evolcore 0.0.25 → 0.0.27

package/dist/cli/task-context.js

@@ -1,14 +1,18 @@
 import { normalizeCausation } from '../core/causation/context.js';
 import { RUNTIME_LOCK_DIR_ENV } from '../core/runtime-lock.js';
 import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { resolveRoot } from '../paths.js';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
 export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
 export const DAEMON_RUNTIME_EPOCH_ENV = 'EVOLCORE_DAEMON_RUNTIME_EPOCH';
 export { RUNTIME_LOCK_DIR_ENV };
 const generatedProcessManagedTempDirs = new Set();
+const preparedWindowsSessionRuntimeDirs = new Set();
 let processTempCleanupRegistered = false;
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
@@ -37,7 +41,9 @@ function normalizeTaskRuntimeContext(value) {
         processRole: optionalProcessRole(value.processRole),
         dataScope: optionalDataScope(value.dataScope),
         authorizedBy: optionalString(value.authorizedBy),
-        executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
+        executionSource: value.executionSource === 'fullaccess-command'
+            || value.executionSource === 'trigger'
+            || value.executionSource === 'agent-policy'
             ? value.executionSource : undefined,
         daemonRuntimeEpoch: optionalString(value.daemonRuntimeEpoch),
         threadId: optionalString(value.threadId),
@@ -189,29 +195,81 @@ export function ensureProcessManagedTempDir() {
         throw error;
     }
 }
-function isRunnerOwnedSessionRuntimeDir(directory) {
-    const resolved = path.resolve(directory);
-    const base = path.basename(resolved);
-    const parent = path.dirname(resolved);
-    // Codex allocates a private, direct child named with a 24-character digest
-    // below its private evolcore-codex-* parent. The runner has already checked
-    // canonical containment before returning this path to the response engine.
-    const isCodexRuntime = /^[a-f0-9]{24}$/.test(base)
-        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(parent));
-    return isCodexRuntime && isPrivateDirectory(parent) && isPrivateDirectory(resolved);
+function canonicalHome() {
+    const configured = path.resolve(resolveRoot());
+    let canonical;
+    try {
+        canonical = fs.realpathSync.native(configured);
+    }
+    catch {
+        canonical = configured;
+    }
+    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+}
+function systemTempRoot() {
+    const testRoot = process.env.EVOLCORE_TEST === '1' && process.env.TMPDIR?.trim();
+    const candidate = testRoot && path.isAbsolute(testRoot)
+        ? testRoot
+        : process.platform === 'win32'
+            ? path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'Temp')
+            : process.platform === 'linux'
+                ? '/tmp'
+                : os.tmpdir();
+    try {
+        return fs.realpathSync.native(candidate);
+    }
+    catch {
+        return path.resolve(candidate);
+    }
+}
+function sessionRuntimeName(sessionId) {
+    const digest = crypto.createHash('sha256')
+        .update(canonicalHome())
+        .update('\0')
+        .update(sessionId)
+        .digest('hex')
+        .slice(0, 24);
+    return `ec-session-${digest}`;
 }
-/** Whether a task-provided runtime directory stays inside the process-managed
- * TMPDIR and is safe to use for transient writes. */
+/**
+ * Windows Codex sandbox accounts and ordinary runner accounts are members of
+ * BUILTIN\Users. Session isolation is enforced by the distinct path plus the
+ * runner filesystem policy, so the runtime directory only needs a portable
+ * writable ACL rather than host-user secrecy.
