evolcore 0.0.29 → 0.0.30

package/CHANGELOG.md

@@ -5,6 +5,13 @@
 
 ## Unreleased
 
+## 0.0.30 (2026-10-10)
+
+- 重构 Agent 运行时、渠道连接与 daemon 生命周期编排，拆分 IPC 注册和受管操作职责，提升启动、重载与数据迁移的可维护性和诊断能力。
+- 统一 AUN 出站消息发送链路，迁移群邀请服务与记忆整理入口，并完善 AID 名片和受管操作。
+- 强化 Trigger 授权、脚本沙箱与 Agent 作用域边界，收紧委托操作和权限校验。
+- 改进 Codex 压缩完成状态、启动版本诊断与迁移后空目录清理，提升运行稳定性。
+
 ## 0.0.29 (2026-10-08)
 
 - 完成记忆系统 v3：支持 note 标签、三作用域工作记忆、自动整理触发、整理队列与签名索引，并完善 `ec memory`、`/memory` 命令和 ECK 注入。

package/dist/agents/codex-runner.js

@@ -87,6 +87,8 @@ class AsyncEventQueue {
     }
 }
 function fallbackErrorCodeForToolDenial(decisionSource, policyCode) {
+    if (decisionSource === 'policy' && policyCode === 'apply_patch_invalid_argument')
+        return 'INVALID_ARGUMENT';
     if (decisionSource === 'policy')
         return 'POLICY_DENIED';
     if (decisionSource === 'approval')
@@ -2427,13 +2429,15 @@ export class CodexRunner {
     }
     async startAndWaitForCompact(appServer, threadId) {
         const completion = this.waitForThreadCompacted(appServer, threadId, Date.now());
+        const compactStart = appServer.threadCompactStart(threadId);
         try {
-            await appServer.threadCompactStart(threadId);
+            await Promise.race([compactStart, completion.promise]);
             await completion.promise;
             return true;
         }
         finally {
             completion.dispose();
+            void compactStart.catch(() => undefined);
         }
     }
     waitForThreadCompacted(appServer, threadId, startedAtMs) {
@@ -2450,7 +2454,17 @@ export class CodexRunner {
             unsubscribe?.();
             resolve();
         };
-        const promise = new Promise(resolve => {
+        const fail = (reject, message, source) => {
+            if (settled)
+                return;
+            settled = true;
+            if (pollTimer)
+                clearInterval(pollTimer);
+            logger.warn(`[CodexRunner] Compact failed for thread: ${threadId} (${source}): ${message}`);
+            unsubscribe?.();
+            reject(new Error(message));
+        };
+        const promise = new Promise((resolve, reject) => {
             unsubscribe = appServer.onNotification(notification => {
                 if (notification.method !== 'thread/compacted')
                     return;
@@ -2460,11 +2474,17 @@ export class CodexRunner {
                     return;
                 settle(resolve, 'notification');
             });
-            pollTimer = setInterval(() => {
-                if (this.hasPersistedCompactCompletion(threadId, startedAtMs)) {
+            const checkPersistedCompletion = () => {
+                const completion = this.readPersistedCompactCompletion(threadId, startedAtMs);
+                if (completion?.kind === 'error') {
+                    fail(reject, completion.message, 'session-log');
+                }
+                else if (completion?.kind === 'complete') {
                     settle(resolve, 'session-log');
                 }
-            }, 1000);
+            };
+            checkPersistedCompletion();
+            pollTimer = setInterval(checkPersistedCompletion, 1000);
             pollTimer.unref?.();
         });
         return {
@@ -2477,16 +2497,16 @@ export class CodexRunner {
             },
         };
     }
-    hasPersistedCompactCompletion(threadId, startedAtMs) {
+    readPersistedCompactCompletion(threadId, startedAtMs) {
