evolcore 0.0.25 → 0.0.26

package/dist/core/bootstrap-service.js

@@ -369,7 +369,7 @@ export class BootstrapService {
         const content = existing.trim() || buildInitialAgentMd({
             aid,
             name: fallbackName,
-            type: 'codeagent',
+            type: 'agent',
         });
         try {
             await adapter.uploadAgentMd(content);

package/dist/core/command/command-handler.js

@@ -1,4 +1,5 @@
 import { BaseagentRunnerUnavailableError } from '../../agents/runner-types.js';
+import { parseMenuClientArgs } from '../../cli/menu-client.js';
 import { renderCommandCardAsText } from '../interaction-router.js';
 import { buildEnvelope, deliveryTargetFromSession, isInteractionSendAccepted, replyContextFromSession, sendInteractionPayload } from '../message/message-utils.js';
 import { resolvePaths, getPackageRoot } from '../../paths.js';
@@ -17,7 +18,7 @@ import { tryParseChannelKey } from '../channel-loader.js';
 import { displaySessionTitle } from '../session/session-title.js';
 import { buildSessionTurnList } from '../session/session-turns.js';
 import { resolveConfigCommand } from '../../config/resolved-config-op.js';
-import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommand } from '../../config/config-operation-service.js';
+import { AUTHENTICATED_CONFIG_ROLE_ENV, executeResolvedConfigCommandAsync } from '../../config/config-operation-service.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../auth/authorization-audit.js';
 import { executeResolvedContactCommand, resolveContactCommand } from '../../config/contact-operation-service.js';
@@ -123,6 +124,43 @@ export class CommandHandler {
     daemonMonitorProvider;
     agentDelegationRegistry;
     handoffRuntime;
+    diagService;
+    setDiagService(service) { this.diagService = service; }
+    async handleMenuClientOperation(argv, sessionId, delegationToken, delegationCommandHash, send) {
+        const validation = this.agentDelegationRegistry?.validate(delegationToken, sessionId, delegationCommandHash);
+        if (!validation?.ok)
+            return { ok: false, code: validation?.code ?? 'DELEGATION_REQUIRED', error: validation?.reason ?? 'Task delegation is required' };
+        const grant = validation.grant;
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session || session.selfAID !== grant.selfAid || argv[0] !== 'request' || argv[1] !== grant.selfAid)
+            return { ok: false, code: 'SCOPE_MISMATCH', error: 'Menu requests must use the current Agent identity and session' };
+        try {
+            const channelId = parsePeerKey(grant.peerKey).channelId;
+            const subject = buildAuthSubject({ selfAid: grant.selfAid, actorId: grant.actorId, channel: grant.channel,
+                channelType: grant.channelType, channelId, chatType: grant.chatType, conversationId: channelId,
+                processOwners: [], ...trustedExecutionIdentityInput(grant) });
+            const decision = authorizeOperation({ source: 'agent-tool', subject,
+                intent: { operation: 'ec.menu.request', scope: 'relation', source: 'agent-tool', args: { self: grant.selfAid, peer: argv[2], targetId: argv[2] } },
+                auditMetadata: { taskId: grant.taskId, sessionId, messageId: grant.messageId } });
+            if (!decision.allow)
+                return { ok: false, code: decision.code, error: decision.reason };
+            const options = parseMenuClientArgs(argv, file => {
+                const target = fs.realpathSync(path.resolve(session.projectPath, file));
+                const roots = [session.projectPath, this.getManagedSessionTempDir(session)].filter((v) => !!v)
+                    .map(root => fs.realpathSync(root));
+                if (!roots.some(root => isSameOrDescendant(target, root)) || isHClassPath(target) || isLClassPath(target))
+                    throw new Error('Menu request file must be an unprotected file in the project or session TMPDIR');
+                const stat = fs.statSync(target);
+                if (!stat.isFile() || stat.nlink > 1 || stat.size > 128 * 1024)
+                    throw new Error('Menu request file must be a regular file of at most 128 KiB');
+                return fs.readFileSync(target, 'utf8');
+            });
+            return { ok: true, response: await send(options) };
+        }
+        catch (error) {
+            return { ok: false, code: error.code ?? 'MENU_REQUEST_FAILED', error: error.message };
+        }
+    }
     contactRequestSubmitter;
     /**
      * Get the runner for a (channel, baseagent) pair.
