evolcore 0.0.25 → 0.0.27

package/dist/core/command/data-root-resolver.js

@@ -0,0 +1,273 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { isValidAid } from '../../aun/aid/validation.js';
+import { isExplicitGroupId } from '../../aun/group/index.js';
+import { isStaticAgentOwner } from '../../config/peer-role-resolver.js';
+import { agentDir, agentRelationSharedDir } from '../../paths.js';
+import { formatPeerKey } from '../relation/peer-identity.js';
+export class DataRootError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.name = 'DataRootError';
+        this.code = code;
+        this.data = data;
+    }
+}
+const DEFAULT_ROOT_TTL_MS = 10 * 60 * 1000;
+const TOKEN_PREFIX = 'dr1';
+function base64Url(value) {
+    return Buffer.from(value).toString('base64url');
+}
+function isInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function authenticatedPrincipal(subject) {
+    const principalId = String(subject.principalId ?? '').trim();
+    if (!isValidAid(principalId) || isExplicitGroupId(principalId)) {
+        throw new DataRootError('ROOT_FORBIDDEN', 'A verified private AUN principal is required');
+    }
+    return principalId;
+}
+export class DataRootResolver {
+    secret;
+    ttlMs;
+    now;
+    isOwner;
+    resolveAgentPath;
+    resolveRelationSharedPath;
+    constructor(options = {}) {
+        this.secret = options.secret ?? crypto.randomBytes(32);
+        if (this.secret.length < 32)
+            throw new Error('Data root signing secret must be at least 32 bytes');
+        this.ttlMs = options.ttlMs ?? DEFAULT_ROOT_TTL_MS;
+        this.now = options.now ?? (() => Date.now());
+        this.isOwner = options.isOwner ?? isStaticAgentOwner;
+        this.resolveAgentPath = options.resolveAgentPath ?? agentDir;
+        this.resolveRelationSharedPath = options.resolveRelationSharedPath ?? agentRelationSharedDir;
+    }
+    issueAgentRoot(subject) {
+        const targetAid = this.targetAid(subject);
+        const principalId = authenticatedPrincipal(subject);
+        if (subject.role !== 'owner' || !this.isOwner(targetAid, principalId)) {
+            throw new DataRootError('ROOT_FORBIDDEN', 'Agent data root requires Agent owner permission');
+        }
+        const rootPath = this.canonicalRoot(this.resolveAgentPath(targetAid), undefined);
+        return this.issueDescriptor({ scope: 'agent', targetAid, principalId }, rootPath);
+    }
+    issueRelationRoot(subject, requestedPeerAid) {
+        const targetAid = this.targetAid(subject);
+        this.assertPrivateAun(subject);
+        const principalId = authenticatedPrincipal(subject);
+        const owner = subject.role === 'owner' && this.isOwner(targetAid, principalId);
+        const explicitPeerAid = typeof requestedPeerAid === 'string' ? requestedPeerAid.trim() : '';
+        if (requestedPeerAid !== undefined && !explicitPeerAid) {
+            throw new DataRootError('INVALID_ARGUMENT', 'args.peerAid must be a non-empty AUN AID');
+        }
+        if (explicitPeerAid && !owner) {
+            throw new DataRootError('ROOT_FORBIDDEN', 'Only the Agent owner may select another relation');
+        }
+        const peerAid = explicitPeerAid || principalId;
+        if (!isValidAid(peerAid) || isExplicitGroupId(peerAid)) {
+            throw new DataRootError('INVALID_ARGUMENT', 'args.peerAid must identify an AUN private-chat peer');
+        }
+        const peerKey = formatPeerKey('aun', peerAid);
+        const agentRoot = this.canonicalRoot(this.resolveAgentPath(targetAid), undefined);
+        const rootPath = this.canonicalRoot(this.resolveRelationSharedPath(targetAid, peerKey), agentRoot);
