evolcore 0.0.26 → 0.0.27

package/dist/core/audit/log-integrity.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { buildToolLifecycleEventKey, normalizeToolCorrelation } from './event-key.js';
 // Logger rotation is hourly/daily, but the suffix is intentionally generic so
 // this check also covers future rotation formats without changing the audit.
 const STRUCTURED_LOG_RE = /^(?:daemon|events|channel-in|channel-out|messages|command-audit)(?:-[^.]+)?\.log$/;
@@ -33,6 +34,7 @@ export function inspectStructuredLogs(logDir, options = {}) {
             // daemon logs mix human-readable entries with structured audit lines.
             // Ignore the former, but still validate malformed structured payloads.
             if (MIXED_TEXT_LOG_RE.test(file)) {
+                raw = raw.replace(/^\[[^\]]+\] \[(?:DEBUG|INFO|WARN|ERROR)\] /, '');
                 if (raw.startsWith('[CommandAuditRecord] '))
                     raw = raw.slice('[CommandAuditRecord] '.length);
                 else if (!raw.startsWith('{'))
@@ -57,8 +59,9 @@ export function inspectStructuredLogs(logDir, options = {}) {
                 issues.push({ file, line: index + 1, reason: 'missing_agent', key });
             if (isLifecycleRecord(value) && !hasContextValue(lifecycleField(value, 'permissionMode')))
                 issues.push({ file, line: index + 1, reason: 'missing_permission_mode', key });
-            if (isCorrelatableRecord(value) && !key)
+            if (isCorrelatableRecord(value) && (!key || value.correlationMissing === true || key.startsWith('tool:unlinked:'))) {
                 issues.push({ file, line: index + 1, reason: 'missing_correlation' });
+            }
         });
     }
     const seen = new Set();
@@ -79,16 +82,33 @@ export function inspectStructuredLogs(logDir, options = {}) {
 function structuredRecordKey(value) {
     const nested = nestedRecord(value);
     const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
-    const eventPhase = firstDefined(value, nested, ['eventPhase', 'event_phase']);
+    const eventPhase = recordPhase(value);
     if (eventKey)
         return `${String(eventKey)}${eventPhase ? `:${String(eventPhase)}` : ''}`;
+    if (isLifecycleRecord(value)) {
+        const correlation = normalizeToolCorrelation({
+            callId: firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
+            correlationId: firstDefined(value, nested, ['correlationId', 'correlation_id']),
+            requestId: firstDefined(value, nested, ['requestId', 'request_id']),
+        });
+        if (!correlation.callId)
+            return undefined;
+        return `${buildToolLifecycleEventKey({
+            sessionId: lifecycleField(value, 'sessionId'),
+            ...correlation,
+        })}:${eventPhase}`;
+    }
     const correlation = firstDefined(value, nested, [
         'correlationId', 'correlation_id', 'callId', 'call_id', 'toolUseId', 'tool_use_id',
         'requestId', 'request_id', 'msgId', 'operationId',
     ]);
     if (!correlation)
         return undefined;
-    return `${canonicalEventType(value)}:${String(correlation)}`;
+    return JSON.stringify([lifecycleField(value, 'sessionId'), canonicalEventType(value), correlation, eventPhase]);
+}
+function recordPhase(value) {
+    return firstDefined(value, nestedRecord(value), ['eventPhase', 'event_phase'])
+        ?? (canonicalEventType(value) === 'tool_use' ? 'use' : canonicalEventType(value) === 'tool_result' ? 'result' : undefined);
 }
 function isLifecycleRecord(value) {
     const type = canonicalEventType(value);
@@ -101,11 +121,13 @@ function isCorrelatableRecord(value) {
 }
 function stableHash(value) {
     const nested = nestedRecord(value);
-    const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
+    const eventKey = structuredRecordKey(value);
     const canonical = {
         eventKey,
-        eventPhase: firstDefined(value, nested, ['eventPhase', 'event_phase']),
+        eventPhase: recordPhase(value),
         type: canonicalEventType(value),
+        operation: firstDefined(value, nested, ['operation']),
+        targetAgentAid: firstDefined(value, nested, ['targetAgentAid']),
         toolName: firstDefined(value, nested, ['toolName', 'tool', 'name']),
         callId: eventKey ? undefined : firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
         correlationId: eventKey ? undefined : firstDefined(value, nested, ['correlationId', 'correlation_id']),
@@ -116,11 +138,15 @@ function stableHash(value) {
