evolcore 0.0.26 → 0.0.28

package/dist/config/builtin-roles.js

@@ -44,6 +44,16 @@ export function getManagementCommandPermissions(role) {
         'agent.baseagent.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
         'observable.current': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true } },
         'observable.update': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.agent': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.storage': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.list': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.query': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.fetch': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.storage.quota': { allow: true, scopes: ['agent'], constraints: { requireAgentOwner: true, targetCurrentAgentOnly: true } },
+        'file.root.relation': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.list': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.query': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
+        'file.data.fetch': { allow: true, scopes: ['relation', 'agent'], constraints: { targetCurrentAgentOnly: true } },
         'config.get': { allow: true, scopes: ['agent', 'relation'] },
         'config.set': { allow: true, scopes: ['agent', 'relation'] },
         'config.unset': { allow: true, scopes: ['agent', 'relation'] },

package/dist/config/config-field-policy.js

@@ -29,14 +29,25 @@ const BASEAGENT_BEHAVIOR_FIELDS = new Set([
     'useVertex',
 ]);
 const SUPPORTED_BASEAGENTS = new Set(['claude', 'codex', 'gemini', 'ecagent']);
+/** Public behavior fields for a runner this version does not implement. */
+export function isUnsupportedBaseagentConfigField(fieldPath) {
+    const parts = fieldPath.split('.');
+    return parts.length === 3
+        && parts[0] === 'baseagents'
+        && /^[a-z][a-z0-9_-]*$/.test(parts[1])
+        && !SUPPORTED_BASEAGENTS.has(parts[1])
+        && BASEAGENT_BEHAVIOR_FIELDS.has(parts[2]);
+}
 const SENSITIVE_TOP_FIELDS = new Set([
     '$schema_version',
     'aid',
     'enabled',
     'lifecycle',
     'initialized',
+    'initialization',
     'owners',
     'access',
+    'fullaccess',
     'admins',
     'channels',
     'aun',

package/dist/config/config-manager.js

@@ -19,7 +19,8 @@ import { atomicReadJson, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { normalizeAidDomain } from '../aun/aid/domain.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { ensureRelationSharedDirectory } from '../core/relation/shared-data.js';
 import { parseContactAlias } from './contact-alias.js';
 import { loadSchema, listSchemaVersions, currentVersion, isSchemaName, } from './schema-registry.js';
 import { mergeLayers, expandVars, buildEnvResolver } from './merge.js';
@@ -881,6 +882,9 @@ export function write(target, value, sel, opts = {}) {
     }
     // 2. 写入文件
     fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (target === ConfigTarget.Relation && sel?.self && sel.peerKey) {
+        ensureRelationSharedDirectory(sel.self, sel.peerKey);
+    }
     atomicWriteJson(file, normalized);
     finishConfigWrite(target, sel, file);
 }
@@ -1291,6 +1295,27 @@ export function resolveAgentConfig(sel, opts = {}) {
         stripRelationRoleData(stripStaticOwnerField(relationConfig)),
     ];
     const merged = mergeLayers(layers, fields);
+    // A baseagent block is a configuration record rather than an atomic value:
+    // selecting a model at Agent or relation scope must retain the defaults
+    // gateway credentials and endpoint. Keep the generic dictionary merge
+    // contract unchanged for every other field.
+    merged.baseagents = mergeBaseagentBlocks(layers);
+    return merged;
+}
+function mergeBaseagentBlocks(layers) {
+    const merged = {};
+    for (const layer of layers) {
+        const baseagents = layer?.baseagents;
+        if (!baseagents || typeof baseagents !== 'object' || Array.isArray(baseagents))
+            continue;
+        for (const [name, rawBlock] of Object.entries(baseagents)) {
+            if (!rawBlock || typeof rawBlock !== 'object' || Array.isArray(rawBlock)) {
+                merged[name] = rawBlock;
+                continue;
+            }
+            merged[name] = { ...(merged[name] ?? {}), ...rawBlock };
+        }
+    }
     return merged;
 }
 /**
@@ -1326,12 +1351,13 @@ function stripStaticOwnerField(config) {
     if (!Object.prototype.hasOwnProperty.call(config, 'owners')
         && !Object.prototype.hasOwnProperty.call(config, 'admins')
         && !Object.prototype.hasOwnProperty.call(config, 'access')
-        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions'))
+        && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions')
+        && !Object.prototype.hasOwnProperty.call(config, 'fullaccess'))
         return config;
-    // groupSlashRequireMentions is intentionally Agent-only. Relation/defaults
+    // fullaccess and groupSlashRequireMentions are Agent-only. Relation/defaults
     // files allow forward-compatible unknown properties, so strip it before the
     // generic merge chain can treat a manually written value as an override.
-    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, ...rest } = config;
+    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, fullaccess: _fullaccess, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -1354,7 +1380,9 @@ export function resolveEffective(sel, opts = {}) {
         enabled: config.enabled,
         lifecycle: config.lifecycle,
         initialized: config.initialized,
+        initialization: config.initialization,
         owners: config.owners,
+        fullaccess: config.fullaccess,
         aun: config.aun,
         channels: config.channels ?? [],
         models: config.models,