         const sessionFile = this.findCodexSessionFile(threadId);
         if (!sessionFile)
-            return false;
+            return undefined;
         let text = '';
         try {
             text = fs.readFileSync(sessionFile, 'utf8');
         }
         catch {
-            return false;
+            return undefined;
         }
         const threshold = startedAtMs - 1000;
         for (const line of text.trimEnd().split('\n').reverse()) {
@@ -2499,16 +2519,43 @@ export class CodexRunner {
             catch {
                 continue;
             }
-            const ts = typeof entry.timestamp === 'string' ? Date.parse(entry.timestamp) : NaN;
+            const payload = entry.payload && typeof entry.payload === 'object' ? entry.payload : undefined;
+            const timestampMs = typeof entry.timestamp === 'string' ? Date.parse(entry.timestamp) : NaN;
+            const completedAtMs = typeof payload?.completed_at_ms === 'number'
+                ? payload.completed_at_ms
+                : typeof entry.completed_at_ms === 'number'
+                    ? entry.completed_at_ms
+                    : typeof payload?.completed_at === 'number'
+                        ? payload.completed_at * 1000
+                        : typeof entry.completed_at === 'number'
+                            ? entry.completed_at * 1000
+                            : NaN;
+            const ts = Number.isFinite(timestampMs) ? timestampMs : completedAtMs;
             if (!Number.isFinite(ts))
                 continue;
             if (ts < threshold)
                 break;
-            const payloadType = entry.payload?.type;
-            if (entry.type === 'compacted' || payloadType === 'context_compacted')
-                return true;
+            const payloadType = payload?.type;
+            if (entry.type === 'compacted'
+                || payloadType === 'context_compacted'
+                || (payloadType === 'item_completed' && payload?.item?.type === 'ContextCompaction')) {
+                return { kind: 'complete' };
+            }
+            const taskComplete = entry.type === 'task_complete'
+                ? entry
+                : payloadType === 'task_complete'
+                    ? payload
+                    : undefined;
+            const taskError = taskComplete?.error;
+            const message = typeof taskError === 'string'
+                ? taskError
+                : typeof taskError?.message === 'string'
+                    ? taskError.message
+                    : undefined;
+            if (message?.trim())
+                return { kind: 'error', message };
         }
-        return false;
+        return undefined;
     }
     codexHomeDir() {
         return process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
@@ -4910,7 +4957,7 @@ export class CodexRunner {
             ? {
                 isError: true,
                 error: managedHookDenial.reason,
-                errorCode: 'POLICY_DENIED',
+                errorCode: errorCodeForToolDenial('policy', managedHookDenial.policyCode),
                 ...(errorDetailCodeForToolDenial('policy', managedHookDenial.policyCode, managedHookDenial.errorDetailCode)
                     ? { errorDetailCode: errorDetailCodeForToolDenial('policy', managedHookDenial.policyCode, managedHookDenial.errorDetailCode) }
                     : {}),

