evolcore 0.0.25 → 0.0.27

package/dist/core/command/menu-handler.js

@@ -1,3 +1,4 @@
+import { getBaseagentSnapshot, loadedBaseagentIds } from '../../agents/baseagent-availability.js';
 import { normalizePeer, writeScope } from '../model/config-scope.js';
 import { formatPeerKey } from '../relation/peer-identity.js';
 import { modelMatches, getCatalog, getBaseagentCatalog, resolveCatalogModel, assertCatalogSelectable, TRANSPORT_EFFORTS } from '../model/model-catalog.js';
@@ -13,7 +14,7 @@ import crypto from 'crypto';
 import { CronExpressionParser } from 'cron-parser';
 import { parseDuration } from '../../trigger/parser.js';
 import { checkLatestVersion, getLocalVersion, isLinkedInstall, compareVersions, resolveGlobalPkg } from '../../utils/npm-ops.js';
-import { commandExists, resolveCliEntry, launchMonitorAndConfirm } from '../../utils/cross-platform.js';
+import { resolveCliEntry, launchMonitorAndConfirm } from '../../utils/cross-platform.js';
 import { cachedCliVersion } from '../../utils/cross-platform.js';
 import { scanInstances } from '../../utils/instance-registry.js';
 import { isFullAccessEnabled, loadDefaults, loadDaemonConfig } from '../../config-store.js';
@@ -29,6 +30,7 @@ import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../au
 import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { authorizationDenialData, formatAuthorizationDenial } from '../auth/authorization-denial.js';
 import { evaluateRoleOperationCapability } from '../auth/operation-authorizer.js';
+import { isUnsupportedBaseagentConfigField } from '../../config/config-field-policy.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
 import { chatmodeFieldForPeer, resolveChatModeForField } from '../message/peer-mode.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
@@ -40,13 +42,16 @@ import { shouldSuppressRealRestart } from '../../utils/restart-safety.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { evolMenuResponseTransportMetadata, menuFailure, menuCommandForName, menuSuccess, normalizeMenuError, validateConfigWriteScope, validateMenuRequest, } from './menu-protocol.js';
 import { parseMenuClientProtectedHeaders } from './menu-protocol.js';
-import { validateAndRenewRemoteAccessToken } from '../auth/remote-access-store.js';
+import { remoteAccessService, validateAndRenewRemoteAccessToken } from '../auth/remote-access-store.js';
 import { listDiagnosticLogOptions, listRawConfigResources, queryDiagnosticLogs, readRawConfigResource, } from './daemon-diagnostics.js';
 import { roleMenuAction, roleMenuOperation, roleMenuOptions, roleMenuQuery, roleMenuUpdate, } from './role-menu.js';
 import { handleConnectMenu, connectMenuOperation } from './connect-menu.js';
 import { groupMenuAuthorizationArgs, groupMenuIntent, handleGroupMenu, } from './group-menu.js';
 import { getMenuCatalog, execMenuValueBatch, resolveExplicitMenuExecutionContext, validateMenuCatalogArgs, validateMenuValueBatchArgs } from './menu-catalog.js';
 import { probeSessionActivity } from './slash-gate.js';
+import { dataRootFailure, dataRootResolver } from './data-root-resolver.js';
+import { agentStorageMenuService, isAgentStorageMenuRequest } from './agent-storage-menu.js';
+import { isArchivedTopicLable, normalizeTopicLable, resolveTopicArchiveFilter, } from '../session/session-mapper.js';
 /**
  * 获取 baseagent CLI 的版本号（claude/gemini/codex）。
  * 失败返回 null（命令不存在或执行失败）。
@@ -180,6 +185,8 @@ function getRenameName(args) {
 }
 function buildSessionPayload(session, name) {
     const payload = { id: session.id, name };
+    if (session.lable)
+        payload.lable = session.lable;
     if (session.agentSessionId)
         payload.agentSessionId = session.agentSessionId;
     return payload;
@@ -413,7 +420,10 @@ function hostCatalogArgs(args = {}) {
     }
     if (args.refresh !== undefined && typeof args.refresh !== 'boolean')
         invalid('refresh must be a boolean');
-    return { baseagent: menuStringArg(args, 'baseagent') ?? menuStringArg(args, 'ba') ?? 'claude', refresh: args.refresh === true };
+    const baseagent = menuStringArg(args, 'baseagent') ?? menuStringArg(args, 'ba');
+    if (!baseagent)
+        return invalid('baseagent is required (claude / codex / ecagent / gemini)');
+    return { baseagent, refresh: args.refresh === true };
 }
 const LEGACY_SESSION_CONFIG_ARG_KEYS = [
     'session',
@@ -851,7 +861,7 @@ export function isProcessLevelOwner(peerId, owners) {
 // ── 控制面双轨鉴权（见 docs/.../2026-06-10-control-channel-auth-design.md）──
 // 白名单而非黑名单：默认安全，新增进程级 action 需显式加入。
 /** /agent 的进程级 action：仅控制 channel 可执行。 */
-export const PROCESS_LEVEL_AGENT_ACTIONS = new Set(['create', 'delete', 'enable', 'disable']);
+export const PROCESS_LEVEL_AGENT_ACTIONS = new Set(['create', 'initialize', 'delete', 'enable', 'disable']);
 /** /agent 的「本 agent 自管理」action：agent channel 仅 owner/admin 可对自身 aid 执行；update 另行收紧为 owner。 */
 export const SELF_MANAGE_AGENT_ACTIONS = new Set(['update', 'reload']);
 /** 判断 (cmdBase, action) 是否为进程级操作（仅控制 channel 可执行）。
@@ -898,6 +908,10 @@ function gateControlScope(opts) {
     return null;
 }
 function buildMenuIntent(verb, cmdBase, args, action, value, fromControlChannel = false) {
+    if (cmdBase === '/agent-data-root' || cmdBase === '/relation-data-root')
+        return null;
+    if (cmdBase === '/file' && args?.rootId !== undefined)
+        return null;
     const payload = { ...(args ?? {}), ...(value !== undefined ? { value } : {}) };
     const intent = (operation, scope = 'relation', extra) => ({
         operation,
@@ -909,6 +923,9 @@ function buildMenuIntent(verb, cmdBase, args, action, value, fromControlChannel
     if (verb === 'query') {
         if (cmdBase === '/baseagent-models')
             return intent('baseagent.models.list', 'process');
+        if (cmdBase === '/baseagents') {
+            return intent(fromControlChannel ? 'system.status' : 'agent.baseagent.list', fromControlChannel ? 'process' : 'agent');
+        }
         if (cmdBase === '/pwd')
             return intent('project.current', 'relation');
         if (cmdBase === '/session' || cmdBase === '/s')
@@ -1015,12 +1032,19 @@ function buildMenuIntent(verb, cmdBase, args, action, value, fromControlChannel
                 return intent('system.upgrade', 'process', { action });
             if (action === 'check')
                 return intent('system.status', 'process', { action });
+            if (action === 'paircode')
+                return intent('system.paircode', 'process', { action });
         }
         if (cmdBase === '/agent') {
+            if (action === 'update' && args?.patch && Object.hasOwn(args.patch, 'avatar')) {
+                return intent('ec.aid.avatar', 'agent', { action });
+            }
             if (action === 'reload')
