evolcore 0.0.26 → 0.0.28

package/dist/core/auth/authorization-audit.js

@@ -2,7 +2,7 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
-import { buildAuthorizationEventKey, buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { buildAuthorizationEventKey, buildToolLifecycleEventKey, normalizeToolCorrelation } from '../audit/event-key.js';
 import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
@@ -14,6 +14,8 @@ export function auditCommandAuthorization(event) {
         event.operation === 'permission.runtime' ||
         event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
+        event.operation === 'file.root.storage' ||
+        event.operation.startsWith('file.storage.') ||
         event.operation === 'cli.exec.raw';
     if (!shouldAudit)
         return;
@@ -25,6 +27,8 @@ export function auditFullAccessEvent(input) {
         || input.event === 'fullaccess.trigger.deescalated';
     const executionEvent = input.event === 'fullaccess.execution.started'
         || input.event === 'fullaccess.execution.ended'
+        || input.event === 'fullaccess.agent-policy.execution.started'
+        || input.event === 'fullaccess.agent-policy.execution.ended'
         || input.event === 'fullaccess.trigger.execution.started'
         || input.event === 'fullaccess.trigger.execution.ended';
     // The scheduler triggers a run, but the executing subject is the task-bound
@@ -39,7 +43,7 @@ export function auditFullAccessEvent(input) {
         ts: Date.now(),
         callId: input.attemptId ?? input.runId ?? input.taskId ?? input.messageId,
         correlationId: input.runId ?? input.taskId,
-        source: input.source === 'trigger' ? 'agent-tool' : 'slash',
+        source: input.source === 'fullaccess-command' ? 'slash' : 'agent-tool',
         operation: input.event,
         // CommandScope has no separate daemon value; process is the closest
         // existing scope for daemon-owner authorization and keeps audit records
@@ -97,20 +101,11 @@ export function auditFullAccessEvent(input) {
  * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
  */
 export function auditToolPreflightDenial(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'preflight',
-        } : {}),
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'preflight',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
@@ -138,29 +133,20 @@ export function auditToolPreflightDenial(input) {
         role: input.role ?? 'unknown',
         selfAid: input.selfAid,
         peerKey: input.peerKey,
-        requestId: input.requestId,
         taskId: input.taskId,
     });
 }
 /**
  * Emit one canonical, structured record for every Codex app-server approval
- * decision. The app-server's request id is the lifecycle key; method and
+ * decision. Prefer the tool call id over the approval request id; method and
  * decision source make policy, user, and infrastructure denials distinct.
  */
 export function auditCodexApprovalDecision(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'approval',
-        } : {}),
-        callId: input.callId ?? input.correlationId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'approval',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
@@ -172,8 +158,6 @@ export function auditCodexApprovalDecision(input) {
         errorCode: input.decision === 'deny'
             ? input.decisionSource === 'approval' ? 'USER_DENIED' : input.decisionSource === 'policy' ? 'POLICY_DENIED' : infrastructureErrorCode(input.policyCode)
             : undefined,
-        requestId: input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -204,6 +188,8 @@ export function auditPermissionDecision(input) {
     auditPermissionLifecycle({
         phase: 'final',
         requestId,
+        callId: input.callId,
+        correlationId: input.correlationId,
         sessionId: input.sessionId,
         agentAid: input.agentAid,
         agentName: input.agentName,
@@ -235,9 +221,7 @@ export function auditPermissionLifecycle(input) {
             requestId: input.requestId,
         }),
         eventPhase: input.phase,
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
-        requestId: input.requestId,
+        ...normalizeToolCorrelation(input),
         sessionId,
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -279,6 +263,8 @@ export function auditPermissionLifecycle(input) {
 export function auditToolInfrastructureFailure(input) {
     auditCommandAuthorization({
         ts: Date.now(),
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'final',
         source: 'agent-tool',
         operation: 'tool.execution.blocked',
         scope: 'filesystem',
@@ -288,9 +274,7 @@ export function auditToolInfrastructureFailure(input) {
         errorCode: infrastructureErrorCode(input.policyCode),
         executed: false,
         executionState: 'blocked',
-        callId: input.callId,
-        correlationId: input.callId,
-        requestId: input.callId,
+        ...normalizeToolCorrelation(input),
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -300,8 +284,20 @@ export function auditToolInfrastructureFailure(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: input.occurrences && input.occurrences > 1
-            ? { occurrences: input.occurrences }
+        argsSummary: input.occurrences || input.sandboxFailure
+            ? {
+                ...(input.occurrences ? { occurrences: input.occurrences } : {}),
+                // Flat primitive fields survive the audit argument redactor and can
+                // be aggregated without reparsing (possibly truncated) stderr.