+ */
+function ensureWindowsSessionRuntimeAccess(directory) {
+    if (process.platform !== 'win32' || preparedWindowsSessionRuntimeDirs.has(directory))
+        return;
+    const icacls = path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'System32', 'icacls.exe');
+    execFileSync(icacls, [
+        directory,
+        '/grant',
+        '*S-1-5-32-545:(OI)(CI)M',
+        '/Q',
+    ], { windowsHide: true, stdio: 'pipe' });
+    preparedWindowsSessionRuntimeDirs.add(directory);
+}
+/** Whether a task-provided runtime directory is a stable EvolCore session root. */
 export function isManagedSessionRuntimeDir(directory, managedRoot) {
-    const tmpDir = (managedRoot ?? process.env.TMPDIR)?.trim();
-    if (!directory || !path.isAbsolute(directory) || !tmpDir || !path.isAbsolute(tmpDir))
+    if (!directory || !path.isAbsolute(directory))
         return false;
-    const root = path.resolve(tmpDir);
     const resolved = path.resolve(directory);
-    const relative = path.relative(root, resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+    const suppliedRoot = managedRoot?.trim();
+    const candidateRoot = suppliedRoot && path.isAbsolute(suppliedRoot)
+        ? path.resolve(suppliedRoot)
+        : systemTempRoot();
+    const root = candidateRoot === resolved ? path.dirname(resolved) : candidateRoot;
+    if (path.dirname(resolved) !== root || !/^ec-session-[a-f0-9]{24}$/.test(path.basename(resolved)))
+        return false;
+    try {
+        const rootStat = fs.lstatSync(root);
+        if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+            return false;
+    }
+    catch {
         return false;
-    return isPrivateDirectory(root) && isPrivateDirectory(resolved);
+    }
+    return isPrivateDirectory(resolved);
 }
 /**
  * Resolve the session-owned temporary root for a managed child process.
@@ -241,58 +299,43 @@ export function getManagedTaskTempDir(runtimeEnv) {
         && (!processRoot || !path.isAbsolute(processRoot) || path.resolve(configured) !== path.resolve(processRoot))
         && contextDir
         && path.resolve(contextDir) === path.resolve(configured)
-        && (isManagedSessionRuntimeDir(configured) || isRunnerOwnedSessionRuntimeDir(configured));
+        && isManagedSessionRuntimeDir(configured);
     if (!trusted) {
         throw new Error('managed session TMPDIR is unavailable or untrusted');
     }
     return path.resolve(configured);
 }
 /**
- * Create a private runtime directory below the process-provided TMPDIR.
- * There is deliberately no os.tmpdir() fallback: managed sessions must not
- * silently escape the session-owned temporary workspace.
+ * Create the stable private runtime directory for one EvolCore session.
+ * Its identity is independent of daemon/runner lifetimes and rotates only
+ * when EvolCore creates a new session id.
  */
 export function ensureSessionRuntimeDir(sessionId) {
     if (!sessionId)
         return undefined;
-    let base = process.env.TMPDIR?.trim();
-    try {
-        if (!base || !path.isAbsolute(base) || !isPrivateDirectory(path.resolve(base))) {
-            base = ensureProcessManagedTempDir();
-        }
-    }
-    catch {
-        return undefined;
-    }
-    if (!base || !path.isAbsolute(base))
-        return undefined;
-    const root = path.resolve(base);
-    const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
-    const directory = path.join(root, `evolcore-runtime-${digest}`);
+    const root = systemTempRoot();
+    const directory = path.join(root, sessionRuntimeName(sessionId));
     try {
         fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-        if (!isPrivateDirectory(root))
-            return undefined;
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        ensureWindowsSessionRuntimeAccess(directory);
         fs.mkdirSync(path.join(directory, 'locks'), { recursive: true, mode: 0o700 });
-        return isManagedSessionRuntimeDir(directory) ? directory : undefined;
+        return isManagedSessionRuntimeDir(directory, root) ? directory : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Shared by tasks in one daemon runtime, while remaining outside each
- * session's history/files area. The caller must still pass this path through
- * the task environment before a sandboxed child can use it. */
+/** Return the lock namespace inside the session-owned runtime directory. */
 export function ensureRuntimeLockDir(sessionRuntimeDir) {
     if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