@@ -983,13 +1021,14 @@ export class CommandHandler {
     getMenuItems(role, chatType = 'private', scope = 'agent', authSubject) {
         return menuGetMenuItems.call(this, role, chatType, scope, authSubject);
     }
-    async getMenuCatalog(channel, channelId, subject, request, channelScope = 'agent') {
+    async getMenuCatalog(channel, channelId, subject, request, channelScope = 'agent', paircodeAllowed) {
         return await getMenuCatalog({
             subject,
             channelType: this.resolveChannelType(channel),
             channelScope,
             channelId,
             request,
+            ...(paircodeAllowed === undefined ? {} : { paircodeAllowed }),
         });
     }
     async execMenuValueBatch(channel, channelId, subject, args, request, channelScope = 'agent') {
@@ -1176,9 +1215,9 @@ export class CommandHandler {
     /**
      * 主命令处理入口
      */
-    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
+    async handle(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, enforceGroupSlashPolicy = false) {
         try {
-            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
+            const result = await this._handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, enforceGroupSlashPolicy);
             // Lifecycle commands are control-plane operations. Their replies must
             // use notification payloads so other agents in a group do not treat the
             // text as ordinary model input. Normalize guard-path replies here too,
@@ -1210,8 +1249,10 @@ export class CommandHandler {
             throw error;
         }
     }
-    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext) {
-        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext);
+    async _handleInternal(content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, 
+    // Menu and delegated CLI operations reuse this implementation without the chat-only policy.
+    applyGroupSlashPolicy = false) {
+        return await handleSlashCommand.call(this, content, channel, channelId, sendMessage, userId, threadId, chatType, source, messageId, selfAID, overrideIdentity, authSubject, replyContext, applyGroupSlashPolicy);
     }
     async handleTriggerCommand(scheduler, content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
         if (content === '/trigger') {
@@ -1399,17 +1440,17 @@ export class CommandHandler {
             const nextStr = reg.trigger.nextFireAt ? new Date(reg.trigger.nextFireAt).toLocaleString() : '未计算';
             return `✅ 触发器已注册：**${reg.trigger.name}**\n下次触发：${nextStr}`;
         }
-        return `❌ 未知子命令。用法：
-/trigger — 查看活跃触发器
-/trigger list [--all] — 查看所有触发器
-/trigger create <参数> — 创建触发器（set 为兼容别名）
-/trigger update <名称|ID> <参数> — 修改触发器
-常用参数：--delay/--at/--cron/--every、--prompt、--description、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）、--feedback、--target-channel/--target-channel-id、--trigger-thread、--baseagent、--on-error、--retry-attempts/--retry-backoff、--script-runtime/--script-args/--script-timeout
-/trigger enable <名称|ID> — 启用触发器
-/trigger disable <名称|ID> — 暂停触发器
-/trigger show <名称|ID> — 查看触发器详情
-/trigger run <名称|ID> [--dry-run] — 手动触发
-/trigger cancel <名称|ID> — 禁用触发器（disable 的兼容别名）
+        return `❌ 未知子命令。用法：
+/trigger — 查看活跃触发器
+/trigger list [--all] — 查看所有触发器
+/trigger create <参数> — 创建触发器（set 为兼容别名）
+/trigger update <名称|ID> <参数> — 修改触发器
+常用参数：--delay/--at/--cron/--every、--prompt、--description、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）、--feedback、--target-channel/--target-channel-id、--trigger-thread、--baseagent、--on-error、--retry-attempts/--retry-backoff、--script-runtime/--script-args/--script-timeout
+/trigger enable <名称|ID> — 启用触发器
+/trigger disable <名称|ID> — 暂停触发器
+/trigger show <名称|ID> — 查看触发器详情
+/trigger run <名称|ID> [--dry-run] — 手动触发
+/trigger cancel <名称|ID> — 禁用触发器（disable 的兼容别名）
 /trigger delete <名称|ID> — 删除触发器`;
     }
     async handleTrigger(content, channel, channelId, peerId, isAdmin, messageId, chatType, threadId, isDaemonOwner = false, canApprovePersistentFullAccess = isDaemonOwner) {
@@ -1677,8 +1718,9 @@ export class CommandHandler {
     buildCtlReplyContext(session) {
         const ctx = { delivery: deliveryTargetFromSession(session) };
         const meta = session.metadata;
-        if (meta?.replyContext?.threadId)
-            ctx.threadId = meta.replyContext.threadId;
+        const threadId = session.threadId || meta?.replyContext?.threadId;
+        if (threadId)
+            ctx.threadId = threadId;
         if (meta?.replyContext?.peerId)
