evolcore 0.0.25 → 0.0.27

package/kits/schemas/single-session.schema.1.json

@@ -1,31 +1,31 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "single-session.schema.1.json",
-  "title": "SingleSessionParams (responseModeParams['single-session'])",
-  "x-logical-name": "single-session",
-  "x-scope": "mode",
-  "type": "object",
-  "additionalProperties": false,
-  "properties": {
-    "pre_tool_1stmsgchk": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
-      "x-enumDescriptions": {
-        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
-        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
-      }
-    },
-    "tool_use_reminder": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
-      "x-enumDescriptions": {
-        "true": "启用：自动汇报工具使用情况",
-        "false": "禁用：静默执行工具"
-      }
-    }
-  }
-}
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "single-session.schema.1.json",
+  "title": "SingleSessionParams (responseModeParams['single-session'])",
+  "x-logical-name": "single-session",
+  "x-scope": "mode",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "pre_tool_1stmsgchk": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
+      "x-enumDescriptions": {
+        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
+        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
+      }
+    },
+    "tool_use_reminder": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
+      "x-enumDescriptions": {
+        "true": "启用：自动汇报工具使用情况",
+        "false": "禁用：静默执行工具"
+      }
+    }
+  }
+}

package/kits/schemas/single-session.schema.2.json

@@ -1,57 +1,57 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "single-session.schema.2.json",
-  "title": "SingleSessionParams (responseModeParams['single-session'])",
-  "x-logical-name": "single-session",
-  "x-scope": "mode",
-  "type": "object",
-  "additionalProperties": false,
-  "properties": {
-    "auxiliaryModel": {
-      "oneOf": [
-        {
-          "type": "string",
-          "minLength": 1
-        },
-        {
-          "type": "object",
-          "minProperties": 1,
-          "additionalProperties": false,
-          "properties": {
-            "claude": { "type": "string", "minLength": 1 },
-            "codex": { "type": "string", "minLength": 1 }
-          }
-        }
-      ],
-      "description": "辅助判断模型；可直接配置模型 ID，或按 claude/codex 配置映射。当前 Session 的 baseagent 在映射中无对应模型时执行 fallback_action。"
-    },
-    "auxiliaryEffort": {
-      "type": "string",
-      "enum": ["low", "medium", "high", "xhigh", "max"],
-      "description": "辅助判断推理强度；配置时同一模式桶必须同时配置 auxiliaryModel，未配置时不向模型 API 发送 effort。"
-    },
-    "pre_tool_1stmsgchk": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
-      "x-enumDescriptions": {
-        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
-        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
-      }
-    },
-    "tool_use_reminder": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
-      "x-enumDescriptions": {
-        "true": "启用：自动汇报工具使用情况",
-        "false": "禁用：静默执行工具"
-      }
-    }
-  },
-  "dependencies": {
-    "auxiliaryEffort": ["auxiliaryModel"]
-  }
-}
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "single-session.schema.2.json",
+  "title": "SingleSessionParams (responseModeParams['single-session'])",
+  "x-logical-name": "single-session",
+  "x-scope": "mode",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "auxiliaryModel": {
+      "oneOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": false,
+          "properties": {
+            "claude": { "type": "string", "minLength": 1 },
+            "codex": { "type": "string", "minLength": 1 }
+          }
+        }
+      ],
+      "description": "辅助判断模型；可直接配置模型 ID，或按 claude/codex 配置映射。当前 Session 的 baseagent 在映射中无对应模型时执行 fallback_action。"
+    },
+    "auxiliaryEffort": {
+      "type": "string",
+      "enum": ["low", "medium", "high", "xhigh", "max"],
+      "description": "辅助判断推理强度；配置时同一模式桶必须同时配置 auxiliaryModel，未配置时不向模型 API 发送 effort。"
+    },
+    "pre_tool_1stmsgchk": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
+      "x-enumDescriptions": {
+        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
+        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
+      }
+    },
+    "tool_use_reminder": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
+      "x-enumDescriptions": {
+        "true": "启用：自动汇报工具使用情况",
+        "false": "禁用：静默执行工具"
+      }
+    }
+  },
+  "dependencies": {
+    "auxiliaryEffort": ["auxiliaryModel"]
+  }
+}

