evolcore 0.0.26 → 0.0.27

package/dist/cli/task-context.js

@@ -1,14 +1,18 @@
 import { normalizeCausation } from '../core/causation/context.js';
 import { RUNTIME_LOCK_DIR_ENV } from '../core/runtime-lock.js';
 import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
+import { resolveRoot } from '../paths.js';
 export const TASK_RUNTIME_CONTEXT_ENV = 'EVOLCORE_TASK_RUNTIME_CONTEXT';
 export const SESSION_RUNTIME_DIR_ENV = 'EVOLCORE_SESSION_RUNTIME_DIR';
 export const DAEMON_RUNTIME_EPOCH_ENV = 'EVOLCORE_DAEMON_RUNTIME_EPOCH';
 export { RUNTIME_LOCK_DIR_ENV };
 const generatedProcessManagedTempDirs = new Set();
+const preparedWindowsSessionRuntimeDirs = new Set();
 let processTempCleanupRegistered = false;
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
@@ -37,7 +41,9 @@ function normalizeTaskRuntimeContext(value) {
         processRole: optionalProcessRole(value.processRole),
         dataScope: optionalDataScope(value.dataScope),
         authorizedBy: optionalString(value.authorizedBy),
-        executionSource: value.executionSource === 'fullaccess-command' || value.executionSource === 'trigger'
+        executionSource: value.executionSource === 'fullaccess-command'
+            || value.executionSource === 'trigger'
+            || value.executionSource === 'agent-policy'
             ? value.executionSource : undefined,
         daemonRuntimeEpoch: optionalString(value.daemonRuntimeEpoch),
         threadId: optionalString(value.threadId),
@@ -189,29 +195,81 @@ export function ensureProcessManagedTempDir() {
         throw error;
     }
 }
-function isRunnerOwnedSessionRuntimeDir(directory) {
-    const resolved = path.resolve(directory);
-    const base = path.basename(resolved);
-    const parent = path.dirname(resolved);
-    // Codex allocates a private, direct child named with a 24-character digest
-    // below its private evolcore-codex-* parent. The runner has already checked
-    // canonical containment before returning this path to the response engine.
-    const isCodexRuntime = /^[a-f0-9]{24}$/.test(base)
-        && /^evolcore-codex-(?:\d+|user)$/.test(path.basename(parent));
-    return isCodexRuntime && isPrivateDirectory(parent) && isPrivateDirectory(resolved);
+function canonicalHome() {
+    const configured = path.resolve(resolveRoot());
+    let canonical;
+    try {
+        canonical = fs.realpathSync.native(configured);
+    }
+    catch {
+        canonical = configured;
+    }
+    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+}
+function systemTempRoot() {
+    const testRoot = process.env.EVOLCORE_TEST === '1' && process.env.TMPDIR?.trim();
+    const candidate = testRoot && path.isAbsolute(testRoot)
+        ? testRoot
+        : process.platform === 'win32'
+            ? path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'Temp')
+            : process.platform === 'linux'
+                ? '/tmp'
+                : os.tmpdir();
+    try {
+        return fs.realpathSync.native(candidate);
+    }
+    catch {
+        return path.resolve(candidate);
+    }
+}
+function sessionRuntimeName(sessionId) {
+    const digest = crypto.createHash('sha256')
+        .update(canonicalHome())
+        .update('\0')
+        .update(sessionId)
+        .digest('hex')
+        .slice(0, 24);
+    return `ec-session-${digest}`;
 }
-/** Whether a task-provided runtime directory stays inside the process-managed
- * TMPDIR and is safe to use for transient writes. */
+/**
+ * Windows Codex sandbox accounts and ordinary runner accounts are members of
+ * BUILTIN\Users. Session isolation is enforced by the distinct path plus the
+ * runner filesystem policy, so the runtime directory only needs a portable
+ * writable ACL rather than host-user secrecy.
+ */
+function ensureWindowsSessionRuntimeAccess(directory) {
+    if (process.platform !== 'win32' || preparedWindowsSessionRuntimeDirs.has(directory))
+        return;
+    const icacls = path.join(process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows', 'System32', 'icacls.exe');
+    execFileSync(icacls, [
+        directory,
+        '/grant',
+        '*S-1-5-32-545:(OI)(CI)M',
+        '/Q',
+    ], { windowsHide: true, stdio: 'pipe' });
+    preparedWindowsSessionRuntimeDirs.add(directory);
+}
+/** Whether a task-provided runtime directory is a stable EvolCore session root. */
 export function isManagedSessionRuntimeDir(directory, managedRoot) {
-    const tmpDir = (managedRoot ?? process.env.TMPDIR)?.trim();
-    if (!directory || !path.isAbsolute(directory) || !tmpDir || !path.isAbsolute(tmpDir))
+    if (!directory || !path.isAbsolute(directory))
         return false;
-    const root = path.resolve(tmpDir);
     const resolved = path.resolve(directory);
-    const relative = path.relative(root, resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+    const suppliedRoot = managedRoot?.trim();
+    const candidateRoot = suppliedRoot && path.isAbsolute(suppliedRoot)
+        ? path.resolve(suppliedRoot)
+        : systemTempRoot();
+    const root = candidateRoot === resolved ? path.dirname(resolved) : candidateRoot;
+    if (path.dirname(resolved) !== root || !/^ec-session-[a-f0-9]{24}$/.test(path.basename(resolved)))
+        return false;
+    try {
+        const rootStat = fs.lstatSync(root);
