evolcore 0.0.25 → 0.0.27

package/dist/cli/daemon-commands.js

@@ -23,11 +23,12 @@ import { displaySessionTitle } from '../core/session/session-title.js';
 import { isNonAgentSessionChannel } from '../core/system-channels.js';
 import { printCodeStats } from './code-stats.js';
 import { getProcessStartTime, startTimeMatches } from '../utils/process-introspect.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { WEB_CLI_BIN, WEB_PACKAGE_LATEST, WEB_PACKAGE_NAME } from '../product.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
 import { isInitCancelledError, printInitCancelHint } from './init-cancel.js';
+import { computeBuildId } from '../utils/evolcore-version.js';
 import { listCodexAppServerProcesses, unregisterCodexAppServerProcess } from '../agents/codex/app-server-registry.js';
 import { DEFAULT_ECWEB_PORT, ecwebService, setEcwebEnabled } from '../config/daemon-services.js';
 import { checkCodexProjectPath, inspectCodexManagedHook, ensureCodexManagedHook, runCodexHookLaunchDiagnostic, } from '../agents/codex/diagnostics.js';
@@ -39,6 +40,8 @@ export function ensureCodexHookBeforeLifecycle(onRepaired) {
     try {
         const usesCodex = loadDefaults()?.active_baseagent === 'codex'
             || loadAllAgents().agents.some(agent => {
+                if (agent.enabled === false)
+                    return false;
                 try {
                     return resolveEffective({ self: agent.aid }).active_baseagent === 'codex';
                 }
@@ -145,7 +148,7 @@ function rejectPidIsolatedLifecycle(action, status, ping) {
 }
 async function tryDelegatedDaemonRestart(socketPath) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     if (!sessionId || !delegationToken)
         return false;
     const response = await ipcQuery(socketPath, {
@@ -312,7 +315,10 @@ export async function runUpgradeChecks(upgradeFn = signal => tryUpgrade({ signal
                 clearTimeout(timer);
         }
     };
-    const upgrade = await runWithTimeout('EvolCore', upgradeFn);
+    const [upgrade, ecwebUpgrade] = await Promise.all([
+        runWithTimeout('EvolCore', upgradeFn),
+        runWithTimeout(WEB_PACKAGE_NAME, ecwebUpgradeFn),
+    ]);
     switch (upgrade.status) {
         case 'upgraded':
             console.log(`✅ Upgraded: ${upgrade.from} → ${upgrade.to}`);
@@ -329,7 +335,6 @@ export async function runUpgradeChecks(upgradeFn = signal => tryUpgrade({ signal
             console.log(`⚠ Upgrade failed${upgrade.from && upgrade.to ? ` (${upgrade.from} → ${upgrade.to})` : ''}, continuing with current version${upgrade.error ? `: ${upgrade.error}` : ''}`);
             break;
     }
-    const ecwebUpgrade = await runWithTimeout(WEB_PACKAGE_NAME, ecwebUpgradeFn);
     switch (ecwebUpgrade.status) {
         case 'upgraded':
             console.log(`✅ ${WEB_PACKAGE_NAME} upgraded: ${ecwebUpgrade.from} → ${ecwebUpgrade.to}`);
@@ -769,21 +774,50 @@ export async function cmdStart(opts = {}) {
     };
     setTimeout(checkReady, 1000);
 }
-async function stopPid(pid, gracefulRequested = false) {
+function isPidReused(pid, expectedStartedAt) {
+    if (expectedStartedAt === undefined)
+        return false;
+    const actualStartedAt = getProcessStartTime(pid);
+    return actualStartedAt !== null && !startTimeMatches(expectedStartedAt, actualStartedAt);
+}
+function reportPidReused(pid) {
+    console.log(`ℹ EvolCore PID ${pid} no longer refers to the recorded process; treating it as stopped`);
+}
+async function stopPid(pid, gracefulRequested = false, expectedStartedAt) {
     console.log(`🛑 Stopping EvolCore (PID: ${pid})...`);
+    if (isPidReused(pid, expectedStartedAt)) {
+        reportPidReused(pid);
+        return true;