                 return intent('agent.reload', fromControlChannel ? 'control' : 'agent', { action });
             if (action === 'create')
                 return intent('agent.create', 'control', { action });
+            if (action === 'initialize')
+                return intent('agent.initialize', 'control', { action });
             if (action === 'delete')
                 return intent('agent.delete', 'control', { action });
             if (action === 'enable')
@@ -1061,6 +1085,7 @@ function buildMenuAuthSubject(owner, params) {
     if (params.subject) {
         return {
             ...params.subject,
+            fromControlChannel: params.fromControlChannel || params.subject.fromControlChannel,
             ...(params.requestId && !params.subject.requestId ? { requestId: params.requestId } : {}),
             ...(params.session?.id && !params.subject.sessionId ? { sessionId: params.session.id } : {}),
         };
@@ -1509,9 +1534,27 @@ export function getMenuItems(role, chatType = 'private', scope = 'agent', authSu
     });
     return items;
 }
+/** All Menu reads and writes must resolve the same transport-scoped topic. */
+async function loadMenuTopicSession(sessionManager, channel, channelId, threadId) {
+    let session;
+    try {
+        if (typeof sessionManager.getThreadSession !== 'function')
+            throw new Error('topic lookup unavailable');
+        session = await sessionManager.getThreadSession(channel, channelId, threadId);
+    }
+    catch (error) {
+        logger.debug(`[MenuHandler] topic session lookup failed: thread=${threadId}: ${error instanceof Error ? error.message : String(error)}`);
+        throw { code: 'TOPIC_SESSION_LOOKUP_FAILED', message: '无法读取话题会话，拒绝回退到主会话' };
+    }
+    if (!session)
+        throw { code: 'TOPIC_SESSION_NOT_FOUND', message: '话题会话不存在，拒绝回退到主会话' };
+    return session;
+}
 /** 动态子菜单：根据 cmd 路径返回选项列表（供 menu.query + cmd 使用） */
-export async function getSubMenuItems(cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel = false, authSubject, source = 'menu') {
-    const session = await this.sessionManager.getActiveSession(channel, channelId);
+export async function getSubMenuItems(cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel = false, authSubject, source = 'menu', transportReplyContext) {
+    const session = transportReplyContext?.threadId
+        ? await loadMenuTopicSession(this.sessionManager, channel, channelId, transportReplyContext.threadId)
+        : await this.sessionManager.getActiveSession(channel, channelId);
     const subject = buildMenuAuthSubject(this, {
         identity: overrideIdentity ?? this.sessionManager.resolveIdentity(channel, userId, ...menuIdentityArgs(session)),
         session,
@@ -1615,19 +1658,23 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
                 : await execAgentOptions(args);
             if ('error' in res)
                 throw { code: res.code, message: res.error };
-            return res.data.agents.map(ag => ({ value: ag.aid, label: ag.name || ag.aid, desc: ag.status }));
+            return res.data.agents.map(ag => ({
+                value: ag.aid, label: ag.name || ag.aid, desc: ag.status, lifecycle: ag.lifecycle ?? null,
+            }));
         }
         // agent channel：直接读取自身，避免先枚举全部 Agent 再过滤。
         const selfAid = this.getOwningAgent?.(channel)?.aid;
         if (!selfAid)
             throw { code: 'FORBIDDEN', message: '当前 channel 无绑定 agent' };
         const res = this.agentApplicationService
-            ? await execAgentQuery({ aid: selfAid }, this.agentApplicationService)
-            : await execAgentQuery({ aid: selfAid });
+            ? await execAgentQuery({ aid: selfAid }, this.agentApplicationService, subject)
+            : await execAgentQuery({ aid: selfAid }, undefined, subject);
         if ('error' in res)
             throw { code: res.code, message: res.error };
         const ag = res.data;
-        return [{ value: ag.aid, label: ag.identity?.name || ag.name || ag.aid, desc: ag.status }];
+        return [{
+                value: ag.aid, label: ag.identity?.name || ag.name || ag.aid, desc: ag.status, lifecycle: ag.lifecycle ?? null,
+            }];
     }
     if (cmd === '/capability') {
         const type = args?.type;
@@ -1683,12 +1730,33 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
                 preview: turn.userContent,
                 turn: turn.index,
                 assistantMessageId: turn.assistantUuid,
+                assistantMessageIds: turn.assistantUuids,
                 userMessageId: turn.userUuid,
+                userTextHash: turn.userTextHash,
+                assistantTextHashes: turn.assistantTextHashes,
             }));
         }
-        const sessions = await this.sessionManager.listSessions(channel, channelId);
+        const hasLable = args && (Object.hasOwn(args, 'lable') || Object.hasOwn(args, 'label'));
+        let lable;
+        if (hasLable) {
+            try {
+                lable = normalizeTopicLable(Object.hasOwn(args, 'lable') ? args.lable : args.label);
+            }
+            catch (error) {
+                throw { code: 'INVALID_ARGS', message: error.message };
+            }
+        }
+        let archiveFilter;
+        try {
+            const archived = args?.archived === undefined && isArchivedTopicLable(lable) ? true : args?.archived;
+            archiveFilter = resolveTopicArchiveFilter(archived);
+        }
+        catch (error) {
+            throw { code: 'INVALID_ARGS', message: error.message };
+        }
+        const sessions = await this.sessionManager.listSessions(channel, channelId, { archiveFilter });
         return sessions
-            .filter((s) => !!s.threadId)
+            .filter((s) => !!s.threadId && (!hasLable || s.lable === lable))
             .map((s) => this.buildTopicMenuItem(s));
     }
     if (cmd === '/s' || cmd === '/session' || cmd === '/del') {
@@ -1733,7 +1801,12 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
         const available = requestedAgent?.name
             ? (this.getAvailableBaseagentsForOwner?.(requestedAgent.name) ?? [])
             : this.getAvailableBaseagents(channel);
-        return available.map((name) => ({ value: name, label: name, selected: name === currentAgent }));
+        const inventory = await getBaseagentSnapshot({
+            config: { active_baseagent: currentAgent }, loaded: available, probe: false,
+        });
+        return inventory.baseagents
+            .filter(item => item.loaded === true)
+            .map(item => ({ value: item.id, label: item.id, selected: item.id === currentAgent }));
     }
     if (cmd === '/model') {
         const target = resolveMenuModelTarget.call(this, {
