evolcore 0.0.29 → 0.0.30

package/dist/cli/aun-commands.js

@@ -98,6 +98,12 @@ function renderAgentmdGet(aid, result, formatJson) {
         console.error(`⚠ 签名验证失败: ${verification.reason ?? '未知原因'}`);
     else
         console.error('ℹ️ 未签名');
+    console.error(`来源: ${result.source === 'remote' ? '远端' : '本地缓存'}`);
+    console.error(`内容 SHA-256: ${result.contentSha256}`);
+    if (result.remoteVersion?.etag)
+        console.error(`远端 ETag: ${result.remoteVersion.etag}`);
+    if (result.remoteVersion?.lastModified)
+        console.error(`远端 Last-Modified: ${result.remoteVersion.lastModified}`);
 }
 function failManagedAid(formatJson, code, error) {
     if (formatJson)
@@ -119,7 +125,10 @@ async function runManagedAid(args, formatJson) {
     if (!parsed.ok)
         failManagedAid(formatJson, parsed.code, parsed.reason);
     const runtime = await readBestTaskRuntimeContext();
-    const requiresSelfAid = parsed.command.kind === 'show' || parsed.command.kind === 'agentmd.put' || parsed.command.kind === 'avatar';
+    const requiresSelfAid = parsed.command.kind === 'show'
+        || parsed.command.kind === 'agentmd.put'
+        || parsed.command.kind === 'agentmd.set'
+        || parsed.command.kind === 'avatar';
     if (requiresSelfAid && runtime?.selfAid && parsed.command.aid !== runtime.selfAid.replace(/^@/, '')) {
         failManagedAid(formatJson, 'SCOPE_MISMATCH', `托管任务只能操作当前 self AID：${runtime.selfAid}`);
     }
@@ -155,10 +164,16 @@ async function runManagedAid(args, formatJson) {
             return;
         case 'agentmd.put':
             if (formatJson)
-                console.log(JSON.stringify({ ok: true, aid: response.result.aid, path: response.result.path }, null, 2));
+                console.log(JSON.stringify({ ok: true, ...response.result }, null, 2));
             else
                 console.log('✓ agent.md 已发布');
             return;
+        case 'agentmd.set':
+            if (formatJson)
+                console.log(JSON.stringify({ ok: true, ...response.result }, null, 2));
+            else
+                console.log(`✓ agent.md 字段已更新: ${response.result.field}`);
+            return;
         case 'avatar':
             if (formatJson)
                 console.log(JSON.stringify({
@@ -441,6 +456,7 @@ Commands:
   lookup <aid>      远程探测 AID（是否存在 + 网关 + agent.md）
   agentmd put <aid> 读本地 agent.md → 签名 → 上传
   agentmd get <aid> 下载 agent.md → 验签 → 本地持久化
+  agentmd set <aid> <field> <value> 修改一个字段并签名上传
   avatar <aid> --file <path> | --url <https-url>  上传头像并更新 agent.md
 
 Options:
@@ -458,14 +474,16 @@ Options:
   ec aid delete --unrecoverable --yes
   ec aid lookup someone.agentid.pub
   ec aid agentmd put mybot.agentid.pub
-  ec aid agentmd get someone.agentid.pub`);
+  ec aid agentmd get someone.agentid.pub
+  ec aid agentmd set mybot.agentid.pub description "A helpful agent"`);
         return;
     }
-    if (process.env.EVOLCORE_SESSION_ID && !wantsHelp(args)) {
+    const isAgentmdHelp = sub === 'agentmd' && (!args[1] || isHelpFlag(args[1]));
+    if (process.env.EVOLCORE_SESSION_ID && !wantsHelp(args) && !isAgentmdHelp) {
         await runManagedAid(args, formatJson);
         return;
     }
-    const { aidList, aidListVerified, aidCreate, aidShow, aidDelete, aidLookup, agentmdPut, agentmdGet, buildInitialAgentMd, isValidAid } = await import('../aun/aid/index.js');
+    const { aidList, aidListVerified, aidCreate, aidShow, aidDelete, aidLookup, agentmdPut, agentmdGet, agentmdSet, buildInitialAgentMd, isValidAid } = await import('../aun/aid/index.js');
     if (sub === 'list') {
         if (wantsHelp(args)) {
             console.log(`用法: ec aid list [筛选选项] [--no-verify] [--format json]
@@ -833,10 +851,50 @@ Options:
         const verb = args[1];
         const aid = args[2];
         if (!verb || isHelpFlag(verb) || wantsHelp(args)) {
-            console.log(`用法: ec aid agentmd <put|get> <aid> [--format json]
+            console.log(`用法: ec aid agentmd <put|get|set> <aid> [field value] [--format json]
 