+    }
     if (!gracefulRequested)
         platform.killProcess(pid);
     if (await platform.waitForProcessExit(pid, gracefulRequested ? 30_000 : 10_000)) {
         console.log('✓ EvolCore stopped');
         return true;
     }
-    console.log(`⚠ EvolCore PID ${pid} did not exit gracefully; forcing termination...`);
+    if (isPidReused(pid, expectedStartedAt)) {
+        reportPidReused(pid);
+        return true;
+    }
+    const state = platform.getProcessState(pid);
+    const stateSuffix = state ? ` (state=${state})` : '';
+    console.log(`⚠ EvolCore PID ${pid} did not exit gracefully${stateSuffix}; forcing termination...`);
+    if (isPidReused(pid, expectedStartedAt)) {
+        reportPidReused(pid);
+        return true;
+    }
     platform.killProcess(pid, true);
     if (await platform.waitForProcessExit(pid, 5_000)) {
         console.log('✓ EvolCore stopped (forced)');
         return true;
     }
-    console.error(`❌ EvolCore PID ${pid} is still running; restart aborted`);
+    if (isPidReused(pid, expectedStartedAt)) {
+        reportPidReused(pid);
+        return true;
+    }
+    const finalState = platform.getProcessState(pid);
+    const finalStateSuffix = finalState ? ` (state=${finalState})` : '';
+    console.error(`❌ EvolCore PID ${pid} is still running${finalStateSuffix}; restart aborted`);
     return false;
 }
 function isRuntimeOrphan(orphan, currentHome = resolveRoot()) {
@@ -813,13 +847,14 @@ export async function cmdStop() {
         return;
     }
     const pids = new Set([...aliveMains.map(entry => entry.record.pid), ...runtimeOrphans.map(orphan => orphan.pid)]);
+    const expectedStarts = new Map(aliveMains.map(entry => [entry.record.pid, entry.record.startedAt]));
     if (runtimeOrphans.length > 0) {
         console.log(`⚠ 检测到未登记的 EvolCore 进程，将一并停止: ${runtimeOrphans.map(orphan => orphan.pid).join(', ')}`);
     }
     const gracefulPid = ping && pids.has(ping.pid)
         ? await requestDaemonShutdown(p.socket, DAEMON_SHUTDOWN_TIMEOUT_MS, 'ec stop', pids)
         : null;
-    const stopped = await Promise.all([...pids].map(pid => stopPid(pid, pid === gracefulPid)));
+    const stopped = await Promise.all([...pids].map(pid => stopPid(pid, pid === gracefulPid, expectedStarts.get(pid))));
     if (stopped.some(result => !result)) {
         process.exitCode = 1;
         return;
@@ -836,11 +871,13 @@ export async function cmdRestart(opts = {}) {
     if (!ensureCodexHookBeforeLifecycle())
         return;
     const initialStatus = scanInstances();
-    const initialOrphans = findOrphanProcesses();
-    const initialRuntimeOrphans = initialOrphans.filter(orphan => isRuntimeOrphan(orphan));
     const socketPath = resolvePaths().socket;
     const ping = await probeDaemon(socketPath);
     if (ping && !hasVisibleDaemonPid(initialStatus, ping)) {
+        // Only pay for a cross-host process-table scan when the IPC PID is not
+        // present in our registry. This is the exceptional PID-namespace case;
+        // healthy restarts no longer scan every Node process before stopping.
+        const initialRuntimeOrphans = findOrphanProcesses().filter(orphan => isRuntimeOrphan(orphan));
         if (await tryDelegatedDaemonRestart(socketPath))
             return;
         if (initialRuntimeOrphans.length === 0 && rejectPidIsolatedLifecycle('restart', initialStatus, ping))
@@ -848,13 +885,13 @@ export async function cmdRestart(opts = {}) {
     }
     // 构建交给 restart-monitor：它在 daemon 停止之后才编译，dist/ 不会被活进程
     // 占用，失败还能回滚到上一份产物。这里再编译一次会落在事务保护之外。
-    // Keep restart behavior identical to startup: both paths use one upgrade
-    // check implementation and continue when an upgrade is unavailable.