         isError: firstDefined(value, nested, ['isError', 'is_error']) ?? (value.ok === false || nested?.ok === false ? true : undefined),
         errorCode: firstDefined(value, nested, ['errorCode', 'error_code']),
         decision: firstDefined(value, nested, ['decision']),
+        decisionSource: firstDefined(value, nested, ['decisionSource', 'decision_source']),
+        policyCode: firstDefined(value, nested, ['policyCode', 'policy_code']),
         executed: firstDefined(value, nested, ['executed']),
         executionState: firstDefined(value, nested, ['executionState', 'execution_state']),
-        input: firstDefined(value, nested, ['input']),
-        result: firstDefined(value, nested, ['result', 'content']),
-        error: firstDefined(value, nested, ['error', 'errorMessage']),
+        // A lifecycle stage may be mirrored without its large input/output body.
+        // Keep decision/classification differences, not projection payload size.
+        input: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['input']),
+        result: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['result', 'content']),
+        error: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['error', 'errorMessage']),
     };
     return crypto.createHash('sha256').update(JSON.stringify(canonical)).digest('hex').slice(0, 16);
 }

package/dist/core/auth/agent-delegation.js

@@ -1,9 +1,22 @@
+import { assertAgentPolicyAuthorization } from '../role/runtime-policy.js';
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 import { logger } from '../../utils/logger.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
+export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
+/**
+ * Resolve the credential carried by an EC CLI process. A live task token has
+ * priority; persistent Codex threads fall back to their session credential.
+ */
+export function readDelegationCredential(env = process.env) {
+    const taskToken = env[AGENT_DELEGATION_TOKEN_ENV]?.trim();
+    if (taskToken)
+        return taskToken;
+    const sessionToken = env[CODEX_SESSION_TOKEN_ENV]?.trim();
+    return sessionToken || undefined;
+}
 export class AgentDelegationRegistry {
     runtimeEpoch = crypto.randomBytes(16).toString('hex');
     grantsByHash = new Map();
@@ -24,6 +37,13 @@ export class AgentDelegationRegistry {
         return token;
     }
     validate(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, true);
+    }
+    /** Authenticate a CLI context lookup without spending its approved operation. */
+    validateForContext(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, false);
+    }
+    validateToken(token, sessionId, commandHash, consumeApproval) {
         if (!token) {
             return {
                 ok: false,
@@ -37,10 +57,19 @@ export class AgentDelegationRegistry {
         if (grant
             && grant.sessionId === sessionId
             && this.activeHashBySession.get(sessionId) === tokenHash) {
+            if (grant.executionIdentity?.source === 'agent-policy') {
+                try {
+                    assertAgentPolicyAuthorization(grant.executionIdentity);
+                }
+                catch {
+                    this.revokeSession(sessionId);
+                    return { ok: false, code: 'INVALID_DELEGATION', reason: 'Agent fullaccess policy was revoked', diagnosticCause: 'task_replaced' };
+                }
+            }
             return { ok: true, grant };
         }
         const approved = commandHash
-            ? this.consumeApprovedCommand(tokenHash, sessionId, commandHash)
+            ? this.readApprovedCommand(tokenHash, sessionId, commandHash, consumeApproval)
             : undefined;
         if (approved)
             return { ok: true, grant: approved };
@@ -66,11 +95,12 @@ export class AgentDelegationRegistry {
         const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
         if (!grant || grant.taskId !== input.taskId)
             return false;
-        if (!input.carrierToken || !isDelegationCommandHash(input.commandHash))
+        const sessionToken = input.sessionToken ?? input.carrierToken;
+        if (!sessionToken || !isDelegationCommandHash(input.commandHash))
             return false;
         this.deleteExpiredApprovedCommands();
-        const carrierTokenHash = hashDelegationToken(input.carrierToken);
-        const key = approvedCommandKey(carrierTokenHash, input.sessionId, input.commandHash);
+        const sessionTokenHash = hashDelegationToken(sessionToken);