package/dist/aun/aid/agentmd.js

@@ -1,3 +1,4 @@
+import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { parseDocument } from 'yaml';
@@ -89,6 +90,80 @@ export function validateAgentTags(tags, options = {}) {
 function resolveAgentMdAunPath(opts) {
     return opts?.aunPath ?? opts?.store?.aunPath ?? resolveRoot();
 }
+function agentMdMetadataPath(aid, aunPath) {
+    return path.join(aidLocalDir(aid, aunPath), 'agentmd.json');
+}
+function readAgentMdMetadata(aid, aunPath) {
+    try {
+        const value = JSON.parse(fs.readFileSync(agentMdMetadataPath(aid, aunPath), 'utf-8'));
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+function normalizeRemoteVersion(value) {
+    const exists = typeof value.exists === 'boolean' ? value.exists : undefined;
+    const etag = String(value.etag ?? '').trim();
+    const lastModified = String(value.last_modified ?? value.lastModified ?? '').trim();
+    if (exists === undefined && !etag && !lastModified)
+        return undefined;
+    return {
+        ...(exists !== undefined ? { exists } : {}),
+        ...(etag ? { etag } : {}),
+        ...(lastModified ? { lastModified } : {}),
+    };
+}
+function remoteVersionFromMetadata(metadata) {
+    return normalizeRemoteVersion({
+        exists: metadata.remote_status === 'missing' ? false : metadata.remote_status === 'found' ? true : undefined,
+        etag: metadata.remote_etag ?? metadata.etag,
+        last_modified: metadata.last_modified,
+    });
+}
+function remoteVersionsEqual(expected, actual) {
+    if (expected.exists !== undefined && expected.exists !== (actual?.exists ?? false))
+        return false;
+    if (expected.etag !== undefined && expected.etag !== (actual?.etag ?? ''))
+        return false;
+    if (expected.lastModified !== undefined && expected.lastModified !== (actual?.lastModified ?? ''))
+        return false;
+    return true;
+}
+export class AgentMdVersionConflictError extends Error {
+    expected;
+    actual;
+    code = 'REMOTE_VERSION_CONFLICT';
+    constructor(expected, actual) {
+        super(`远端 agent.md 版本已变化，请重新 get 后再修改（expected=${JSON.stringify(expected)}, actual=${JSON.stringify(actual ?? {})}）`);
+        this.expected = expected;
+        this.actual = actual;
+        this.name = 'AgentMdVersionConflictError';
+    }
+}
+export class AgentMdVersionUnavailableError extends Error {
+    code = 'REMOTE_VERSION_UNAVAILABLE';
+    constructor(message) {
+        super(message);
+        this.name = 'AgentMdVersionUnavailableError';
+    }
+}
+const agentMdWriteLocks = new Map();
+async function withAgentMdWriteLock(key, operation) {
+    const previous = agentMdWriteLocks.get(key) ?? Promise.resolve();
+    let release;
+    const current = new Promise(resolve => { release = resolve; });
+    agentMdWriteLocks.set(key, current);
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+        if (agentMdWriteLocks.get(key) === current)
+            agentMdWriteLocks.delete(key);
+    }
+}
 // A process can host agents that deliberately use different AUN keystore
 // roots. Keep their display-name state separate so one root cannot shadow the
 // other with a same-named AID.
@@ -359,11 +434,79 @@ export function updateAgentMdFrontmatterAvatar(content, avatarUrl) {
 export function updateAgentMdFrontmatterName(content, name) {
     return updateAgentMdFrontmatterField(content, 'name', name, 'aid');
 }
+function updateAgentMdFrontmatterTags(content, tags) {
+    const original = content;
+    const payload = stripAgentMdSignature(content);
+    const lines = payload.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    const openLine = lines[0];
+    if (!openLine || lineValue(openLine) !== '---')
+        throw new Error('agent.md has no YAML frontmatter');
+    const closeIndex = lines.findIndex((line, index) => index > 0 && lineValue(line) === '---');
+    if (closeIndex < 0)
+        throw new Error('agent.md frontmatter is not closed');
+    const defaultEol = lineEnding(openLine, '\n');
+    const fmLines = lines.slice(1, closeIndex);
+    const fieldPattern = /^tags\s*:/;
+    const fieldIndex = fmLines.findIndex(line => fieldPattern.test(lineValue(line)));
+    const replacement = [
+        `tags:${defaultEol}`,
+        ...tags.map(tag => `  - ${yamlDoubleQuote(tag)}${defaultEol}`),
+    ];
+    if (fieldIndex >= 0) {
+        let endIndex = fieldIndex + 1;
+        while (endIndex < fmLines.length && /^\s*-\s+/.test(lineValue(fmLines[endIndex] ?? '')))
+            endIndex++;
+        fmLines.splice(fieldIndex, endIndex - fieldIndex, ...replacement);
+    }
+    else {