+        if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+            return false;
+    }
+    catch {
         return false;
-    return isPrivateDirectory(root) && isPrivateDirectory(resolved);
+    }
+    return isPrivateDirectory(resolved);
 }
 /**
  * Resolve the session-owned temporary root for a managed child process.
@@ -241,58 +299,43 @@ export function getManagedTaskTempDir(runtimeEnv) {
         && (!processRoot || !path.isAbsolute(processRoot) || path.resolve(configured) !== path.resolve(processRoot))
         && contextDir
         && path.resolve(contextDir) === path.resolve(configured)
-        && (isManagedSessionRuntimeDir(configured) || isRunnerOwnedSessionRuntimeDir(configured));
+        && isManagedSessionRuntimeDir(configured);
     if (!trusted) {
         throw new Error('managed session TMPDIR is unavailable or untrusted');
     }
     return path.resolve(configured);
 }
 /**
- * Create a private runtime directory below the process-provided TMPDIR.
- * There is deliberately no os.tmpdir() fallback: managed sessions must not
- * silently escape the session-owned temporary workspace.
+ * Create the stable private runtime directory for one EvolCore session.
+ * Its identity is independent of daemon/runner lifetimes and rotates only
+ * when EvolCore creates a new session id.
  */
 export function ensureSessionRuntimeDir(sessionId) {
     if (!sessionId)
         return undefined;
-    let base = process.env.TMPDIR?.trim();
-    try {
-        if (!base || !path.isAbsolute(base) || !isPrivateDirectory(path.resolve(base))) {
-            base = ensureProcessManagedTempDir();
-        }
-    }
-    catch {
-        return undefined;
-    }
-    if (!base || !path.isAbsolute(base))
-        return undefined;
-    const root = path.resolve(base);
-    const digest = crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
-    const directory = path.join(root, `evolcore-runtime-${digest}`);
+    const root = systemTempRoot();
+    const directory = path.join(root, sessionRuntimeName(sessionId));
     try {
         fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-        if (!isPrivateDirectory(root))
-            return undefined;
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        ensureWindowsSessionRuntimeAccess(directory);
         fs.mkdirSync(path.join(directory, 'locks'), { recursive: true, mode: 0o700 });
-        return isManagedSessionRuntimeDir(directory) ? directory : undefined;
+        return isManagedSessionRuntimeDir(directory, root) ? directory : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Shared by tasks in one daemon runtime, while remaining outside each
- * session's history/files area. The caller must still pass this path through
- * the task environment before a sandboxed child can use it. */
+/** Return the lock namespace inside the session-owned runtime directory. */
 export function ensureRuntimeLockDir(sessionRuntimeDir) {
     if (!sessionRuntimeDir || !path.isAbsolute(sessionRuntimeDir))
         return undefined;
-    if (!isManagedSessionRuntimeDir(sessionRuntimeDir) && !isRunnerOwnedSessionRuntimeDir(sessionRuntimeDir))
+    if (!isManagedSessionRuntimeDir(sessionRuntimeDir))
         return undefined;
-    const parent = path.dirname(path.resolve(sessionRuntimeDir));
+    const parent = path.resolve(sessionRuntimeDir);
     if (!isPrivateDirectory(parent))
         return undefined;
-    const directory = path.join(parent, 'evolcore-locks');
+    const directory = path.join(parent, 'locks');
     try {
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
         return isPrivateDirectory(directory) ? directory : undefined;
@@ -325,7 +368,7 @@ export function parseTaskRuntimeContext(raw) {
 export function readTaskRuntimeContextFromEnv(env = process.env) {
     return parseTaskRuntimeContext(env[TASK_RUNTIME_CONTEXT_ENV]);
 }
-export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500) {
+export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 500, env = process.env) {
     if (!sessionId)
         return undefined;
     try {
@@ -333,7 +376,12 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
             import('../paths.js'),
             import('../ipc.js'),
         ]);
-        const response = await ipcQuery(resolvePaths().socket, { type: 'task-runtime-context', sessionId }, timeoutMs);
+        const response = await ipcQuery(resolvePaths().socket, {
+            type: 'task-runtime-context',
+            sessionId,
+            delegationToken: readDelegationCredential(env),
+            daemonRuntimeEpoch: env[DAEMON_RUNTIME_EPOCH_ENV],
+        }, timeoutMs);
         return response?.ok && response.context ? response.context : undefined;
     }
     catch {
@@ -343,7 +391,7 @@ export async function readTaskRuntimeContextFromDaemon(sessionId, timeoutMs = 50
 export async function readBestTaskRuntimeContext(env = process.env) {
     const envContext = readTaskRuntimeContextFromEnv(env);
     const sessionId = env.EVOLCORE_SESSION_ID || envContext?.sessionId;
-    return (await readTaskRuntimeContextFromDaemon(sessionId)) ?? envContext;
+    return (await readTaskRuntimeContextFromDaemon(sessionId, 500, env)) ?? envContext;
 }
 export function buildTaskRuntimeEnv(ctx) {
     const clean = normalizeTaskRuntimeContext(ctx);