@@ -1767,7 +1840,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             const requestedModel = menuStringArg(args, 'model') ?? menuStringArg(args, 'current');
             const currentModel = requestedModel || readMenuModel(target, agent).value || agent.getModel();
             if (models.length > 0)
-                return models.map((m) => ({ value: m, label: modelDisplayLabel(agent, m) + (catalog.models.find(e => e.id === m)?.verification === 'unverified' ? ' [unverified]' : '') + (catalog.freshness === 'stale' ? ' [stale]' : ''), selected: modelMatches(agent, m, currentModel) }));
+                return models.map((m) => ({ value: m, label: modelDisplayLabel(agent, m) + (catalog.models.find(e => e.id === m)?.verification === 'unverified' ? ' [unverified]' : ''), selected: modelMatches(agent, m, currentModel) }));
         }
         return null;
     }
@@ -1892,7 +1965,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
 // 所有方法返回 { data } 或 { error, code? }。code 是结构化错误码（NO_ACTIVE_SESSION 等），
 // 客户端可据此决定降级策略。message-bridge 把 code 透传到 menu.response。
 /** menu.query — 查询当前值。 */
-export async function execMenuQuery(cmd, channel, channelId, userId, args, explicitChatType, fromControlChannel = false, overrideIdentity, authSubject, source = 'menu') {
+export async function execMenuQuery(cmd, channel, channelId, userId, args, explicitChatType, fromControlChannel = false, overrideIdentity, authSubject, source = 'menu', transportReplyContext) {
     const cmdBase = cmd.trim().split(' ')[0];
     if (!cmdBase)
         return { error: '缺少命令', code: 'MISSING_CMD' };
@@ -1903,7 +1976,17 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
     const gated = gateControlScope.call(this, { cmdBase, args, channel, fromControlChannel });
     if (gated)
         return gated;
-    const { session, evolagent } = await this.loadMenuContext(channel, channelId);
+    const loadedContext = await this.loadMenuContext(channel, channelId);
+    const evolagent = loadedContext.evolagent;
+    let session = loadedContext.session;
+    if (transportReplyContext?.threadId) {
+        try {
+            session = await loadMenuTopicSession(this.sessionManager, channel, channelId, transportReplyContext.threadId);
+        }
+        catch (error) {
+            return menuResultFailure(error);
+        }
+    }
     const identity = overrideIdentity ?? this.sessionManager.resolveIdentity(channel, userId, ...menuIdentityArgs(session));
     const subject = buildMenuAuthSubject(this, {
         identity,
@@ -1915,6 +1998,15 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         fromControlChannel,
         subject: authSubject,
     });
+    const storageRequest = { type: 'menu.query', cmd, args };
+    if (isAgentStorageMenuRequest(storageRequest)) {
+        try {
+            return { data: await agentStorageMenuService.execute(storageRequest, subject, this.agentStorageClientResolver) };
+        }
+        catch (error) {
+            return dataRootFailure(error);
+        }
+    }
     if (isRequesterRoleQuery) {
         if (!subject.allowAccess) {
             return { error: `Role ${subject.role} is not allowed to access this agent`, code: 'ROLE_ACCESS_DENIED' };
@@ -1983,6 +2075,28 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
     });
     if (authDenied)
         return authDenied;
+    if (cmdBase === '/agent-data-root') {
+        if (args && Object.keys(args).length > 0) {
+            return { error: 'agent-data-root does not accept args', code: 'INVALID_ARGUMENT' };
+        }
+        try {
+            return { data: dataRootResolver.issueAgentRoot(subject) };
+        }
+        catch (error) {
+            return dataRootFailure(error);
+        }
+    }
+    if (cmdBase === '/relation-data-root') {
+        if (args && Object.keys(args).some(key => key !== 'peerAid')) {
+            return { error: 'relation-data-root only accepts args.peerAid', code: 'INVALID_ARGUMENT' };
+        }
+        try {
+            return { data: dataRootResolver.issueRelationRoot(subject, args?.peerAid) };
+        }
+        catch (error) {
+            return dataRootFailure(error);
+        }
+    }
     if (cmdBase === '/baseagent-models') {
         try {
             const query = hostCatalogArgs(args);
@@ -2001,8 +2115,8 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (fromControlChannel) {
             if (args?.aid) {
                 return this.agentApplicationService
-                    ? await execAgentQuery(args, this.agentApplicationService)
-                    : await execAgentQuery(args);
+                    ? await execAgentQuery(args, this.agentApplicationService, subject)
+                    : await execAgentQuery(args, undefined, subject);
             }
             return this.agentApplicationService
                 ? await execAgentOptions(args, this.agentApplicationService)
@@ -2012,8 +2126,8 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (!selfAid)
             return { error: '当前 channel 无绑定 agent', code: 'FORBIDDEN' };
         return this.agentApplicationService
-            ? await execAgentQuery({ ...(args ?? {}), aid: selfAid }, this.agentApplicationService)
-            : await execAgentQuery({ ...(args ?? {}), aid: selfAid });
+            ? await execAgentQuery({ ...(args ?? {}), aid: selfAid }, this.agentApplicationService, subject)
+            : await execAgentQuery({ ...(args ?? {}), aid: selfAid }, undefined, subject);
     }
     // ── /gateway 查询（只读，列出全部作用域的网关配置；apiKey 已掩码） ──
     if (cmdBase === '/gateway') {
@@ -2093,6 +2207,9 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (!session) {
             return { data: { status: 'no-session' } };
         }
+        if (args?.view === 'subtasks') {
+            return { data: { scope: 'retained-history', tasks: this.sessionManager.getRunnerTaskHistory(session.id) } };
+        }
         const sessionKey = this.getQueueKey(session, channel, channelId);
         const sessionAgent = this.getAgent(channel, session.baseagent);
         const isProcessing = this.messageQueue.isProcessing(sessionKey) || sessionAgent.hasActiveStream(sessionKey);
@@ -2115,6 +2232,8 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
             status: isProcessing ? 'processing' : 'idle',
             createdAt: session.createdAt,
             updatedAt: session.updatedAt,
+            subtasks: this.sessionManager.getRunnerTaskHistory(session.id).length,
+            subtasksScope: 'retained-history',
         };
         if (processingDuration !== undefined)
             data.processingDuration = processingDuration;
@@ -2130,6 +2249,21 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
             data.lastError = { type: health.lastErrorType || 'unknown', message: health.lastError.substring(0, 100) };