+                ...(input.sandboxFailure ? {
+                    sandboxFailureKind: input.sandboxFailure.kind,
+                    sandboxFailureObservation: input.sandboxFailure.observation,
+                    sandboxInitializationFailures: input.sandboxFailure.counters.total,
+                    sandboxApplySeccompFailures: input.sandboxFailure.counters.applySeccomp,
+                    ...Object.fromEntries(Object.entries(input.sandboxFailure.counters.byKind)
+                        .map(([kind, count]) => [`sandboxFailures_${kind}`, count])),
+                } : {}),
+            }
             : undefined,
     });
 }
@@ -335,7 +331,7 @@ function buildAuditRecord(event) {
                     : 'authorized');
     const ecwebRequestId = event.source === 'ecweb' ? event.ecwebRequestId : undefined;
     const requestId = event.requestId ?? ecwebRequestId;
-    const correlationId = event.correlationId ?? requestId;
+    const correlationId = event.correlationId ?? event.callId ?? requestId;
     const lifecycleId = event.callId ?? correlationId ?? requestId;
     return {
         ts: event.ts,

package/dist/core/auth/operation-authorizer.js

@@ -1,13 +1,15 @@
 import { getRoleDefinition } from '../../config/roles.js';
 import { isManagementRole } from '../../config/builtin-roles.js';
-import { relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
+import { isUnsupportedBaseagentConfigField, relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
 import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
 import { normalizePeer } from '../model/config-scope.js';
 import { getOperationMeta } from './operation-catalog.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+import { sameGroupAid } from '../../aun/group/index.js';
 const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
     'agent.list',
     'agent.create',
+    'agent.initialize',
     'agent.delete',
     'agent.enable',
     'agent.disable',
@@ -99,6 +101,12 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
         return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
     }
+    if (resolvedConfigCommand?.kind === 'field'
+        && resolvedConfigCommand.configScope === 'agent'
+        && (resolvedConfigCommand.field === 'fullaccess' || resolvedConfigCommand.field.startsWith('fullaccess.'))
+        && resolvedConfigCommand.subcommand !== 'get') {
+        return denyDecision(ctx, 'NOT_ALLOWED', 'Agent fullaccess can only be configured in ECWeb Agent settings', operation, intent.scope, true);
+    }
     // A fullaccess task is deliberately a daemon-scoped runtime identity. It
     // still has to name a known operation and pass structural command parsing,
     // but relation/Agent role rules, source lists, and daemon-owner gates are
@@ -224,11 +232,30 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: role === 'owner' ? 'agent-owner-persona' : 'daemon-owner-persona',
         };
     }
+    if (operation === 'agent.welcome') {
+        if (!isCurrentAgentTarget(ctx) || ctx.chatType !== 'private'
+            || (role !== 'owner' && !(role === 'admin' && intent.args.action === 'show'))) {
+            return denyDecision(ctx, 'NOT_ALLOWED', 'welcome requires the current Agent Owner in private (admin may read)', operation, intent.scope, opMeta.dangerous);
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'self-agent-welcome',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