package/kits/schemas/single-session.schema.3.json

@@ -1,32 +1,32 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "single-session.schema.3.json",
-  "title": "SingleSessionParams (responseModeParams['single-session'])",
-  "description": "Single-session mode parameters. Session Renew auxiliary model settings belong to baseagents.<name>.",
-  "x-logical-name": "single-session",
-  "x-scope": "mode",
-  "type": "object",
-  "additionalProperties": false,
-  "properties": {
-    "pre_tool_1stmsgchk": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
-      "x-enumDescriptions": {
-        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
-        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
-      }
-    },
-    "tool_use_reminder": {
-      "type": "boolean",
-      "enum": [true, false],
-      "default": true,
-      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
-      "x-enumDescriptions": {
-        "true": "启用：自动汇报工具使用情况",
-        "false": "禁用：静默执行工具"
-      }
-    }
-  }
-}
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "single-session.schema.3.json",
+  "title": "SingleSessionParams (responseModeParams['single-session'])",
+  "description": "Single-session mode parameters. Session Renew auxiliary model settings belong to baseagents.<name>.",
+  "x-logical-name": "single-session",
+  "x-scope": "mode",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "pre_tool_1stmsgchk": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 首个本地工具表态检查（仅 chatmode=proactive 生效）：首个可被 PreToolUse 覆盖的本地工具必须是当前会话精确对应的 ec msg/group send，否则拦截；WebSearch、图像生成、浏览器和 Computer Use 等 hosted 工具不进入此硬拒绝边界。",
+      "x-enumDescriptions": {
+        "true": "启用：首个 hook 可覆盖的本地工具必须是精确会话 send",
+        "false": "禁用：不执行 proactive 首个本地工具 send 检查"
+      }
+    },
+    "tool_use_reminder": {
+      "type": "boolean",
+      "enum": [true, false],
+      "default": true,
+      "description": "proactive 工具汇报提醒（仅 chatmode=proactive 生效）：启用队列未读提醒 + 每 10 次工具调用的汇报提醒。",
+      "x-enumDescriptions": {
+        "true": "启用：自动汇报工具使用情况",
+        "false": "禁用：静默执行工具"
+      }
+    }
+  }
+}

package/kits/templates/bootstrap-welcome.md

@@ -1,17 +1,17 @@
-你好，我是 {{agentName}}。
-
-我刚刚完成连接，需要先和你确认我的基础信息，然后再进入正常工作状态。
-
-请帮我确认三项内容：
-1. 显示名：你希望我叫什么？
-2. 简介：我主要负责什么？一句到两句话即可。
-3. 标签：给我 3 到 6 个标签，例如 `代码审查`、`客服助手`、`项目管理`。
-
-当前信息：
-- AID: {{agentAid}}
-- 渠道: {{channel}}
-- Baseagent: {{baseagent}}
-
-如果希望沿用已有 agent.md 信息，可以直接回复“沿用现有信息”；我会先读取并回显现有值，请你确认是否保持或修改，不需要重新输入。
-
-如果希望重新设定，也可以直接按上面的三项回复。
+你好，我是 {{agentName}}。
+
+我刚刚完成连接，需要先和你确认我的基础信息，然后再进入正常工作状态。
+
+请帮我确认三项内容：
+1. 显示名：你希望我叫什么？
+2. 简介：我主要负责什么？一句到两句话即可。
+3. 标签：给我 3 到 6 个标签，例如 `代码审查`、`客服助手`、`项目管理`。
+
+当前信息：
+- AID: {{agentAid}}
+- 渠道: {{channel}}
+- Baseagent: {{baseagent}}
+
+如果希望沿用已有 agent.md 信息，可以直接回复“沿用现有信息”；我会先读取并回显现有值，请你确认是否保持或修改，不需要重新输入。
+
+如果希望重新设定，也可以直接按上面的三项回复。