         return { data };
     }
+    if (cmdBase === '/baseagents') {
+        if (args && Object.keys(args).length > 0) {
+            return { error: 'baseagents does not accept query arguments', code: 'INVALID_ARGUMENT' };
+        }
+        if (fromControlChannel) {
+            return { data: await getBaseagentSnapshot({ loaded: loadedBaseagentIds(this.agentMap.keys()) }) };
+        }
+        if (!evolagent)
+            return { error: '当前 channel 无绑定 agent', code: 'FORBIDDEN' };
+        return { data: await getBaseagentSnapshot({
+                config: evolagent.config ?? {},
+                loaded: this.getAvailableBaseagents(channel),
+                probe: false,
+            }) };
+    }
     if (cmdBase === '/topic') {
         const target = (args?.target ?? '').toString().trim();
         if (!target)
@@ -2137,6 +2271,9 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         const topic = await this.sessionManager.getThreadSession(channel, channelId, target);
         if (!topic)
             return { error: '话题不存在', code: 'NOT_FOUND' };
+        if (args?.view === 'subtasks') {
+            return { data: { scope: 'retained-history', tasks: this.sessionManager.getRunnerTaskHistory(topic.id) } };
+        }
         const sessionKey = this.getQueueKey(topic, channel, channelId);
         const sessionAgent = this.getAgent(channel, topic.baseagent);
         const isProcessing = this.messageQueue.isProcessing(sessionKey) || sessionAgent.hasActiveStream(sessionKey);
@@ -2155,10 +2292,13 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         const data = {
             threadId: topic.threadId,
             name: topic.name || null,
+            lable: topic.lable || null,
             agentSessionId: topic.agentSessionId || null,
             status: isProcessing ? 'processing' : 'idle',
             createdAt: topic.createdAt,
             updatedAt: topic.updatedAt,
+            subtasks: this.sessionManager.getRunnerTaskHistory(topic.id).length,
+            subtasksScope: 'retained-history',
         };
         if (processingDuration !== undefined)
             data.processingDuration = processingDuration;
@@ -2372,6 +2512,24 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
     }
     if (cmdBase === '/system') {
         const view = args?.view ?? 'status';
+        if (view === 'version') {
+            const data = {};
+            try {
+                const pkgPath = path.join(getPackageRoot(), 'package.json');
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+                if (pkg?.version)
+                    data.version = pkg.version;
+            }
+            catch { }
+            try {
+                const fp = path.join(getPackageRoot(), 'node_modules', '@agentunion', 'fastaun', 'package.json');
+                const fp2 = JSON.parse(fs.readFileSync(fp, 'utf-8'));
+                if (fp2?.version)
+                    data.fastaunVersion = fp2.version;
+            }
+            catch { }
+            return { data };
+        }
         if (view === 'monitor') {
             if (typeof this.daemonMonitorProvider !== 'function') {
                 return { error: 'Daemon monitor snapshot is unavailable', code: 'DEPENDENCY_UNAVAILABLE' };
@@ -2416,24 +2574,41 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if (ecwebPkg?.version)
             data.ecwebVersion = ecwebPkg.version;
         // 收集主机级可用的所有 baseagent 类型（检测已安装的 CLI + 版本）
-        const baseagents = [];
-        for (const cmd of ['claude', 'gemini', 'codex']) {
-            if (commandExists(cmd)) {
-                baseagents.push({ name: cmd, version: getBaseagentVersion(cmd) });
-            }
-        }
-        data.baseagents = baseagents;
+        const inventory = await getBaseagentSnapshot({
+            loaded: loadedBaseagentIds(this.agentMap.keys()),
+        });
+        data.baseagents = inventory.baseagents.map(item => ({
+            ...item, name: item.id,
+            version: item.version ?? (item.detected && item.id !== 'ecagent' ? getBaseagentVersion(item.id) : null),
+        }));
         return { data };
     }
     // ── name=file：文件元信息（§5.1） ──
     // operation 权限已在入口统一判定；项目外文件仍仅 owner 可取。
     if (cmdBase === '/file') {
-        const role = identity.role;
-        const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
-        const resolved = resolveMenuFilePath(args?.path, projectPath, role, 'file');
-        if ('error' in resolved)
-            return resolved;
-        const { realPath, stat } = resolved;
+        let realPath;
+        let stat;
+        let responsePath = (args?.path ?? '').toString();
+        let dataRoot;
+        if (args?.rootId !== undefined) {
+            try {
+                const resolved = dataRootResolver.resolvePath(args.rootId, subject, args?.path, 'file');
+                ({ realPath, stat } = resolved);
+                responsePath = resolved.relativePath;
+                dataRoot = resolved;
+            }
+            catch (error) {
+                return dataRootFailure(error);
+            }
+        }
+        else {
+            const role = identity.role;
+            const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
+            const resolved = resolveMenuFilePath(args?.path, projectPath, role, 'file');
+            if ('error' in resolved)
+                return resolved;
+            ({ realPath, stat } = resolved);
+        }
         // sha256 仅对 ≤ 2 MB 文件计算，超过返回 null，客户端降级到 size+mtime（§4、§7 决策 2）
         let sha256 = null;
         if (stat.size <= FILE_HASH_MAX_SIZE) {
@@ -2446,7 +2621,16 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         }
         return {
             data: {
-                path: (args?.path ?? '').toString(),
+                path: responsePath,
+                ...(dataRoot ? {
+                    root: {
+                        scope: dataRoot.scope,
+                        targetAid: dataRoot.targetAid,
+                        ...(dataRoot.peerAid ? { peerAid: dataRoot.peerAid } : {}),
+                        ...(dataRoot.peerKey ? { peerKey: dataRoot.peerKey } : {}),
+                        expiresAt: dataRoot.expiresAt,
+                    },
+                } : {}),
                 sha256,
                 size: stat.size,
                 mtime: stat.mtimeMs,
@@ -2475,17 +2659,12 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
     const loadedContext = await this.loadMenuContext(channel, channelId);
     let session = loadedContext.session;
     const evolagent = loadedContext.evolagent;
-    if (transportReplyContext?.threadId && typeof this.sessionManager.getThreadSession === 'function') {
+    if (transportReplyContext?.threadId) {
