payloadType}`;
+        const now = Date.now();
+        const state = this.rpcWarningStates.get(key) ?? { lastWarnAt: 0, suppressed: 0, maxDurationMs: 0 };
+        state.maxDurationMs = Math.max(state.maxDurationMs, durationMs);
+        if (state.lastWarnAt > 0 && now - state.lastWarnAt < AUNChannel.RPC_WARN_INTERVAL_MS) {
+            state.suppressed++;
+            this.rpcWarningStates.set(key, state);
+            return;
+        }
+        const suppressed = state.suppressed;
+        const maxDurationMs = state.maxDurationMs;
+        state.lastWarnAt = now;
+        state.suppressed = 0;
+        state.maxDurationMs = 0;
+        this.rpcWarningStates.set(key, state);
+        const summary = suppressed > 0 ? ` suppressed=${suppressed} max_duration=${maxDurationMs}ms` : '';
+        if (kind === 'failed') {
+            const name = error instanceof Error ? error.name : '';
+            const message = error instanceof Error ? error.message : String(error ?? '');
+            const errorLabel = `${name}${code ? `(${code})` : ''} ${message}`.trim();
+            logger.warn(`${this.logPrefix()} rpc ${method} failed after ${durationMs}ms: ${errorLabel} queue_wait=${queueWaitMs}ms rpc=${rpcDurationMs}ms payload=${payloadType}${summary}`);
+            return;
+        }
+        logger.warn(`${this.logPrefix()} rpc ${method} SLOW: duration=${durationMs}ms queue_wait=${queueWaitMs}ms rpc=${rpcDurationMs}ms payload=${payloadType}${summary} (发送管线可能饱和或链路抖动)`);
+    }
+    observerQueueDropCount = 0;
+    observerQueueDropLastWarnAt = 0;
+    noteObserverQueueDrop(count = 1) {
+        this.observerQueueDropCount += count;
+        const now = Date.now();
+        if (now - this.observerQueueDropLastWarnAt < AUNChannel.RPC_WARN_INTERVAL_MS)
+            return;
+        const dropped = this.observerQueueDropCount;
+        this.observerQueueDropCount = 0;
+        this.observerQueueDropLastWarnAt = now;
+        logger.warn(`${this.logPrefix()} observer send queue full: dropped=${dropped} (observer telemetry is being sampled while the gateway is unavailable)`);
+    }
     /** Resolve the authenticated transport route for an ordinary outbound send.
      * The channel id is an address only; it is intentionally never used to infer
      * whether the address is a group.
@@ -693,7 +842,13 @@ export class AUNChannel {
             context.threadId = threadId;
         if (operatorId && delivery.chatType === 'group')
             context.peerId = operatorId;
-        void this.sendMessage(channelId, text, context).catch((err) => {
+        const payload = {
+            type: 'notice',
+            ...this.buildTaskPayloadBase({}, context),
+            text,
+            severity: 'info',
+        };
+        void this.sendReliableStructured(channelId, payload, context, text).catch((err) => {
             logger.error(`${this.logPrefix()} Failed to send card action error:`, err);
         });
     }
@@ -713,6 +868,12 @@ export class AUNChannel {
                     : typeof obj.card_message_id === 'string' ? obj.card_message_id : '';
                 const cardInfo = cardMsgId ? this.cardMessageIdMap.get(cardMsgId) : undefined;
                 const cardDelivery = cardInfo?.delivery ?? delivery;
+                const savedTopic = this.ownedCardTopics.get(cardMsgId);
+                // Keep the topic after the actionable mapping expires, including for
+                // older clients that omit thread_id in their callbacks.
+                const threadId = cardInfo?.replyContext?.threadId
+                    ?? (savedTopic?.channelId === channelId ? savedTopic?.threadId : undefined)
+                    ?? (typeof obj.thread_id === 'string' ? obj.thread_id : undefined);
                 if (cardInfo) {
                     // compose 按钮由新版客户端在卡片内采集输入；旧版客户端可继续从主编辑器
                     // 采集。两者最终都回传 action_card_reply{behavior:"compose", text}。
@@ -728,10 +889,6 @@ export class AUNChannel {
                     const actionValue = isComposeReply ? '_custom_input'
                         : typeof obj.value === 'string' ? obj.value
                             : typeof obj.action_value === 'string' ? obj.action_value : text;
-                    // Prefer the trusted context persisted with the card. A callback's
-                    // thread_id is client-controlled and may be absent or stale.