   put <aid>   读本地 agent.md → 用本地私钥签名 → 上传到 PKI
-  get <aid>   从 PKI 下载 agent.md → 验签 → 持久化到本地`);
+  get <aid>   从 PKI 下载 agent.md → 验签 → 持久化到本地
+  set <aid> <field> <value>
+              修改 name/type/description/version/tags 中的一个字段，签名后上传
+              tags 的 value 必须是 JSON 字符串数组，例如 ["coding","tools","aun"]`);
+            return;
+        }
+        if (verb === 'set') {
+            const field = args[3];
+            const value = args[4];
+            const editableFields = new Set(['name', 'type', 'description', 'version', 'tags']);
+            if (!aid || !field || value === undefined) {
+                failManagedAid(formatJson, 'INVALID_ARGUMENT', '用法: ec aid agentmd set <aid> <name|type|description|version|tags> <value>');
+            }
+            if (!isValidAid(aid)) {
+                failManagedAid(formatJson, 'INVALID_AID', `无效 AID 格式: ${aid}`);
+            }
+            if (!editableFields.has(field)) {
+                failManagedAid(formatJson, 'INVALID_ARGUMENT', `agentmd set field must be one of ${[...editableFields].join(', ')}`);
+            }
+            let parsedValue = value;
+            if (field === 'tags') {
+                try {
+                    const parsed = JSON.parse(value);
+                    if (!Array.isArray(parsed) || parsed.some(item => typeof item !== 'string'))
+                        throw new Error('not an array of strings');
+                    parsedValue = parsed;
+                }
+                catch {
+                    failManagedAid(formatJson, 'INVALID_ARGUMENT', 'agentmd set tags value must be a JSON array of strings');
+                }
+            }
+            try {
+                const result = await agentmdSet(aid, field, parsedValue, { aunPath });
+                if (formatJson)
+                    console.log(JSON.stringify({ ok: true, aid, ...result }, null, 2));
+                else
+                    console.log(`✓ agent.md 字段 ${field} 已更新并发布`);
+            }
+            catch (error) {
+                failManagedAid(formatJson, String(error?.code ?? 'AID_OPERATION_FAILED'), String(error?.message ?? error));
+            }
             return;
         }
         if (verb === 'put') {
@@ -848,18 +906,21 @@ Options:
                 console.error(`❌ 无效 AID 格式: ${aid}`);
                 process.exit(1);
             }
-            const localPath = agentMdPath(aid);
+            const localPath = agentMdPath(aid, aunPath);
             if (!fs.existsSync(localPath)) {
                 console.error(`❌ 本地无 agent.md: ${aid}`);
                 process.exit(1);
             }
             const content = fs.readFileSync(localPath, 'utf-8');
-            await agentmdPut(content, { aid, aunPath });
-            if (formatJson) {
-                console.log(JSON.stringify({ ok: true, aid, path: localPath }, null, 2));
+            try {
+                const result = await agentmdPut(content, { aid, aunPath });
+                if (formatJson)
+                    console.log(JSON.stringify({ ok: true, aid, ...result }, null, 2));
+                else
+                    console.log('✓ agent.md 已发布');
             }
-            else {
-                console.log('✓ agent.md 已发布');
+            catch (error) {
+                failManagedAid(formatJson, String(error?.code ?? 'AID_OPERATION_FAILED'), String(error?.message ?? error));
             }
             return;
         }
@@ -888,7 +949,7 @@ Options:
             }
             return;
         }
-        console.error(`未知子命令: aid agentmd ${verb ?? ''}\n用法: ec aid agentmd [put|get] <aid>`);
+        console.error(`未知子命令: aid agentmd ${verb ?? ''}\n用法: ec aid agentmd [put|get|set] <aid>`);
         process.exit(1);
     }
     if (sub === 'avatar') {
@@ -1727,6 +1788,21 @@ function printGroupSendAidHint() {
     console.error(`仅格式示例（.example.invalid 是保留的虚构域，不是真实 AID）: ec group send ${GROUP_FROM_AID_FORMAT_EXAMPLE} ${GROUP_AID_FORMAT_EXAMPLE} "hello"`);
     console.error('查询真实群 AID: ec group list <发送方AID>');
 }
+function printGroupRulesUsage() {
+    console.log(`用法:
+  ec group rules <from> <group-id> get
+  ec group rules <from> <group-id> set <file>
+  ec group rules <from> <group-id> publish
+  ec group rules <from> <group-id> [--mode open|approval|invite_only|closed] [--question Q] [--max-pending N]
+
+说明:
+  get      读取当前已发布的群规则文件 /rules.md
+  set      上传本地文件到群空间 /rules.md，发布 rules.content 元数据，并发送 group.rules.updated 通知
+  publish  不上传文件，仅发布当前群空间 /rules.md 的元数据并发送通知
+
+兼容:
+  不带 get/set/publish 时仍使用旧的入群规则接口。`);
+}
 export async function cmdGroup(args) {
     args = canonicalizeEvolcoreCommandArgv(['ec', 'group', ...args]).slice(2);
     const sub = args[0];
@@ -1752,8 +1828,11 @@ export async function cmdGroup(args) {
 visitor 不开放历史；群权限仍由托管会话校验。`);
         return;
     }
-    const rulesActionHelp = sub === 'rules' && isHelpFlag(args[3]);
-    if (!sub || isHelpFlag(sub) || (wantsHelp(args) && !rulesActionHelp)) {
+    if (sub === 'rules' && (wantsHelp(args) || isHelpFlag(args[3]))) {
+        printGroupRulesUsage();
+        return;
+    }
+    if (!sub || isHelpFlag(sub) || wantsHelp(args)) {
         console.log(`用法: ec group <command> <from-aid> [args...] [options]
 