         try {
-            const topicSession = await this.sessionManager.getThreadSession(channel, channelId, transportReplyContext.threadId);
-            if (!topicSession) {
-                return { error: '话题会话不存在，拒绝回退到主会话', code: 'TOPIC_SESSION_NOT_FOUND' };
-            }
-            session = topicSession;
+            session = await loadMenuTopicSession(this.sessionManager, channel, channelId, transportReplyContext.threadId);
         }
         catch (error) {
-            logger.debug('[MenuHandler] topic session lookup failed for menu update: thread=' + transportReplyContext.threadId + ': ' + (error instanceof Error ? error.message : String(error)));
-            return { error: '无法读取话题会话，拒绝回退到主会话', code: 'TOPIC_SESSION_LOOKUP_FAILED' };
+            return menuResultFailure(error);
         }
     }
     if (cmdBase === '/baseagent-models')
@@ -2764,7 +2943,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
         if ('error' in target)
             return target;
         const agent = this.getAgent(channel, target.baseagent);
-        let targetModel = arg;
+        const requestedModel = arg;
         if (hasModelSwitcher(agent)) {
             const catalog = await getCatalog(target.sel.self, target.baseagent);
             assertCatalogSelectable(catalog);
@@ -2772,20 +2951,22 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             const decision = validateModelSelectionForRole({
                 role: identity.role,
                 baseagent: target.baseagent,
-                requestedModel: arg,
+                requestedModel,
                 models,
                 selfAid: target.sel.self,
                 resolveModelId: model => resolveCatalogModel(catalog, model),
             });
             if (!decision.ok)
                 return { error: decision.message || `invalid model: ${arg}`, code: decision.code || 'INVALID_VALUE' };
-            targetModel = decision.model || arg;
-            if (models.length && !models.includes(targetModel)) {
+            // Validate the resolved ID, but persist/echo the selected value so aliases
+            // such as `sonnet` keep following the catalog instead of pinning a version.
+            const resolvedModel = decision.model || requestedModel;
+            if (models.length && !models.includes(resolvedModel)) {
                 return { error: `无效模型: ${arg}`, code: 'INVALID_VALUE' };
             }
         }
         try {
-            writeMenuModel(target, targetModel);
+            writeMenuModel(target, requestedModel);
         }
         catch (e) {
             return { error: e?.message || String(e), code: e?.code || 'CONFIG_WRITE_FAILED', ...(e?.data !== undefined ? { data: e.data } : {}) };
@@ -2795,12 +2976,12 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             sessionId: session?.id,
             agentName: evolagent?.name,
             baseagent: target.baseagent,
-            model: targetModel,
+            model: requestedModel,
             timestamp: Date.now(),
         });
         return {
             data: {
-                model: targetModel,
+                model: requestedModel,
                 baseagent: target.baseagent,
                 scope: target.scope,
                 field: target.fieldPath,
@@ -3024,6 +3205,15 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         fromControlChannel,
         subject: authSubject,
     });
+    const storageRequest = { type: 'menu.action', cmd, action, args };
+    if (isAgentStorageMenuRequest(storageRequest)) {
+        try {
+            return { data: await agentStorageMenuService.execute(storageRequest, subject, this.agentStorageClientResolver) };
+        }
+        catch (error) {
+            return dataRootFailure(error);
+        }
+    }
     if (cmdBase === '/system' && fromControlChannel && !subject.isDaemonOwner && subject.processRole !== 'daemon-service') {
         return {
             error: formatAuthorizationDenial('This daemon-level operation requires DaemonOwner.', 'DAEMON_OWNER_REQUIRED'),
@@ -3103,7 +3293,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
     }
     const isMenuAdmin = isManagementRole(authIdentity.role);
     // ── /aid avatar ──
-    // The AID namespace is the only avatar mutation surface.
+    // Canonical avatar action; legacy agent/update patch.avatar reuses the same uploader.
     if (cmdBase === '/aid') {
         if (action !== 'avatar')
             return { error: `不支持 aid action: ${action}`, code: 'NOT_SUPPORTED' };
@@ -3245,7 +3435,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 }
             }
         }
-        return await execAgentAction(action, a, userId ?? '', this.eventBus, this.agentApplicationService);
+        return await execAgentAction(action, a, userId ?? '', this.eventBus, this.agentApplicationService, subject);
     }
     // ── 关系级 /trigger（不走 owners；复用 isAdmin + scoped 逻辑，D4 直调底层） ──
     if (cmdBase === '/trigger') {
@@ -3290,6 +3480,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 targetThreadId: args.targetThreadId,
                 agentId: args.agentId,
                 model: args.model,
+                executionTimeoutMs: args.executionTimeoutMs,
                 effort: args.effort,
                 permissionMode: args.permissionMode,
                 triggerThread,
@@ -3427,6 +3618,16 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         return { error: `不支持的 trigger action: ${action}`, code: 'INVALID_ARGS' };
     }
     if (cmdBase === '/topic') {
+        const hasLable = args && (Object.hasOwn(args, 'lable') || Object.hasOwn(args, 'label'));
+        let lable;
+        if (hasLable && (action === 'fork' || action === 'label')) {
+            try {
+                lable = normalizeTopicLable(Object.hasOwn(args, 'lable') ? args.lable : args.label);
+            }
+            catch (error) {
+                return { error: error.message, code: 'INVALID_ARGS' };
+            }
+        }
         if (action === 'fork') {
             if (!this.canReadTopics(identity.role))
                 return { error: '无权限创建话题分支', code: 'FORBIDDEN' };
@@ -3503,21 +3704,24 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 const executeFork = async (current, currentAgent) => {
                     const messages = await currentAgent.getSessionMessages(current.agentSessionId, current.projectPath);
                     const turns = buildSessionTurnList(messages);
-                    const forkTurn = turns.find((turn) => turn.assistantUuid === sourceAssistantMessageId);
+                    // fork-turns resolves bubble aliases to this canonical, complete-turn
+                    // anchor. Never fall back to a runner iteration or a guessed index.