package/dist/config/config-operation-service.js

@@ -6,8 +6,9 @@ import fs from 'fs';
 import path from 'path';
 import { resolvePaths, agentDir, agentRelationConfig } from '../paths.js';
 import { roleMenuQuery, roleMenuUpdate } from '../core/command/role-menu.js';
-import { parsePeerKey } from '../core/relation/peer-identity.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { parsePeerKey, PeerIdentityCache } from '../core/relation/peer-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { isUnsupportedBaseagentConfigField } from './config-field-policy.js';
 export const AUTHENTICATED_CONFIG_ROLE_ENV = 'EVOLCORE_AUTHENTICATED_CONFIG_ROLE';
 export function executeResolvedConfigCommand(command, options = {}) {
     try {
@@ -63,7 +64,7 @@ async function executeRelationRoleCommand(op, options) {
     if (!op.self || !op.peerKey) {
         return { ok: false, code: 'PEER_REQUIRED', error: 'role requires --self <aid> --peer <peer-aid>' };
     }
-    const target = roleTargetFromPeerKey(op.peerKey);
+    const target = roleTargetFromPeerKey(op.self, op.peerKey);
     const context = options.roleContext ?? {
         self: op.self,
         actorRole: options.role || 'owner',
@@ -139,7 +140,7 @@ async function executeRelationRoleCommand(op, options) {
         roleDetails: updatedDetails,
     };
 }
-function roleTargetFromPeerKey(peerKey) {
+function roleTargetFromPeerKey(self, peerKey) {
     let parsed;
     try {
         parsed = parsePeerKey(peerKey);
@@ -150,7 +151,13 @@ function roleTargetFromPeerKey(peerKey) {
     if (parsed.channelType !== 'aun') {
         throw new ConfigError('NOT_SUPPORTED', 'Relation role assignments currently support AUN peers only');
     }
-    return isExplicitGroupId(parsed.channelId)
+    const relation = read(ConfigTarget.Relation, { self, peerKey });
+    const identity = PeerIdentityCache.get('aun', parsed.channelId, agentDir(self));
+    const verifiedType = identity?.aid === parsed.channelId && identity.source === 'agentmd' && identity.verifiedAt > 0
+        ? identity.type : undefined;
+    const isGroup = relation?.targetKind ? relation.targetKind === 'group'
+        : verifiedType ? verifiedType === 'group' : isExplicitGroupId(parsed.channelId);
+    return isGroup
         ? { kind: 'group', groupId: parsed.channelId }
         : { kind: 'private', peerAid: parsed.channelId };
 }
@@ -159,6 +166,11 @@ export function executeResolvedConfigOperation(op, options = {}) {
         const missingAgent = selectedAgentError(op);
         if (missingAgent)
             return missingAgent;
+        if (op.configScope === 'agent'
+            && (op.field === 'fullaccess' || op.field.startsWith('fullaccess.'))
+            && op.subcommand !== 'get') {
+            return { ok: false, code: 'FORBIDDEN', error: 'Agent fullaccess can only be configured in ECWeb Agent settings' };
+        }
         if (op.subcommand === 'get')
             return executeGet(op, options);
         if (op.subcommand === 'set')
@@ -353,6 +365,9 @@ function executeSchema(command) {
     };
 }
 function executeGet(op, options) {
+    if (isUnsupportedBaseagentConfigField(op.field)) {
+        return { ok: false, code: 'UNSUPPORTED_FIELD', error: `Config field ${op.field} is not supported by this version` };
+    }
     const selector = selectorFor(op, options);
     if (op.configScope === 'process') {
         const config = read(ConfigTarget.Process, selector) || {};