+        return this.issueDescriptor({ scope: 'relation', targetAid, principalId, peerAid, peerKey }, rootPath);
+    }
+    resolveRoot(rootId, subject) {
+        const claims = this.verifyToken(rootId);
+        const targetAid = this.targetAid(subject);
+        const principalId = authenticatedPrincipal(subject);
+        if (claims.targetAid !== targetAid) {
+            throw new DataRootError('ROOT_SCOPE_MISMATCH', 'Root does not belong to the receiving Agent');
+        }
+        if (claims.principalId !== principalId) {
+            throw new DataRootError('ROOT_FORBIDDEN', 'Root was issued to another authenticated principal');
+        }
+        let rootPath;
+        if (claims.scope === 'agent') {
+            if (subject.role !== 'owner' || !this.isOwner(targetAid, principalId)) {
+                throw new DataRootError('ROOT_FORBIDDEN', 'Agent data root requires Agent owner permission');
+            }
+            rootPath = this.canonicalRoot(this.resolveAgentPath(targetAid), undefined);
+        }
+        else {
+            this.assertPrivateAun(subject);
+            if (!claims.peerAid || !claims.peerKey || claims.peerKey !== formatPeerKey('aun', claims.peerAid)) {
+                throw new DataRootError('ROOT_SCOPE_MISMATCH', 'Relation root claims are invalid');
+            }
+            const owner = subject.role === 'owner' && this.isOwner(targetAid, principalId);
+            if (!owner && principalId !== claims.peerAid) {
+                throw new DataRootError('ROOT_PEER_MISMATCH', 'Only the relation peer may use this root');
+            }
+            const agentRoot = this.canonicalRoot(this.resolveAgentPath(targetAid), undefined);
+            rootPath = this.canonicalRoot(this.resolveRelationSharedPath(targetAid, claims.peerKey), agentRoot);
+        }
+        const revision = this.rootRevision(rootPath);
+        if (revision !== claims.revision) {
+            throw new DataRootError('ROOT_SCOPE_MISMATCH', 'Root identity changed; request a new root');
+        }
+        return {
+            scope: claims.scope,
+            targetAid,
+            ...(claims.peerAid ? { peerAid: claims.peerAid } : {}),
+            ...(claims.peerKey ? { peerKey: claims.peerKey } : {}),
+            rootPath,
+            revision,
+            expiresAt: claims.expiresAt,
+        };
+    }
+    resolvePath(rootId, subject, input, expectType) {
+        const root = this.resolveRoot(rootId, subject);
+        const raw = String(input ?? '').trim();
+        if (!raw)
+            throw new DataRootError('INVALID_ROOT_PATH', 'A root-relative path is required');
+        if (raw.includes('\0'))
+            throw new DataRootError('INVALID_ROOT_PATH', 'NUL is not allowed in a path');
+        if (path.isAbsolute(raw) || path.win32.isAbsolute(raw) || path.posix.isAbsolute(raw)) {
+            throw new DataRootError('INVALID_ROOT_PATH', 'Data root paths must be relative');
+        }
+        if (raw.split(/[\\/]+/).includes('..')) {
+            throw new DataRootError('INVALID_ROOT_PATH', 'Parent traversal is not allowed');
+        }
+        const lexicalPath = path.resolve(root.rootPath, raw);
+        if (!isInside(root.rootPath, lexicalPath)) {
+            throw new DataRootError('INVALID_ROOT_PATH', 'Path escapes the data root');
+        }
+        let realPath;
+        let stat;
+        try {
+            realPath = fs.realpathSync(lexicalPath);
+            stat = fs.statSync(realPath);
+        }
+        catch {
+            throw new DataRootError('NOT_FOUND', 'File or directory does not exist');