+                    const forkTurn = turns.find(turn => turn.assistantUuid === sourceAssistantMessageId);
                     if (!forkTurn)
                         return { error: '分叉点已失效，请刷新历史后重试', code: 'NOT_FOUND' };
-                    const forkedAgentSessionId = await currentAgent.forkSessionAt(current.agentSessionId, current.projectPath, sourceAssistantMessageId, name || undefined);
+                    const forkedAgentSessionId = await currentAgent.forkSessionAt(current.agentSessionId, current.projectPath, forkTurn.assistantUuid, name || undefined, { sessionId: current.id, permissionMode: subject.permissionMode, role: subject.role });
                     const topic = await this.sessionManager.createForkedThreadSession(current, forkedAgentSessionId, targetThreadId, {
                         name: name || undefined,
+                        ...(hasLable ? { lable: lable ?? null } : {}),
                         creatorPeerId: userId,
-                        sourceAssistantMessageId,
+                        sourceAssistantMessageId: forkTurn.assistantUuid,
                         sourceTurn: forkTurn.index,
                         requestId,
                     });
                     await currentAgent.updateSessionMetadata?.(forkedAgentSessionId, {
                         evolcoreSessionId: topic.id,
                         sourceSessionId: current.id,
-                        sourceAssistantMessageId,
+                        sourceAssistantMessageId: forkTurn.assistantUuid,
                         sourceTurn: forkTurn.index,
                     }).catch((error) => {
                         logger.debug(`[MenuHandler] Topic fork metadata sync failed: ${error}`);
@@ -3528,7 +3732,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                         sourceSessionId: current.id,
                         name: topic.name,
                         threadId: topic.threadId,
-                        sourceAssistantMessageId,
+                        sourceAssistantMessageId: forkTurn.assistantUuid,
                         sourceTurn: forkTurn.index,
                     });
                     return {
@@ -3540,7 +3744,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                                 threadId: topic.threadId,
                                 sourceSessionId: current.id,
                                 sourceThreadId: current.threadId || null,
-                                sourceAssistantMessageId,
+                                sourceAssistantMessageId: forkTurn.assistantUuid,
                                 sourceTurn: forkTurn.index,
                             },
                         },
@@ -3629,7 +3833,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 topicForkTargetsInFlight.delete(targetKey);
             }
         }
-        if (action !== 'delete' && action !== 'rename') {
+        if (action !== 'delete' && action !== 'rename' && action !== 'label') {
             return { error: `不支持的 topic action: ${action}`, code: 'NOT_SUPPORTED' };
         }
         const target = (args?.target ?? '').toString().trim();
@@ -3638,6 +3842,8 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         const renameName = action === 'rename' ? getRenameName(args) : '';
         if (action === 'rename' && !renameName)
             return { error: '缺少 args.name', code: 'MISSING_VALUE' };
+        if (action === 'label' && !hasLable)
+            return { error: '缺少 args.lable', code: 'MISSING_VALUE' };
         const topic = await this.sessionManager.getThreadSession(channel, channelId, target);
         if (!topic)
             return { error: '话题不存在', code: 'NOT_FOUND' };
@@ -3647,7 +3853,18 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 ? 'private'
                 : this.resolveMenuChatType(channel, channelId, explicitChatType);
         if (!this.canDeleteTopic(identity.role, chatType, topic, userId)) {
-            return { error: action === 'rename' ? '无权限重命名话题' : '无权限删除话题', code: 'FORBIDDEN' };
+            return { error: action === 'label' ? '无权限修改话题分类' : action === 'rename' ? '无权限重命名话题' : '无权限删除话题', code: 'FORBIDDEN' };
+        }
+        if (action === 'label') {
+            const success = await this.sessionManager.setTopicLable(topic.id, lable ?? null);
+            if (!success)
+                return { error: '话题不存在', code: 'NOT_FOUND' };
+            return {
+                data: {
+                    action: 'label', success: true,
+                    topic: { ...buildSessionPayload(topic, topic.name || ''), threadId: topic.threadId, lable: lable ?? null },
+                },
+            };
         }
         if (action === 'rename') {
             const newName = renameName;
@@ -3885,6 +4102,12 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             this.eventBus.publish({ type: 'system:restart', channel, channelId });
             return { data: { action: 'restart', success: true } };
         }
+        if (action === 'paircode') {
+            // Keep Menu pairing on the same daemon-owned store as /pair, ECWeb, and
+            // the local IPC endpoint. Each successful redemption consumes the code.
+            const pair = remoteAccessService.getPairingCode(subject.actorId, Date.now(), source === 'ecweb' ? 'ecweb-local' : 'menu');
+            return { data: { code: pair.code, expiresAt: pair.expiresAt } };
+        }
         if (action === 'check') {
             const r = await this.delegateAsAction(action, '/check', channel, channelId, userId, { overrideIdentity, authSubject: subject, threadId: transportReplyContext?.threadId, chatType: transportReplyContext?.delivery?.chatType, replyContext: transportReplyContext });
             // delegateAsAction 会把 structured 展开到 data 顶层，并保留 data.structured 兼容旧客户端。
@@ -4016,6 +4239,15 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 },
             });
             if (!decision.allow) {
+                // Keep unsupported runner fields in the aggregate so the CLI can
+                // return a per-field error while still returning supported values.