-                    const threadId = cardInfo?.replyContext?.threadId
-                        ?? (typeof obj.thread_id === 'string' ? obj.thread_id : undefined);
                     // 卡片点击者身份：只信认证信封（senderAid 参数，由调用方从 msg.from / msg.sender_aid 提取）。
                     // payload 自报字段（from / sender_aid / user_id）不可信，可被客户端伪造，不读取。
                     // 两类卡片共用：CommandCard → 伪入站消息的 peerId，ActionInteraction → operatorId。
@@ -774,9 +931,11 @@ export class AUNChannel {
                                 peerName: typeof obj.label === 'string' ? obj.label : typeof obj.action_label === 'string' ? obj.action_label : undefined,
                                 messageId: `card-trigger-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
                                 threadId,
-                                replyContext: cardInfo?.replyContext ?? ((threadId || cardDelivery)
-                                    ? { ...(threadId ? { threadId } : {}), ...(cardDelivery ? { delivery: cardDelivery } : {}) }
-                                    : undefined),
+                                replyContext: {
+                                    ...(cardInfo.replyContext ?? {}),
+                                    ...(threadId ? { threadId } : {}),
+                                    ...(cardDelivery ? { delivery: cardDelivery } : {}),
+                                },
                                 source: 'card-trigger',
                             })).catch((err) => {
                                 logger.error(`${this.logPrefix()} CommandCard handler failed: action=${actionValue} mid=${cardMsgId}`, err);
@@ -887,9 +1046,9 @@ export class AUNChannel {
                     }
                 }
                 else if (this.ownedCardMsgIds.has(cardMsgId)) {
-                    // 本 agent 发出的卡片，但 entry 已过期（24h TTL）
+                    // 本 agent 发出的卡片，但 entry 已过期或被清理。
                     logger.debug(`${this.logPrefix()} action_card_reply expired: cardMsgId=${cardMsgId}`);
-                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', undefined, undefined, delivery);
+                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', senderAid, threadId, delivery);
                 }
                 else {
                     // 非本 agent 发出的卡片（broadcast 模式下其他 agent 的卡）→ 静默忽略
@@ -1295,6 +1454,7 @@ export class AUNChannel {
     cardMessageIdMap = new Map();
     /** 本 agent 曾发出过的卡片 msgId（只增不删，用于区分"过期失效"vs"他人发的卡"） */
     ownedCardMsgIds = new Set();
+    ownedCardTopics = new Map();
     /** requestId → 已投递的卡片 message_id 集合（撤权/超时时撤回） */
     interactionCardMessageIds = new Map();
     /** 撤权可能先于 outbox 卡片投递完成；迟到卡片注册后立即撤回。 */
@@ -1304,7 +1464,7 @@ export class AUNChannel {
     groupSlashRequireMentionsResolver;
     static PROACTIVE_ALLOW_TYPES = new Set([
         'text', 'quote', 'image', 'video', 'voice', 'file', 'json',
-        'merge', 'link', 'location', 'personal_card',
+        'merge', 'link', 'location', 'personal_card', 'contact.request.response',
     ]);
     /** 观察者插话请求类型（owner → agent.AID）。详见 docs/observer-insert-design.md。 */
     static INJECT_REQUEST_TYPE = 'observer.inject';
@@ -1344,7 +1504,7 @@ export class AUNChannel {
     aidState;
     aidStatsCollector;
     outboxInFlight = new Set();
-    /** Shared gateway-facing send limit for replies, activity, observer and thought messages. */
+    /** Shared total gateway-facing send capacity; normal traffic has priority over observer telemetry. */
     static OUTBOUND_SEND_METHODS = new Set([
         'message.send',
         'group.send',
@@ -1352,8 +1512,14 @@ export class AUNChannel {
         'group.thought.put',
     ]);
     static OUTBOUND_SEND_CONCURRENCY = 4;
+    static OBSERVER_SEND_CONCURRENCY = 1;
+    static OBSERVER_SEND_QUEUE_MAX = 256;
+    static RPC_WARN_INTERVAL_MS = 60_000;
     outboundSendActive = 0;
     outboundSendQueue = [];
+    observerSendActive = 0;
+    observerSendQueue = [];
+    rpcWarningStates = new Map();
     constructor(config) {
         this.config = config;
         this.agentDir = agentDirPath(config.aid);
@@ -1425,6 +1591,27 @@ export class AUNChannel {
             this.initInProgress = false;
         }
     }
+    /** Optional local compatibility code is never required by a clean checkout or npm install. */
+    async loadLocalSenderInstallation(client) {
+        this.localSenderInstallation = undefined;
+        const currentFile = fileURLToPath(import.meta.url);
+        const modulePath = path.join(path.dirname(currentFile), '..', 'aun', `sender-installation${path.extname(currentFile)}`);
+        if (!fs.existsSync(modulePath))
+            return;
+        try {
+            // Use a runtime URL so TypeScript can build when the local file is absent.