+        }
+        if (!isInside(root.rootPath, realPath)) {
+            throw new DataRootError('INVALID_ROOT_PATH', 'Symbolic link escapes the data root');
+        }
+        if (expectType === 'file' && !stat.isFile()) {
+            throw new DataRootError('NOT_SUPPORTED', 'Path is not a regular file');
+        }
+        if (expectType === 'directory' && !stat.isDirectory()) {
+            throw new DataRootError('NOT_A_DIRECTORY', 'Path is not a directory');
+        }
+        const relativePath = path.relative(root.rootPath, realPath).split(path.sep).join('/') || '.';
+        return { ...root, realPath, relativePath, stat };
+    }
+    issueDescriptor(base, rootPath) {
+        const issuedAt = this.now();
+        const claims = {
+            v: 1,
+            ...base,
+            revision: this.rootRevision(rootPath),
+            issuedAt,
+            expiresAt: issuedAt + this.ttlMs,
+            nonce: crypto.randomBytes(12).toString('base64url'),
+        };
+        return {
+            rootId: this.sign(claims),
+            scope: claims.scope,
+            targetAid: claims.targetAid,
+            ...(claims.peerAid ? { peerAid: claims.peerAid } : {}),
+            ...(claims.peerKey ? { peerKey: claims.peerKey } : {}),
+            virtualPath: claims.scope === 'agent'
+                ? '$AGENTS_DIR/<targetAid>'
+                : '$AGENTS_DIR/<targetAid>/relations/<peerKey>/shared',
+            revision: `sha256:${claims.revision}`,
+            expiresAt: claims.expiresAt,
+            readOnly: true,
+            capabilities: { list: true, query: true, fetch: true },
+        };
+    }
+    sign(claims) {
+        const encoded = base64Url(JSON.stringify(claims));
+        const signature = crypto.createHmac('sha256', this.secret).update(encoded).digest('base64url');
+        return `${TOKEN_PREFIX}.${encoded}.${signature}`;
+    }
+    verifyToken(value) {
+        if (typeof value !== 'string' || !value.trim()) {
+            throw new DataRootError('MISSING_ROOT_ID', 'A data rootId is required');
+        }
+        const parts = value.split('.');
+        if (parts.length !== 3 || parts[0] !== TOKEN_PREFIX) {
+            throw new DataRootError('INVALID_ROOT_ID', 'Invalid data rootId');
+        }
+        const expected = crypto.createHmac('sha256', this.secret).update(parts[1]).digest();
+        let actual;
+        try {
+            actual = Buffer.from(parts[2], 'base64url');
+        }
+        catch {
+            throw new DataRootError('INVALID_ROOT_ID', 'Invalid data rootId');
+        }
+        if (actual.length !== expected.length || !crypto.timingSafeEqual(actual, expected)) {
+            throw new DataRootError('INVALID_ROOT_ID', 'Invalid data rootId signature');
+        }
+        let claims;
+        try {
+            claims = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        }
+        catch {
+            throw new DataRootError('INVALID_ROOT_ID', 'Invalid data rootId payload');
+        }
+        if (claims.v !== 1
+            || (claims.scope !== 'agent' && claims.scope !== 'relation')
+            || typeof claims.targetAid !== 'string'
+            || typeof claims.principalId !== 'string'
+            || typeof claims.revision !== 'string'
+            || !Number.isFinite(claims.expiresAt)) {
+            throw new DataRootError('INVALID_ROOT_ID', 'Invalid data rootId claims');
+        }
+        if (claims.expiresAt <= this.now()) {
+            throw new DataRootError('ROOT_EXPIRED', 'Data rootId expired; query the root again');
+        }
+        return claims;
+    }