             return denyDecision(ctx, intent.scope === 'relation' ? 'ARGUMENT_MISMATCH' : 'SCOPE_MISMATCH', targetCheck.reason || 'Config target is outside the current task context', operation, intent.scope, opMeta.dangerous);
         }
+        if (resolvedConfigCommand.kind === 'field'
+            && resolvedConfigCommand.subcommand === 'get'
+            && isUnsupportedBaseagentConfigField(resolvedConfigCommand.field)) {
+            return denyDecision(ctx, 'UNSUPPORTED_FIELD', `Config field ${resolvedConfigCommand.field} is not supported by this version`, operation, intent.scope, opMeta.dangerous);
+        }
         const identityMutationCheck = checkManagementIdentityMutation(ctx, resolvedConfigCommand);
         if (!identityMutationCheck.ok) {
             return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
@@ -236,7 +263,9 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (role === 'owner' && isCurrentAgentTarget(ctx)) {
+        if (role === 'owner'
+            && isCurrentAgentTarget(ctx)
+            && !isCrossRelationConfigRead(ctx, resolvedConfigCommand)) {
             return {
                 allow: true,
                 operation,
@@ -636,6 +665,19 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     }
     return { ok: true };
 }
+function isCrossRelationConfigRead(ctx, command) {
+    if (!command || command.kind !== 'field' || command.subcommand !== 'get' || command.configScope !== 'relation') {
+        return false;
+    }
+    if (!command.peerKey || !ctx.peerKey)
+        return true;
+    try {
+        return normalizeRelationPeer(command.peerKey) !== normalizeRelationPeer(ctx.peerKey);
+    }
+    catch {
+        return true;
+    }
+}
 function checkResolvedConfigTarget(ctx, command) {
     if (command.kind === 'global' || command.configScope === 'process' || command.configScope === 'defaults') {
         return { ok: true };
@@ -652,8 +694,12 @@ function checkResolvedConfigTarget(ctx, command) {
         return { ok: true };
     }
     if (ctx.allowExplicitRelationTarget
-        && (ctx.role === 'owner' || ctx.role === 'admin')
-        && (command.kind === 'field' && command.operationId.startsWith('role.'))) {
+        && isManagementRole(ctx.role)
+        && command.kind === 'field'
+        && (command.operationId.startsWith('role.') || command.subcommand === 'get')) {
+        // Management reads may select another relation of this Agent. This only
+        // relaxes target matching; admin field grants/constraints are checked later.
+        // Ordinary config writes and whole-config commands remain current-relation only.
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent relation can be targeted' };
         }
@@ -693,7 +739,8 @@ function checkCurrentRelation(ctx, resolvedConfigCommand) {
         return { ok: false, reason: 'Current relation context is required' };
     }
     try {
-        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)) {
+        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)
+            && !sameAunGroupRelation(ctx, requestedPeer, ctx.peerKey)) {
             if (ctx.intent.operation.startsWith('ec.group.')) {
                 const currentGroup = peerIdFromArg(ctx.peerKey);
                 const targetGroup = stringArg(ctx.intent.args.targetId) ?? peerIdFromArg(requestedPeer);
@@ -788,6 +835,20 @@ function collectStringValues(value, out) {
             out.add(item);
     }
 }
+function sameAunGroupRelation(ctx, requested, current) {
+    if (ctx.chatType !== 'group'
+        || (!ctx.intent.operation.startsWith('ec.group.') && !ctx.intent.operation.startsWith('ec.fs.')))