package/dist/config/contact-book-store.js

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';

package/dist/config/contact-book.js

@@ -1,6 +1,6 @@
 import { agentContactConfig } from '../paths.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { ConfigTarget, read, validateConfig } from './config-manager.js';
 import { ContactMutationError, contactRevision, mutateContactBookSync } from './contact-book-store.js';
 import { formatContactAlias, normalizeContactChannelKey, parseContactAlias, } from './contact-alias.js';

package/dist/config/contact-operation-service.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig } from '../paths.js';
 import { getContactSnapshot, resolveContactView } from './contact-book.js';
 import { ContactMutationError } from './contact-book-store.js';

package/dist/config/peer-role-resolver.js

@@ -10,7 +10,7 @@ import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 export function isAuthenticated(userId) {
     return isValidAid(String(userId || '').trim());
 }

package/dist/config/resolved-config-op.js

@@ -97,6 +97,9 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: 'permissionMode is defined by roles; use the role policy editor',
         };
     }
+    if (subcommand !== 'get' && (field === 'initialization' || field.startsWith('initialization.'))) {
+        return { ok: false, code: 'INITIALIZATION_MANAGED', reason: 'initialization is owned by the creation service' };
+    }
     const isRelationRole = field === 'role';
     if (isRelationRole && selector.scope !== 'relation') {
         return {

package/dist/config-store.js

@@ -58,7 +58,7 @@ export function loadDaemonConfig() {
     return validateDaemonConfig(normalizeProcessConfigCompat(normalizeDaemonServices(sanitized)), false);
 }
 export function isFullAccessEnabled(config = loadDaemonConfig()) {
-    return config.fullaccess?.enabled === true;
+    return config.fullaccess?.enabled === undefined || config.fullaccess.enabled === true;
 }
 let eckSnapshotsConfigCache;
 /** Parse the process-level snapshot gate once for the current daemon lifecycle. */

package/dist/core/agent-application-service.js

@@ -48,6 +48,8 @@ function errorFrom(error, fallback = 'agent operation failed') {
  */
 export class AgentApplicationService {
     deps;
+    initialization;
+    setInitializationService(service) { this.initialization = service; }
     constructor(deps) {
         this.deps = deps;
     }
@@ -212,6 +214,8 @@ export class AgentApplicationService {
         }
         if (!config)
             return { ok: false, error: `Agent "${aid}" not found`, code: 'NOT_FOUND' };
+        if (!enabled)
+            await this.initialization?.cancel(aid);
         const previousEnabled = config.enabled;
         try {
             config.enabled = enabled;
@@ -240,6 +244,7 @@ export class AgentApplicationService {
         return { ok: true, aid, enabled, reloaded: result.ok };
     }
     async delete(aid, purge = false) {
+        await this.initialization?.cancel(aid);
         const paths = resolvePaths();
         const agentDir = path.join(paths.agentsDir, aid);
         const configPath = path.join(agentDir, 'config.json');