-    await runUpgradeChecks();
+    // restart-monitor owns upgrade checks. Running them here as well caused a
+    // normal restart to perform every registry lookup twice, and in installed
+    // mode could race the monitor while it was preparing its rollback point.
     if (!requireCompletedDataMigration(resolveRoot(), 'restart'))
         return;
     // 停止所有活 main 进程（可能不止一个）
-    const status = scanInstances();
+    const status = initialStatus;
     const aliveMains = status.mains.filter(m => m.alive);
     if (aliveMains.length > 0) {
         if (aliveMains.length > 1) {
@@ -865,7 +902,7 @@ export async function cmdRestart(opts = {}) {
         const gracefulPid = currentPing && mainPids.has(currentPing.pid)
             ? await requestDaemonShutdown(socketPath, DAEMON_SHUTDOWN_TIMEOUT_MS, 'ec restart', mainPids)
             : null;
-        const stopped = await Promise.all(aliveMains.map(m => stopPid(m.record.pid, m.record.pid === gracefulPid)));
+        const stopped = await Promise.all(aliveMains.map(m => stopPid(m.record.pid, m.record.pid === gracefulPid, m.record.startedAt)));
         if (stopped.some(result => !result)) {
             console.error('❌ Restart aborted because an existing EvolCore process could not be stopped');
             process.exitCode = 1;
@@ -881,7 +918,8 @@ export async function cmdRestart(opts = {}) {
         return;
     }
     // 孤儿处理：同 HOME/同安装包的孤儿属于本运行时，先确认退出再替换；
-    // 跨 HOME 的孤儿只在 --clear 时 kill，否则仅警告。
+    // 跨 HOME 的孤儿只在 --clear 时 kill，否则仅警告。findOrphanProcesses
+    // 在 Windows 上需要一次 CIM 查询；保留一个快照，避免同一阶段重复扫描。
     {
         const orphans = findOrphanProcesses();
         const confirmedTestDaemons = orphans.filter(o => o.confirmedTestDaemon);
@@ -890,7 +928,7 @@ export async function cmdRestart(opts = {}) {
             console.log(`☠ 已清理 ${killed.length} 个泄漏的测试 daemon: ${killed.join(', ')}`);
             await sleep(500);
         }
-        const runtimeOrphans = findOrphanProcesses().filter(o => isRuntimeOrphan(o));
+        const runtimeOrphans = orphans.filter(o => isRuntimeOrphan(o));
         if (runtimeOrphans.length > 0) {
             console.log(`⚠ 检测到未登记的 EvolCore 进程，将一并停止: ${runtimeOrphans.map(o => o.pid).join(', ')}`);
             const orphanPids = new Set(runtimeOrphans.map(orphan => orphan.pid));
@@ -906,13 +944,9 @@ export async function cmdRestart(opts = {}) {
             }
             await sleep(500);
         }
-        const remainingRuntimeOrphans = findOrphanProcesses().filter(o => isRuntimeOrphan(o));
-        if (remainingRuntimeOrphans.length > 0) {
-            console.error(`❌ Restart aborted: EvolCore process still running (PID: ${remainingRuntimeOrphans.map(o => o.pid).join(', ')})`);
-            process.exitCode = 1;
-            return;
-        }
-        const otherHome = findOrphanProcesses().filter(o => !o.confirmedTestDaemon && !isRuntimeOrphan(o));
+        // stopPid() already waited for every runtime orphan above, so avoid a
+        // second scan before handling cross-HOME records.
+        const otherHome = orphans.filter(o => !o.confirmedTestDaemon && !isRuntimeOrphan(o));
         if (opts.clear && otherHome.length > 0) {
             const killed = killOrphans(otherHome);
             console.log(`☠ 已 SIGKILL ${killed.length} 个跨 HOME 孤儿进程: ${killed.join(', ')}`);
@@ -921,6 +955,14 @@ export async function cmdRestart(opts = {}) {
         else if (otherHome.length > 0) {
             reportOrphans(otherHome);
         }
+        // Keep the post-stop ownership guard: a process that appeared during the
+        // cleanup window must still block replacement.