             ctx.peerId = meta.replyContext.peerId;
         if (!ctx.peerId && meta?.peerId)
@@ -1759,7 +1801,7 @@ export class CommandHandler {
             processOwners: loadDaemonConfig().owners ?? [],
             ...trustedExecutionIdentityInput(grant),
         });
-        const executeOne = (fieldArgv) => {
+        const executeOne = async (fieldArgv) => {
             const resolved = resolveConfigCommand(fieldArgv, {
                 defaultRelation: { self: grant.selfAid, peerKey: grant.peerKey },
             });
@@ -1780,6 +1822,7 @@ export class CommandHandler {
                     dangerous: resolved.command.dangerous,
                 },
                 resolvedConfigCommand: resolved.command,
+                allowExplicitRelationTarget: true,
                 auditMetadata: {
                     argvHash: hashArgv(resolved.command.canonicalArgv),
                     taskId: grant.taskId,
@@ -1788,22 +1831,35 @@ export class CommandHandler {
             });
             if (!decision.allow)
                 return { ok: false, code: decision.code, error: decision.reason };
-            return executeResolvedConfigCommand(resolved.command, { role: subject.role });
+            const roleContext = {
+                self: grant.selfAid,
+                actorRole: subject.role,
+                actorRoleSource: subject.roleSource,
+                actorAllowAccess: subject.allowAccess,
+                actorAid: grant.actorId,
+                isDaemonOwner: subject.isDaemonOwner,
+                fromControlChannel: subject.fromControlChannel,
+                chatType: grant.chatType,
+            };
+            return await executeResolvedConfigCommandAsync(resolved.command, {
+                role: subject.role,
+                roleContext,
+            });
         };
         const batch = splitConfigBatchGetArgv(argv);
         if (batch && batch.fields.length > 1) {
-            const results = batch.fields.map(field => {
-                const result = executeOne(['config', 'get', field, ...batch.rest]);
+            const results = await Promise.all(batch.fields.map(async (field) => {
+                const result = await executeOne(['config', 'get', field, ...batch.rest]);
                 if (!result.ok)
                     return { ok: false, field, code: result.code, error: result.error };
                 if (result.subcommand !== 'get') {
                     return { ok: false, field, code: 'UNEXPECTED_RESULT', error: `config get ${field} produced a non-get result` };
                 }
                 return result;
-            });
+            }));
             return { ok: true, result: { ok: true, subcommand: 'batch-get', results } };
         }
-        const result = executeOne(argv);
+        const result = await executeOne(argv);
         return result.ok
             ? { ok: true, result }
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
@@ -1827,7 +1883,8 @@ export class CommandHandler {
         catch {
             return { ok: false, code: 'INVALID_DELEGATION', error: 'Delegation contains an invalid relation key' };
         }
-        const resolved = resolveContactCommand(argv);
+        const resolvedArgv = argv.includes('--self') ? argv : [...argv, '--self', grant.selfAid];
+        const resolved = resolveContactCommand(resolvedArgv);
         if (!resolved.ok)
             return { ok: false, code: resolved.code, error: resolved.reason };
         if (resolved.command.selfAid !== grant.selfAid && !hasTrustedFullAccessDelegation(grant)) {

package/dist/core/command/diag-service.js

@@ -0,0 +1,118 @@
+import { isValidAid } from '../../aun/aid/validation.js';
+import { remoteAccessService } from '../auth/remote-access-store.js';
+export const DIAGNOSTIC_AGENT_AID = 'diag.agentid.cn';
+/** IPC verifies local control authority; managed calls must independently prove their actor. */
+export async function executeDiagIpc(service, registry, owners, cmd) {
+    if (cmd.sessionId !== undefined) {
+        if (typeof cmd.sessionId !== 'string' || !cmd.sessionId)
+            return { ok: false, code: 'INVALID_SESSION', message: '无效托管会话' };
+        const auth = registry.validate(cmd.delegationToken, cmd.sessionId, cmd.delegationCommandHash);
+        if (!auth.ok)
+            return { ok: false, code: auth.code, message: auth.reason };
+        if (auth.grant.channelType !== 'aun' || !owners.includes(auth.grant.actorId))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '托管诊断发起需要本机 AUN DaemonOwner' };