package/kits/templates/message-fragments/handoff-context-to-target.md

@@ -1,9 +1,9 @@
-说明：
-- 以下是此前未纳入本会话上下文的本地发言，仅补充一次。
-- 请结合这些发言与当前对端回复继续处理。
-
-本地发言：
-{{#each handoffContextEntries}}- {{previousContent}}
-{{/each}}
-当前对端回复内容：
-{{content}}
+说明：
+- 以下是此前未纳入本会话上下文的本地发言，仅补充一次。
+- 请结合这些发言与当前对端回复继续处理。
+
+本地发言：
+{{#each handoffContextEntries}}- {{previousContent}}
+{{/each}}
+当前对端回复内容：
+{{content}}

package/kits/templates/message-fragments/handoff-request-to-target.md

@@ -1,19 +1,19 @@
-说明：
-- 以下是尚未完成的跨会话请求，仅本端可见。
-- 请结合请求列表与当前对端回复，分别判断哪些请求已经得到充分回答。
-- 不要在对外回复中主动提及 handoff、ID、return 命令或内部路由机制。
-- 当前回复足以处理某项请求时，需要使用：`ec handoff return ID "<完整回流内容>"`
-- 命令双引号内若含双引号、反引号或 Shell 展开形式的 `$`，需经转义符转义，Shell 传给 ec 时会做还原。
-- 若回复不足，不要执行 return。
-
-待回流请求：
-{{#each handoffRequiredEntries}}- ID：{{handoffId}}
-  原请求：{{previousContent}}
-{{/each}}
-{{?handoffContextEntries}}
-以下本地发言只用于补充上下文，不需要回流：
-{{#each handoffContextEntries}}- {{previousContent}}
-{{/each}}
-{{/}}
-当前对端回复内容：
-{{content}}
+说明：
+- 以下是尚未完成的跨会话请求，仅本端可见。
+- 请结合请求列表与当前对端回复，分别判断哪些请求已经得到充分回答。
+- 不要在对外回复中主动提及 handoff、ID、return 命令或内部路由机制。
+- 通常请直接在当前回复中给出完整处理结果，本端会自动把回复绑定并回流到原请求会话。
+- 如果请求因权限、网络或其它原因无法完成，且需要把失败/阻塞原因明确回传给原会话，可执行已有命令 `ec handoff return <handoff-id> "<失败原因>"`；required 请求允许用同一个 ID 追加多次结果。
+- 不要在对外回复中主动提及 handoff、ID 或内部路由机制。
+
+待回流请求：
+{{#each handoffRequiredEntries}}- ID：{{handoffId}}
+  原请求：{{previousContent}}
+{{/each}}
+{{?handoffContextEntries}}
+以下本地发言只用于补充上下文，不需要回流：
+{{#each handoffContextEntries}}- {{previousContent}}
+{{/each}}
+{{/}}
+当前对端回复内容：
+{{content}}

package/kits/templates/message-fragments/handoff-response-to-origin.md

@@ -1,9 +1,9 @@
-说明：
-- 跨会话结果回流，仅本端可见。
-- 以下是此前本会话一个或多个请求的返回结果，请逐项结合当前上下文处理。
-- 不要提及 handoff 或内部路由机制。
-
-待处理结果：
-{{#each handoffOriginEntries}}- 原请求：{{previousContent}}
-  返回结果：{{responseContent}}
-{{/each}}
+说明：
+- 跨会话结果回流，仅本端可见。
+- 以下是此前本会话一个或多个请求的返回结果，请逐项结合当前上下文处理。
+- 不要提及 handoff 或内部路由机制。
+
+待处理结果：
+{{#each handoffOriginEntries}}- 原请求：{{previousContent}}
+  返回结果：{{responseContent}}
+{{/each}}