+        const remainingRuntimeOrphans = findOrphanProcesses().filter(o => isRuntimeOrphan(o));
+        if (remainingRuntimeOrphans.length > 0) {
+            console.error(`❌ Restart aborted: EvolCore process still running (PID: ${remainingRuntimeOrphans.map(o => o.pid).join(', ')})`);
+            process.exitCode = 1;
+            return;
+        }
     }
     // 只清理 EvolCore 自己登记的 codex app-server，不能影响桌面端实例。
     {
@@ -955,8 +997,7 @@ export async function cmdRestart(opts = {}) {
         process.exitCode = 1;
         return;
     }
-    console.log('🔄 Restart monitor started, waiting for service to come back online...');
-    await sleep(2000);
+    console.log('🔄 Restart monitor started; service is coming back online in the background...');
     // 代码统计（开发环境）
     if (path.normalize(resolveRoot()) === path.normalize(getPackageRoot())) {
         console.log('');
@@ -1125,6 +1166,7 @@ export async function cmdStatus() {
     const p = resolvePaths();
     const status = scanInstances();
     const aliveMains = status.mains.filter(m => m.alive);
+    const aliveRestartMonitors = status.restartMonitors.filter(m => m.alive);
     // Start all read-only daemon queries together. On a busy Windows host each
     // query can otherwise wait behind the same IPC/event-loop delay and make the
     // total `ec status` time the sum of several individual timeouts.
@@ -1263,6 +1305,10 @@ export async function cmdStatus() {
             catch { }
         }
     }
+    else if (aliveRestartMonitors.length > 0) {
+        console.log(`🔄 EvolCore 正在重启，daemon 尚未就绪（monitor PID: ${aliveRestartMonitors.map(m => m.record.pid).join(', ')}）`);
+        console.log('  请稍后再次执行 ec status。');
+    }
     else {
         console.log(ipcFailure ? '⚠ 无法确认 EvolCore 运行状态：IPC 不可用，且没有可见的存活 PID。' : '⚠ EvolCore is not running');
         if (ipcFailure)
@@ -1312,6 +1358,24 @@ export async function cmdStatus() {
         ]);
         agentsResponse = agentResponse;
         if (statusResponse) {
+            if (statusResponse.build) {
+                if (statusResponse.build.runtimeMode === 'source') {
+                    console.log(`  Build ID: runtime=source dist=${statusResponse.build.diskDistId || '?'}`);
+                    console.log('  ℹ daemon 当前由源码入口运行，dist build ID 不参与一致性比较。');
+                }
+                else {
+                    const runtimeBuildId = statusResponse.build.runtimeId || '?';
+                    const diskDistBuildId = statusResponse.build.diskDistId || '?';
+                    console.log(`  Build ID: runtime=${runtimeBuildId} dist=${diskDistBuildId}`);
+                    if (runtimeBuildId !== '?' && diskDistBuildId !== '?' && runtimeBuildId !== diskDistBuildId) {
+                        console.log('  ⚠ 运行进程 build ID 与磁盘 dist 不一致；请重启 daemon 后再判断源码行为。');
+                    }
+                }
+            }
+            else {
+                console.log(`  Build ID: runtime=unavailable (daemon 未提供 build identity) dist=${computeBuildId(path.join(getPackageRoot(), 'dist')) ?? '?'}`);
+                console.log('  ⚠ 当前 daemon 未提供 build ID；请重启到包含 build identity 的版本后再判断源码行为。');
+            }
             // 🔑 AUN AIDs 表格（详细 AUN 实例状态）
             try {
                 if (aidsResponse?.ok && aidsResponse.aids?.length > 0) {
@@ -2658,17 +2722,18 @@ function findAliveEcweb(p) {
     return alive[0] ?? null;
 }
 /**
- * 轻量 HTTP 就绪探测：GET / 返回 2xx 即视为就绪。
- * 不走 /api/pair-code（会触发配对码刷新副作用），不走 /api/health（不存在）。
- * 根路径由 serveStatic 处理，返回 index.html，无副作用。
+ * 轻量 HTTP 就绪探测：ECWeb 的健康端点必须返回明确的服务标识。
+ * 不走 /api/pair-code（会触发配对码刷新副作用），也不依赖静态页面内容。
  */
 async function probeEcwebReady(port) {
     try {
-        const res = await fetch(`http://127.0.0.1:${port}/`, {
-            method: 'GET',
+        const res = await fetch(`http://127.0.0.1:${port}/api/health`, {
             signal: AbortSignal.timeout(2000),
         });
-        return res.ok;
+        if (!res.ok)
+            return false;
+        const body = await res.json();
+        return body.ok === true && body.service === 'ecweb';
     }
     catch {
         return false;
@@ -2694,8 +2759,9 @@ async function waitForExistingEcweb(p, timeoutMs = 3_000) {
 }
 /**
  * 输出 ECWeb 状态。判定口径：
- *   1. 进程是否存活（instance/ 下的 pid 文件 + isProcessRunning）
- *   2. HTTP 是否就绪——探测根路径 /（serveStatic → index.html, 无副作用）。
+ *   1. HTTP 是否就绪——探测 ECWeb 专用 /api/health 端点。
+ *   2. 进程是否存活（instance/ 下的 pid 文件 + isProcessRunning）仅用于补充诊断；
+ *      某些 CLI 运行在隔离 PID namespace 中，看不到宿主 ECWeb PID 是正常情况。
  */
 async function printEcwebStatus(p) {
     try {
@@ -2711,6 +2777,15 @@ async function printEcwebStatus(p) {
         // still provide an authoritative runtime status without local config access.