+        const key = approvedCommandKey(sessionTokenHash, input.sessionId, input.commandHash);
         const existing = this.approvedCommands.get(key);
         const ttlMs = Math.max(1, Math.min(input.ttlMs ?? AGENT_DELEGATION_COMMAND_TTL_MS, AGENT_DELEGATION_COMMAND_TTL_MS));
         this.approvedCommands.set(key, {
@@ -105,10 +135,10 @@ export class AgentDelegationRegistry {
         this.activeHashBySession.delete(sessionId);
         this.deleteApprovedCommandsForSession(sessionId);
     }
-    consumeApprovedCommand(carrierTokenHash, sessionId, commandHash) {
+    readApprovedCommand(sessionTokenHash, sessionId, commandHash, consume) {
         if (!isDelegationCommandHash(commandHash))
             return undefined;
-        const key = approvedCommandKey(carrierTokenHash, sessionId, commandHash);
+        const key = approvedCommandKey(sessionTokenHash, sessionId, commandHash);
         const approved = this.approvedCommands.get(key);
         if (!approved)
             return undefined;
@@ -124,10 +154,12 @@ export class AgentDelegationRegistry {
             this.approvedCommands.delete(key);
             return undefined;
         }
-        if (approved.remainingUses <= 1)
-            this.approvedCommands.delete(key);
-        else
-            approved.remainingUses--;
+        if (consume) {
+            if (approved.remainingUses <= 1)
+                this.approvedCommands.delete(key);
+            else
+                approved.remainingUses--;
+        }
         return grant;
     }
     deleteExpiredApprovedCommands() {
@@ -216,8 +248,10 @@ function isValidFullAccessExecutionIdentity(identity) {
         || identity.processRole !== 'fullaccess-run'
         || identity.dataScope !== 'daemon')
         return false;
-    if (identity.source === 'fullaccess-command') {
-        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0;
+    if (identity.source === 'fullaccess-command' || identity.source === 'agent-policy') {
+        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
+            && (identity.source !== 'agent-policy'
+                || (typeof identity.agentAid === 'string' && identity.agentAid.length > 0));
     }
     return identity.source === 'trigger'
         && typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
@@ -228,8 +262,8 @@ function isValidFullAccessExecutionIdentity(identity) {
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }
-function approvedCommandKey(carrierTokenHash, sessionId, commandHash) {
-    return JSON.stringify([carrierTokenHash, sessionId, commandHash]);
+function approvedCommandKey(sessionTokenHash, sessionId, commandHash) {
+    return JSON.stringify([sessionTokenHash, sessionId, commandHash]);
 }
 function isDelegationCommandHash(value) {
     return /^[a-f0-9]{64}$/.test(value);

package/dist/core/auth/auth-gateway.js

@@ -70,6 +70,7 @@ export function buildAuthSubject(input) {
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
         fromControlChannel: !!input.fromControlChannel,
+        ecwebManagement: input.ecwebManagement === true && isTrustedDaemonOwner && input.fromControlChannel === true,
         allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
@@ -114,6 +115,7 @@ export function authorizeOperation(params) {
         return access;
     }
     const ctx = {
+        principalId: params.subject.principalId,
         intent: params.intent,
         actorId: params.subject.actorId,
         channel: params.subject.channel,

package/dist/core/auth/authorization-audit.js

@@ -2,7 +2,7 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
-import { buildAuthorizationEventKey, buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { buildAuthorizationEventKey, buildToolLifecycleEventKey, normalizeToolCorrelation } from '../audit/event-key.js';
 import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
@@ -14,6 +14,8 @@ export function auditCommandAuthorization(event) {
         event.operation === 'permission.runtime' ||
         event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
+        event.operation === 'file.root.storage' ||
+        event.operation.startsWith('file.storage.') ||
         event.operation === 'cli.exec.raw';
     if (!shouldAudit)
         return;
@@ -25,6 +27,8 @@ export function auditFullAccessEvent(input) {
         || input.event === 'fullaccess.trigger.deescalated';
     const executionEvent = input.event === 'fullaccess.execution.started'
         || input.event === 'fullaccess.execution.ended'