+        const versionIndex = fmLines.findIndex(line => /^version\s*:/.test(lineValue(line)));
+        const insertIndex = versionIndex >= 0 ? versionIndex + 1 : fmLines.length;
+        fmLines.splice(insertIndex, 0, ...replacement);
+    }
+    const updated = ensureTrailingNewline([
+        lines[0],
+        ...fmLines,
+        ...lines.slice(closeIndex),
+    ].join(''));
+    return { content: updated, changed: updated !== original };
+}
+export function updateAgentMdFrontmatterFieldValue(content, field, value) {
+    if (field === 'tags') {
+        if (!Array.isArray(value))
+            throw new Error('agent.md tags must be an array of strings');
+        const errors = validateAgentTags(value);
+        if (errors.length > 0)
+            throw new Error(`agent.md tags ${errors.join('; ')}`);
+        const tags = [...new Set(value.map(tag => tag.trim()))];
+        return updateAgentMdFrontmatterTags(content, tags);
+    }
+    if (typeof value !== 'string')
+        throw new Error(`agent.md ${field} must be a string`);
+    const normalized = value.trim();
+    if (field === 'name' && !normalized)
+        throw new Error('agent.md name must be a non-empty string');
+    if (field === 'type') {
+        const error = validateAgentType(normalized);
+        if (error)
+            throw new Error(`agent.md type ${error}`);
+        return updateAgentMdFrontmatterField(content, field, normalizeAgentType(normalized), 'aid');
+    }
+    if (field === 'version' && !/^\d+\.\d+\.\d+$/.test(normalized)) {
+        throw new Error('agent.md version must use major.minor.patch format');
+    }
+    if (field === 'description' && Array.from(value).length > AGENT_DESCRIPTION_MAX_LENGTH) {
+        throw new Error(`agent.md description must be at most ${AGENT_DESCRIPTION_MAX_LENGTH} characters`);
+    }
+    return updateAgentMdFrontmatterField(content, field, field === 'description' ? value : normalized, field === 'name' ? 'aid' : undefined);
+}
 /** Normalize an SDK verification result to the local union type. */
 function normalizeVerification(v) {
     const status = v.status === 'verified' ? 'verified' : v.status === 'unsigned' ? 'unsigned' : 'invalid';
     return { status, ...(v.reason ? { reason: String(v.reason) } : {}) };
 }
+function localStateFromVerification(verification) {
+    return verification.status === 'verified' ? 'signed' : verification.status;
+}
 /**
  * Verify locally-cached agent.md content offline via the AID value object.
  * Loads the peer cert through the store (no network, no private key required).
@@ -392,10 +535,13 @@ export async function agentmdGet(aid, opts) {
     try {
         let content;
         let verification;
+        let source = 'remote';
+        let remoteVersion;
         const r = await store.downloadAgentMd(aid);
         if (r.ok) {
             content = r.data.content;
             verification = normalizeVerification(r.data.verification);
+            remoteVersion = normalizeRemoteVersion({ exists: true, etag: r.data.etag, last_modified: r.data.last_modified });
         }
         else {
             if (opts?.remoteOnly) {
@@ -411,13 +557,23 @@ export async function agentmdGet(aid, opts) {
                 throw new Error(`fetch agent.md failed for ${aid}: ${r.error.message}`);
             }
             content = fs.readFileSync(localPath, 'utf-8');
+            source = 'local-cache';
+            remoteVersion = remoteVersionFromMetadata(readAgentMdMetadata(aid, aunPath));
             if (opts?.withVerification) {
                 verification = verifyLocal(store, aid, content);
             }
         }
         if (!opts?.withVerification)
             return content;
-        return { content, verification: verification ?? { status: 'unsigned' } };
+        const finalVerification = verification ?? { status: 'unsigned' };
+        return {
+            content,
+            verification: finalVerification,
+            source,
+            contentSha256: crypto.createHash('sha256').update(content, 'utf8').digest('hex'),
+            localState: localStateFromVerification(finalVerification),
+            ...(remoteVersion ? { remoteVersion } : {}),
+        };
     }
     finally {
         if (ownStore)
@@ -428,39 +584,63 @@ export async function agentmdGet(aid, opts) {
     }
 }
 /**
- * Upload agent.md: write local file → store.uploadAgentMd (auto-auth + sign + upload).
+ * Validate and upload agent.md. The SDK signs the payload and persists its
+ * signed local cache only after the remote upload succeeds.
  *
  * fastaun 0.4.7: uploadAgentMd moved from AUNClient to AIDStore; the store builds