     }
     const entries = readEcwebInstanceEntries(p);
+    // Probe before consulting PID visibility. The daemon and CLI can be in
+    // different PID namespaces while sharing the host network namespace.
+    let readyEntry;
+    for (const entry of entries) {
+        if (await probeEcwebReady(entry.record.port)) {
+            readyEntry = entry;
+            break;
+        }
+    }
     const aliveEntries = [];
     for (const entry of entries) {
         if (platform.isProcessRunning(entry.record.pid)) {
@@ -2719,22 +2794,21 @@ async function printEcwebStatus(p) {
         else {
             // A stale EC Web record must never be used to report the PID of an
             // unrelated process that later inherited the port.
-            try {
-                fs.unlinkSync(entry.filePath);
+            // Keep a record whose dedicated health endpoint just proved live: the
+            // PID may be hidden by a namespace boundary rather than actually dead.
+            if (entry.filePath !== readyEntry?.filePath) {
+                try {
+                    fs.unlinkSync(entry.filePath);
+                }
+                catch { }
             }
-            catch { }
-        }
-    }
-    let readyEntry;
-    for (const entry of aliveEntries) {
-        if (await probeEcwebReady(entry.record.port)) {
-            readyEntry = entry;
-            break;
         }
     }
     if (readyEntry) {
         console.log('');
-        console.log(`🔭 ECWeb: 运行中 (PID: ${readyEntry.record.pid})  http://localhost:${readyEntry.record.port}`);
+        const pidVisible = aliveEntries.some(entry => entry.filePath === readyEntry.filePath);
+        const pidText = pidVisible ? `PID: ${readyEntry.record.pid}` : `PID: ${readyEntry.record.pid}（当前 namespace 不可见）`;
+        console.log(`🔭 ECWeb: 运行中 (${pidText})  http://localhost:${readyEntry.record.port}`);
         return;
     }
     const occupiedPids = new Set();
@@ -2771,9 +2845,12 @@ function removeEcwebInstanceFiles(p) {
 }
 /** 清理 EvolCore 登记的 codex app-server 孤儿进程，返回清理的进程数。 */
 export function stopCodexAppServerOrphans() {
+    const entries = listCodexAppServerProcesses();
+    if (entries.length === 0)
+        return 0;
     const codexProcs = new Set(platform.findProcesses('codex app-server'));
     let killed = 0;
-    for (const entry of listCodexAppServerProcesses()) {
+    for (const entry of entries) {
         const { pid, startedAt } = entry.record;
         if (!platform.isProcessRunning(pid)) {
             unregisterCodexAppServerProcess(entry.filePath);
@@ -2926,7 +3003,7 @@ export async function startEcwebIfEnabled(p, options = {}) {
             console.log(`✓ ECWeb ${actionLabel} (PID: ${pid})  http://localhost:${port}`);
             if (pair) {
                 const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
-                console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，已配对过的浏览器无需重新配对)`);
+                console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，仅可配对一次，已配对过的浏览器无需重新配对)`);
             }
             else {
                 console.log('   daemon 尚未提供配对码；EvolCore 启动后可通过 /pair 或 ECWeb 页面获取');
@@ -2962,7 +3039,7 @@ async function printEcwebAccess(port) {
     }
     if (pair) {
         const mins = Math.max(0, Math.round((pair.expiresAt - Date.now()) / 60000));
-        console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，配对后远程访问 token 缓存 30 天)`);
+        console.log(`   配对码: ${pair.code}  (约 ${mins} 分钟内有效，仅可配对一次，token 缓存 7 天，有访问自动续期)`);