+    }
+    try {
+        if (!Array.isArray(cmd.argv) || cmd.argv.some((v) => typeof v !== 'string'))
+            throw new Error('Invalid diag argv');
+        return await service.execute(parseDiagArgs(cmd.argv));
+    }
+    catch (error) {
+        return { ok: false, code: error.code ?? 'INVALID_ARGUMENT', message: error.message };
+    }
+}
+export function parseDiagArgs(args) {
+    const words = [];
+    let ownerAid;
+    let literal = false;
+    for (let i = 0; i < args.length; i++) {
+        const word = args[i];
+        if (!literal && word === '--') {
+            literal = true;
+            continue;
+        }
+        if (!literal && word === '--owner') {
+            if (ownerAid || !args[i + 1] || !isValidAid(args[i + 1]))
+                throw new Error('--owner 需要一个有效 AID');
+            ownerAid = args[++i];
+        }
+        else if (!literal && word.startsWith('--'))
+            throw new Error(`不支持的参数：${word}`);
+        else
+            words.push(word);
+    }
+    const problem = words.join(' ').trim();
+    if (problem.toLowerCase() === 'stop') {
+        if (ownerAid)
+            throw new Error('diag stop 不需要指定对象');
+        return { action: 'stop' };
+    }
+    if (!problem || problem.length > 16_000)
+        throw new Error('请提供 1 到 16000 字符的问题描述');
+    return { action: 'start', problem, ...(ownerAid ? { ownerAid } : {}) };
+}
+export class DiagService {
+    context;
+    send;
+    tokens;
+    constructor(context, send, tokens = remoteAccessService) {
+        this.context = context;
+        this.send = send;
+        this.tokens = tokens;
+    }
+    /** Local CLI authority is checked by IPC; slash identity is authenticated AUN peerId. */
+    async execute(command, actorAid) {
+        const { controlAid, owners } = this.context();
+        if (!controlAid || !isValidAid(controlAid))
+            return { ok: false, code: 'CONTROL_AID_REQUIRED', message: '本机尚未配置 Control AID' };
+        if (actorAid !== undefined && !owners.includes(actorAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '只有本机 DaemonOwner 可以发起或停止诊断' };
+        if (command.action === 'stop') {
+            const previous = this.tokens.revokeDiagnosticToken(controlAid);
+            if (!previous)
+                return { ok: true, message: '当前没有诊断授权' };
+            const diag = previous.diagnostic;
+            try {
+                await this.send(diag.agentAid, `诊断授权已取消。目标 daemon：${controlAid}；case：${diag.caseId}；沟通 Owner：${diag.ownerAid}。请停止这次诊断的后续访问，并告知 Owner。`);
+                return { ok: true, message: '诊断授权已撤销，已通知诊断 Agent' };
+            }
+            catch {
+                return { ok: true, code: 'DIAG_STOP_NOTICE_FAILED', message: '诊断授权已撤销；取消通知发送失败，诊断 Agent 后续访问将被拒绝' };
+            }
+        }
+        const ownerAid = actorAid ?? command.ownerAid ?? owners[0];
+        if (!ownerAid || !isValidAid(ownerAid) || !owners.includes(ownerAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '请配置本机 owners，或指定其中一个有效 Owner AID' };
+        if (!command.problem?.trim() || command.problem.length > 16_000)
+            return { ok: false, code: 'INVALID_ARGUMENT', message: '请提供 1 到 16000 字符的问题描述' };
+        let record;
+        try {
+            record = this.tokens.issueDiagnosticToken(controlAid, DIAGNOSTIC_AGENT_AID, ownerAid);
+        }
+        catch (error) {
+            return { ok: false, code: error.code ?? 'DIAG_AUTH_FAILED', message: error.message };
+        }
+        const caseId = record.diagnostic.caseId;
+        const invitation = [
+            '请协助诊断以下主机，并主动联系指定 Owner 展示进展、追问和报告。',
+            `目标 daemon Control AID：${controlAid}`, `沟通 Owner AID：${ownerAid}`, `case：${caseId}`,
+            `远程访问 Token：${record.token}`,
+            '请通过标准 Menu 调用诊断；Token 放入 E2EE 受保护头。权限复用该主机既有 Control Menu，包含 restart。有效访问滑动续期，空闲 60 分钟失效。',
+            '先给 Owner 发开始消息，使用通用 handoff 保留目标、Token、问题和发现；无需等待 Owner 回复即可开始。授权失效后停止访问。',
+            `问题描述：\n${command.problem.trim()}`,
+        ].join('\n');
+        try {
+            await this.send(DIAGNOSTIC_AGENT_AID, invitation);
+        }
+        catch (error) {
+            this.tokens.revokeDiagnosticToken(controlAid, record.token);
+            const reason = error instanceof Error ? error.message : String(error);
+            return { ok: false, code: 'DIAG_INVITATION_FAILED', message: `未能确认诊断邀请发送成功：${reason}。本次授权已撤销，请重试` };
+        }
+        // A stop may race with delivery; never report an already revoked grant as active.