+            const extension = await import(pathToFileURL(modulePath).href);
+            if (typeof extension.enableAunSenderInstallation !== 'function'
+                || typeof extension.aunSenderInstallation !== 'function') {
+                throw new Error('Invalid local sender installation module');
+            }
+            extension.enableAunSenderInstallation(client);
+            this.localSenderInstallation = extension;
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} Optional local sender installation disabled: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     async _initClientInner() {
         this.observerGroupMembers.clear();
         for (const groupId of new Set([
@@ -1454,6 +1641,7 @@ export class AUNChannel {
             this.store = null;
         }
         this.connected = false;
+        this.clearQueuedObserverSends('client reinitialization');
         this.lastConnectionStateSignature = '';
         const aunPath = this.config.keystorePath || resolveRoot();
         const aidName = this.config.aid;
@@ -1473,6 +1661,7 @@ export class AUNChannel {
         const client = await loadClient(store, aidName);
         enableFullGroupPullPagination(client);
         enableReliableMessageDelivery(client);
+        await this.loadLocalSenderInstallation(client);
         this.client = client;
         // A reconnect replaces the SDK client. Late events from the retired
         // instance must not mutate the new instance's health or message state.
@@ -2115,6 +2304,15 @@ export class AUNChannel {
             return;
         const protectedHeaders = verifiedProtectedHeaders(msg, env);
         const payload = msg.payload ?? '';
+        if (this.managedMenuClient.accept(fromAid, payload, !!env.encrypted)) {
+            this.acknowledgeImmediately(messageId, seq);
+            return;
+        }
+        if (payloadTypeForObserver(msg) === 'observer.forward') {
+            this.acknowledgeImmediately(messageId, seq);
+            logger.debug(`${this.logPrefix()} P2P dropped observer.forward control envelope: mid=${messageId}`);
+            return;
+        }
         const mentions = this.parsePayloadMentionsOrReject(payload, 'p2p.inbound', messageId, seq);
         if (!mentions)
             return;
@@ -2191,12 +2389,17 @@ export class AUNChannel {
         if (p2pPayloadType.startsWith('menu.')
             || p2pPayloadType === AUNChannel.CONTACT_REQUEST_QUERY_TYPE
             || p2pPayloadType === AUNChannel.CONTACT_REQUEST_SUBMIT_TYPE) {
+            const installation = p2pPayloadType.startsWith('menu.')
+                ? this.localSenderInstallation?.aunSenderInstallation(msg) : undefined;
             this.acknowledgeImmediately(messageId, seq);
             this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             this.dispatchMessage({
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
                 chatType: 'private', messageId, seq, receivedAt, receivedAtMono, gatewaySeq: seq,
+                peerDeviceId: installation?.deviceId,
+                peerSlotId: installation?.slotId,
+                threadId,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
@@ -2228,6 +2431,7 @@ export class AUNChannel {
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
                 chatType: 'private', messageId, seq, receivedAt, gatewaySeq: seq,
+                threadId,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
@@ -2260,6 +2464,7 @@ export class AUNChannel {
             chatType: 'private',
             messageId,
             receivedAt,
+            createdAt: typeof msg.created_at === 'number' ? msg.created_at : undefined,
             gatewaySeq: seq,
             causation,
             seq,
@@ -2297,6 +2502,12 @@ export class AUNChannel {
         const groupId = env.group_id ?? '';
         const senderAid = env.from ?? '';
         const payload = msg.payload ?? '';
+        const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
+        if (inboundType === 'observer.forward') {
+            this.acknowledgeImmediately(messageId, seq);
+            logger.debug(`${this.logPrefix()} Group dropped observer.forward control envelope: mid=${messageId}`);
+            return;
+        }
         const payloadMentionEntries = this.parsePayloadMentionsOrReject(payload, 'group.inbound', messageId, seq);
         if (!payloadMentionEntries)
             return;
@@ -2307,7 +2518,6 @@ export class AUNChannel {
         const topicName = (typeof payload === 'object' && payload !== null)
             ? this.sanitizeTopicName(payload.topicName)
             : undefined;
-        const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
         // 终态错误只作为展示信号，不能进入 Agent，也不能被 observer 再次传播。
         if (inboundType === 'error') {
             this.acknowledgeImmediately(messageId, seq);
@@ -2377,27 +2587,10 @@ export class AUNChannel {
         {
             const payloadObj = (payload && typeof payload === 'object') ? payload : null;
             const payloadType = typeof payloadObj?.type === 'string' ? payloadObj.type : '';
-            // menu.* 协议：自定义消息快速路径
+            // Menu control requests are private-only, including token issuance.