+        || input.event === 'fullaccess.agent-policy.execution.started'
+        || input.event === 'fullaccess.agent-policy.execution.ended'
         || input.event === 'fullaccess.trigger.execution.started'
         || input.event === 'fullaccess.trigger.execution.ended';
     // The scheduler triggers a run, but the executing subject is the task-bound
@@ -39,7 +43,7 @@ export function auditFullAccessEvent(input) {
         ts: Date.now(),
         callId: input.attemptId ?? input.runId ?? input.taskId ?? input.messageId,
         correlationId: input.runId ?? input.taskId,
-        source: input.source === 'trigger' ? 'agent-tool' : 'slash',
+        source: input.source === 'fullaccess-command' ? 'slash' : 'agent-tool',
         operation: input.event,
         // CommandScope has no separate daemon value; process is the closest
         // existing scope for daemon-owner authorization and keeps audit records
@@ -97,20 +101,11 @@ export function auditFullAccessEvent(input) {
  * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
  */
 export function auditToolPreflightDenial(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'preflight',
-        } : {}),
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'preflight',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
@@ -138,29 +133,20 @@ export function auditToolPreflightDenial(input) {
         role: input.role ?? 'unknown',
         selfAid: input.selfAid,
         peerKey: input.peerKey,
-        requestId: input.requestId,
         taskId: input.taskId,
     });
 }
 /**
  * Emit one canonical, structured record for every Codex app-server approval
- * decision. The app-server's request id is the lifecycle key; method and
+ * decision. Prefer the tool call id over the approval request id; method and
  * decision source make policy, user, and infrastructure denials distinct.
  */
 export function auditCodexApprovalDecision(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'approval',
-        } : {}),
-        callId: input.callId ?? input.correlationId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'approval',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
@@ -172,8 +158,6 @@ export function auditCodexApprovalDecision(input) {
         errorCode: input.decision === 'deny'
             ? input.decisionSource === 'approval' ? 'USER_DENIED' : input.decisionSource === 'policy' ? 'POLICY_DENIED' : infrastructureErrorCode(input.policyCode)
             : undefined,
-        requestId: input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -204,6 +188,8 @@ export function auditPermissionDecision(input) {
     auditPermissionLifecycle({
         phase: 'final',
         requestId,
+        callId: input.callId,
+        correlationId: input.correlationId,
         sessionId: input.sessionId,
         agentAid: input.agentAid,
         agentName: input.agentName,
@@ -235,9 +221,7 @@ export function auditPermissionLifecycle(input) {
             requestId: input.requestId,
         }),
         eventPhase: input.phase,
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
-        requestId: input.requestId,
+        ...normalizeToolCorrelation(input),
         sessionId,
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -279,6 +263,8 @@ export function auditPermissionLifecycle(input) {
 export function auditToolInfrastructureFailure(input) {
     auditCommandAuthorization({
         ts: Date.now(),
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'final',
         source: 'agent-tool',
         operation: 'tool.execution.blocked',
         scope: 'filesystem',
@@ -288,9 +274,7 @@ export function auditToolInfrastructureFailure(input) {
         errorCode: infrastructureErrorCode(input.policyCode),
         executed: false,
         executionState: 'blocked',
-        callId: input.callId,
-        correlationId: input.callId,
-        requestId: input.callId,
+        ...normalizeToolCorrelation(input),
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -300,8 +284,20 @@ export function auditToolInfrastructureFailure(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: input.occurrences && input.occurrences > 1
-            ? { occurrences: input.occurrences }
+        argsSummary: input.occurrences || input.sandboxFailure
+            ? {
+                ...(input.occurrences ? { occurrences: input.occurrences } : {}),
+                // Flat primitive fields survive the audit argument redactor and can
+                // be aggregated without reparsing (possibly truncated) stderr.