package/dist/core/audit/event-key.js

@@ -7,16 +7,31 @@ function stableDigest(parts) {
     const material = parts.map(part => compactPart(part) ?? '-').join('\u0000');
     return crypto.createHash('sha256').update(material).digest('hex').slice(0, 20);
 }
+/** Preserve distinct source IDs; fill aliases only when the producer omitted them. */
+export function normalizeToolCorrelation(input) {
+    const callId = compactPart(input.callId);
+    const correlationId = compactPart(input.correlationId);
+    const requestId = compactPart(input.requestId);
+    return {
+        callId: callId ?? correlationId ?? requestId,
+        correlationId: correlationId ?? callId ?? requestId,
+        requestId: requestId ?? callId ?? correlationId,
+    };
+}
 /** Stable across source/mirror records for one tool-call lifecycle. */
 export function buildToolLifecycleEventKey(input) {
+    const { callId } = normalizeToolCorrelation(input);
+    // No source ID means no safe join. Never merge unrelated anonymous calls.
+    if (!callId)
+        return `tool:unlinked:${crypto.randomUUID()}`;
     return `tool:${stableDigest([
         input.sessionId ?? 'unknown',
-        input.callId ?? input.correlationId ?? input.requestId ?? 'unknown',
+        callId,
     ])}`;
 }
 /** Stable across repeated projections of one authorization decision. */
 export function buildAuthorizationEventKey(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
+    const lifecycleId = normalizeToolCorrelation(input).callId;
     if (lifecycleId) {
         return `${buildToolLifecycleEventKey({
             sessionId: input.sessionId,

package/dist/core/audit/log-integrity.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { buildToolLifecycleEventKey, normalizeToolCorrelation } from './event-key.js';
 // Logger rotation is hourly/daily, but the suffix is intentionally generic so
 // this check also covers future rotation formats without changing the audit.
 const STRUCTURED_LOG_RE = /^(?:daemon|events|channel-in|channel-out|messages|command-audit)(?:-[^.]+)?\.log$/;
@@ -33,6 +34,7 @@ export function inspectStructuredLogs(logDir, options = {}) {
             // daemon logs mix human-readable entries with structured audit lines.
             // Ignore the former, but still validate malformed structured payloads.
             if (MIXED_TEXT_LOG_RE.test(file)) {
+                raw = raw.replace(/^\[[^\]]+\] \[(?:DEBUG|INFO|WARN|ERROR)\] /, '');
                 if (raw.startsWith('[CommandAuditRecord] '))
                     raw = raw.slice('[CommandAuditRecord] '.length);
                 else if (!raw.startsWith('{'))
@@ -57,8 +59,9 @@ export function inspectStructuredLogs(logDir, options = {}) {
                 issues.push({ file, line: index + 1, reason: 'missing_agent', key });
             if (isLifecycleRecord(value) && !hasContextValue(lifecycleField(value, 'permissionMode')))
                 issues.push({ file, line: index + 1, reason: 'missing_permission_mode', key });
-            if (isCorrelatableRecord(value) && !key)
+            if (isCorrelatableRecord(value) && (!key || value.correlationMissing === true || key.startsWith('tool:unlinked:'))) {
                 issues.push({ file, line: index + 1, reason: 'missing_correlation' });
+            }
         });
     }
     const seen = new Set();
@@ -79,16 +82,33 @@ export function inspectStructuredLogs(logDir, options = {}) {
 function structuredRecordKey(value) {
     const nested = nestedRecord(value);
     const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
-    const eventPhase = firstDefined(value, nested, ['eventPhase', 'event_phase']);
+    const eventPhase = recordPhase(value);
     if (eventKey)