+        if (this.tokens.getDiagnosticToken(controlAid)?.token !== record.token)
+            return { ok: false, code: 'DIAG_CANCELLED', message: '邀请发送期间授权已撤销，本次诊断已取消' };
+        return { ok: true, caseId, ownerAid, agentAid: DIAGNOSTIC_AGENT_AID,
+            message: `诊断邀请已发出，远程诊断 Agent 将联系 ${ownerAid}，请在与 ${DIAGNOSTIC_AGENT_AID} 的会话中查看处理过程。` };
+    }
+}

package/dist/core/command/menu-catalog.js

@@ -87,6 +87,7 @@ const ENTRIES = [
     { id: 'baseagent.models', type: 'list', contexts: ['process'], name: 'baseagent-models', label: 'Baseagent 模型目录', section: 'process', order: 41, query: { cmd: '/baseagent-models', args: { baseagent: 'claude' }, operation: 'baseagent.models.list', scope: 'process' }, control: 'list' },
     { id: 'system.restart', type: 'action', contexts: ['process'], name: 'system', label: '重启服务', section: 'process', order: 20, action: { cmd: '/system', action: 'restart', operation: 'system.restart', scope: 'process' } },
     { id: 'system.upgrade', type: 'action', contexts: ['process'], name: 'system', label: '升级服务', section: 'process', order: 30, action: { cmd: '/system', action: 'upgrade', operation: 'system.upgrade', scope: 'process' } },
+    { id: 'system.paircode', type: 'action', contexts: ['process'], name: 'system', label: '获取配对码', section: 'process', order: 35, action: { cmd: '/system', action: 'paircode', operation: 'system.paircode', scope: 'process' } },
     { id: 'agent.list', type: 'list', contexts: ['process'], name: 'agent', label: 'Agent 列表', section: 'process', order: 40, options: { cmd: '/agent', args: { options: 'all' }, operation: 'agent.list', scope: 'control', mode: 'dynamic' }, control: 'list' },
     { id: 'agent.create', type: 'action', contexts: ['process'], name: 'agent', label: '创建 Agent', section: 'process', order: 50, action: { cmd: '/agent', action: 'create', operation: 'agent.create', scope: 'control' } },
     { id: 'agent.reload', type: 'action', contexts: ['process'], name: 'agent', label: '重载 Agent', section: 'process', order: 60, action: { cmd: '/agent', action: 'reload', operation: 'agent.reload', scope: 'control' } },
@@ -304,11 +305,18 @@ export async function resolveExplicitMenuExecutionContext(input) {
 }
 function entryVisible(entry, context) { return entry.contexts.includes(context.kind); }
 function intentFor(binding, context) { return { operation: binding.operation, scope: binding.scope, source: 'menu', args: { ...bindingArgs(binding, context) } }; }
-async function operationView(binding, context) {
+async function operationView(binding, context, options = {}) {
     if (!binding)
         return undefined;
     if (binding.supported === false)
         return { supported: false, allowed: false, reason: { code: 'NOT_SUPPORTED', message: 'operation is not supported' } };
+    if (binding.operation === 'system.paircode' && options.paircodeAllowed === false) {
+        return {
+            supported: true,
+            allowed: false,
+            reason: { code: 'NOT_ALLOWED', message: 'Pairing code issuance requires encrypted DaemonOwner authentication' },
+        };
+    }
     if (binding.operation === 'group.rulespolicy.update' && context.subject.role !== 'owner') {
         return { supported: true, allowed: false, reason: { code: 'PERMISSION_DENIED', message: 'rulesPolicy can only be changed by an Agent owner' } };
     }
@@ -331,16 +339,17 @@ function wireBinding(binding, context) {
 export async function getMenuCatalog(input) {
     const context = await resolveMenuCatalogContext(input);
     const entries = [];
+    const paircodeAllowed = input.paircodeAllowed ?? input.channelScope !== 'control';
     for (const entry of ENTRIES.filter(candidate => entryVisible(candidate, context)).sort((a, b) => a.order - b.order)) {
         const operations = {};
         for (const [key, binding] of [['query', entry.query], ['options', entry.options], ['update', entry.update], ['action', entry.action]]) {
-            const view = await operationView(binding, context);
+            const view = await operationView(binding, context, { paircodeAllowed });
             if (view)
                 operations[key] = view;