         return undefined;
-    if (!isManagedSessionRuntimeDir(sessionRuntimeDir) && !isRunnerOwnedSessionRuntimeDir(sessionRuntimeDir))
+    if (!isManagedSessionRuntimeDir(sessionRuntimeDir))
         return undefined;
-    const parent = path.dirname(path.resolve(sessionRuntimeDir));
+    const parent = path.resolve(sessionRuntimeDir);
     if (!isPrivateDirectory(parent))
         return undefined;
-    const directory = path.join(parent, 'evolcore-locks');
+    const directory = path.join(parent, 'locks');
     try {
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
         return isPrivateDirectory(directory) ? directory : undefined;
@@ -325,7 +368,7 @@ export function parseTaskRuntimeContext(raw) {
 export function readTaskRuntimeContextFromEnv(env = process.env) {
     return parseTaskRuntimeContext(env[TASK_RUNTIME_CONTEXT_ENV]);
 }
-export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500) {
+export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500, env = process.env) {
     if (!sessionId)
         return undefined;
     try {
@@ -333,7 +376,12 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
             import('../paths.js'),
             import('../ipc.js'),
         ]);
-        const response = await ipcQuery(resolvePaths().socket, { type: 'task-runtime-context', sessionId }, timeoutMs);
+        const response = await ipcQuery(resolvePaths().socket, {
+            type: 'task-runtime-context',
+            sessionId,
+            delegationToken: readDelegationCredential(env),
+            daemonRuntimeEpoch: env[DAEMON_RUNTIME_EPOCH_ENV],
+        }, timeoutMs);
         return response?.ok && response.context ? response.context : undefined;
     }
     catch {
@@ -343,7 +391,7 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
 export async function readBestTaskRuntimeContext(env = process.env) {
     const envContext = readTaskRuntimeContextFromEnv(env);
     const sessionId = env.EVOLCORE_SESSION_ID || envContext?.sessionId;
-    return (await readTaskRuntimeContextFromDaemon(sessionId)) ?? envContext;
+    return (await readTaskRuntimeContextFromDaemon(sessionId, 500, env)) ?? envContext;
 }
 export function buildTaskRuntimeEnv(ctx) {
     const clean = normalizeTaskRuntimeContext(ctx);

package/dist/cli/trigger-command.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
 import { isHelpFlag, wantsHelp } from './help.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { readTaskRuntimeContextFromEnv } from './task-context.js';
 import { normalizeTriggerDefinition, resolveScriptPath, } from '../trigger/validation.js';
 export async function cmdTrigger(args) {
@@ -81,62 +81,65 @@ export async function cmdTrigger(args) {
     }
 }
 function printHelp() {
-    console.log(`用法: ec trigger <subcommand>
-
-命令:
-  list [--agent <aid>] [--all] [--json]
-  show [--agent <aid>] <triggerId> [--json]
-  history [--agent <aid>] [triggerId] [--limit <n>] [--json]
-  create --exec <script|trigger-session|target-session> --file <trigger.json|trigger-dir> [--enable] [--json]
-    OR
-  create [--agent <aid>] --exec <script|trigger-session|target-session> --cron <expr>|--event <pattern> (--prompt <text>|--prompt-file <path>) [--enable] [其他flag]
-  set ...  (create 的兼容别名)
-  update [--agent <aid>] <triggerId> <参数...> [--if-revision <sha256:...>] [--json]
-  enable [--agent <aid>] <triggerId>
-  disable [--agent <aid>] <triggerId>
-  cancel [--agent <aid>] <triggerId>  (disable 的兼容别名)
-  delete|remove|rm [--agent <aid>] <triggerId>
-  run [--agent <aid>] <triggerId> [--dry-run] [--json]
-  template list|show <name> [--json]
-
-Create 参数模式支持:
-  --once | --delay <时长> | --at <ISO时间> | --cron <表达式> | --every <时长> | --event <事件模式>
-  --exec <script|trigger-session|target-session>  (必填)
-  --prompt <文本> | --prompt-file <路径>
-    Shell 双引号内的双引号、反引号和变量形式的美元符号都需在前面加反斜杠；trigger 保存的是还原后的原文
-  --script-path <路径> --script-runtime <node|python|bash>
-  --script-args <JSON> --script-timeout <时长>
-  --feedback <target>  (origin/silent 仅可通过 --file 导入)
-  --baseagent <name>  (仅 --exec trigger-session)
-  --model <模型>  --effort <low|medium|high|xhigh|max>
-  --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
-  --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
-  --tz <时区> (仅 cron)
-  --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
-  --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)
-  --target-session <main|thread> [--target-thread-id <threadId>]