  * its own LocalTokenStore + AuthFlow internally, so no AUNClient/authenticate needed.
  */
-export async function agentmdPut(content, opts) {
+async function publishAgentMd(content, opts) {
     const validation = validateAgentMdFrontmatter(content, opts.aid);
     if (!validation.valid) {
         throw new Error(`invalid agent.md frontmatter: ${validation.errors.join('; ')}`);
     }
     const aunPath = resolveAgentMdAunPath(opts);
-    const store = opts.store ?? await getAidStore({ slotId: SLOT.cli, aunPath });
-    const ownStore = !opts.store;
     const dir = aidLocalDir(opts.aid, aunPath);
     const filePath = path.join(dir, 'agent.md');
-    const existed = fs.existsSync(filePath);
-    // 先写本地文件（与旧行为一致：本地内容更新应在上传失败时仍保留）
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(filePath, content, 'utf-8');
+    const store = opts.store ?? await getAidStore({ slotId: SLOT.cli, aunPath });
+    const ownStore = !opts.store;
     try {
+        const metadataVersion = remoteVersionFromMetadata(readAgentMdMetadata(opts.aid, aunPath));
+        const expectedVersion = opts.expectedRemoteVersion ?? metadataVersion;
+        let versionChecked = false;
+        let currentVersion;
+        const candidate = store;
+        if (typeof candidate.checkAgentMd !== 'function') {
+            if (expectedVersion) {
+                throw new AgentMdVersionUnavailableError('当前 AUN SDK 不支持 agent.md 远端版本检查，已拒绝覆盖发布');
+            }
+        }
+        else {
+            const checked = await candidate.checkAgentMd(opts.aid, 0);
+            if (!checked.ok) {
+                if (expectedVersion) {
+                    throw new AgentMdVersionUnavailableError(`无法确认远端 agent.md 版本，已拒绝发布: ${checked.error?.message ?? 'unknown error'}`);
+                }
+            }
+            else {
+                versionChecked = true;
+                currentVersion = normalizeRemoteVersion({
+                    exists: checked.data?.remote_found,
+                    etag: checked.data?.remote_etag,
+                    last_modified: checked.data?.last_modified,
+                });
+                if (expectedVersion && !remoteVersionsEqual(expectedVersion, currentVersion)) {
+                    throw new AgentMdVersionConflictError(expectedVersion, currentVersion);
+                }
+            }
+        }
         const r = await store.uploadAgentMd(opts.aid, content);
         if (!r.ok)
             throw new Error(`upload agent.md failed for ${opts.aid}: ${r.error.message}`);
-    }
-    catch (e) {
-        // 上传失败：仅当文件原本不存在（本次新建）时回滚，避免留下孤儿文件；
-        // 已存在的文件保留新内容（旧语义）。
-        if (!existed)
-            try {
-                fs.unlinkSync(filePath);
-            }
-            catch { /* ignore */ }
-        throw e;
+        invalidateAgentDisplayName(opts.aid, aunPath);
+        const remoteVersion = normalizeRemoteVersion({ exists: true, etag: r.data?.etag, last_modified: r.data?.last_modified ?? r.data?.lastModified });
+        return {
+            path: filePath,
+            ...(remoteVersion ? { remoteVersion } : {}),
+            versionChecked,
+            atomicVersionCheck: false,
+        };
     }
     finally {
         if (ownStore)
@@ -470,6 +650,31 @@ export async function agentmdPut(content, opts) {
             catch { /* ignore */ }
     }
 }
+export async function agentmdPut(content, opts) {
+    const aunPath = resolveAgentMdAunPath(opts);
+    const lockKey = `${path.resolve(aunPath)}\u0000${opts.aid.toLowerCase()}`;
+    return withAgentMdWriteLock(lockKey, () => publishAgentMd(content, opts));
+}
+export async function agentmdSet(aid, field, value, opts = {}) {
+    const aunPath = resolveAgentMdAunPath(opts);
+    const lockKey = `${path.resolve(aunPath)}\u0000${aid.toLowerCase()}`;
+    return withAgentMdWriteLock(lockKey, async () => {
+        const localPath = agentMdPath(aid, aunPath);
+        if (!fs.existsSync(localPath)) {
+            const error = new Error(`local agent.md not found: ${aid}`);
+            error.code = 'LOCAL_AGENTMD_MISSING';
+            throw error;
+        }
+        const current = fs.readFileSync(localPath, 'utf-8');
+        const updated = updateAgentMdFrontmatterFieldValue(current, field, value);
+        const result = await publishAgentMd(updated.content, {
+            ...opts,
+            aid,
+            expectedRemoteVersion: remoteVersionFromMetadata(readAgentMdMetadata(aid, aunPath)),
+        });
+        return { ...result, field };
+    });
+}
 /**
  * Check if agent.md is up-to-date (30-day TTL), fetch if changed.
  * Returns changed=true + content when a new version was downloaded.