         }
         entries.push({ id: entry.id, type: entry.type, name: entry.name, label: entry.label, section: entry.section, order: entry.order, target: { scope: context.kind === 'agent' ? 'agent' : context.kind === 'process' ? 'process' : 'relation', ...(context.self ? { self: context.self } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}) }, valueSchema: entry.valueSchema ?? { type: 'object' }, operations, wire: { name: entry.name, operations: { ...(wireBinding(entry.query, context) ? { query: wireBinding(entry.query, context) } : {}), ...(wireBinding(entry.options, context) ? { options: wireBinding(entry.options, context) } : {}), ...(wireBinding(entry.update, context) ? { update: wireBinding(entry.update, context) } : {}), ...(wireBinding(entry.action, context) ? { action: wireBinding(entry.action, context) } : {}) } }, ui: { control: entry.control ?? 'action' } });
     }
-    const policyRevision = hash({ role: context.subject.role, self: context.subject.selfAid, peerKey: context.subject.peerKey, groupMembershipRole: context.groupMembershipRole, baselineRole: context.baselineRole, roles: readRolesConfig(context.subject.selfAid) });
+    const policyRevision = hash({ role: context.subject.role, self: context.subject.selfAid, peerKey: context.subject.peerKey, groupMembershipRole: context.groupMembershipRole, baselineRole: context.baselineRole, paircodeAllowed, roles: readRolesConfig(context.subject.selfAid) });
     const data = { $schema_version: 1, kind: 'menu.catalog', complete: true, catalogRevision: hash({ entries, context: context.contextKey, policyRevision }), policyRevision, generatedAt: Date.now(), context: { contextKey: context.contextKey, kind: context.kind, channelScope: context.channelScope, transport: context.transport, chatType: context.chatType, ...(context.self ? { self: context.self } : {}), ...(context.actor ? { actor: context.actor } : {}), ...(context.groupId ? { groupId: context.groupId } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}), requesterRole: context.requesterRole, ...(context.groupMembershipRole ? { groupMembershipRole: context.groupMembershipRole } : {}), ...(context.baselineRole !== undefined ? { baselineRole: context.baselineRole } : {}) }, features: { batchValuesV1: true, verifiedExplicitGroupContext: context.kind === 'group_relation' }, entries };
     return data;
 }

package/dist/core/command/menu-handler.js

@@ -40,7 +40,7 @@ import { shouldSuppressRealRestart } from '../../utils/restart-safety.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { evolMenuResponseTransportMetadata, menuFailure, menuCommandForName, menuSuccess, normalizeMenuError, validateConfigWriteScope, validateMenuRequest, } from './menu-protocol.js';
 import { parseMenuClientProtectedHeaders } from './menu-protocol.js';
-import { validateAndRenewRemoteAccessToken } from '../auth/remote-access-store.js';
+import { remoteAccessService, validateAndRenewRemoteAccessToken } from '../auth/remote-access-store.js';
 import { listDiagnosticLogOptions, listRawConfigResources, queryDiagnosticLogs, readRawConfigResource, } from './daemon-diagnostics.js';
 import { roleMenuAction, roleMenuOperation, roleMenuOptions, roleMenuQuery, roleMenuUpdate, } from './role-menu.js';
 import { handleConnectMenu, connectMenuOperation } from './connect-menu.js';
@@ -1015,6 +1015,8 @@ function buildMenuIntent(verb, cmdBase, args, action, value, fromControlChannel
                 return intent('system.upgrade', 'process', { action });
             if (action === 'check')
                 return intent('system.status', 'process', { action });
+            if (action === 'paircode')
+                return intent('system.paircode', 'process', { action });
         }
         if (cmdBase === '/agent') {
             if (action === 'reload')
@@ -1767,7 +1769,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             const requestedModel = menuStringArg(args, 'model') ?? menuStringArg(args, 'current');
             const currentModel = requestedModel || readMenuModel(target, agent).value || agent.getModel();
             if (models.length > 0)