+    canonicalRoot(candidate, requiredParent) {
+        let realPath;
+        let stat;
+        try {
+            realPath = fs.realpathSync(candidate);
+            stat = fs.statSync(realPath);
+        }
+        catch {
+            throw new DataRootError('ROOT_NOT_FOUND', 'Data root does not exist');
+        }
+        if (!stat.isDirectory())
+            throw new DataRootError('ROOT_NOT_FOUND', 'Data root is not a directory');
+        if (requiredParent && !isInside(requiredParent, realPath)) {
+            throw new DataRootError('ROOT_SCOPE_MISMATCH', 'Data root escapes the Agent directory');
+        }
+        return realPath;
+    }
+    rootRevision(rootPath) {
+        const stat = fs.statSync(rootPath);
+        return crypto.createHash('sha256')
+            .update(JSON.stringify({ rootPath, dev: stat.dev, ino: stat.ino, birthtimeMs: stat.birthtimeMs }))
+            .digest('hex');
+    }
+    targetAid(subject) {
+        const targetAid = String(subject.selfAid ?? '').trim();
+        if (!isValidAid(targetAid))
+            throw new DataRootError('ROOT_FORBIDDEN', 'Receiving Agent AID is unavailable');
+        return targetAid;
+    }
+    assertPrivateAun(subject) {
+        if (subject.channelType !== 'aun' || subject.chatType !== 'private') {
+            throw new DataRootError('NOT_SUPPORTED', 'Relation data roots currently support AUN private chats only');
+        }
+    }
+}
+export const dataRootResolver = new DataRootResolver();
+export function dataRootFailure(error) {
+    if (error instanceof DataRootError) {
+        return { error: error.message, code: error.code, ...(error.data ? { data: error.data } : {}) };
+    }
+    return { error: 'Internal data root error', code: 'INTERNAL_ERROR' };
+}

package/dist/core/command/diag-service.js

@@ -0,0 +1,118 @@
+import { isValidAid } from '../../aun/aid/validation.js';
+import { remoteAccessService } from '../auth/remote-access-store.js';
+export const DIAGNOSTIC_AGENT_AID = 'diag.agentid.cn';
+/** IPC verifies local control authority; managed calls must independently prove their actor. */
+export async function executeDiagIpc(service, registry, owners, cmd) {
+    if (cmd.sessionId !== undefined) {
+        if (typeof cmd.sessionId !== 'string' || !cmd.sessionId)
+            return { ok: false, code: 'INVALID_SESSION', message: '无效托管会话' };
+        const auth = registry.validate(cmd.delegationToken, cmd.sessionId, cmd.delegationCommandHash);
+        if (!auth.ok)
+            return { ok: false, code: auth.code, message: auth.reason };
+        if (auth.grant.channelType !== 'aun' || !owners.includes(auth.grant.actorId))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '托管诊断发起需要本机 AUN DaemonOwner' };
+    }
+    try {
+        if (!Array.isArray(cmd.argv) || cmd.argv.some((v) => typeof v !== 'string'))
+            throw new Error('Invalid diag argv');
+        return await service.execute(parseDiagArgs(cmd.argv));
+    }
+    catch (error) {
+        return { ok: false, code: error.code ?? 'INVALID_ARGUMENT', message: error.message };
+    }
+}
+export function parseDiagArgs(args) {
+    const words = [];
+    let ownerAid;
+    let literal = false;
+    for (let i = 0; i < args.length; i++) {
+        const word = args[i];
+        if (!literal && word === '--') {
+            literal = true;
+            continue;
+        }
+        if (!literal && word === '--owner') {
+            if (ownerAid || !args[i + 1] || !isValidAid(args[i + 1]))
+                throw new Error('--owner 需要一个有效 AID');
+            ownerAid = args[++i];
+        }
+        else if (!literal && word.startsWith('--'))