             if (payloadType.startsWith('menu.')) {
-                const menuEncrypted = !!env.encrypted;
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, menuEncrypted, true, logDescriptor, threadId, receivedAt, seq);
-                this.dispatchMessage({
-                    channelId: groupId, userId: senderAid,
-                    text: JSON.stringify(payload),
-                    chatType: 'group', messageId, seq, receivedAt, receivedAtMono, gatewaySeq: seq, groupId,
-                    encrypted: menuEncrypted,
-                    protectedHeaders,
-                    mentions: payloadMentionEntries,
-                    mentionAids: payloadMentionAids,
-                    isMentioned: hasMentionAll(payloadMentionEntries)
-                        || (!!this._aid && mentionEntryTargets(payloadMentionEntries).includes(this._aid)),
-                    replyContext: this.buildGroupReplyContext(threadId, senderAid, menuEncrypted, messageId, payloadObj?.chatmode, topicName, groupId),
-                    msgType: logDescriptor.msgType,
-                    payloadType: logDescriptor.payloadType,
-                    payloadSummary: logDescriptor.payloadSummary,
-                    messageLogContent: logDescriptor.content,
-                });
+                logger.debug(`${this.logPrefix()} Group Menu dropped: code=MENU_PRIVATE_ONLY mid=${messageId}`);
                 return;
             }
             if (payloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(payloadType)) {
@@ -2437,17 +2630,15 @@ export class AUNChannel {
         if (isEchoMsg) {
             // 短 echo（≤10 字符）已在前面的快速通道命中并 return，这里只处理长 echo
             // >10 字符：追加 trace,存 pending echo,跳过 mention 过滤继续走 Agent 流程
-            const echoTs = () => {
-                const d = new Date();
-                return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}.${String(d.getMilliseconds()).padStart(3, '0')}`;
-            };
+            const echoCreatedAt = data.created_at;
+            const echoReceiveTs = Date.now();
             let echoText = text;
-            echoText += `\n${echoTs()} [EvolCore.receive] from=${senderAid} mid=${messageId} chat=group self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((Date.now() - this.connectedAt) / 1000) + 's' : 'unknown'}`;
+            echoText += `\n${echoTraceClock(echoReceiveTs)} [EvolCore.receive] from=${senderAid} mid=${messageId} chat=group self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((echoReceiveTs - this.connectedAt) / 1000) + 's' : 'unknown'}${echoInboundLegLabel(echoCreatedAt, receivedAt)}${echoTraceOriginLabel(echoReceiveTs)}`;
             const msgChatmodeEcho = (payload && typeof payload === 'object') ? payload.chatmode : undefined;
             this.pendingEchoMessages.set(messageId, {
                 text: echoText,
                 channelId: groupId,
-                context: this.buildGroupReplyContext(undefined, senderAid, msgEncrypted, messageId, msgChatmodeEcho, undefined, groupId),
+                context: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmodeEcho, topicName, groupId),
                 receiveTs: Date.now(),
             });
             // 继续走正常 Agent 流程（下面的代码会 dispatch）
@@ -2536,6 +2727,7 @@ export class AUNChannel {
             chatType: 'group',
             messageId,
             receivedAt,
+            createdAt: typeof msg.created_at === 'number' ? msg.created_at : undefined,
             gatewaySeq: seq,
             seq,
             threadId,
@@ -2564,6 +2756,7 @@ export class AUNChannel {
                 && authenticatedDelivery.chatType === 'group'
                 && suppliedDelivery.groupId === authenticatedDelivery.groupId;
         const delivery = suppliedDelivery && suppliedMatches ? suppliedDelivery : authenticatedDelivery;
+        const threadId = event.threadId ?? event.replyContext?.threadId;
         if (suppliedDelivery && delivery !== suppliedDelivery) {