     }
     else {
         console.log('   配对码: 暂不可用（稍后重试 ec watch web，或查看 logs/watch-web.log）');
@@ -3260,21 +3337,21 @@ export async function cmdWatchCommand(args) {
     }
     else if (args[0] === 'msg') {
         if (isHelpFlag(args[1])) {
-            console.log(`用法: ec watch msg
-
-三面板交互式消息监控 TUI。
-
-面板:
-  左 (Scope)     本地 AID 列表，显示收发统计和对端数量
-  中 (Stats)     选中 AID 的对端列表（默认 All），显示 per-peer 收发数
-  右 (Messages)  消息流，带滚动条
-
-操作:
-  ↑↓             当前面板内导航
-  ←→ / Tab       切换面板
-  Enter          选中 AID / 选中对端
-  Backspace      返回上一级
-  Page Up/Down   消息滚动
+            console.log(`用法: ec watch msg
+
+三面板交互式消息监控 TUI。
+
+面板:
+  左 (Scope)     本地 AID 列表，显示收发统计和对端数量
+  中 (Stats)     选中 AID 的对端列表（默认 All），显示 per-peer 收发数
+  右 (Messages)  消息流，带滚动条
+
+操作:
+  ↑↓             当前面板内导航
+  ←→ / Tab       切换面板
+  Enter          选中 AID / 选中对端
+  Backspace      返回上一级
+  Page Up/Down   消息滚动
   ESC            退出`);
             return;
         }

package/dist/cli/diag.js

@@ -0,0 +1,31 @@
+import { ipcQuery } from '../ipc.js';
+import { resolvePaths } from '../paths.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { parseDiagArgs } from '../core/command/diag-service.js';
+import { wantsHelp } from './help.js';
+export async function cmdDiag(args) {
+    if (wantsHelp(args)) {
+        console.log('用法：ec diag <问题描述> [--owner <daemonOwner-aid>] [--format json]\n      ec diag stop [--format json]\n未指定 --owner 时联系本机 daemon.json.owners[0]。');
+        return;
+    }
+    const json = args.at(-2) === '--format' && args.at(-1) === 'json';
+    const argv = json ? args.slice(0, -2) : args;
+    let result;
+    try {
+        parseDiagArgs(argv);
+        result = await ipcQuery(resolvePaths().socket, {
+            type: 'diag', argv,
+            ...(process.env.EVOLCORE_SESSION_ID ? {
+                sessionId: process.env.EVOLCORE_SESSION_ID,
+                delegationToken: readDelegationCredential(),
+            } : {}),
+        }, 30_000) ?? { ok: false, code: 'DAEMON_UNAVAILABLE', message: 'daemon 未返回结果，请检查其运行状态；发送结果尚未确认' };
+    }
+    catch (error) {
+        result = { ok: false, code: 'INVALID_ARGUMENT', message: error.message };
+    }
+    result.message ??= result.error ?? '诊断请求未完成';
+    console.log(json ? JSON.stringify(result, null, 2) : result.message);
+    if (!result.ok)
+        process.exitCode = 1;
+}

package/dist/cli/fs-command.js

@@ -5,8 +5,8 @@ import { getArgValue, isHelpFlag, wantsHelp } from './help.js';
 import { agentmdGet, getAidStore, isValidAid, loadClient, SLOT } from '../aun/aid/index.js';
 import { ipcQuery } from '../ipc.js';
 import { resolvePaths } from '../paths.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
-import { downloadGroupFsBytes } from '../aun/group-fs-download.js';
+import { AGENT_DELEGATION_TOKEN_ENV, readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { downloadGroupFsBytes } from '../aun/group/index.js';
 class FsCliError extends Error {
     code;
     suggestion;
@@ -19,73 +19,73 @@ class FsCliError extends Error {
         this.details = details;
     }
 }
-const HELP = `用法: ec fs <command> [args...] [options]
-
-Commands:
-  ls <AID>:<path>                 列目录
-  stat [-L] <AID>:<path>          查看节点元数据（默认不跟随软链；-L 跟随）
-  lstat <AID>:<path>              查看节点本身（不跟随末级软链）
-  cat <AID>:<path>                输出文本文件内容；二进制/大文件返回头部摘要
-  cp <local> <AID>:<path>         上传本地文件
-  cp <AID>:<path> <local>         下载远程文件
-  cp <AID>:<path> <AID>:<path>    远程复制（同后端）