+            throw new Error(`不支持的参数：${word}`);
+        else
+            words.push(word);
+    }
+    const problem = words.join(' ').trim();
+    if (problem.toLowerCase() === 'stop') {
+        if (ownerAid)
+            throw new Error('diag stop 不需要指定对象');
+        return { action: 'stop' };
+    }
+    if (!problem || problem.length > 16_000)
+        throw new Error('请提供 1 到 16000 字符的问题描述');
+    return { action: 'start', problem, ...(ownerAid ? { ownerAid } : {}) };
+}
+export class DiagService {
+    context;
+    send;
+    tokens;
+    constructor(context, send, tokens = remoteAccessService) {
+        this.context = context;
+        this.send = send;
+        this.tokens = tokens;
+    }
+    /** Local CLI authority is checked by IPC; slash identity is authenticated AUN peerId. */
+    async execute(command, actorAid) {
+        const { controlAid, owners } = this.context();
+        if (!controlAid || !isValidAid(controlAid))
+            return { ok: false, code: 'CONTROL_AID_REQUIRED', message: '本机尚未配置 Control AID' };
+        if (actorAid !== undefined && !owners.includes(actorAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '只有本机 DaemonOwner 可以发起或停止诊断' };
+        if (command.action === 'stop') {
+            const previous = this.tokens.revokeDiagnosticToken(controlAid);
+            if (!previous)
+                return { ok: true, message: '当前没有诊断授权' };
+            const diag = previous.diagnostic;
+            try {
+                await this.send(diag.agentAid, `诊断授权已取消。目标 daemon：${controlAid}；case：${diag.caseId}；沟通 Owner：${diag.ownerAid}。请停止这次诊断的后续访问，并告知 Owner。`);
+                return { ok: true, message: '诊断授权已撤销，已通知诊断 Agent' };
+            }
+            catch {
+                return { ok: true, code: 'DIAG_STOP_NOTICE_FAILED', message: '诊断授权已撤销；取消通知发送失败，诊断 Agent 后续访问将被拒绝' };
+            }
+        }
+        const ownerAid = actorAid ?? command.ownerAid ?? owners[0];
+        if (!ownerAid || !isValidAid(ownerAid) || !owners.includes(ownerAid))
+            return { ok: false, code: 'DAEMON_OWNER_REQUIRED', message: '请配置本机 owners，或指定其中一个有效 Owner AID' };
+        if (!command.problem?.trim() || command.problem.length > 16_000)
+            return { ok: false, code: 'INVALID_ARGUMENT', message: '请提供 1 到 16000 字符的问题描述' };
+        let record;
+        try {
+            record = this.tokens.issueDiagnosticToken(controlAid, DIAGNOSTIC_AGENT_AID, ownerAid);
+        }
+        catch (error) {
+            return { ok: false, code: error.code ?? 'DIAG_AUTH_FAILED', message: error.message };
+        }
+        const caseId = record.diagnostic.caseId;
+        const invitation = [
+            '请协助诊断以下主机，并主动联系指定 Owner 展示进展、追问和报告。',
+            `目标 daemon Control AID：${controlAid}`, `沟通 Owner AID：${ownerAid}`, `case：${caseId}`,
+            `远程访问 Token：${record.token}`,
+            '请通过标准 Menu 调用诊断；Token 放入 E2EE 受保护头。权限复用该主机既有 Control Menu，包含 restart。有效访问滑动续期，空闲 60 分钟失效。',
+            '先给 Owner 发开始消息，使用通用 handoff 保留目标、Token、问题和发现；无需等待 Owner 回复即可开始。授权失效后停止访问。',
+            `问题描述：\n${command.problem.trim()}`,
+        ].join('\n');
+        try {
+            await this.send(DIAGNOSTIC_AGENT_AID, invitation);
+        }
+        catch (error) {
+            this.tokens.revokeDiagnosticToken(controlAid, record.token);
+            const reason = error instanceof Error ? error.message : String(error);
+            return { ok: false, code: 'DIAG_INVITATION_FAILED', message: `未能确认诊断邀请发送成功：${reason}。本次授权已撤销，请重试` };
+        }
+        // A stop may race with delivery; never report an already revoked grant as active.