 消息:
@@ -2320,21 +2399,6 @@ g- 是名称的一部分，会完整保留；默认命名格式为 g-10000 至 g
     if (sub === 'rules') {
         const groupId = requireGroupId();
         const action = args[3];
-        const printRulesFileUsage = () => {
-            console.log(`用法:
-  ec group rules <from> <group-id> get
-  ec group rules <from> <group-id> set <file>
-  ec group rules <from> <group-id> publish
-  ec group rules <from> <group-id> [--mode open|approval|invite_only|closed] [--question Q] [--max-pending N]
-
-说明:
-  get      读取当前已发布的群规则文件 /rules.md
-  set      上传本地文件到群空间 /rules.md，发布 rules.content 元数据，并发送 group.rules.updated 通知
-  publish  不上传文件，仅发布当前群空间 /rules.md 的元数据并发送通知
-
-兼容:
-  不带 get/set/publish 时仍使用旧的入群规则接口。`);
-        };
         const printRulesFileState = (result, verb) => {
             if (!result.ok) {
                 if (formatJson) {
@@ -2381,10 +2445,6 @@ g- 是名称的一部分，会完整保留；默认命名格式为 g-10000 至 g
                 process.exit(1);
             }
         };
-        if (action && isHelpFlag(action)) {
-            printRulesFileUsage();
-            return;
-        }
         if (action === 'get') {
             const result = await groupRulesFileGet({ from, groupId, ...commonOpts });
             printRulesFileState(result, 'get');
@@ -2394,7 +2454,7 @@ g- 是名称的一部分，会完整保留；默认命名格式为 g-10000 至 g
             const filePath = args[4];
             if (!filePath || filePath.startsWith('--')) {
                 console.error('❌ 缺少 <file> 参数');
-                printRulesFileUsage();
+                printGroupRulesUsage();
                 process.exit(1);
             }
             const result = await groupRulesFileSet({ from, groupId, filePath, ...commonOpts });
@@ -2408,7 +2468,7 @@ g- 是名称的一部分，会完整保留；默认命名格式为 g-10000 至 g
         }
         if (action && !action.startsWith('--')) {
             console.error(`❌ 未知 rules 动作: ${action}`);
-            printRulesFileUsage();
+            printGroupRulesUsage();
             process.exit(1);
         }
         const wantsUpdate = args.includes('--mode') || args.includes('--question') || args.includes('--max-pending');