package/dist/cli/trigger-command.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { ipcQuery } from '../ipc.js';
 import { isHelpFlag, wantsHelp } from './help.js';
-import { AGENT_DELEGATION_TOKEN_ENV } from '../core/auth/agent-delegation.js';
+import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { readTaskRuntimeContextFromEnv } from './task-context.js';
 import { normalizeTriggerDefinition, resolveScriptPath, } from '../trigger/validation.js';
 export async function cmdTrigger(args) {
@@ -101,13 +101,15 @@ function printHelp() {
 
 Create 参数模式支持:
   --once | --delay <时长> | --at <ISO时间> | --cron <表达式> | --every <时长> | --event <事件模式>
+  --event-filter <JSON>  (仅 --event；按事件 payload 字段匹配)
   --exec <script|trigger-session|target-session>  (必填)
   --prompt <文本> | --prompt-file <路径>
     Shell 双引号内的双引号、反引号和变量形式的美元符号都需在前面加反斜杠；trigger 保存的是还原后的原文
   --script-path <路径> --script-runtime <node|python|bash>
   --script-args <JSON> --script-timeout <时长>
-  --feedback <target>  (origin/silent 仅可通过 --file 导入)
+  --feedback <target|event-session>  (event-session 使用事件来源会话)
   --baseagent <name>  (仅 --exec trigger-session)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
   --model <模型>  --effort <low|medium|high|xhigh|max>
   --max-runs <次数>  --max-duration <时长: 30s|15m|2h|1d>
   --permission <readonly|auto|request|bypass|fullaccess>（省略则继承当前身份配置；fullaccess 仅 daemon-owner 且 feature flag 开启时可用）
@@ -125,10 +127,11 @@ Update 参数:
   --once | --delay | --at | --cron | --every | --event [--tz]
   --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
   --description <文本>  (空字符串删除)
+  --execution-timeout <时长>（模型类 Trigger 单次执行总时限）
   --model <模型>  --effort <强度>  --permission <权限模式|inherit>（inherit 清除覆盖）
   --max-runs <次数>  --max-duration <时长>
   --concurrency <forbid|replace|allow>  --missed-policy <skip|run-once|run-all>
-  --feedback <origin|target|silent>
+  --feedback <origin|target|event-session|silent>
   --target-channel <channelKey> --target-channel-id <ID>  (必须同时指定)
   --target-chat-type <private|group>  --target-session <main|thread> [--target-thread-id <threadId>]
   --trigger-thread <by-run|by-trigger>  --baseagent <name>  (仅 trigger_session 之间)
@@ -189,6 +192,7 @@ async function showTrigger(args, json) {
     if (t.execution.type === 'script')
         console.log(`script: ${scriptCommandLabel(t.execution.script)}`);
     console.log(`model: ${t.execution.model ?? 'inherit'}`);
+    console.log(`executionTimeoutMs: ${t.execution.timeoutMs ?? 'default'}`);
     console.log(`effort: ${t.execution.effort ?? 'inherit'}`);
     console.log(`permission: ${t.execution.permissionMode ?? 'inherit'}`);
     console.log(`feedback: ${t.feedback.strategy}${t.feedback.target ? ` -> ${t.feedback.target.channelKey}/${t.feedback.target.channelId}/${t.feedback.target.session}` : ''}`);
@@ -266,13 +270,14 @@ async function createTrigger(args, json) {
     }