+                ...(input.sandboxFailure ? {
+                    sandboxFailureKind: input.sandboxFailure.kind,
+                    sandboxFailureObservation: input.sandboxFailure.observation,
+                    sandboxInitializationFailures: input.sandboxFailure.counters.total,
+                    sandboxApplySeccompFailures: input.sandboxFailure.counters.applySeccomp,
+                    ...Object.fromEntries(Object.entries(input.sandboxFailure.counters.byKind)
+                        .map(([kind, count]) => [`sandboxFailures_${kind}`, count])),
+                } : {}),
+            }
             : undefined,
     });
 }
@@ -335,7 +331,7 @@ function buildAuditRecord(event) {
                     : 'authorized');
     const ecwebRequestId = event.source === 'ecweb' ? event.ecwebRequestId : undefined;
     const requestId = event.requestId ?? ecwebRequestId;
-    const correlationId = event.correlationId ?? requestId;
+    const correlationId = event.correlationId ?? event.callId ?? requestId;
     const lifecycleId = event.callId ?? correlationId ?? requestId;
     return {
         ts: event.ts,

package/dist/core/auth/operation-authorizer.js

@@ -1,13 +1,15 @@
 import { getRoleDefinition } from '../../config/roles.js';
 import { isManagementRole } from '../../config/builtin-roles.js';
-import { relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
+import { isUnsupportedBaseagentConfigField, relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
 import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
 import { normalizePeer } from '../model/config-scope.js';
 import { getOperationMeta } from './operation-catalog.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+import { sameGroupAid } from '../../aun/group/index.js';
 const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
     'agent.list',
     'agent.create',
+    'agent.initialize',
     'agent.delete',
     'agent.enable',
     'agent.disable',
@@ -99,6 +101,12 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
         return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
     }
+    if (resolvedConfigCommand?.kind === 'field'
+        && resolvedConfigCommand.configScope === 'agent'
+        && (resolvedConfigCommand.field === 'fullaccess' || resolvedConfigCommand.field.startsWith('fullaccess.'))
+        && resolvedConfigCommand.subcommand !== 'get') {
+        return denyDecision(ctx, 'NOT_ALLOWED', 'Agent fullaccess can only be configured in ECWeb Agent settings', operation, intent.scope, true);
+    }
     // A fullaccess task is deliberately a daemon-scoped runtime identity. It
     // still has to name a known operation and pass structural command parsing,
     // but relation/Agent role rules, source lists, and daemon-owner gates are
@@ -224,11 +232,30 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: role === 'owner' ? 'agent-owner-persona' : 'daemon-owner-persona',
         };
     }
+    if (operation === 'agent.welcome') {
+        if (!isCurrentAgentTarget(ctx) || ctx.chatType !== 'private'
+            || (role !== 'owner' && !(role === 'admin' && intent.args.action === 'show'))) {
+            return denyDecision(ctx, 'NOT_ALLOWED', 'welcome requires the current Agent Owner in private (admin may read)', operation, intent.scope, opMeta.dangerous);
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'self-agent-welcome',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
             return denyDecision(ctx, intent.scope === 'relation' ? 'ARGUMENT_MISMATCH' : 'SCOPE_MISMATCH', targetCheck.reason || 'Config target is outside the current task context', operation, intent.scope, opMeta.dangerous);
         }
+        if (resolvedConfigCommand.kind === 'field'
+            && resolvedConfigCommand.subcommand === 'get'
+            && isUnsupportedBaseagentConfigField(resolvedConfigCommand.field)) {
+            return denyDecision(ctx, 'UNSUPPORTED_FIELD', `Config field ${resolvedConfigCommand.field} is not supported by this version`, operation, intent.scope, opMeta.dangerous);