             logger.warn(`${this.logPrefix()} Ignoring mismatched inbound reply route: channel=${event.channelId} chatType=${event.chatType}`);
         }
@@ -2585,17 +2778,15 @@ export class AUNChannel {
         }
         // 长 echo（>10 字符）：存 pending,继续交给 agent 处理
         if (/echo/i.test(firstLine) && firstLine.trim().length > 10 && !hasEvolCoreTracePrivate) {
-            const echoTs = () => {
-                const d = new Date();
-                return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}.${String(d.getMilliseconds()).padStart(3, '0')}`;
-            };
+            const echoReceiveTs = Date.now();
             let echoText = event.text;
-            echoText += `\n${echoTs()} [EvolCore.receive] from=${event.userId}${event.peerName ? `(${event.peerName})` : ''} mid=${event.messageId} chat=${event.chatType} self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((Date.now() - this.connectedAt) / 1000) + 's' : 'unknown'}`;
+            echoText += `\n${echoTraceClock(echoReceiveTs)} [EvolCore.receive] from=${event.userId}${event.peerName ? `(${event.peerName})` : ''} mid=${event.messageId} chat=${event.chatType} self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((echoReceiveTs - this.connectedAt) / 1000) + 's' : 'unknown'}${echoInboundLegLabel(event.createdAt, event.receivedAt ?? echoReceiveTs)}${echoTraceOriginLabel(echoReceiveTs)}`;
             this.pendingEchoMessages.set(event.messageId, {
                 text: echoText,
                 channelId: event.channelId,
                 context: {
                     ...(event.replyContext?.metadata ? { metadata: event.replyContext.metadata } : {}),
+                    ...(threadId ? { threadId } : {}),
                     delivery,
                 },
                 receiveTs: Date.now(),
@@ -2610,7 +2801,7 @@ export class AUNChannel {
         const replyContext = {
             ...(event.replyContext ?? {}),
             delivery,
-            ...(event.threadId && !event.replyContext?.threadId ? { threadId: event.threadId } : {}),
+            ...(threadId ? { threadId } : {}),
         };
         this.messageHandler({
             channelId: event.channelId || '',
@@ -2622,6 +2813,8 @@ export class AUNChannel {
             peerId: event.userId || event.channelId || '',
             peerName: event.peerName,
             peerType: event.peerType,
+            peerDeviceId: event.peerDeviceId,
+            peerSlotId: event.peerSlotId,
             sameDevice: event.sameDevice,
             sameNetwork: event.sameNetwork,
             sameEgressIp: event.sameEgressIp,
@@ -2632,7 +2825,7 @@ export class AUNChannel {
             receivedAtMono: event.receivedAtMono,
             gatewaySeq: event.gatewaySeq ?? event.seq,
             causation: event.causation,
-            threadId: event.threadId,
+            threadId,
             mentions: event.mentions,
             mentionAids: event.mentionAids,
             isMentioned: event.isMentioned, // ← 新增：传递 isMentioned 标记
@@ -2797,7 +2990,10 @@ export class AUNChannel {
     forwardInbound(data) {
         if (!this.connected || !this.client)
             return Promise.resolve();
-        if (payloadTypeForObserver(data)?.startsWith('menu.'))
+        const inboundType = payloadTypeForObserver(data);
+        // Observer envelopes are control-plane telemetry. Mirroring one again
+        // would amplify every activity event across observer-connected agents.
+        if (inboundType === 'observer.forward' || inboundType?.startsWith('menu.'))
             return Promise.resolve();
         const { observable, owners } = this.getObserverConfig();
         if (!observable || owners.length === 0)
@@ -2833,7 +3029,8 @@ export class AUNChannel {
     forwardOutbound(result) {
         if (!this.connected || !this.client)
             return Promise.resolve();
-        if (payloadTypeForObserver(result)?.startsWith('menu.'))