     const parsed = parseResult.value;
     const agentAid = parsed.agentId ?? resolveAgentAid(args);
-    if (parsed.feedbackStrategy !== 'target') {
+    const eventSession = parsed.feedbackStrategy === 'event_session';
+    if (parsed.feedbackStrategy !== 'target' && !eventSession) {
         throw new Error('CLI flag 模式仅支持 --feedback target；origin/silent 请使用 /trigger 或 --file 导入 Trigger V3 第二阶段 JSON');
     }
-    if (!parsed.targetChannel || !parsed.targetChannelId) {
+    if (!eventSession && (!parsed.targetChannel || !parsed.targetChannelId)) {
         throw new Error('CLI flag 模式需要显式指定 --target-channel <channelKey> --target-channel-id <id>');
     }
-    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel.startsWith('aun#');
+    const targetIsAun = parsed.targetChannel === 'aun' || parsed.targetChannel?.startsWith('aun#');
     if (targetIsAun && !parsed.targetChatType) {
         throw new Error('AUN 目标必须显式指定 --target-chat-type private 或 group');
     }
@@ -299,6 +304,7 @@ async function createTrigger(args, json) {
             type: parsed.executionType,
             ...(script ? { script } : { prompt: parsed.prompt }),
             ...(parsed.model ? { model: parsed.model } : {}),
+            ...(parsed.executionTimeoutMs !== undefined ? { timeoutMs: parsed.executionTimeoutMs } : {}),
             ...(parsed.effort ? { effort: parsed.effort } : {}),
             ...(parsed.permissionMode ? { permissionMode: parsed.permissionMode } : {}),
             ...(parsed.executionType === 'trigger_session' ? {
@@ -308,7 +314,7 @@ async function createTrigger(args, json) {
             onError: 'retry',
             noopSentinel: '[[NOOP]]',
         },
-        feedback: {
+        feedback: eventSession ? { strategy: 'event_session' } : {
             strategy: 'target',
             target: {
                 channelKey: parsed.targetChannel,
@@ -362,8 +368,12 @@ function sourceFromParsed(parsed) {
     }
     if (parsed.scheduleType === 'interval')
         return { type: 'interval', everyMs: Number(parsed.scheduleValue) };
-    if (parsed.scheduleType === 'event')
-        return { type: 'event', eventPattern: parsed.scheduleValue };
+    if (parsed.scheduleType === 'event') {
+        const source = { type: 'event', eventPattern: parsed.scheduleValue };
+        if (parsed.eventFilter !== undefined)
+            source.filter = parsed.eventFilter;
+        return source;
+    }
     throw new Error(`unsupported scheduleType: ${parsed.scheduleType}`);
 }
 function executionTypeFromFlag(args) {
@@ -565,7 +575,7 @@ function handleTemplate(args) {
 }
 async function request(cmd, timeoutMs = 10_000) {
     const actorSessionId = process.env.EVOLCORE_SESSION_ID;
-    const delegationToken = process.env[AGENT_DELEGATION_TOKEN_ENV];
+    const delegationToken = readDelegationCredential();
     let controlToken;
     if (!actorSessionId) {
         try {