-  --trigger-thread <by-run|by-trigger>  (兼容旧值 per-run)
-  --name <名称>
-
-通用输出参数:
-  --json | --format json
-
-Update 参数:
-  --once | --delay | --at | --cron | --every | --event [--tz]
-  --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
-  --description <文本>  (空字符串删除)
-  --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
-  --max-runs <次数>  --max-duration <时长>
-  --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
-  --feedback <origin|target|silent>
-  --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
-  --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
-  --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
-  --on-error <fail|retry>  --noop-sentinel <文本>
-  --retry-attempts <次数>  --retry-backoff <毫秒>
-  --script-runtime <node|python|bash>  --script-args <JSON>  --script-timeout <时长>
-
-省略 --agent 时使用当前 agent AID；无会话上下文或跨身份操作时需要显式指定。
+    console.log(`用法: ec trigger <subcommand>
+
+命令:
+  list [--agent <aid>] [--all] [--json]
+  show [--agent <aid>] <triggerId> [--json]
+  history [--agent <aid>] [triggerId] [--limit <n>] [--json]
+  create --exec <script|trigger-session|target-session> --file <trigger.json|trigger-dir> [--enable] [--json]
+    OR
+  create [--agent <aid>] --exec <script|trigger-session|target-session> --cron <expr>|--event <pattern> (--prompt <text>|--prompt-file <path>) [--enable] [其他flag]
+  set ...  (create 的兼容别名)
+  update [--agent <aid>] <triggerId> <参数...> [--if-revision <sha256:...>] [--json]
+  enable [--agent <aid>] <triggerId>
+  disable [--agent <aid>] <triggerId>
+  cancel [--agent <aid>] <triggerId>  (disable 的兼容别名)
+  delete|remove|rm [--agent <aid>] <triggerId>
+  run [--agent <aid>] <triggerId> [--dry-run] [--json]
+  template list|show <name> [--json]
+
+Create 参数模式支持:
+  --once | --delay <时长> | --at <ISO时间> | --cron <表达式> | --every <时长> | --event <事件模式>
+  --event-filter <JSON>  (仅 --event；按事件 payload 字段匹配)
+  --exec <script|trigger-session|target-session>  (必填)
+  --prompt <文本> | --prompt-file <路径>
+    Shell 双引号内的双引号、反引号和变量形式的美元符号都需在前面加反斜杠；trigger 保存的是还原后的原文
+  --script-path <路径> --script-runtime <node|python|bash>
+  --script-args <JSON> --script-timeout <时长>
+  --feedback <target|event-session>  (event-session 使用事件来源会话)
+  --baseagent <name>  (仅 --exec trigger-session)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
+  --model <模型>  --effort <low|medium|high|xhigh|max>
+  --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
+  --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
+  --tz <时区> (仅 cron)
+  --target-channel <channelKey> --target-channel-id <ID>  (AUN 可简写为 aun)
+  --target-chat-type <private|group>  (AUN 目标必填；channelId 同时作为群聊 ID)
+  --target-session <main|thread> [--target-thread-id <threadId>]
+  --trigger-thread <by-run|by-trigger>  (兼容旧值 per-run)
+  --name <名称>
+
+通用输出参数:
+  --json | --format json
+
+Update 参数:
+  --once | --delay | --at | --cron | --every | --event [--tz]
+  --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
+  --description <文本>  (空字符串删除)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
+  --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
+  --max-runs <次数>  --max-duration <时长>
+  --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
+  --feedback <origin|target|event-session|silent>
+  --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
+  --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
+  --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
+  --on-error <fail|retry>  --noop-sentinel <文本>
+  --retry-attempts <次数>  --retry-backoff <毫秒>
+  --script-runtime <node|python|bash>  --script-args <JSON>  --script-timeout <时长>
+
+省略 --agent 时使用当前 agent AID；无会话上下文或跨身份操作时需要显式指定。
 任务会话中的跨身份操作仅允许目标 Agent 上具备 owner/admin 权限的调用者执行 list/show/history；创建、修改、启停、删除和运行仍只允许当前 Agent。`);
 }
 async function listTriggers(args, json) {
@@ -189,6 +192,7 @@ async function showTrigger(args, json) {
     if (t.execution.type === 'script')
         console.log(`script: ${scriptCommandLabel(t.execution.script)}`);
     console.log(`model: ${t.execution.model ?? 'inherit'}`);
+    console.log(`executionTimeoutMs: ${t.execution.timeoutMs ?? 'default'}`);
     console.log(`effort: ${t.execution.effort ?? 'inherit'}`);
     console.log(`permission: ${t.execution.permissionMode ?? 'inherit'}`);
     console.log(`feedback: ${t.feedback.strategy}${t.feedback.target ? ` -> ${t.feedback.target.channelKey}/${t.feedback.target.channelId}/${t.feedback.target.session}` : ''}`);
@@ -266,13 +270,14 @@ async function createTrigger(args, json) {