+        const outboundType = payloadTypeForObserver(result);
+        if (outboundType === 'observer.forward' || outboundType?.startsWith('menu.'))
             return Promise.resolve();
         const { observable, owners } = this.getObserverConfig();
         if (!observable || owners.length === 0)
@@ -2874,8 +3071,8 @@ export class AUNChannel {
         };
         const encrypt = this.shouldEncrypt('observer.forward');
         for (const ownerAid of owners) {
-            this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt })
-                .catch(e => logger.warn(`${this.logPrefix()} observer.forward send to ${ownerAid} failed: ${e}`));
+            this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt }, { lane: 'observer' })
+                .catch(e => logger.debug(`${this.logPrefix()} observer.forward send to ${ownerAid} failed: ${e}`));
         }
     }
     // ── 观察者插话（Observer Insert，v0.3 待用上下文提示） ──────────────
@@ -2978,14 +3175,12 @@ export class AUNChannel {
         }
     }
     handleEcho(event) {
-        const ts = () => {
-            const d = new Date();
-            return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}.${String(d.getMilliseconds()).padStart(3, '0')}`;
-        };
+        const receiveTs = Date.now();
         // 在收到的消息文本末尾追加 trace 行（只追加,不修改原文）
         let echoText = event.text;
-        echoText += `\n${ts()} [EvolCore.receive] from=${event.userId}${event.peerName ? `(${event.peerName})` : ''} mid=${event.messageId} chat=${event.chatType} self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((Date.now() - this.connectedAt) / 1000) + 's' : 'unknown'}`;
-        echoText += `\n${ts()} [EvolCore.reply] echo回声发出 conn_uptime=${this.connectedAt ? Math.round((Date.now() - this.connectedAt) / 1000) + 's' : 'unknown'}`;
+        echoText += `\n${echoTraceClock(receiveTs)} [EvolCore.receive] from=${event.userId}${event.peerName ? `(${event.peerName})` : ''} mid=${event.messageId} chat=${event.chatType} self=${this._aid || 'unknown'} conn_uptime=${this.connectedAt ? Math.round((receiveTs - this.connectedAt) / 1000) + 's' : 'unknown'}${echoInboundLegLabel(event.createdAt, receiveTs)}${echoTraceOriginLabel(receiveTs)}`;
+        const replyTs = Date.now();
+        echoText += `\n${echoTraceClock(replyTs)} [EvolCore.reply] echo回声发出 conn_uptime=${this.connectedAt ? Math.round((replyTs - this.connectedAt) / 1000) + 's' : 'unknown'}${echoTraceOriginLabel(replyTs)}`;
         if (Buffer.byteLength(echoText, 'utf-8') > 4096) {
             echoText += `\n[TRUNCATED]`;
         }
@@ -2995,7 +3190,7 @@ export class AUNChannel {
             ? { chatType: 'group', groupId: event.channelId }
             : { chatType: 'private' };
         const context = {
-            threadId: event.threadId,
+            threadId: event.threadId ?? event.replyContext?.threadId,
             metadata: event.replyContext?.metadata,
             delivery: authenticatedDelivery,
         };
@@ -3098,6 +3293,7 @@ export class AUNChannel {
         else if (state === 'disconnected' || state === 'reconnecting') {
             const wasConnected = this.connected;
             this.connected = false;
+            this.clearQueuedObserverSends(state);
             // The nine-state SDK emits standby -> retry_backoff -> reconnecting for
             // one reconnect cycle. Count the connected-to-down edge once instead of
             // inflating the metric for every intermediate state.
@@ -3281,6 +3477,7 @@ export class AUNChannel {
             this.client = null;
         }
         this.connected = false;
+        this.clearQueuedObserverSends(`takeover_${reason}`);
         const delaySec = Math.round(delayMs / 1000);
         logger.info(`${this.logPrefix()} Scheduling TS-layer reconnect (${reason}) in ${delaySec}s`);
         this.trace('OUT', 'reconnect.scheduled', { reason, delayMs, generation: gen });
@@ -3498,6 +3695,9 @@ export class AUNChannel {
                 if (!current || typeof current !== 'object')
                     continue;
                 for (const key of Object.keys(current)) {
+                    // Topic routing must survive content truncation and fallback.