package/dist/aun/aid/index.js

@@ -1,5 +1,6 @@
+export { AgentMdVersionUnavailableError, AgentMdVersionConflictError } from './agentmd.js';
 export { AGENT_TAG_MIN_COUNT, AGENT_TAG_MAX_COUNT, AGENT_TAG_MAX_LENGTH, validateAgentTag, validateAgentTags, } from './agentmd.js';
 export { isValidAid, aidList, aidListVerified, aidCreate, aidShow, aidDelete, aidLookup, verifySignAbility, probePkiRecoverability, appendAidLifecycle, readAidLifecycle } from './identity.js';
-export { AGENT_TYPES, DEFAULT_AGENT_DESCRIPTION, DEFAULT_AGENT_TYPE, normalizeAgentType, validateAgentType, buildInitialAgentMd, validateAgentMdFrontmatter, agentmdGet, agentmdPut, agentmdSync, invalidateAgentDisplayName, parseAgentDisplayName, refreshAgentDisplayName, resolveAgentDisplayName, stripAgentMdSignature, updateAgentMdFrontmatterAvatar, updateAgentMdFrontmatterName, } from './agentmd.js';
+export { AGENT_TYPES, DEFAULT_AGENT_DESCRIPTION, DEFAULT_AGENT_TYPE, normalizeAgentType, validateAgentType, buildInitialAgentMd, validateAgentMdFrontmatter, agentmdGet, agentmdPut, agentmdSet, agentmdSync, invalidateAgentDisplayName, parseAgentDisplayName, refreshAgentDisplayName, resolveAgentDisplayName, stripAgentMdSignature, updateAgentMdFrontmatterAvatar, updateAgentMdFrontmatterFieldValue, updateAgentMdFrontmatterName, } from './agentmd.js';
 export { MIN_AUN_CORE_SDK, AUN_CORE_SDK_PKG, isAunSdkVersionOk, resolveAunCoreSdkPkg, ensureAunSdk, isAunSdkReady, downloadCaRoot, suppressSdkLogs, } from './client.js';
 export { getAidStore, loadClient, loadAid, AidLoadError, SLOT } from './store.js';