package/kits/templates/message-fragments/inject-default.md

@@ -1,2 +1,2 @@
-‹owner 提示 · 已验证 · {{injectTime}}{{?ownerAid}} · from:{{ownerAid}}{{/}}›（仅你可见，对端无感；请据此决定如何回复对端）
-{{content}}
+‹owner 提示 · 已验证 · {{injectTime}}{{?ownerAid}} · from:{{ownerAid}}{{/}}›（仅你可见，对端无感；请据此决定如何回复对端）
+{{content}}

package/kits/templates/message-fragments/item.md

@@ -1,2 +1,2 @@
-‹{{now}} · from:{{peerId}}{{?peerName}}({{peerName}}){{/}}{{?peerRole}} · role:{{peerRole}}{{/}}{{?chatType=group}} → 群:{{groupLabel}} · self:{{selfAid}}{{/}}{{?chatType=private}} → self:{{selfAid}}{{/}}{{?encrypted=true}} · 🔒密文{{/}}{{?encrypted=false}} · ✉️明文{{/}}{{?sameDevice}} · 📍同设备{{/}}{{?sameNetwork}} · 🌐同网络{{/}}{{?sameEgressIp}} · 🔀同出口IP{{/}}{{?mentionAids}} · @:{{mentionAids}}{{/}}›
-{{?isHandoff!=true}}{{content}}{{/}}
+‹{{now}} · from:{{peerId}}{{?peerName}}({{peerName}}){{/}}{{?peerRole}} · role:{{peerRole}}{{/}}{{?chatType=group}} → 群:{{groupLabel}} · self:{{selfAid}}{{/}}{{?chatType=private}} → self:{{selfAid}}{{/}}{{?encrypted=true}} · 🔒密文{{/}}{{?encrypted=false}} · ✉️明文{{/}}{{?sameDevice}} · 📍同设备{{/}}{{?sameNetwork}} · 🌐同网络{{/}}{{?sameEgressIp}} · 🔀同出口IP{{/}}{{?mentionAids}} · @:{{mentionAids}}{{/}}›
+{{?isHandoff!=true}}{{content}}{{/}}