+                    if (current === limited && key === 'thread_id')
+                        continue;
                     const value = current[key];
                     if (typeof value === 'string') {
                         leaves.push({ parent: current, key, value, bytes: Buffer.byteLength(value, 'utf8') });
@@ -3544,6 +3744,8 @@ export class AUNChannel {
         };
         if (typeof payload.chatmode === 'string')
             fallback.chatmode = truncateUtf8ToBytes(payload.chatmode, 32);
+        if (typeof payload.thread_id === 'string')
+            fallback.thread_id = payload.thread_id;
         logger.info(`${this.logPrefix()} Thought payload reduced to fallback (${Buffer.byteLength(JSON.stringify(fallback), 'utf8')} bytes)`);
         return fallback;
     }
@@ -3611,6 +3813,9 @@ export class AUNChannel {
             replyContext,
         });
         this.ownedCardMsgIds.add(messageId);
+        if (replyContext?.threadId) {
+            this.ownedCardTopics.set(messageId, { channelId, threadId: replyContext.threadId });
+        }
         let messageIds = this.interactionCardMessageIds.get(action.requestId);
         if (!messageIds) {
             messageIds = new Set();
@@ -3629,7 +3834,10 @@ export class AUNChannel {
                 this.interactionCardMessageIds.delete(action.requestId);
         }, mapTtl);
         mapTimer.unref?.();
-        const ownedTimer = setTimeout(() => this.ownedCardMsgIds.delete(messageId), 24 * 60 * 60 * 1000);
+        const ownedTimer = setTimeout(() => {
+            this.ownedCardMsgIds.delete(messageId);
+            this.ownedCardTopics.delete(messageId);
+        }, 24 * 60 * 60 * 1000);
         ownedTimer.unref?.();
         const invalidationReason = this.invalidatedInteractions.get(action.requestId);
         if (invalidationReason) {
@@ -3889,10 +4097,11 @@ export class AUNChannel {
     /**
      * Truncate payload if it exceeds AUN protocol limits.
      * AUN SDK enforces MAX_WS_PAYLOAD_SIZE = 1_000_000 bytes (1MB) for the entire JSON-RPC message.
-     * We use a conservative 800KB limit for the payload itself to leave room for RPC envelope.
+     * We use a conservative 512KB limit for the payload itself to leave room for
+     * the encrypted AUN envelope and RPC framing.
      */
     truncatePayloadIfNeeded(payload, label) {
-        const MAX_PAYLOAD_SIZE = 800 * 1024; // 800KB conservative limit
+        const MAX_PAYLOAD_SIZE = 512 * 1024; // 512KB conservative limit
         const MAX_FIELD_SIZE = 256 * 1024; // 256KB per field
         // First check total size
         const payloadJson = JSON.stringify(payload);
@@ -3981,6 +4190,8 @@ export class AUNChannel {
             throw Object.assign(new Error(result.error ?? 'AUN structured send failed'), {
                 code: result.code ?? 'AUN_SEND_FAILED',
                 outboxId: result.outboxId,
+                permanent: true,
+                status: 'failed',
             });
         }
         return result;
@@ -3994,7 +4205,7 @@ export class AUNChannel {
         const routedContext = this.withDelivery(context, delivery);
         // 长 echo: agent 首次回复前先发 echo trace（echo 自身发送时跳过）
         if (!this.isEchoSending) {
-            await this.flushPendingEcho(channelId, delivery);
+            await this.flushPendingEcho(channelId, delivery, context?.threadId);
         }
         let finalText = text;
         this.sentCount.set(channelId, (this.sentCount.get(channelId) || 0) + 1);
@@ -4321,20 +4532,20 @@ export class AUNChannel {
             return { ok: false, error: e?.message || String(e), code: e?.code };
         }
     }
-    async flushPendingEcho(channelId, delivery) {
+    async flushPendingEcho(channelId, delivery, threadId) {
         // 查找该 channelId 是否有 pending echo（长 echo 等待 agent 首次回复）
         for (const [key, echo] of this.pendingEchoMessages) {
-            if (echo.channelId === channelId) {
+            if (echo.channelId === channelId
+                && (echo.context?.threadId ?? '') === (threadId ?? '')
+                && echo.context?.delivery?.chatType === delivery.chatType) {
                 this.pendingEchoMessages.delete(key);
                 logger.info(`${this.logPrefix()} [Echo] flushPendingEcho triggered: key=${key} channelId=${channelId} pendingCount=${this.pendingEchoMessages.size}`);
-                const ts = () => {
-                    const d = new Date();
-                    return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}.${String(d.getMilliseconds()).padStart(3, '0')}`;
-                };