package/dist/aun/aid/managed-operation.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { resolveRoot } from '../../paths.js';
-import { agentmdGet, agentmdPut } from './agentmd.js';
+import { agentmdGet, agentmdPut, agentmdSet, } from './agentmd.js';
 import { uploadAvatarBuffer, uploadAvatarUrl } from '../../utils/avatar-upload.js';
 import { aidLookup, aidShow } from './identity.js';
 import { isValidAid } from './validation.js';
@@ -55,6 +55,53 @@ function parseAvatar(args) {
         },
     };
 }
+const AGENTMD_EDITABLE_FIELDS = new Set(['name', 'type', 'description', 'version', 'tags']);
+function parseAgentmdSet(args) {
+    const aidResult = parseAid(args[2]);
+    if (!aidResult.ok)
+        return aidResult;
+    const field = args[3];
+    if (!field || !AGENTMD_EDITABLE_FIELDS.has(field)) {
+        return { ok: false, code: 'INVALID_ARGUMENT', reason: `agentmd set field must be one of ${[...AGENTMD_EDITABLE_FIELDS].join(', ')}` };
+    }
+    if (args[4] === undefined)
+        return { ok: false, code: 'INVALID_ARGUMENT', reason: 'agentmd set requires a value' };
+    if (args.length !== 5 && !(args.length === 7 && args[5] === '--format' && args[6] === 'json')) {
+        return { ok: false, code: 'NOT_ALLOWED', reason: 'agentmd set only supports an optional --format json suffix' };
+    }
+    let value = args[4];
+    if (field === 'tags') {
+        try {
+            const parsed = JSON.parse(args[4]);
+            if (!Array.isArray(parsed) || parsed.some(item => typeof item !== 'string'))
+                throw new Error('not an array of strings');
+            value = parsed;
+        }
+        catch {
+            return { ok: false, code: 'INVALID_ARGUMENT', reason: 'agentmd set tags value must be a JSON array of strings' };
+        }
+    }
+    return {
+        ok: true,
+        command: {
+            kind: 'agentmd.set',
+            aid: aidResult.aid,
+            field,
+            value,
+            operationId: 'ec.aid.agentmd.set',
+            canonicalArgv: ['aid', 'agentmd', 'set', aidResult.aid, field, args[4]],
+        },
+    };
+}
+function rethrowAgentmdError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error && typeof error === 'object' && 'code' in error
+        ? String(error.code || '')
+        : '';
+    if (code)
+        throw new ManagedAidOperationError(code, message);
+    throw error;
+}
 /**
  * The daemon accepts only the narrowly scoped AID commands exposed to managed
  * tasks. Public lookup/get may name any valid AID; local show/publish remain
@@ -94,10 +141,12 @@ export function resolveManagedAidOperation(argv) {
             },
         };
     }
+    if (subcommand === 'agentmd' && args[1] === 'set')
+        return parseAgentmdSet(args);
     return {
         ok: false,
         code: 'NOT_ALLOWED',
-        reason: 'Managed AID operations only allow exact show, lookup, agentmd get, agentmd put, or avatar commands with supported options',
+        reason: 'Managed AID operations only allow exact show, lookup, agentmd get, agentmd put, agentmd set, or avatar commands with supported options',
     };
 }
 export function managedAidShowViewForRole(role) {
@@ -120,6 +169,7 @@ const defaultDependencies = () => ({
     aidLookup,
     agentmdGet,
     agentmdPut,
+    agentmdSet,
     existsSync: fs.existsSync,
     readFileSync: fs.readFileSync,
     uploadAvatarBuffer,
@@ -153,8 +203,24 @@ export async function executeManagedAidOperation(command, options = {}) {
                 throw new ManagedAidOperationError('LOCAL_AGENTMD_MISSING', `local agent.md not found: ${command.aid}`);
             }
             const content = deps.readFileSync(localPath, 'utf-8');
-            await deps.agentmdPut(content, { aid: command.aid, aunPath });
-            return { kind: command.kind, aid: command.aid, path: localPath };
+            let result;
+            try {
+                result = await deps.agentmdPut(content, { aid: command.aid, aunPath });
+            }
+            catch (error) {
+                rethrowAgentmdError(error);
+            }
+            return { kind: command.kind, aid: command.aid, ...result };
+        }
+        case 'agentmd.set': {
+            let result;
+            try {
+                result = await deps.agentmdSet(command.aid, command.field, command.value, { aunPath });
+            }
+            catch (error) {
+                rethrowAgentmdError(error);
+            }
+            return { kind: command.kind, aid: command.aid, ...result };
         }
         case 'avatar': {
             const result = command.url