package/dist/config/builtin-roles.js

@@ -44,6 +44,16 @@ export function getManagementCommandPermissions(role) {
         'agent.baseagent.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'observable.current': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
         'observable.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.agent': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.storage': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.list': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.query': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.fetch': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.quota': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.relation': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.list': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.query': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.fetch': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
         'config.get': { allow: true, scopes: ['agent', 'relation'] },
         'config.set': { allow: true, scopes: ['agent', 'relation'] },
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },

package/dist/config/config-field-policy.js

@@ -29,14 +29,25 @@ const BASEAGENT_BEHAVIOR_FIELDS = new Set([
     'useVertex',
 ]);
 const SUPPORTED_BASEAGENTS = new Set(['claude', 'codex', 'gemini', 'ecagent']);
+/** Public behavior fields for a runner this version does not implement. */
+export function isUnsupportedBaseagentConfigField(fieldPath) {
+    const parts = fieldPath.split('.');
+    return parts.length === 3
+        && parts[0] === 'baseagents'
+        && /^[a-z][a-z0-9_-]*$/.test(parts[1])
+        && !SUPPORTED_BASEAGENTS.has(parts[1])
+        && BASEAGENT_BEHAVIOR_FIELDS.has(parts[2]);
+}
 const SENSITIVE_TOP_FIELDS = new Set([
     '$schema_version',
     'aid',
     'enabled',
     'lifecycle',
     'initialized',
+    'initialization',
     'owners',
     'access',
+    'fullaccess',
     'admins',
     'channels',
     'aun',

package/dist/config/config-manager.js

@@ -19,7 +19,8 @@ import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { normalizeAidDomain } from '../aun/aid/domain.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { ensureRelationSharedDirectory } from '../core/relation/shared-data.js';
 import { parseContactAlias } from './contact-alias.js';
 import { loadSchema, listSchemaVersions, currentVersion, isSchemaName, } from './schema-registry.js';
 import { mergeLayers, expandVars, buildEnvResolver } from './merge.js';
@@ -881,6 +882,9 @@ export function write(target, value, sel, opts = {}) {
     }
     // 2. 写入文件
     fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (target === ConfigTarget.Relation && sel?.self && sel.peerKey) {
+        ensureRelationSharedDirectory(sel.self, sel.peerKey);
+    }
     atomicWriteJson(file, normalized);
     finishConfigWrite(target, sel, file);
 }
@@ -1291,6 +1295,27 @@ export function resolveAgentConfig(sel, opts = {}) {
         stripRelationRoleData(stripStaticOwnerField(relationConfig)),
     ];
     const merged = mergeLayers(layers, fields);
+    // A baseagent block is a configuration record rather than an atomic value:
+    // selecting a model at Agent or relation scope must retain the defaults
+    // gateway credentials and endpoint. Keep the generic dictionary merge
+    // contract unchanged for every other field.
+    merged.baseagents = mergeBaseagentBlocks(layers);
+    return merged;
+}
+function mergeBaseagentBlocks(layers) {
+    const merged = {};
+    for (const layer of layers) {
+        const baseagents = layer?.baseagents;
+        if (!baseagents || typeof baseagents !== 'object' || Array.isArray(baseagents))
+            continue;
+        for (const [name, rawBlock] of Object.entries(baseagents)) {
+            if (!rawBlock || typeof rawBlock !== 'object' || Array.isArray(rawBlock)) {
+                merged[name] = rawBlock;
+                continue;
+            }
+            merged[name] = { ...(merged[name] ?? {}), ...rawBlock };
+        }
+    }
     return merged;
 }
 /**
@@ -1326,12 +1351,13 @@ function stripStaticOwnerField(config) {
     if (!Object.prototype.hasOwnProperty.call(config, 'owners')
         && !Object.prototype.hasOwnProperty.call(config, 'admins')
         && !Object.prototype.hasOwnProperty.call(config, 'access')
-        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions'))
+        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions')
+        && !Object.prototype.hasOwnProperty.call(config, 'fullaccess'))
         return config;
-    // groupSlashRequireMentions is intentionally Agent-only. Relation/defaults
+    // fullaccess and groupSlashRequireMentions are Agent-only. Relation/defaults
     // files allow forward-compatible unknown properties, so strip it before the
     // generic merge chain can treat a manually written value as an override.
-    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, ...rest } = config;
+    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, fullaccess: _fullaccess, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -1354,7 +1380,9 @@ export function resolveEffective(sel, opts = {}) {
         enabled: config.enabled,
         lifecycle: config.lifecycle,
         initialized: config.initialized,
+        initialization: config.initialization,
         owners: config.owners,
+        fullaccess: config.fullaccess,
         aun: config.aun,
         channels: config.channels ?? [],
         models: config.models,