     }
     const parsed = parseResult.value;
     const agentAid = parsed.agentId ?? resolveAgentAid(args);
-    if (parsed.feedbackStrategy !== 'target') {
+    const eventSession = parsed.feedbackStrategy === 'event_session';
+    if (parsed.feedbackStrategy !== 'target' && !eventSession) {
         throw new Error('CLI flag 模式仅支持 --feedback target；origin/silent 请使用 /trigger 或 --file 导入 Trigger V3 第二阶段 JSON');
     }
-    if (!parsed.targetChannel || !parsed.targetChannelId) {
+    if (!eventSession && (!parsed.targetChannel || !parsed.targetChannelId)) {
         throw new Error('CLI flag 模式需要显式指定 --target-channel <channelKey> --target-channel-id <id>');
     }
-    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel.startsWith('aun#');
+    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel?.startsWith('aun#');
     if (targetIsAun && !parsed.targetChatType) {
         throw new Error('AUN 目标必须显式指定 --target-chat-type private 或 group');
     }
@@ -299,6 +304,7 @@ async function createTrigger(args, json) {
             type: parsed.executionType,
             ...(script ? { script } : { prompt: parsed.prompt }),
             ...(parsed.model ? { model: parsed.model } : {}),
+            ...(parsed.executionTimeoutMs !== undefined ? { timeoutMs: parsed.executionTimeoutMs } : {}),
             ...(parsed.effort ? { effort: parsed.effort } : {}),
             ...(parsed.permissionMode ? { permissionMode: parsed.permissionMode } : {}),
             ...(parsed.executionType === 'trigger_session' ? {
@@ -308,7 +314,7 @@ async function createTrigger(args, json) {
             onError: 'retry',
             noopSentinel: '[[NOOP]]',
         },
-        feedback: {
+        feedback: eventSession ? { strategy: 'event_session' } : {
             strategy: 'target',
             target: {
                 channelKey: parsed.targetChannel,
@@ -362,8 +368,12 @@ function sourceFromParsed(parsed) {
     }
     if (parsed.scheduleType === 'interval')
         return { type: 'interval', everyMs: Number(parsed.scheduleValue) };
-    if (parsed.scheduleType === 'event')
-        return { type: 'event', eventPattern: parsed.scheduleValue };
+    if (parsed.scheduleType === 'event') {
+        const source = { type: 'event', eventPattern: parsed.scheduleValue };
+        if (parsed.eventFilter !== undefined)
+            source.filter = parsed.eventFilter;
+        return source;
+    }
     throw new Error(`unsupported scheduleType: ${parsed.scheduleType}`);
 }
 function executionTypeFromFlag(args) {
@@ -565,7 +575,7 @@ function handleTemplate(args) {
 }
 async function request(cmd, timeoutMs = 10_000) {
     const actorSessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     let controlToken;
     if (!actorSessionId) {
         try {

package/dist/config/builtin-roles.js

@@ -34,6 +34,7 @@ export function getManagementCommandPermissions(role) {
         'contact.read': { allow: true, scopes: ['agent'] },
         'contact.add': { allow: true, scopes: ['relation'], constraints: { ownPeerOnly: true, privateOnly: true } },
         'contact.block': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
+        'contact.review': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'connect.write': { allow: true, scopes: ['agent'], constraints: { requireAgentAdmin: true } },
         'connect.access.write': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
         'role.assign': { allow: true, scopes: ['agent'] },
@@ -43,6 +44,16 @@ export function getManagementCommandPermissions(role) {
         'agent.baseagent.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'observable.current': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
         'observable.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.agent': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.storage': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.list': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.query': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.fetch': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.quota': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.relation': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.list': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.query': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.fetch': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
         'config.get': { allow: true, scopes: ['agent', 'relation'] },