package/dist/cli/data-command.js

@@ -6,6 +6,7 @@ import { scanInstances } from '../utils/instance-registry.js';
 import { isProcessRunning, killProcess } from '../utils/cross-platform.js';
 import { ipcQuery } from '../ipc.js';
 import { cmdStart, cmdStop } from './daemon-commands.js';
+import { wantsHelp } from './help.js';
 function printSummary(manifest) {
     const counts = manifest.operations.reduce((result, operation) => {
         result[operation.status] = (result[operation.status] ?? 0) + 1;
@@ -78,7 +79,7 @@ async function waitForMaintenanceWindow() {
     throw new Error(`cannot begin migration while runtime remains active (main=${runtime.mainCount}, restart-monitor=${runtime.monitorPids.length}, ipc=${ipc})`);
 }
 export async function cmdData(args) {
-    if (args[0] !== 'migrate' || args.includes('--help')) {
+    if (args[0] !== 'migrate' || wantsHelp(args)) {
         console.log('用法: ec data migrate --dry-run | --apply [migration-id] | --verify [migration-id]');
         return;
     }

package/dist/cli/managed-command-guard.js

@@ -1,4 +1,4 @@
-import { wantsHelp } from './help.js';
+import { isHelpFlag, wantsHelp } from './help.js';
 const MANAGED_TASK_COMMANDS = new Set([
     'aid',
     'agent',
@@ -51,7 +51,7 @@ export class ManagedCommandNotAllowedError extends Error {
  * Keep them outside managed tasks so they cannot read or mutate host state.
  */
 export function assertManagedTopLevelCommandAllowed(command, args, env = process.env) {
-    if (!env.EVOLCORE_SESSION_ID || wantsHelp(args.slice(1)) || command === '--help' || command === '-h')
+    if (!env.EVOLCORE_SESSION_ID || isHelpFlag(command) || wantsHelp(args.slice(1)))
         return;
     if (!MANAGED_TASK_COMMANDS.has(command))
         throw new ManagedCommandNotAllowedError(command);

package/dist/cli/model.js

@@ -601,7 +601,7 @@ async function cmdCheck(args, formatJson) {
 export async function cmdModel(args) {
     const sub = args[0];
     const formatJson = getArgValue(args, '--format') === 'json';
-    if (!sub || isHelpFlag(sub)) {
+    if (!sub || isHelpFlag(sub) || wantsHelp(args)) {
         console.log(HELP);
         return;
     }

package/dist/cli/response.js

@@ -395,7 +395,7 @@ function cmdConfigSet(args, formatJson) {
 export async function cmdResponse(args) {
     const sub = args[0];
     const formatJson = getArgValue(args, '--format') === 'json';
-    if (!sub || isHelpFlag(sub)) {
+    if (!sub || isHelpFlag(sub) || wantsHelp(args)) {
         console.log(HELP);
         return;
     }