+        return false;
+    try {
+        const target = parsePeerKey(requested);
+        const relation = parsePeerKey(current);
+        return target.channelType === 'aun' && relation.channelType === 'aun'
+            && sameGroupAid(target.channelId, relation.channelId);
+    }
+    catch {
+        return false;
+    }
+}
 function checkOwnPeer(ctx) {
     const argPeer = stringArg(ctx.intent.args.peer);
     const argPeerKey = stringArg(ctx.intent.args.peerKey);
@@ -812,6 +873,7 @@ function checkOwnPeer(ctx) {
                 candidateKeys.add(`${legacyChannelType}::${argPeer}`);
         }
         return candidateKeys.has(expectedPeerKey)
+            || [...candidateKeys].some(key => sameAunGroupRelation(ctx, key, expectedPeerKey))
             ? { ok: true }
             : { ok: false, reason: 'Only the current group relation can be targeted' };
     }

package/dist/core/auth/operation-catalog.js

@@ -25,6 +25,7 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     ['ec.group.list', 'read', ['agent'], 'List groups joined by the current Agent'],
     ['ec.group.info', 'read', ['relation', 'agent'], 'Read group information'],
     ['ec.group.pull', 'read', ['relation', 'agent'], 'Pull group messages'],
+    ['ec.group.history', 'read', ['relation', 'agent'], 'Read local group conversation history'],
     ['ec.group.members', 'read', ['relation', 'agent'], 'List group members'],
     ['ec.group.online', 'read', ['relation', 'agent'], 'List online group members'],
     ['ec.group.rules.get', 'read', ['relation', 'agent'], 'Read the published group rules file'],
@@ -47,6 +48,11 @@ const GROUP_MANAGEMENT_OPERATIONS = [
     ['ec.group.owner', 'write-agent', ['agent'], 'Transfer group ownership'],
     ['ec.group.ban', 'write-agent', ['agent'], 'Read or update the group ban list'],
     ['ec.group.unban', 'write-agent', ['agent'], 'Remove a group ban'],
+    ['ec.group.block', 'write-own', ['relation', 'agent'], 'Block group message reception'],
+    ['ec.group.unblock', 'write-own', ['relation', 'agent'], 'Unblock group message reception'],
+    ['ec.group.blocklist', 'read', ['agent'], 'Read the group block list'],
+    ['ec.group.report-status', 'write-own', ['relation', 'agent'], 'Report the current Agent group status'],
+    ['ec.group.member-statuses', 'read', ['relation', 'agent'], 'Read reported group member statuses'],
     ['ec.group.rules.set', 'write-agent', ['agent'], 'Upload and publish group rules content'],
     ['ec.group.rules.publish', 'write-agent', ['agent'], 'Publish the current group rules file'],
     ['ec.group.rules.update', 'write-agent', ['agent'], 'Update group join rules'],
@@ -365,6 +371,86 @@ const OPERATIONS = [
         description: '获取文件内容（需路径沙箱检查）',
         sources: ['slash', 'menu'],
     },
+    {
+        id: 'file.root.agent',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '获取 Agent 内部数据根目录句柄',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.root.relation',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: '获取当前或 owner 指定关系的共享数据根目录句柄',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.data.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: '列出已授权内部数据根目录',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.data.query',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: '查询已授权内部数据根文件元信息',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.data.fetch',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: '下载已授权内部数据根文件',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.root.storage',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '获取 Agent 自有云存储根句柄',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.storage.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '列出 Agent 自有云存储目录',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.storage.query',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '查询 Agent 自有云存储元信息',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.storage.fetch',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '获取 Agent 自有云存储短时下载链接',
+        sources: ['menu'],
+    },
+    {
+        id: 'file.storage.quota',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '查询 Agent 自有云存储配额',
+        sources: ['menu'],