package/dist/config/config-operation-service.js

@@ -6,8 +6,9 @@ import fs from 'fs';
 import path from 'path';
 import { resolvePaths, agentDir, agentRelationConfig } from '../paths.js';
 import { roleMenuQuery, roleMenuUpdate } from '../core/command/role-menu.js';
-import { parsePeerKey } from '../core/relation/peer-identity.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { parsePeerKey, PeerIdentityCache } from '../core/relation/peer-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { isUnsupportedBaseagentConfigField } from './config-field-policy.js';
 export const AUTHENTICATED_CONFIG_ROLE_ENV = 'EVOLCORE_AUTHENTICATED_CONFIG_ROLE';
 export function executeResolvedConfigCommand(command, options = {}) {
     try {
@@ -63,7 +64,7 @@ async function executeRelationRoleCommand(op, options) {
     if (!op.self || !op.peerKey) {
         return { ok: false, code: 'PEER_REQUIRED', error: 'role requires --self <aid> --peer <peer-aid>' };
     }
-    const target = roleTargetFromPeerKey(op.peerKey);
+    const target = roleTargetFromPeerKey(op.self, op.peerKey);
     const context = options.roleContext ?? {
         self: op.self,
         actorRole: options.role || 'owner',
@@ -139,7 +140,7 @@ async function executeRelationRoleCommand(op, options) {
         roleDetails: updatedDetails,
     };
 }
-function roleTargetFromPeerKey(peerKey) {
+function roleTargetFromPeerKey(self, peerKey) {
     let parsed;
     try {
         parsed = parsePeerKey(peerKey);
@@ -150,7 +151,13 @@ function roleTargetFromPeerKey(peerKey) {
     if (parsed.channelType !== 'aun') {
         throw new ConfigError('NOT_SUPPORTED', 'Relation role assignments currently support AUN peers only');
     }
-    return isExplicitGroupId(parsed.channelId)
+    const relation = read(ConfigTarget.Relation, { self, peerKey });
+    const identity = PeerIdentityCache.get('aun', parsed.channelId, agentDir(self));
+    const verifiedType = identity?.aid === parsed.channelId && identity.source === 'agentmd' && identity.verifiedAt > 0
+        ? identity.type : undefined;
+    const isGroup = relation?.targetKind ? relation.targetKind === 'group'
+        : verifiedType ? verifiedType === 'group' : isExplicitGroupId(parsed.channelId);
+    return isGroup
         ? { kind: 'group', groupId: parsed.channelId }
         : { kind: 'private', peerAid: parsed.channelId };
 }
@@ -159,6 +166,11 @@ export function executeResolvedConfigOperation(op, options = {}) {
         const missingAgent = selectedAgentError(op);
         if (missingAgent)
             return missingAgent;
+        if (op.configScope === 'agent'
+            && (op.field === 'fullaccess' || op.field.startsWith('fullaccess.'))
+            && op.subcommand !== 'get') {
+            return { ok: false, code: 'FORBIDDEN', error: 'Agent fullaccess can only be configured in ECWeb Agent settings' };
+        }
         if (op.subcommand === 'get')
             return executeGet(op, options);
         if (op.subcommand === 'set')
@@ -353,6 +365,9 @@ function executeSchema(command) {
     };
 }
 function executeGet(op, options) {
+    if (isUnsupportedBaseagentConfigField(op.field)) {
+        return { ok: false, code: 'UNSUPPORTED_FIELD', error: `Config field ${op.field} is not supported by this version` };
+    }
     const selector = selectorFor(op, options);
     if (op.configScope === 'process') {
         const config = read(ConfigTarget.Process, selector) || {};

package/dist/config/contact-book-store.js

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';