-                const agentDuration = Date.now() - echo.receiveTs;
+                const agentDoneTs = Date.now();
+                const agentDuration = agentDoneTs - echo.receiveTs;
                 let echoText = echo.text;
-                echoText += `\n${ts()} [EvolCore.agent] duration=${agentDuration}ms`;
-                echoText += `\n${ts()} [EvolCore.reply] echo回声发出 conn_uptime=${this.connectedAt ? Math.round((Date.now() - this.connectedAt) / 1000) + 's' : 'unknown'}`;
+                echoText += `\n${echoTraceClock(agentDoneTs)} [EvolCore.agent] duration=${agentDuration}ms${echoTraceOriginLabel(agentDoneTs)}`;
+                const replyTs = Date.now();
+                echoText += `\n${echoTraceClock(replyTs)} [EvolCore.reply] echo回声发出 conn_uptime=${this.connectedAt ? Math.round((replyTs - this.connectedAt) / 1000) + 's' : 'unknown'}${echoTraceOriginLabel(replyTs)}`;
                 if (Buffer.byteLength(echoText, 'utf-8') > 4096) {
                     echoText += `\n[TRUNCATED]`;
                 }
@@ -4777,6 +4988,8 @@ export class AUNChannel {
         const payloadWithChatmode = context?.metadata?.chatmode && !finalPayload.chatmode
             ? { ...finalPayload, chatmode: context.metadata.chatmode }
             : finalPayload;
+        if (context?.threadId && !payloadWithChatmode.thread_id)
+            payloadWithChatmode.thread_id = context.threadId;
         const params = {
             context: { type: 'task', id: taskId },
             payload: this.limitThoughtPayload(payloadWithChatmode),
@@ -5525,6 +5738,7 @@ export class AUNChannel {
         await this.sendStructuredOrThrow(channelId, payloadObj, context);
     }
     async disconnect() {
+        this.managedMenuClient.close();
         this.intentionalDisconnect = true;
         if (this.reconnectTimer) {
             clearTimeout(this.reconnectTimer);
@@ -5549,6 +5763,7 @@ export class AUNChannel {
             this.store = null;
         }
         this.connected = false;
+        this.clearQueuedObserverSends('intentional disconnect');
         appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'disconnected', aid: this.config.aid, reason: 'intentional' });
         appendAidLifecycle({ ts: Date.now(), iso: new Date().toISOString(), event: 'disconnected', aid: this.config.aid, reason: 'intentional' });
         this.setAidStatus('disabled');
@@ -5626,7 +5841,7 @@ export class AUNChannel {
         try {
             const selfAgentDir = path.join(resolvePaths().agentsDir, this.config.aid);
             const identity = await PeerIdentityCache.resolve('aun', aid, selfAgentDir, this.store, false);
-            const type = identity.type === 'human' ? 'human' : 'ai';
+            const type = identity.type === 'human' ? 'human' : 'agent';
             const name = identity.name || undefined;
             const info = { type, name };
             this.peerInfoCache.set(aid, info);
@@ -5777,6 +5992,26 @@ export class AUNChannelPlugin {
                     case 'result.text':
                     case 'command.result':
                     case 'command.error': {
+                        // Group command feedback is control traffic, not model input for
+                        // the other agents in the conversation.
+                        if (delivery.chatType === 'group'
+                            && (payload.kind === 'command.result' || payload.kind === 'command.error')) {
+                            const isError = payload.kind === 'command.error';
+                            const feedback = {
+                                type: isError ? 'error' : 'notice',
+                                ...taskBase(),
+                                subtype: payload.kind,
+                                text: payload.text,
+                                ...(isError
+                                    ? { message: payload.text, user_message: payload.text, recoverable: true, terminal: false }
+                                    : { severity: 'info' }),
+                            };
+                            for (const key of ['format', 'reason', 'reasonCode', 'nextStep']) {
+                                setIfDefined(feedback, key, payload[key]);
+                            }
+                            await channel.sendReliableStructured(channelId, feedback, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
+                            return;
+                        }
                         const sendCtx = {
                             ...(replyCtx ?? {}),
                             metadata: {