+        if (this.tokens.getDiagnosticToken(controlAid)?.token !== record.token)
+            return { ok: false, code: 'DIAG_CANCELLED', message: '邀请发送期间授权已撤销，本次诊断已取消' };
+        return { ok: true, caseId, ownerAid, agentAid: DIAGNOSTIC_AGENT_AID,
+            message: `诊断邀请已发出，远程诊断 Agent 将联系 ${ownerAid}，请在与 ${DIAGNOSTIC_AGENT_AID} 的会话中查看处理过程。` };
+    }
+}

package/dist/core/command/group-menu.js

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 import { ConfigTarget, mutateConfig, read as readConfig, resolveEffectiveFieldWithSource, } from '../../config/config-manager.js';
 import { normalizeMentionMode } from '../../config/mention-mode.js';
 import { readRolesConfig } from '../../config/roles.js';
-import { groupInfo, groupList, groupDirectoryErrorCode } from '../../aun/msg/group.js';
+import { groupInfo, groupList, groupDirectoryErrorCode, normalizeGroupAid } from '../../aun/group/index.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 const DEFAULT_DIRECTORY = {
     getGroup: groupInfo,
@@ -185,7 +185,12 @@ function groupIdFromArgs(args, currentGroupId) {
     if (!groupId) {
         throw new GroupMenuError('INVALID_ARGUMENT', 'relation settings require args.groupId or args.peerKey');
     }
-    return groupId;
+    try {
+        return normalizeGroupAid(groupId);
+    }
+    catch (error) {
+        throw new GroupMenuError('INVALID_ARGUMENT', error.message);
+    }
 }
 function settingOptions(key, target) {
     const state = readSettingState(key, target);

package/dist/core/command/menu-catalog.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { groupInfo, groupMembers } from '../../aun/msg/group.js';
+import { groupInfo, groupMembers } from '../../aun/group/index.js';
 import { formatPeerKey } from '../relation/peer-identity.js';
 import { authorizeAccess, authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { authorizationDenialData, formatAuthorizationDenial } from '../auth/authorization-denial.js';
@@ -8,6 +8,7 @@ import { readRolesConfig } from '../../config/roles.js';
 import { normalizeMenuError } from './menu-protocol.js';
 import { isValidAid } from '../../aun/aid/validation.js';
 const DEFAULT_DIRECTORY = { getGroup: groupInfo, getMembers: groupMembers };
+const HOST_BASEAGENTS = ['claude', 'codex', 'ecagent', 'gemini'];
 export function validateMenuValueBatchArgs(args) {
     if (!args || typeof args !== 'object' || Array.isArray(args))
         throw { code: 'INVALID_ARGUMENT', message: 'batch args must be an object' };
@@ -80,13 +81,14 @@ const ENTRIES = [
     { id: 'activity.agent', type: 'setting', contexts: ['agent'], name: 'activity', label: 'Agent 中间输出', section: 'agent', order: 50, query: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.current', scope: 'agent' }, options: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.current', scope: 'agent' }, update: { cmd: '/activity', args: { scope: 'agent' }, operation: 'activity.update', scope: 'agent' }, control: 'select' },
     { id: 'observable.agent', type: 'setting', contexts: ['agent'], name: 'observable', label: '观察模式', section: 'agent', order: 60, query: { cmd: '/observable', operation: 'observable.current', scope: 'agent' }, update: { cmd: '/observable', operation: 'observable.update', scope: 'agent' }, valueSchema: { type: 'boolean' }, control: 'toggle' },
     { id: 'aid.avatar', type: 'action', contexts: ['agent'], name: 'aid', label: '更换头像', section: 'agent', order: 70, action: { cmd: '/aid', action: 'avatar', operation: 'ec.aid.avatar', scope: 'agent' }, valueSchema: { type: 'object', properties: { data: { type: 'string' }, url: { type: 'string', format: 'uri' } }, oneOf: [{ required: ['data'] }, { required: ['url'] }] }, control: 'action' },
+    { id: 'baseagents.inventory', type: 'list', contexts: ['process'], name: 'baseagents', label: 'Base Agent 清单', section: 'process', order: 9, query: { cmd: '/baseagents', operation: 'system.status', scope: 'process' }, control: 'list' },