package/dist/config/contact-book.js

@@ -1,6 +1,6 @@
 import { agentContactConfig } from '../paths.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { ConfigTarget, read, validateConfig } from './config-manager.js';
 import { ContactMutationError, contactRevision, mutateContactBookSync } from './contact-book-store.js';
 import { formatContactAlias, normalizeContactChannelKey, parseContactAlias, } from './contact-alias.js';

package/dist/config/contact-operation-service.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig } from '../paths.js';
 import { getContactSnapshot, resolveContactView } from './contact-book.js';
 import { ContactMutationError } from './contact-book-store.js';

package/dist/config/peer-role-resolver.js

@@ -10,7 +10,7 @@ import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 export function isAuthenticated(userId) {
     return isValidAid(String(userId || '').trim());
 }

package/dist/config/resolved-config-op.js

@@ -97,6 +97,9 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: 'permissionMode is defined by roles; use the role policy editor',
         };
     }
+    if (subcommand !== 'get' && (field === 'initialization' || field.startsWith('initialization.'))) {
+        return { ok: false, code: 'INITIALIZATION_MANAGED', reason: 'initialization is owned by the creation service' };
+    }
     const isRelationRole = field === 'role';
     if (isRelationRole && selector.scope !== 'relation') {
         return {

package/dist/config-store.js

@@ -58,7 +58,7 @@ export function loadDaemonConfig() {
     return validateDaemonConfig(normalizeProcessConfigCompat(normalizeDaemonServices(sanitized)), false);
 }
 export function isFullAccessEnabled(config = loadDaemonConfig()) {
-    return config.fullaccess?.enabled === true;
+    return config.fullaccess?.enabled === undefined || config.fullaccess.enabled === true;
 }
 let eckSnapshotsConfigCache;
 /** Parse the process-level snapshot gate once for the current daemon lifecycle. */

package/dist/core/agent-application-service.js

@@ -48,6 +48,8 @@ function errorFrom(error, fallback = 'agent operation failed') {
  */
 export class AgentApplicationService {
     deps;
+    initialization;
+    setInitializationService(service) { this.initialization = service; }
     constructor(deps) {
         this.deps = deps;
     }
@@ -212,6 +214,8 @@ export class AgentApplicationService {
         }
         if (!config)
             return { ok: false, error: `Agent "${aid}" not found`, code: 'NOT_FOUND' };
+        if (!enabled)
+            await this.initialization?.cancel(aid);
         const previousEnabled = config.enabled;
         try {
             config.enabled = enabled;
@@ -240,6 +244,7 @@ export class AgentApplicationService {
         return { ok: true, aid, enabled, reloaded: result.ok };
     }
     async delete(aid, purge = false) {
+        await this.initialization?.cancel(aid);
         const paths = resolvePaths();
         const agentDir = path.join(paths.agentsDir, aid);
         const configPath = path.join(agentDir, 'config.json');

package/dist/core/audit/event-key.js

@@ -7,16 +7,31 @@ function stableDigest(parts) {
     const material = parts.map(part => compactPart(part) ?? '-').join('\u0000');
     return crypto.createHash('sha256').update(material).digest('hex').slice(0, 20);
 }
+/** Preserve distinct source IDs; fill aliases only when the producer omitted them. */
+export function normalizeToolCorrelation(input) {
+    const callId = compactPart(input.callId);
+    const correlationId = compactPart(input.correlationId);
+    const requestId = compactPart(input.requestId);
+    return {
+        callId: callId ?? correlationId ?? requestId,
+        correlationId: correlationId ?? callId ?? requestId,
+        requestId: requestId ?? callId ?? correlationId,
+    };
+}
 /** Stable across source/mirror records for one tool-call lifecycle. */
 export function buildToolLifecycleEventKey(input) {
+    const { callId } = normalizeToolCorrelation(input);
+    // No source ID means no safe join. Never merge unrelated anonymous calls.
+    if (!callId)
+        return `tool:unlinked:${crypto.randomUUID()}`;
     return `tool:${stableDigest([
         input.sessionId ?? 'unknown',
-        input.callId ?? input.correlationId ?? input.requestId ?? 'unknown',
+        callId,
     ])}`;
 }
 /** Stable across repeated projections of one authorization decision. */
 export function buildAuthorizationEventKey(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
+    const lifecycleId = normalizeToolCorrelation(input).callId;
     if (lifecycleId) {
         return `${buildToolLifecycleEventKey({
             sessionId: input.sessionId,