-                return models.map((m) => ({ value: m, label: modelDisplayLabel(agent, m) + (catalog.models.find(e => e.id === m)?.verification === 'unverified' ? ' [unverified]' : '') + (catalog.freshness === 'stale' ? ' [stale]' : ''), selected: modelMatches(agent, m, currentModel) }));
+                return models.map((m) => ({ value: m, label: modelDisplayLabel(agent, m) + (catalog.models.find(e => e.id === m)?.verification === 'unverified' ? ' [unverified]' : ''), selected: modelMatches(agent, m, currentModel) }));
         }
         return null;
     }
@@ -2372,6 +2374,24 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
     }
     if (cmdBase === '/system') {
         const view = args?.view ?? 'status';
+        if (view === 'version') {
+            const data = {};
+            try {
+                const pkgPath = path.join(getPackageRoot(), 'package.json');
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+                if (pkg?.version)
+                    data.version = pkg.version;
+            }
+            catch { }
+            try {
+                const fp = path.join(getPackageRoot(), 'node_modules', '@agentunion', 'fastaun', 'package.json');
+                const fp2 = JSON.parse(fs.readFileSync(fp, 'utf-8'));
+                if (fp2?.version)
+                    data.fastaunVersion = fp2.version;
+            }
+            catch { }
+            return { data };
+        }
         if (view === 'monitor') {
             if (typeof this.daemonMonitorProvider !== 'function') {
                 return { error: 'Daemon monitor snapshot is unavailable', code: 'DEPENDENCY_UNAVAILABLE' };
@@ -3885,6 +3905,13 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             this.eventBus.publish({ type: 'system:restart', channel, channelId });
             return { data: { action: 'restart', success: true } };
         }
+        if (action === 'paircode') {
+            // Keep Menu pairing on the same daemon-owned store as /pair, ECWeb, and
+            // the local IPC endpoint. The store reuses an unexpired code and creates
+            // a new one only after the shared TTL has elapsed.
+            const pair = remoteAccessService.getPairingCode(subject.actorId);
+            return { data: { code: pair.code, expiresAt: pair.expiresAt } };
+        }
         if (action === 'check') {
             const r = await this.delegateAsAction(action, '/check', channel, channelId, userId, { overrideIdentity, authSubject: subject, threadId: transportReplyContext?.threadId, chatType: transportReplyContext?.delivery?.chatType, replyContext: transportReplyContext });
             // delegateAsAction 会把 structured 展开到 data 顶层，并保留 data.structured 兼容旧客户端。
@@ -4221,6 +4248,12 @@ async function execMenuForSystemControl(payload, context) {
     });
     const trustedIdentity = trustedSubject.identity;
     const cmd = name ? (menuCommandForName(name) ?? payload.cmd) : payload.cmd;
+    if (payload?.type === 'menu.action'
+        && menuCommandToken(cmd) === '/system'
+        && payload.action === 'paircode'
+        && (context.authMethod !== 'daemon-owner' || (context.source === 'control' && !context.encrypted))) {
+        return ecwebErr(id, name, 'NOT_ALLOWED', 'Pairing code issuance requires encrypted DaemonOwner authentication');
+    }
     try {
         if (menuCommandToken(cmd) === '/baseagent-models') {
             if (payload.type !== 'menu.query')
@@ -4239,6 +4272,8 @@ async function execMenuForSystemControl(payload, context) {
                         channelScope: 'control',
                         channelId: targetChannel,
                         request: payload.args.context,
+                        paircodeAllowed: context.authMethod === 'daemon-owner'
+                            && (context.source !== 'control' || context.encrypted),
                     });
                     return menuSuccess({ id, ...(name ? { name } : {}) }, data);
                 }
@@ -4343,15 +4378,6 @@ export async function execMenuForEcweb(payload, trusted) {
     const validationError = validateMenuRequest(payload ?? {});
     if (validationError)