+                if (isBatchGet
+                    && decision.code === 'UNSUPPORTED_FIELD'
+                    && parsed.resolvedConfigCommand?.kind === 'field'
+                    && parsed.resolvedConfigCommand.subcommand === 'get'
+                    && isUnsupportedBaseagentConfigField(parsed.resolvedConfigCommand.field)) {
+                    continue;
+                }
                 return { error: decision.reason, code: decision.code };
             }
             authorizedCommands.push({ parsed, decision });
@@ -4047,26 +4279,78 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
     // fetch 文件作为独立 result.file 消息异步发回；把请求 id 作为 correlationId 透传，
     // 客户端用它把异步到达的文件消息对回这次 fetch 点击。
     if (cmdBase === '/file') {
-        const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
         if (action === 'list') {
             const dirArg = (args?.path ?? '.').toString().trim() || '.';
-            const resolved = resolveMenuFilePath(dirArg, projectPath, identity.role, 'directory');
-            if ('error' in resolved)
-                return resolved;
             const offset = parseFileListOffset(args?.offset);
             const limit = parseFileListLimit(args?.limit);
             const includeHidden = args?.includeHidden === true;
-            const listed = listDirectory(resolved.realPath, { offset, limit, includeHidden, projectPath: resolved.projectPath, role: identity.role });
+            let listed;
+            let responsePath = dirArg;
+            let dataRoot;
+            if (args?.rootId !== undefined) {
+                try {
+                    const resolved = dataRootResolver.resolvePath(args.rootId, subject, dirArg, 'directory');
+                    listed = listDirectory(resolved.realPath, {
+                        offset,
+                        limit,
+                        includeHidden,
+                        projectPath: resolved.rootPath,
+                        role: undefined,
+                    });
+                    responsePath = resolved.relativePath;
+                    dataRoot = resolved;
+                }
+                catch (error) {
+                    return dataRootFailure(error);
+                }
+            }
+            else {
+                const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
+                const resolved = resolveMenuFilePath(dirArg, projectPath, identity.role, 'directory');
+                if ('error' in resolved)
+                    return resolved;
+                listed = listDirectory(resolved.realPath, { offset, limit, includeHidden, projectPath: resolved.projectPath, role: identity.role });
+            }
             if ('error' in listed)
                 return listed;
-            return { data: { path: dirArg, ...listed.data } };
+            return {
+                data: {
+                    path: responsePath,
+                    ...(dataRoot ? {
+                        root: {
+                            scope: dataRoot.scope,
+                            targetAid: dataRoot.targetAid,
+                            ...(dataRoot.peerAid ? { peerAid: dataRoot.peerAid } : {}),
+                            ...(dataRoot.peerKey ? { peerKey: dataRoot.peerKey } : {}),
+                            expiresAt: dataRoot.expiresAt,
+                        },
+                    } : {}),
+                    ...listed.data,
+                },
+            };
         }
         if (action !== 'fetch')
             return { error: `不支持的 file action: ${action}`, code: 'NOT_SUPPORTED' };
-        const resolved = resolveMenuFilePath(args?.path, projectPath, identity.role, 'file');
-        if ('error' in resolved)
-            return resolved;
-        const { realPath, stat } = resolved;
+        let realPath;
+        let stat;
+        let dataRoot;
+        if (args?.rootId !== undefined) {
+            try {
+                const resolved = dataRootResolver.resolvePath(args.rootId, subject, args?.path, 'file');
+                ({ realPath, stat } = resolved);
+                dataRoot = resolved;
+            }
+            catch (error) {
+                return dataRootFailure(error);
+            }
+        }
+        else {
+            const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
+            const resolved = resolveMenuFilePath(args?.path, projectPath, identity.role, 'file');
+            if ('error' in resolved)
+                return resolved;
+            ({ realPath, stat } = resolved);
+        }
         if (stat.size > FILE_FETCH_MAX_SIZE) {
             return { error: `文件过大: ${(stat.size / 1024 / 1024).toFixed(1)} MB (限制 ${FILE_FETCH_MAX_SIZE / 1024 / 1024} MB)`, code: 'FILE_TOO_LARGE' };
         }
@@ -4087,15 +4371,21 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             }
             : sessionReplyContext;
         const sendFile = async () => {
-            await adapter.send(buildEnvelope({ channel: adapter.channelName, channelId, replyContext: replyCtx }), { kind: 'result.file', filePath: realPath, correlationId: requestId });
+            const receipt = await adapter.send(buildEnvelope({ channel: adapter.channelName, channelId, replyContext: replyCtx }), { kind: 'result.file', filePath: realPath, correlationId: requestId });
+            if (receipt && typeof receipt === 'object' && receipt.status === 'failed') {
+                throw Object.assign(new Error(receipt.error || '文件发送失败'), {
+                    code: receipt.code ?? 'EXEC_FAILED',
+                    outboxId: receipt.outboxId,
+                });
+            }
         };
         if (deferSideEffect) {
             deferSideEffect(sendFile);
-            return { data: { accepted: true } };
+            return { data: { accepted: true, ...(dataRoot ? { scope: dataRoot.scope, expiresAt: dataRoot.expiresAt } : {}) } };
         }
         try {
             await sendFile();
-            return { data: { accepted: true } };
+            return { data: { accepted: true, ...(dataRoot ? { scope: dataRoot.scope, expiresAt: dataRoot.expiresAt } : {}) } };
         }
         catch (e) {
             return { error: `文件发送失败: ${e?.message ?? e}`, code: 'EXEC_FAILED' };
@@ -4152,8 +4442,8 @@ function menuCommandToken(cmd) {
 }
 function isProcessLevelMenu(name, cmd) {
     const cmdToken = menuCommandToken(cmd);
-    return name === 'system' || name === 'agent' || name === 'gateway' || name === 'config' || name === 'baseagent-models'
-        || cmdToken === '/system' || cmdToken === '/agent' || cmdToken === '/gateway' || cmdToken === '/config' || cmdToken === '/baseagent-models';