         'config.set': { allow: true, scopes: ['agent', 'relation'] },
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },

package/dist/config/config-field-policy.js

@@ -29,14 +29,25 @@ const BASEAGENT_BEHAVIOR_FIELDS = new Set([
     'useVertex',
 ]);
 const SUPPORTED_BASEAGENTS = new Set(['claude', 'codex', 'gemini', 'ecagent']);
+/** Public behavior fields for a runner this version does not implement. */
+export function isUnsupportedBaseagentConfigField(fieldPath) {
+    const parts = fieldPath.split('.');
+    return parts.length === 3
+        && parts[0] === 'baseagents'
+        && /^[a-z][a-z0-9_-]*$/.test(parts[1])
+        && !SUPPORTED_BASEAGENTS.has(parts[1])
+        && BASEAGENT_BEHAVIOR_FIELDS.has(parts[2]);
+}
 const SENSITIVE_TOP_FIELDS = new Set([
     '$schema_version',
     'aid',
     'enabled',
     'lifecycle',
     'initialized',
+    'initialization',
     'owners',
     'access',
+    'fullaccess',
     'admins',
     'channels',
     'aun',

package/dist/config/config-manager.js

@@ -19,7 +19,8 @@ import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { normalizeAidDomain } from '../aun/aid/domain.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { ensureRelationSharedDirectory } from '../core/relation/shared-data.js';
 import { parseContactAlias } from './contact-alias.js';
 import { loadSchema, listSchemaVersions, currentVersion, isSchemaName, } from './schema-registry.js';
 import { mergeLayers, expandVars, buildEnvResolver } from './merge.js';
@@ -881,6 +882,9 @@ export function write(target, value, sel, opts = {}) {
     }
     // 2. 写入文件
     fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (target === ConfigTarget.Relation && sel?.self && sel.peerKey) {
+        ensureRelationSharedDirectory(sel.self, sel.peerKey);
+    }
     atomicWriteJson(file, normalized);
     finishConfigWrite(target, sel, file);
 }
@@ -1291,6 +1295,27 @@ export function resolveAgentConfig(sel, opts = {}) {
         stripRelationRoleData(stripStaticOwnerField(relationConfig)),
     ];
     const merged = mergeLayers(layers, fields);
+    // A baseagent block is a configuration record rather than an atomic value:
+    // selecting a model at Agent or relation scope must retain the defaults
+    // gateway credentials and endpoint. Keep the generic dictionary merge
+    // contract unchanged for every other field.
+    merged.baseagents = mergeBaseagentBlocks(layers);
+    return merged;
+}
+function mergeBaseagentBlocks(layers) {
+    const merged = {};
+    for (const layer of layers) {
+        const baseagents = layer?.baseagents;
+        if (!baseagents || typeof baseagents !== 'object' || Array.isArray(baseagents))
+            continue;
+        for (const [name, rawBlock] of Object.entries(baseagents)) {
+            if (!rawBlock || typeof rawBlock !== 'object' || Array.isArray(rawBlock)) {
+                merged[name] = rawBlock;
+                continue;
+            }
+            merged[name] = { ...(merged[name] ?? {}), ...rawBlock };
+        }
+    }
     return merged;
 }
 /**
@@ -1326,12 +1351,13 @@ function stripStaticOwnerField(config) {
     if (!Object.prototype.hasOwnProperty.call(config, 'owners')
         && !Object.prototype.hasOwnProperty.call(config, 'admins')
         && !Object.prototype.hasOwnProperty.call(config, 'access')
-        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions'))
+        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions')
+        && !Object.prototype.hasOwnProperty.call(config, 'fullaccess'))
         return config;
-    // groupSlashRequireMentions is intentionally Agent-only. Relation/defaults
+    // fullaccess and groupSlashRequireMentions are Agent-only. Relation/defaults
     // files allow forward-compatible unknown properties, so strip it before the
     // generic merge chain can treat a manually written value as an override.
-    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, ...rest } = config;
+    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, fullaccess: _fullaccess, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -1354,7 +1380,9 @@ export function resolveEffective(sel, opts = {}) {
         enabled: config.enabled,
         lifecycle: config.lifecycle,
         initialized: config.initialized,
+        initialization: config.initialization,
         owners: config.owners,
+        fullaccess: config.fullaccess,
         aun: config.aun,
         channels: config.channels ?? [],
         models: config.models,