package/dist/aun/group/index.js

@@ -1,4 +1,5 @@
 export * from './operations.js';
+export * from './invite-service.js';
 export * from './history.js';
 export * from './identity.js';
 export * from './index-rpc.js';

package/dist/{core → aun}/group/invite-service.js

@@ -1,14 +1,14 @@
 import { randomUUID } from 'node:crypto';
 import { atomicReadJson, atomicWriteJson } from '../../utils/atomic-write.js';
 import { agentGroupInviteReviewsPath } from '../../paths.js';
-import { normalizeGroupAid } from '../../aun/group/identity.js';
-import { isValidAid } from '../../aun/aid/validation.js';
+import { normalizeGroupAid } from './identity.js';
+import { isValidAid } from '../aid/validation.js';
 import { listStaticAgentOwners } from '../../config/peer-role-resolver.js';
 import { read, ConfigTarget } from '../../config/config-manager.js';
 import { resolveAgentLifecycle } from '../../config/lifecycle.js';
 import { logger } from '../../utils/logger.js';
-import { buildEnvelope, sendInteractionPayload, withEnvelopeReplyContext } from '../message/message-utils.js';
-import { renderActionAsText } from '../interaction-router.js';
+import { buildEnvelope, sendInteractionPayload, withEnvelopeReplyContext } from '../../core/message/message-utils.js';
+import { renderActionAsText } from '../../core/interaction-router.js';
 export const OPEN_INVITE_STATES = ['pending', 'processing', 'reconciling'];
 export function recordValue(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);

package/dist/channels/daemon.js

@@ -225,7 +225,7 @@ export class DaemonChannel {
         // 记忆整理会话：把会话原型与整理模式写进 metadata，供渲染层选 manifest / 手册，
         // 供 ipc 侧校验写命令的 --scope。
         const { memoryMode, memoryScope, consolidationBatchDir, consolidationChatDir, consolidationMemoryDir } = trigger.execution;
-        // 反馈目标与触发方式（launch-consolidation 在 normalize 后补挂的字段）：
+        // 反馈目标与触发方式（consolidation.ts 在 normalize 后补挂的字段）：
         // 收尾时据此投递反馈，并判断是否该反馈（定时触发不反馈）。
         const { feedbackOrigin, consolidationTriggeredBy } = trigger.execution;
         return await this.sessionManager.getOrCreateSession(this.channelName, channelId, projectPath, threadId, {

package/dist/cli/agent-command.js

@@ -689,18 +689,18 @@ Options:
         return;
     }
     if (sub === 'welcome') {
-        if (args.length === 2 && isHelpFlag(args[1])) {
-            console.log(`用法: ${MAIN_CLI_BIN} agent welcome show [--format json]
-     ${MAIN_CLI_BIN} agent welcome --text <text> [--format json]
-
-读取或保存当前 Agent 在 Bootstrap 中经 Owner 确认的 welcome 文案。文案固定保存到 personal/welcome.md。`);
-            return;
-        }
         let text;
         try {
             ({ text } = parseAgentWelcomeArgs(args.slice(1)));
         }
         catch (error) {
+            if (wantsHelp(args)) {
+                console.log(`用法: ${MAIN_CLI_BIN} agent welcome show [--format json]
+     ${MAIN_CLI_BIN} agent welcome --text <text> [--format json]
+
+读取或保存当前 Agent 在 Bootstrap 中经 Owner 确认的 welcome 文案。文案固定保存到 personal/welcome.md。`);
+                return;
+            }
             const result = { ok: false, code: 'INVALID_ARGS', error: error.message };
             if (formatJson)
                 console.log(JSON.stringify(result));