+    return name === 'system' || name === 'agent' || name === 'gateway' || name === 'config' || name === 'baseagent-models' || name === 'baseagents'
+        || cmdToken === '/system' || cmdToken === '/agent' || cmdToken === '/gateway' || cmdToken === '/config' || cmdToken === '/baseagent-models' || cmdToken === '/baseagents';
 }
 function isProcessContextMenu(payload) {
     const isCatalog = payload?.type === 'menu.list' && payload?.args?.view === 'catalog';
@@ -4173,8 +4463,15 @@ async function execMenuForSystemControl(payload, context) {
     const isFileFetch = (payload?.type === 'menu.query'
         || (payload?.type === 'menu.action' && payload?.action === 'fetch'))
         && (name === 'file' || compatCmd === '/file');
-    if (isFileFetch) {
-        return ecwebErr(id, name, 'NOT_SUPPORTED', 'Host/control 不支持 file.fetch，请通过目标 Agent AID 请求');
+    const isDataRootQuery = payload?.type === 'menu.query'
+        && (name === 'agent-data-root'
+            || name === 'relation-data-root'
+            || compatCmd === '/agent-data-root'
+            || compatCmd === '/relation-data-root');
+    const isRootedFile = (name === 'file' || compatCmd === '/file')
+        && typeof payload?.args?.rootId === 'string';
+    if (isFileFetch || isDataRootQuery || isRootedFile || isAgentStorageMenuRequest(payload ?? {})) {
+        return ecwebErr(id, name, 'NOT_SUPPORTED', 'Host/control 不支持数据根文件访问，请通过目标 Agent AID 请求');
     }
     if (name === 'cli' || compatCmd === '/cli') {
         const message = context.source === 'ecweb'
@@ -4216,11 +4513,18 @@ async function execMenuForSystemControl(payload, context) {
         conversationId: context.actorAid || SYSTEM_CONTROL_CHANNEL,
         processOwners: context.owners,
         fromControlChannel: true,
+        ecwebManagement: context.source === 'ecweb',
         canApprovePersistentFullAccess: context.canApprovePersistentFullAccess,
         trustedProcessRole: context.source === 'ecweb' ? 'daemon-owner' : undefined,
     });
     const trustedIdentity = trustedSubject.identity;
     const cmd = name ? (menuCommandForName(name) ?? payload.cmd) : payload.cmd;
+    if (payload?.type === 'menu.action'
+        && menuCommandToken(cmd) === '/system'
+        && payload.action === 'paircode'
+        && (context.authMethod !== 'daemon-owner' || (context.source === 'control' && !context.encrypted))) {
+        return ecwebErr(id, name, 'NOT_ALLOWED', 'Pairing code issuance requires encrypted DaemonOwner authentication');
+    }
     try {
         if (menuCommandToken(cmd) === '/baseagent-models') {
             if (payload.type !== 'menu.query')
@@ -4239,6 +4543,8 @@ async function execMenuForSystemControl(payload, context) {
                         channelScope: 'control',
                         channelId: targetChannel,
                         request: payload.args.context,
+                        paircodeAllowed: context.authMethod === 'daemon-owner'
+                            && (context.source !== 'control' || context.encrypted),
                     });
                     return menuSuccess({ id, ...(name ? { name } : {}) }, data);
                 }
@@ -4343,15 +4649,6 @@ export async function execMenuForEcweb(payload, trusted) {
     const validationError = validateMenuRequest(payload ?? {});
     if (validationError)
         return menuFailure({ id, ...(name ? { name } : {}) }, validationError);
-    const isProcessLevel = isProcessLevelMenu(name, payload?.cmd) || isProcessContextMenu(payload);
-    const owners = loadDaemonConfig().owners ?? [];
-    if (isProcessLevel && owners.length === 0) {
-        return menuFailure({ id, ...(name ? { name } : {}) }, {
-            code: 'NOT_ALLOWED',
-            message: formatAuthorizationDenial('Configure daemon.json.owners before using process-level operations.', 'DAEMON_OWNER_REQUIRED'),
-            data: authorizationDenialData('DAEMON_OWNER_REQUIRED'),
-        });
-    }
     if (!trusted || (!trusted.localDirect && trusted.authenticated !== true)) {
         return menuFailure({ id, ...(name ? { name } : {}) }, {
             code: 'PERMISSION_DENIED',
@@ -4359,29 +4656,22 @@ export async function execMenuForEcweb(payload, trusted) {
             data: { $schema_version: 1, kind: 'role_permission_denied', self: payload?.args?.self ?? null },
         });
     }
-    // A verified ECWeb connection has daemon-owner management authority. If the
-    // bearer token has no explicit owner provenance (the normal pairing path),
-    // use the first currently configured owner as the canonical management
-    // principal. This keeps audit/Trigger approval attribution deterministic
-    // without requiring owner-bound pairing metadata.
+    // ECWeb authentication grants daemon-owner authority independently of the
+    // configured owners. Prefer an owner for audit/Trigger attribution when
+    // available; otherwise keep local and remote management actors distinct.
+    const owners = loadDaemonConfig().owners ?? [];
     const userId = (trusted.actorAid && owners.includes(trusted.actorAid))
         ? trusted.actorAid
-        : owners[0] ?? (trusted.localDirect ? 'local-direct' : undefined);
-    if (!userId) {
-        return menuFailure({ id, ...(name ? { name } : {}) }, {
-            code: 'PERMISSION_DENIED',
-            message: 'ECWeb operation requires configured daemon owners',
-            data: { $schema_version: 1, kind: 'role_permission_denied', self: payload?.args?.self ?? null },
-        });
-    }
+        : owners[0] ?? (trusted.localDirect ? 'local-direct' : 'ecweb-remote');
     return execMenuForSystemControl.call(this, payload, {
         source: 'ecweb',
         actorAid: userId,
+        authMethod: trusted.localDirect ? 'daemon-owner' : 'remote-access-token',
+        encrypted: trusted.localDirect,
         localDirect: trusted.localDirect,
         // The ECWeb server/IPC control-token gate authenticates this management
         // request. All authenticated ECWeb connections are equally eligible to
-        // approve persistent fullaccess; actorAid is used only when it identifies
-        // a current configured owner.
+        // approve persistent fullaccess without owner-bound token metadata.
         canApprovePersistentFullAccess: true,
         owners,
     });
@@ -4415,6 +4705,8 @@ export async function execMenuForControl(payload, peerId, auth = {}) {
     return execMenuForSystemControl.call(this, payload, {
         source: 'control',
         actorAid: managementActor,
+        authMethod: authorization.allowed ? authorization.authMethod : 'daemon-owner',
+        encrypted: auth.encrypted === true,
         localDirect: false,
         canApprovePersistentFullAccess: false,
         owners,