         return `${String(eventKey)}${eventPhase ? `:${String(eventPhase)}` : ''}`;
+    if (isLifecycleRecord(value)) {
+        const correlation = normalizeToolCorrelation({
+            callId: firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
+            correlationId: firstDefined(value, nested, ['correlationId', 'correlation_id']),
+            requestId: firstDefined(value, nested, ['requestId', 'request_id']),
+        });
+        if (!correlation.callId)
+            return undefined;
+        return `${buildToolLifecycleEventKey({
+            sessionId: lifecycleField(value, 'sessionId'),
+            ...correlation,
+        })}:${eventPhase}`;
+    }
     const correlation = firstDefined(value, nested, [
         'correlationId', 'correlation_id', 'callId', 'call_id', 'toolUseId', 'tool_use_id',
         'requestId', 'request_id', 'msgId', 'operationId',
     ]);
     if (!correlation)
         return undefined;
-    return `${canonicalEventType(value)}:${String(correlation)}`;
+    return JSON.stringify([lifecycleField(value, 'sessionId'), canonicalEventType(value), correlation, eventPhase]);
+}
+function recordPhase(value) {
+    return firstDefined(value, nestedRecord(value), ['eventPhase', 'event_phase'])
+        ?? (canonicalEventType(value) === 'tool_use' ? 'use' : canonicalEventType(value) === 'tool_result' ? 'result' : undefined);
 }
 function isLifecycleRecord(value) {
     const type = canonicalEventType(value);
@@ -101,11 +121,13 @@ function isCorrelatableRecord(value) {
 }
 function stableHash(value) {
     const nested = nestedRecord(value);
-    const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
+    const eventKey = structuredRecordKey(value);
     const canonical = {
         eventKey,
-        eventPhase: firstDefined(value, nested, ['eventPhase', 'event_phase']),
+        eventPhase: recordPhase(value),
         type: canonicalEventType(value),
+        operation: firstDefined(value, nested, ['operation']),
+        targetAgentAid: firstDefined(value, nested, ['targetAgentAid']),
         toolName: firstDefined(value, nested, ['toolName', 'tool', 'name']),
         callId: eventKey ? undefined : firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
         correlationId: eventKey ? undefined : firstDefined(value, nested, ['correlationId', 'correlation_id']),
@@ -116,11 +138,15 @@ function stableHash(value) {
         isError: firstDefined(value, nested, ['isError', 'is_error']) ?? (value.ok === false || nested?.ok === false ? true : undefined),
         errorCode: firstDefined(value, nested, ['errorCode', 'error_code']),
         decision: firstDefined(value, nested, ['decision']),
+        decisionSource: firstDefined(value, nested, ['decisionSource', 'decision_source']),
+        policyCode: firstDefined(value, nested, ['policyCode', 'policy_code']),
         executed: firstDefined(value, nested, ['executed']),
         executionState: firstDefined(value, nested, ['executionState', 'execution_state']),
-        input: firstDefined(value, nested, ['input']),
-        result: firstDefined(value, nested, ['result', 'content']),
-        error: firstDefined(value, nested, ['error', 'errorMessage']),
+        // A lifecycle stage may be mirrored without its large input/output body.
+        // Keep decision/classification differences, not projection payload size.
+        input: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['input']),
+        result: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['result', 'content']),
+        error: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['error', 'errorMessage']),
     };
     return crypto.createHash('sha256').update(JSON.stringify(canonical)).digest('hex').slice(0, 16);
 }