-  mv <AID>:<path> <AID>:<path>    移动/改名（同后端）
-  rm [-r] <AID>:<path>            删除文件或目录
-  mkdir [-p] <AID>:<path>         创建目录
-  ln -s <target> <AID>:<path>     创建软链（personal storage）
-  chmod [mode] <AID>:<path>       切换公开/私有（personal storage）
-  setfacl <AID>:<path> -m|-x ...   设置/移除 ACL（群路径使用 role:member|role:admin）
-  getfacl <AID>:<path>            查看 ACL
-  token issue|revoke|ls <path>    管理访问 token（personal storage）
-  find <AID>:<path> [filters]     查找节点
-  df <AID>:                       查看容量/配额
-  mount <target> --volume <id>    挂载实体卷
-  mount <target> --source <src>   挂载远程子树
-  approve <AID>:<path>            批准待审挂载（personal storage）
-  reject <AID>:<path>             拒绝待审挂载（personal storage）
-  umount <AID>:<path>             卸载挂载点
-
-Options:
-  --as <aid>                      操作者 AID；也可由 EVOLCORE_SELF_AID 注入
-  --format json                   输出 JSON
-  --overwrite, --force            覆盖目标（用于 cp/mv/ln）或强制删除（用于 rm）
-  -r, --recursive                 递归（用于 rm/cp）
-  -p, --parents                   自动创建父目录（用于 mkdir/group 上传）
-  -L, --follow                    stat 跟随末级软链
-  --token <token>                 读取时携带访问 token（personal storage）
-  --content-type <mime>           上传时指定内容类型
-  --public                        上传后公开可读（personal storage）
-  --visibility <public|private>   chmod 可见性
-  --allow-roles <roles>           chmod 角色约束，逗号分隔
-  -m aid:<aid>:<perms>            setfacl 新增/更新 ACL
-  -x aid:<aid>                    setfacl 移除 ACL
-  --source <AID>:<path>           mount 虚拟卷来源
-  --volume <id>                   mount 实体卷 ID
-  --require-approval              mount 需要来源 owner 审批
-  --expires <time>                mount/token/ACL 过期时间，Unix 秒或 ISO 日期
-  --max-uses <n>                  ACL 最大使用次数
-  --max-reads <n>                 token 最大读取次数
-  --readonly, --readwrite         mount 只读/读写
-  --name <glob>                   find 名称过滤
-  --type <f|d|l>                  find 类型过滤
-  --size <expr>                   find 大小过滤，如 +1M
-  --mtime <expr>                  find 修改时间过滤
-  --head-bytes <n>                cat 二进制头部字节数，默认 256
-  --max-bytes <n>                 cat 最大直接输出字节数，默认 1048576
-  --aun-path <path>               指定 AUN keystore 根
-  --app <name>                    指定 AUN app slot
-
-示例:
-  ec fs ls alice.agentid.pub:/private/
-  ec fs cp ./report.md alice.agentid.pub:/private/report.md --as alice.agentid.pub
-  ec fs cp alice.agentid.pub:/private/report.md ./report.md --as alice.agentid.pub
-  ec fs cp alice.agentid.pub:/private/a.md bob.agentid.pub:/inbox/a.md --as alice.agentid.pub
-  ec fs cat alice.agentid.pub:/private/report.md --as alice.agentid.pub
-  ec fs ln -s alice.agentid.pub:/private/report.md alice.agentid.pub:/public/report.md --as alice.agentid.pub
-  ec fs chmod +r alice.agentid.pub:/public/report.md --as alice.agentid.pub
-  ec fs setfacl alice.agentid.pub:/private/report.md -m aid:bob.agentid.pub:r --as alice.agentid.pub
-  ec fs token issue alice.agentid.pub:/public/report.md --expires 2026-12-31 --as alice.agentid.pub
-  ec fs find alice.agentid.pub:/private/ --name "*.md" --as alice.agentid.pub
+const HELP = `用法: ec fs <command> [args...] [options]
+
+Commands:
+  ls <AID>:<path>                 列目录
+  stat [-L] <AID>:<path>          查看节点元数据（默认不跟随软链；-L 跟随）
+  lstat <AID>:<path>              查看节点本身（不跟随末级软链）
+  cat <AID>:<path>                输出文本文件内容；二进制/大文件返回头部摘要
+  cp <local> <AID>:<path>         上传本地文件
+  cp <AID>:<path> <local>         下载远程文件
+  cp <AID>:<path> <AID>:<path>    远程复制（同后端）