+    },
     // ── Trigger Operations ──
     {
         id: 'trigger.list',
@@ -624,6 +710,14 @@ const OPERATIONS = [
         description: '读取或更新当前 Agent 的 persona.md',
         sources: ['agent-tool', 'control'],
     },
+    {
+        id: 'agent.welcome',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: '读取或更新当前 Agent 的 Bootstrap welcome.md',
+        sources: ['agent-tool', 'control'],
+    },
     {
         id: 'agent.create',
         category: 'process',
@@ -632,6 +726,14 @@ const OPERATIONS = [
         description: '创建新 agent',
         sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
     },
+    {
+        id: 'agent.initialize',
+        category: 'process',
+        dangerous: true,
+        defaultScopes: ['control'],
+        description: 'Create and initialize an Agent from an explicit final plan',
+        sources: ['menu', 'menu.cli', 'agent-tool', 'control'],
+    },
     {
         id: 'agent.enable',
         category: 'process',
@@ -935,6 +1037,14 @@ const OPERATIONS = [
     ...HANDOFF_READ_OPERATIONS,
     ...HANDOFF_WRITE_OPERATIONS,
     ...QUEUE_OPERATIONS,
+    {
+        id: 'ec.task.resume',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Resume a paused or abnormally interrupted Agent session task',
+        sources: ['agent-tool', 'control'],
+    },
     {
         id: 'ec.version',
         category: 'read',

package/dist/core/auth/remote-access-store.js

@@ -12,13 +12,21 @@ export function remoteAccessTokenStorePath() {
 function loadStore() {
     try {
         const value = JSON.parse(fs.readFileSync(remoteAccessTokenStorePath(), 'utf8'));
-        if (Array.isArray(value.tokens))
-            return value;
+        if (Array.isArray(value.tokens)) {
+            return {
+                tokens: value.tokens,
+                pairingIssuances: Array.isArray(value.pairingIssuances) ? value.pairingIssuances : [],
+            };
+        }
     }
     catch { }
-    return { tokens: [] };
+    return { tokens: [], pairingIssuances: [] };
 }
 function saveStore(store) {
+    // Issuance history contains no credentials. Keep 30 days; live tokens retain
+    // their own provenance even after the corresponding history is pruned.
+    const cutoff = Date.now() - 30 * 24 * 60 * 60 * 1000;
+    store.pairingIssuances = store.pairingIssuances.filter(record => record.expiresAt >= cutoff);
     const file = remoteAccessTokenStorePath();
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const temporary = `${file}.${process.pid}.tmp`;
@@ -87,6 +95,12 @@ export class RemoteAccessService {
     pairingCode = '';
     pairingExpiresAt = 0;
     pairingAuthorizedBy;
+    pairingId = '';
+    pairingIssuedAt = 0;
+    pairingIssuers = [];
+    // Do not recycle consumed codes during their original validity window,
+    // including when other sources have issued intervening codes.
+    recentPairingCodes = new Map();
     /** Synchronous reservation: concurrent invitations cannot issue two grants. */
     issueDiagnosticToken(controlAid, agentAid, ownerAid, now = Date.now()) {
         const store = loadStore();
@@ -124,18 +138,62 @@ export class RemoteAccessService {
         saveStore(store);
         return record;
     }
-    getPairingCode(authorizedBy, now = Date.now()) {
-        if (!this.pairingCode || now >= this.pairingExpiresAt) {
-            this.pairingCode = String(crypto.randomInt(0, 1_000_000)).padStart(6, '0');
+    getPairingCode(authorizedBy, now = Date.now(), source = 'host-cli') {
+        const owner = validOwner(authorizedBy);
+        if (!['host-cli', 'pair', 'menu', 'ecweb-local'].includes(source)
+            || ((source === 'pair' || source === 'menu') && !owner)) {
+            throw new Error('pairing source requires a valid source and an owner for /pair or Menu');
+        }
+        const generated = !this.pairingCode || now >= this.pairingExpiresAt;
+        if (generated) {
+            for (const [code, expiresAt] of this.recentPairingCodes) {
+                if (now >= expiresAt)
+                    this.recentPairingCodes.delete(code);
+            }
+            // Choose uniformly from unused values without an unbounded retry loop.