     { id: 'system.status', type: 'list', contexts: ['process'], name: 'system', label: '系统状态', section: 'process', order: 10, query: { cmd: '/system', operation: 'system.status', scope: 'process' }, control: 'list' },
     { id: 'system.monitor', type: 'list', contexts: ['process'], name: 'system', label: '运行监控快照', section: 'process', order: 11, query: { cmd: '/system', args: { view: 'monitor' }, operation: 'system.status', scope: 'process' }, control: 'list' },
     { id: 'system.logs', type: 'list', contexts: ['process'], name: 'system', label: 'Daemon 日志', section: 'process', order: 12, query: { cmd: '/system', args: { view: 'logs' }, operation: 'system.status', scope: 'process' }, options: { cmd: '/system', args: { option: 'logs' }, operation: 'system.status', scope: 'process', mode: 'dynamic' }, control: 'list' },
     { id: 'config.rawFile', type: 'list', contexts: ['process'], name: 'config', label: '原始配置文件', section: 'process', order: 13, query: { cmd: '/config', args: { view: 'rawFile' }, operation: 'config.read', scope: 'process' }, options: { cmd: '/config', args: { option: 'rawFile' }, operation: 'config.read', scope: 'process', mode: 'dynamic' }, control: 'list' },
-    { id: 'baseagent.models', type: 'list', contexts: ['process'], name: 'baseagent-models', label: 'Baseagent 模型目录', section: 'process', order: 41, query: { cmd: '/baseagent-models', args: { baseagent: 'claude' }, operation: 'baseagent.models.list', scope: 'process' }, control: 'list' },
     { id: 'system.restart', type: 'action', contexts: ['process'], name: 'system', label: '重启服务', section: 'process', order: 20, action: { cmd: '/system', action: 'restart', operation: 'system.restart', scope: 'process' } },
     { id: 'system.upgrade', type: 'action', contexts: ['process'], name: 'system', label: '升级服务', section: 'process', order: 30, action: { cmd: '/system', action: 'upgrade', operation: 'system.upgrade', scope: 'process' } },
+    { id: 'system.paircode', type: 'action', contexts: ['process'], name: 'system', label: '获取配对码', section: 'process', order: 35, action: { cmd: '/system', action: 'paircode', operation: 'system.paircode', scope: 'process' } },
     { id: 'agent.list', type: 'list', contexts: ['process'], name: 'agent', label: 'Agent 列表', section: 'process', order: 40, options: { cmd: '/agent', args: { options: 'all' }, operation: 'agent.list', scope: 'control', mode: 'dynamic' }, control: 'list' },
     { id: 'agent.create', type: 'action', contexts: ['process'], name: 'agent', label: '创建 Agent', section: 'process', order: 50, action: { cmd: '/agent', action: 'create', operation: 'agent.create', scope: 'control' } },
     { id: 'agent.reload', type: 'action', contexts: ['process'], name: 'agent', label: '重载 Agent', section: 'process', order: 60, action: { cmd: '/agent', action: 'reload', operation: 'agent.reload', scope: 'control' } },
@@ -303,12 +305,47 @@ export async function resolveExplicitMenuExecutionContext(input) {
     };
 }
 function entryVisible(entry, context) { return entry.contexts.includes(context.kind); }
+function configuredHostBaseagentEntries() {
+    const defaults = readConfig(ConfigTarget.Defaults);
+    const configured = defaults?.baseagents;
+    if (!configured || typeof configured !== 'object' || Array.isArray(configured))
+        return [];
+    return HOST_BASEAGENTS
+        .filter(baseagent => {
+        const block = configured[baseagent];
+        return Object.hasOwn(configured, baseagent) && block !== null
+            && typeof block === 'object' && !Array.isArray(block);
+    })
+        .map((baseagent, index) => ({
+        // Value batches only carry entry IDs, so each configured backend gets a
+        // binding with an explicit backend instead of an implicit Claude default.