+  mv <AID>:<path> <AID>:<path>    移动/改名（同后端）
+  rm [-r] <AID>:<path>            删除文件或目录
+  mkdir [-p] <AID>:<path>         创建目录
+  ln -s <target> <AID>:<path>     创建软链（personal storage）
+  chmod [mode] <AID>:<path>       切换公开/私有（personal storage）
+  setfacl <AID>:<path> -m|-x ...   设置/移除 ACL（群路径使用 role:member|role:admin）
+  getfacl <AID>:<path>            查看 ACL
+  token issue|revoke|ls <path>    管理访问 token（personal storage）
+  find <AID>:<path> [filters]     查找节点
+  df <AID>:                       查看容量/配额
+  mount <target> --volume <id>    挂载实体卷
+  mount <target> --source <src>   挂载远程子树
+  approve <AID>:<path>            批准待审挂载（personal storage）
+  reject <AID>:<path>             拒绝待审挂载（personal storage）
+  umount <AID>:<path>             卸载挂载点
+
+Options:
+  --as <aid>                      操作者 AID；也可由 EVOLCORE_SELF_AID 注入
+  --format json                   输出 JSON
+  --overwrite, --force            覆盖目标（用于 cp/mv/ln）或强制删除（用于 rm）
+  -r, --recursive                 递归（用于 rm/cp）
+  -p, --parents                   自动创建父目录（用于 mkdir/group 上传）
+  -L, --follow                    stat 跟随末级软链
+  --token <token>                 读取时携带访问 token（personal storage）
+  --content-type <mime>           上传时指定内容类型
+  --public                        上传后公开可读（personal storage）
+  --visibility <public|private>   chmod 可见性
+  --allow-roles <roles>           chmod 角色约束，逗号分隔
+  -m aid:<aid>:<perms>            setfacl 新增/更新 ACL
+  -x aid:<aid>                    setfacl 移除 ACL
+  --source <AID>:<path>           mount 虚拟卷来源
+  --volume <id>                   mount 实体卷 ID
+  --require-approval              mount 需要来源 owner 审批
+  --expires <time>                mount/token/ACL 过期时间，Unix 秒或 ISO 日期
+  --max-uses <n>                  ACL 最大使用次数
+  --max-reads <n>                 token 最大读取次数
+  --readonly, --readwrite         mount 只读/读写
+  --name <glob>                   find 名称过滤
+  --type <f|d|l>                  find 类型过滤
+  --size <expr>                   find 大小过滤，如 +1M
+  --mtime <expr>                  find 修改时间过滤
+  --head-bytes <n>                cat 二进制头部字节数，默认 256
+  --max-bytes <n>                 cat 最大直接输出字节数，默认 1048576
+  --aun-path <path>               指定 AUN keystore 根
+  --app <name>                    指定 AUN app slot
+
+示例:
+  ec fs ls alice.agentid.pub:/private/
+  ec fs cp ./report.md alice.agentid.pub:/private/report.md --as alice.agentid.pub
+  ec fs cp alice.agentid.pub:/private/report.md ./report.md --as alice.agentid.pub
+  ec fs cp alice.agentid.pub:/private/a.md bob.agentid.pub:/inbox/a.md --as alice.agentid.pub
+  ec fs cat alice.agentid.pub:/private/report.md --as alice.agentid.pub
+  ec fs ln -s alice.agentid.pub:/private/report.md alice.agentid.pub:/public/report.md --as alice.agentid.pub
+  ec fs chmod +r alice.agentid.pub:/public/report.md --as alice.agentid.pub
+  ec fs setfacl alice.agentid.pub:/private/report.md -m aid:bob.agentid.pub:r --as alice.agentid.pub
+  ec fs token issue alice.agentid.pub:/public/report.md --expires 2026-12-31 --as alice.agentid.pub
+  ec fs find alice.agentid.pub:/private/ --name "*.md" --as alice.agentid.pub
   ec fs df alice.agentid.pub: --as alice.agentid.pub`;
 const VALUE_FLAGS = new Set([
     '--as',
@@ -209,7 +209,7 @@ export async function cmdFs(args) {
 }
 async function runManagedFs(args, formatJson) {
     const sessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     const fail = (code, message) => {
         if (formatJson)
             console.log(JSON.stringify({ ok: false, code, error: message }));