+            let code = crypto.randomInt(0, 1_000_000 - this.recentPairingCodes.size);
+            for (const occupied of [...this.recentPairingCodes.keys()].sort((a, b) => a - b)) {
+                if (occupied > code)
+                    break;
+                code++;
+            }
+            this.pairingCode = String(code).padStart(6, '0');
+            this.pairingId = crypto.randomUUID();
+            this.pairingIssuedAt = now;
             this.pairingExpiresAt = now + REMOTE_ACCESS_PAIRING_TTL_MS;
+            this.recentPairingCodes.set(code, this.pairingExpiresAt);
             this.pairingAuthorizedBy = undefined;
+            this.pairingIssuers = [];
         }
-        const owner = validOwner(authorizedBy);
+        const previousOwner = this.pairingAuthorizedBy;
         if (!this.pairingAuthorizedBy && owner)
             this.pairingAuthorizedBy = owner;
+        const issuer = {
+            source,
+            issuedAt: now,
+            ...((source === 'pair' || source === 'menu') && owner ? { authorizedBy: owner } : {}),
+        };
+        const addedIssuer = !this.pairingIssuers.some(candidate => candidate.source === issuer.source
+            && candidate.authorizedBy === issuer.authorizedBy);
+        if (addedIssuer) {
+            this.pairingIssuers.push(issuer);
+        }
+        try {
+            this.recordPairingIssuance();
+        }
+        catch (error) {
+            if (generated)
+                this.clearPairingCode();
+            else {
+                this.pairingAuthorizedBy = previousOwner;
+                if (addedIssuer)
+                    this.pairingIssuers.pop();
+            }
+            throw error;
+        }
         return { code: this.pairingCode, expiresAt: this.pairingExpiresAt };
     }
-    redeemPairingCode(code, label, authorizedBy, now = Date.now()) {
+    redeemPairingCode(code, label, now = Date.now()) {
         if (typeof code !== 'string' || !/^\d{6}$/.test(code)) {
             return { ok: false, code: 'INVALID_ARGUMENT', error: 'pairing code must be six digits' };
         }
@@ -149,17 +207,65 @@ export class RemoteAccessService {
         const token = crypto.randomBytes(32).toString('hex');
         const store = loadStore();
         pruneExpired(store, now);
-        const owner = validOwner(authorizedBy) ?? this.pairingAuthorizedBy;
+        const owner = this.pairingAuthorizedBy;
+        const pairingId = this.pairingId;
+        const pairingIssuers = this.pairingIssuers.map(issuer => ({ ...issuer }));
         store.tokens.push({
             token,
             createdAt,
             lastActive: createdAt,
             label: validLabel(label),
             ...(owner ? { authorizedBy: owner } : {}),
+            pairingId,
+            pairingIssuers,
         });
+        const issuance = store.pairingIssuances.find(record => record.pairingId === pairingId);
+        if (issuance) {
+            issuance.redeemedAt = createdAt;
+        }
+        else {
+            store.pairingIssuances.push({
+                pairingId,
+                issuedAt: this.pairingIssuedAt,
+                expiresAt: this.pairingExpiresAt,
+                issuers: pairingIssuers,
+                redeemedAt: createdAt,
+            });
+        }
         saveStore(store);
+        // A pairing code is a one-time capability. Clear it only after the token
+        // and provenance record have been atomically saved. No await separates
+        // validation, persistence and consumption, so concurrent IPC calls cannot
+        // grant the same code twice.
+        this.clearPairingCode();
         return { ok: true, token, expiresAt: createdAt + REMOTE_ACCESS_TOKEN_TTL_MS };
     }
+    clearPairingCode() {
+        this.pairingCode = '';
+        this.pairingExpiresAt = 0;
+        this.pairingAuthorizedBy = undefined;
+        this.pairingId = '';
+        this.pairingIssuedAt = 0;
+        this.pairingIssuers = [];
+    }
+    recordPairingIssuance() {
+        if (!this.pairingId || !this.pairingCode)
+            return;
+        const store = loadStore();
+        const existing = store.pairingIssuances.find(record => record.pairingId === this.pairingId);
+        const record = {
+            pairingId: this.pairingId,
+            issuedAt: this.pairingIssuedAt,
+            expiresAt: this.pairingExpiresAt,
+            issuers: this.pairingIssuers.map(issuer => ({ ...issuer })),
+            ...(existing?.redeemedAt ? { redeemedAt: existing.redeemedAt } : {}),
+        };
+        if (existing)
+            Object.assign(existing, record);
+        else
+            store.pairingIssuances.push(record);
+        saveStore(store);
+    }
     issueLocalToken(label, now = Date.now()) {
         const token = crypto.randomBytes(32).toString('hex');
         const store = loadStore();