         return menuFailure({ id, ...(name ? { name } : {}) }, validationError);
-    const isProcessLevel = isProcessLevelMenu(name, payload?.cmd) || isProcessContextMenu(payload);
-    const owners = loadDaemonConfig().owners ?? [];
-    if (isProcessLevel && owners.length === 0) {
-        return menuFailure({ id, ...(name ? { name } : {}) }, {
-            code: 'NOT_ALLOWED',
-            message: formatAuthorizationDenial('Configure daemon.json.owners before using process-level operations.', 'DAEMON_OWNER_REQUIRED'),
-            data: authorizationDenialData('DAEMON_OWNER_REQUIRED'),
-        });
-    }
     if (!trusted || (!trusted.localDirect && trusted.authenticated !== true)) {
         return menuFailure({ id, ...(name ? { name } : {}) }, {
             code: 'PERMISSION_DENIED',
@@ -4359,29 +4385,22 @@ export async function execMenuForEcweb(payload, trusted) {
             data: { $schema_version: 1, kind: 'role_permission_denied', self: payload?.args?.self ?? null },
         });
     }
-    // A verified ECWeb connection has daemon-owner management authority. If the
-    // bearer token has no explicit owner provenance (the normal pairing path),
-    // use the first currently configured owner as the canonical management
-    // principal. This keeps audit/Trigger approval attribution deterministic
-    // without requiring owner-bound pairing metadata.
+    // ECWeb authentication grants daemon-owner authority independently of the
+    // configured owners. Prefer an owner for audit/Trigger attribution when
+    // available; otherwise keep local and remote management actors distinct.
+    const owners = loadDaemonConfig().owners ?? [];
     const userId = (trusted.actorAid && owners.includes(trusted.actorAid))
         ? trusted.actorAid
-        : owners[0] ?? (trusted.localDirect ? 'local-direct' : undefined);
-    if (!userId) {
-        return menuFailure({ id, ...(name ? { name } : {}) }, {
-            code: 'PERMISSION_DENIED',
-            message: 'ECWeb operation requires configured daemon owners',
-            data: { $schema_version: 1, kind: 'role_permission_denied', self: payload?.args?.self ?? null },
-        });
-    }
+        : owners[0] ?? (trusted.localDirect ? 'local-direct' : 'ecweb-remote');
     return execMenuForSystemControl.call(this, payload, {
         source: 'ecweb',
         actorAid: userId,
+        authMethod: trusted.localDirect ? 'daemon-owner' : 'remote-access-token',
+        encrypted: trusted.localDirect,
         localDirect: trusted.localDirect,
         // The ECWeb server/IPC control-token gate authenticates this management
         // request. All authenticated ECWeb connections are equally eligible to
-        // approve persistent fullaccess; actorAid is used only when it identifies
-        // a current configured owner.
+        // approve persistent fullaccess without owner-bound token metadata.
         canApprovePersistentFullAccess: true,
         owners,
     });
@@ -4415,6 +4434,8 @@ export async function execMenuForControl(payload, peerId, auth = {}) {
     return execMenuForSystemControl.call(this, payload, {
         source: 'control',
         actorAid: managementActor,
+        authMethod: authorization.allowed ? authorization.authMethod : 'daemon-owner',
+        encrypted: auth.encrypted === true,
         localDirect: false,
         canApprovePersistentFullAccess: false,
         owners,

package/dist/core/command/menu-protocol.js

@@ -567,6 +567,11 @@ function sanitizeLogArgv(value, depth, seen) {
 export function sanitizeMenuLogValue(value, key = '', depth = 0, seen = new WeakSet()) {
     if (isSensitiveLogKey(key))
         return '[REDACTED]';
+    // Pairing codes are intentionally returned as `code` on the wire for
+    // compatibility with /pair and the ECWeb API. Do not persist six-digit
+    // credentials in menu-protocol.log.
+    if (key === 'code' && typeof value === 'string' && /^\d{6}$/.test(value))
+        return '[REDACTED]';
     if (value === null || value === undefined || typeof value === 'number' || typeof value === 'boolean')
         return value;
     if (typeof value === 'bigint')