package/kits/templates/roles/admin.json

@@ -1,71 +1,71 @@
-{
-  "$schema_version": 1,
-  "description": "Agent administrator with guarded management authority",
-  "rank": 700,
-  "allowAccess": true,
-  "permissions": {
-    "permissionMode": { "default": "request", "allowOverride": false }
-  },
-  "commandPermissions": {
-    "contact.read": { "allow": true, "scopes": ["agent"] },
-    "contact.add": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "privateOnly": true } },
-    "contact.block": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentAdmin": true }
-    },
-    "connect.write": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentAdmin": true }
-    },
-    "connect.access.write": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentOwner": true }
-    },
-    "role.assign": { "allow": true, "scopes": ["agent"] },
-    "role.revoke": { "allow": true, "scopes": ["agent"] },
-    "role.policy.read": { "allow": true, "scopes": ["agent"] },
-    "role.relation.read": { "allow": true, "scopes": ["agent"] },
-    "agent.baseagent.update": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
-    },
-    "observable.current": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentOwner": true }
-    },
-    "observable.update": {
-      "allow": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
-    },
-    "config.get": { "allow": true, "scopes": ["agent", "relation"] },
-    "config.set": { "allow": true, "scopes": ["agent", "relation"] },
-    "config.unset": { "allow": true, "scopes": ["agent", "relation"] },
-    "role.policy.write": {
-      "allow": true,
-      "dangerous": true,
-      "scopes": ["agent"],
-      "constraints": { "requireAgentAdmin": true }
-    },
-    "ec.aid.show": {
-      "allow": true,
-      "dangerous": true,
-      "scopes": ["agent"],
-      "constraints": { "targetCurrentAgentOnly": true, "requireAgentAdmin": true }
-    },
-    "ec.aid.lookup": {
-      "allow": true,
-      "scopes": ["agent"]
-    },
-    "ec.aid.agentmd.get": {
-      "allow": true,
-      "scopes": ["agent"]
-    },
+{
+  "$schema_version": 1,
+  "description": "Agent administrator with guarded management authority",
+  "rank": 700,
+  "allowAccess": true,
+  "permissions": {
+    "permissionMode": { "default": "request", "allowOverride": false }
+  },
+  "commandPermissions": {
+    "contact.read": { "allow": true, "scopes": ["agent"] },
+    "contact.add": { "allow": true, "scopes": ["relation"], "constraints": { "ownPeerOnly": true, "privateOnly": true } },
+    "contact.block": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentAdmin": true }
+    },
+    "connect.write": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentAdmin": true }
+    },
+    "connect.access.write": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true }
+    },
+    "role.assign": { "allow": true, "scopes": ["agent"] },
+    "role.revoke": { "allow": true, "scopes": ["agent"] },
+    "role.policy.read": { "allow": true, "scopes": ["agent"] },
+    "role.relation.read": { "allow": true, "scopes": ["agent"] },
+    "agent.baseagent.update": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
+    },
+    "observable.current": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true }
+    },
+    "observable.update": {
+      "allow": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentOwner": true, "targetCurrentAgentOnly": true }
+    },
+    "config.get": { "allow": true, "scopes": ["agent", "relation"] },
+    "config.set": { "allow": true, "scopes": ["agent", "relation"] },
+    "config.unset": { "allow": true, "scopes": ["agent", "relation"] },
+    "role.policy.write": {
+      "allow": true,
+      "dangerous": true,
+      "scopes": ["agent"],
+      "constraints": { "requireAgentAdmin": true }
+    },
+    "ec.aid.show": {
+      "allow": true,
+      "dangerous": true,
+      "scopes": ["agent"],
+      "constraints": { "targetCurrentAgentOnly": true, "requireAgentAdmin": true }
+    },
+    "ec.aid.lookup": {
+      "allow": true,
+      "scopes": ["agent"]
+    },
+    "ec.aid.agentmd.get": {
+      "allow": true,
+      "scopes": ["agent"]
+    },
     "ec.aid.agentmd.put": {
       "allow": true,
       "dangerous": true,
@@ -78,27 +78,27 @@
       "scopes": ["agent"],
       "constraints": { "targetCurrentAgentOnly": true, "requireAgentOwner": true }
     },
-    "ec.fs.mkdir": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.upload": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.move": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.remove": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.getfacl": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "ec.fs.setfacl": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
-    "*": { "allow": true },
-    "agent.reload": {
-      "allow": true,
-      "dangerous": true,
-      "scopes": ["agent", "control"],
-      "constraints": {
-        "targetCurrentAgentOnly": true,
-        "requireAgentAdmin": true
-      }
-    },
-    "dangerous:*": {
-      "allow": true,
-      "dangerous": true,
-      "constraints": { "requireDaemonOwner": true }
-    }
-  }
-}
+    "ec.fs.mkdir": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.upload": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.copy": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.move": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.remove": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.getfacl": { "allow": true, "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "ec.fs.setfacl": { "allow": true, "permissionMode": "auto", "scopes": ["relation"], "constraints": { "groupOnly": true, "currentRelationOnly": true, "targetCurrentAgentOnly": true } },
+    "*": { "allow": true },
+    "agent.reload": {
+      "allow": true,
+      "dangerous": true,
+      "scopes": ["agent", "control"],
+      "constraints": {
+        "targetCurrentAgentOnly": true,
+        "requireAgentAdmin": true
+      }
+    },
+    "dangerous:*": {
+      "allow": true,
+      "dangerous": true,
+      "constraints": { "requireDaemonOwner": true }
+    }
+  }
+}