+        }
         const identityMutationCheck = checkManagementIdentityMutation(ctx, resolvedConfigCommand);
         if (!identityMutationCheck.ok) {
             return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
@@ -236,7 +263,9 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (role === 'owner' && isCurrentAgentTarget(ctx)) {
+        if (role === 'owner'
+            && isCurrentAgentTarget(ctx)
+            && !isCrossRelationConfigRead(ctx, resolvedConfigCommand)) {
             return {
                 allow: true,
                 operation,
@@ -636,6 +665,19 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     }
     return { ok: true };
 }
+function isCrossRelationConfigRead(ctx, command) {
+    if (!command || command.kind !== 'field' || command.subcommand !== 'get' || command.configScope !== 'relation') {
+        return false;
+    }
+    if (!command.peerKey || !ctx.peerKey)
+        return true;
+    try {
+        return normalizeRelationPeer(command.peerKey) !== normalizeRelationPeer(ctx.peerKey);
+    }
+    catch {
+        return true;
+    }
+}
 function checkResolvedConfigTarget(ctx, command) {
     if (command.kind === 'global' || command.configScope === 'process' || command.configScope === 'defaults') {
         return { ok: true };
@@ -652,8 +694,12 @@ function checkResolvedConfigTarget(ctx, command) {
         return { ok: true };
     }
     if (ctx.allowExplicitRelationTarget
-        && (ctx.role === 'owner' || ctx.role === 'admin')
-        && (command.kind === 'field' && command.operationId.startsWith('role.'))) {
+        && isManagementRole(ctx.role)
+        && command.kind === 'field'
+        && (command.operationId.startsWith('role.') || command.subcommand === 'get')) {
+        // Management reads may select another relation of this Agent. This only
+        // relaxes target matching; admin field grants/constraints are checked later.
+        // Ordinary config writes and whole-config commands remain current-relation only.
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent relation can be targeted' };
         }
@@ -693,7 +739,8 @@ function checkCurrentRelation(ctx, resolvedConfigCommand) {
         return { ok: false, reason: 'Current relation context is required' };
     }
     try {
-        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)) {
+        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)
+            && !sameAunGroupRelation(ctx, requestedPeer, ctx.peerKey)) {
             if (ctx.intent.operation.startsWith('ec.group.')) {
                 const currentGroup = peerIdFromArg(ctx.peerKey);
                 const targetGroup = stringArg(ctx.intent.args.targetId) ?? peerIdFromArg(requestedPeer);
@@ -788,6 +835,20 @@ function collectStringValues(value, out) {
             out.add(item);
     }
 }
+function sameAunGroupRelation(ctx, requested, current) {
+    if (ctx.chatType !== 'group'
+        || (!ctx.intent.operation.startsWith('ec.group.') && !ctx.intent.operation.startsWith('ec.fs.')))
+        return false;
+    try {
+        const target = parsePeerKey(requested);
+        const relation = parsePeerKey(current);
+        return target.channelType === 'aun' && relation.channelType === 'aun'
+            && sameGroupAid(target.channelId, relation.channelId);
+    }
+    catch {
+        return false;
+    }
+}
 function checkOwnPeer(ctx) {
     const argPeer = stringArg(ctx.intent.args.peer);
     const argPeerKey = stringArg(ctx.intent.args.peerKey);
@@ -812,6 +873,7 @@ function checkOwnPeer(ctx) {
                 candidateKeys.add(`${legacyChannelType}::${argPeer}`);
         }
         return candidateKeys.has(expectedPeerKey)
+            || [...candidateKeys].some(key => sameAunGroupRelation(ctx, key, expectedPeerKey))
             ? { ok: true }
             : { ok: false, reason: 'Only the current group relation can be targeted' };
     }