package/dist/core/auth/agent-delegation.js

@@ -1,9 +1,22 @@
+import { assertAgentPolicyAuthorization } from '../role/runtime-policy.js';
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 import { logger } from '../../utils/logger.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
+export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
+/**
+ * Resolve the credential carried by an EC CLI process. A live task token has
+ * priority; persistent Codex threads fall back to their session credential.
+ */
+export function readDelegationCredential(env = process.env) {
+    const taskToken = env[AGENT_DELEGATION_TOKEN_ENV]?.trim();
+    if (taskToken)
+        return taskToken;
+    const sessionToken = env[CODEX_SESSION_TOKEN_ENV]?.trim();
+    return sessionToken || undefined;
+}
 export class AgentDelegationRegistry {
     runtimeEpoch = crypto.randomBytes(16).toString('hex');
     grantsByHash = new Map();
@@ -24,6 +37,13 @@ export class AgentDelegationRegistry {
         return token;
     }
     validate(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, true);
+    }
+    /** Authenticate a CLI context lookup without spending its approved operation. */
+    validateForContext(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, false);
+    }
+    validateToken(token, sessionId, commandHash, consumeApproval) {
         if (!token) {
             return {
                 ok: false,
@@ -37,10 +57,19 @@ export class AgentDelegationRegistry {
         if (grant
             && grant.sessionId === sessionId
             && this.activeHashBySession.get(sessionId) === tokenHash) {
+            if (grant.executionIdentity?.source === 'agent-policy') {
+                try {
+                    assertAgentPolicyAuthorization(grant.executionIdentity);
+                }
+                catch {
+                    this.revokeSession(sessionId);
+                    return { ok: false, code: 'INVALID_DELEGATION', reason: 'Agent fullaccess policy was revoked', diagnosticCause: 'task_replaced' };
+                }
+            }
             return { ok: true, grant };
         }
         const approved = commandHash
-            ? this.consumeApprovedCommand(tokenHash, sessionId, commandHash)
+            ? this.readApprovedCommand(tokenHash, sessionId, commandHash, consumeApproval)
             : undefined;
         if (approved)
             return { ok: true, grant: approved };
@@ -66,11 +95,12 @@ export class AgentDelegationRegistry {
         const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
         if (!grant || grant.taskId !== input.taskId)
             return false;
-        if (!input.carrierToken || !isDelegationCommandHash(input.commandHash))
+        const sessionToken = input.sessionToken ?? input.carrierToken;
+        if (!sessionToken || !isDelegationCommandHash(input.commandHash))
             return false;
         this.deleteExpiredApprovedCommands();
-        const carrierTokenHash = hashDelegationToken(input.carrierToken);
-        const key = approvedCommandKey(carrierTokenHash, input.sessionId, input.commandHash);
+        const sessionTokenHash = hashDelegationToken(sessionToken);
+        const key = approvedCommandKey(sessionTokenHash, input.sessionId, input.commandHash);
         const existing = this.approvedCommands.get(key);
         const ttlMs = Math.max(1, Math.min(input.ttlMs ?? AGENT_DELEGATION_COMMAND_TTL_MS, AGENT_DELEGATION_COMMAND_TTL_MS));
         this.approvedCommands.set(key, {
@@ -105,10 +135,10 @@ export class AgentDelegationRegistry {
         this.activeHashBySession.delete(sessionId);
         this.deleteApprovedCommandsForSession(sessionId);
     }
-    consumeApprovedCommand(carrierTokenHash, sessionId, commandHash) {
+    readApprovedCommand(sessionTokenHash, sessionId, commandHash, consume) {
         if (!isDelegationCommandHash(commandHash))
             return undefined;
-        const key = approvedCommandKey(carrierTokenHash, sessionId, commandHash);
+        const key = approvedCommandKey(sessionTokenHash, sessionId, commandHash);
         const approved = this.approvedCommands.get(key);
         if (!approved)
             return undefined;
@@ -124,10 +154,12 @@ export class AgentDelegationRegistry {
             this.approvedCommands.delete(key);
             return undefined;
         }
-        if (approved.remainingUses <= 1)
-            this.approvedCommands.delete(key);
-        else
-            approved.remainingUses--;
+        if (consume) {
+            if (approved.remainingUses <= 1)
+                this.approvedCommands.delete(key);
+            else
+                approved.remainingUses--;
+        }
         return grant;
     }
     deleteExpiredApprovedCommands() {
@@ -216,8 +248,10 @@ function isValidFullAccessExecutionIdentity(identity) {
         || identity.processRole !== 'fullaccess-run'
         || identity.dataScope !== 'daemon')
         return false;
-    if (identity.source === 'fullaccess-command') {
-        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0;
+    if (identity.source === 'fullaccess-command' || identity.source === 'agent-policy') {
+        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
+            && (identity.source !== 'agent-policy'
+                || (typeof identity.agentAid === 'string' && identity.agentAid.length > 0));
     }
     return identity.source === 'trigger'
         && typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
@@ -228,8 +262,8 @@ function isValidFullAccessExecutionIdentity(identity) {
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }
-function approvedCommandKey(carrierTokenHash, sessionId, commandHash) {
-    return JSON.stringify([carrierTokenHash, sessionId, commandHash]);
+function approvedCommandKey(sessionTokenHash, sessionId, commandHash) {
+    return JSON.stringify([sessionTokenHash, sessionId, commandHash]);
 }
 function isDelegationCommandHash(value) {
     return /^[a-f0-9]{64}$/.test(value);

package/dist/core/auth/auth-gateway.js

@@ -70,6 +70,7 @@ export function buildAuthSubject(input) {
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
         fromControlChannel: !!input.fromControlChannel,
+        ecwebManagement: input.ecwebManagement === true && isTrustedDaemonOwner && input.fromControlChannel === true,
         allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
@@ -114,6 +115,7 @@ export function authorizeOperation(params) {
         return access;
     }
     const ctx = {
+        principalId: params.subject.principalId,
         intent: params.intent,
         actorId: params.subject.actorId,
         channel: params.subject.channel,