+        id: `baseagent.models.${baseagent}`,
+        type: 'list',
+        contexts: ['process'],
+        name: 'baseagent-models',
+        label: `${baseagent} 模型目录`,
+        section: 'process',
+        order: 41 + index,
+        query: { cmd: '/baseagent-models', args: { baseagent }, operation: 'baseagent.models.list', scope: 'process' },
+        control: 'list',
+    }));
+}
+function menuEntryDefinitions(context) {
+    return context.kind === 'process' ? [...ENTRIES, ...configuredHostBaseagentEntries()] : ENTRIES;
+}
 function intentFor(binding, context) { return { operation: binding.operation, scope: binding.scope, source: 'menu', args: { ...bindingArgs(binding, context) } }; }
-async function operationView(binding, context) {
+async function operationView(binding, context, options = {}) {
     if (!binding)
         return undefined;
     if (binding.supported === false)
         return { supported: false, allowed: false, reason: { code: 'NOT_SUPPORTED', message: 'operation is not supported' } };
+    if (binding.operation === 'system.paircode' && options.paircodeAllowed === false) {
+        return {
+            supported: true,
+            allowed: false,
+            reason: { code: 'NOT_ALLOWED', message: 'Pairing code issuance requires encrypted DaemonOwner authentication' },
+        };
+    }
     if (binding.operation === 'group.rulespolicy.update' && context.subject.role !== 'owner') {
         return { supported: true, allowed: false, reason: { code: 'PERMISSION_DENIED', message: 'rulesPolicy can only be changed by an Agent owner' } };
     }
@@ -331,16 +368,18 @@ function wireBinding(binding, context) {
 export async function getMenuCatalog(input) {
     const context = await resolveMenuCatalogContext(input);
     const entries = [];
-    for (const entry of ENTRIES.filter(candidate => entryVisible(candidate, context)).sort((a, b) => a.order - b.order)) {
+    const paircodeAllowed = input.paircodeAllowed ?? input.channelScope !== 'control';
+    const definitions = menuEntryDefinitions(context);
+    for (const entry of definitions.filter(candidate => entryVisible(candidate, context)).sort((a, b) => a.order - b.order)) {
         const operations = {};
         for (const [key, binding] of [['query', entry.query], ['options', entry.options], ['update', entry.update], ['action', entry.action]]) {
-            const view = await operationView(binding, context);
+            const view = await operationView(binding, context, { paircodeAllowed });
             if (view)
                 operations[key] = view;
         }
         entries.push({ id: entry.id, type: entry.type, name: entry.name, label: entry.label, section: entry.section, order: entry.order, target: { scope: context.kind === 'agent' ? 'agent' : context.kind === 'process' ? 'process' : 'relation', ...(context.self ? { self: context.self } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}) }, valueSchema: entry.valueSchema ?? { type: 'object' }, operations, wire: { name: entry.name, operations: { ...(wireBinding(entry.query, context) ? { query: wireBinding(entry.query, context) } : {}), ...(wireBinding(entry.options, context) ? { options: wireBinding(entry.options, context) } : {}), ...(wireBinding(entry.update, context) ? { update: wireBinding(entry.update, context) } : {}), ...(wireBinding(entry.action, context) ? { action: wireBinding(entry.action, context) } : {}) } }, ui: { control: entry.control ?? 'action' } });
     }
-    const policyRevision = hash({ role: context.subject.role, self: context.subject.selfAid, peerKey: context.subject.peerKey, groupMembershipRole: context.groupMembershipRole, baselineRole: context.baselineRole, roles: readRolesConfig(context.subject.selfAid) });
+    const policyRevision = hash({ role: context.subject.role, self: context.subject.selfAid, peerKey: context.subject.peerKey, groupMembershipRole: context.groupMembershipRole, baselineRole: context.baselineRole, paircodeAllowed, roles: readRolesConfig(context.subject.selfAid) });
     const data = { $schema_version: 1, kind: 'menu.catalog', complete: true, catalogRevision: hash({ entries, context: context.contextKey, policyRevision }), policyRevision, generatedAt: Date.now(), context: { contextKey: context.contextKey, kind: context.kind, channelScope: context.channelScope, transport: context.transport, chatType: context.chatType, ...(context.self ? { self: context.self } : {}), ...(context.actor ? { actor: context.actor } : {}), ...(context.groupId ? { groupId: context.groupId } : {}), ...(context.peerKey ? { peerKey: context.peerKey } : {}), requesterRole: context.requesterRole, ...(context.groupMembershipRole ? { groupMembershipRole: context.groupMembershipRole } : {}), ...(context.baselineRole !== undefined ? { baselineRole: context.baselineRole } : {}) }, features: { batchValuesV1: true, verifiedExplicitGroupContext: context.kind === 'group_relation' }, entries };
     return data;
 }
@@ -369,7 +408,7 @@ export async function execMenuValueBatch(input) {
         normalizedItems.push({ itemId, entryId });
     }
     const results = new Array(normalizedItems.length);
-    const byId = new Map(ENTRIES.map(entry => [entry.id, entry]));
+    const byId = new Map(menuEntryDefinitions(context).map(entry => [entry.id, entry]));
     let cursor = 0;
     const resolveItem = async (item) => {
         const { itemId, entryId } = item;