package/dist/cli/trigger-command.js

@@ -7,7 +7,8 @@ import { readDelegationCredential } from '../core/auth/agent-delegation.js';
 import { readTaskRuntimeContextFromEnv } from './task-context.js';
 import { assertEcSingleLine } from './cli-argv.js';
 import { canonicalizeEvolcoreCommandArgv } from '../core/permission/ec-command-parser.js';
-import { normalizeTriggerDefinition, resolveScriptPath, } from '../trigger/validation.js';
+import { readTriggerLocalFile, resolveTriggerLocalPath } from '../trigger/local-files.js';
+import { normalizeTriggerDefinition, resolveScriptPath, safeRelativePath, } from '../trigger/validation.js';
 export async function cmdTrigger(args) {
     args = canonicalizeEvolcoreCommandArgv(['ec', 'trigger', ...args]).slice(2);
     const sub = args[0];
@@ -39,11 +40,31 @@ export async function cmdTrigger(args) {
         }
         return;
     }
-    if (process.env.EVOLCORE_SESSION_ID
-        && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path') || hasOption(rest, '--script-file'))) {
-        throw new Error('Managed tasks cannot read trigger definitions, prompts, or scripts from local files; use inline prompt content');
-    }
     try {
+        let fileScope;
+        if (process.env.EVOLCORE_SESSION_ID
+            && (hasOption(rest, '--file') || hasOption(rest, '--prompt-file') || hasOption(rest, '--script-path') || hasOption(rest, '--script-file'))) {
+            if (!['create', 'set', 'update'].includes(sub))
+                throw new Error('local file inputs are only valid for Trigger create/update');
+            const agentAid = resolveAgentAid(rest);
+            const triggerId = sub === 'update'
+                ? positional(rest, 0, ['--agent', '--format', '--if-revision', '--prompt-file', '--script-file'])
+                : undefined;
+            const authorization = await request({
+                type: 'trigger.authorizeLocalFiles',
+                agentAid,
+                operation: sub === 'update' ? 'trigger.update' : 'trigger.create',
+                ...(triggerId ? { triggerId } : {}),
+                cwd: process.cwd(),
+            });
+            if (authorization.fullAccess !== true) {
+                if (!authorization.fileScope || typeof authorization.fileScope.projectPath !== 'string'
+                    || typeof authorization.fileScope.cwd !== 'string' || authorization.fileScope.selfAid !== agentAid) {
+                    throw new Error('daemon did not provide a valid Trigger file scope');
+                }
+                fileScope = authorization.fileScope;
+            }
+        }
         switch (sub) {
             case 'list':
                 await listTriggers(rest, json);
@@ -56,10 +77,10 @@ export async function cmdTrigger(args) {
                 return;
             case 'create':
             case 'set':
-                await createTrigger(rest, json);
+                await createTrigger(rest, json, fileScope);
                 return;
             case 'update':
-                await updateTrigger(rest, json);
+                await updateTrigger(rest, json, fileScope);
                 return;
             case 'enable':
             case 'disable':
@@ -131,6 +152,10 @@ Create 参数模式支持:
 通用输出参数:
   --json | --format json
 
+托管文件输入:
+  当前 Agent owner 经 daemon 鉴权后，可读取项目或本会话 TMPDIR 内的定义、prompt 和脚本（单文件上限 4 MiB）。
+  普通脚本必须使用实际可用的进程沙箱；bypass 不授予宿主权限，fullaccess 仍要求独立宿主批准。
+
 Update 参数:
   --once | --delay | --at | --cron | --every | --event [--tz]
   --prompt <文本> | --prompt-file <路径>  --script-file <路径>  --name <名称>
@@ -240,7 +265,7 @@ async function showHistory(args, json) {
         console.log(`${timestamp}  ${event.type.padEnd(18)}  ${event.triggerId}  ${detail}`);
     }
 }
-async function createTrigger(args, json) {
+async function createTrigger(args, json, fileScope) {
     if (!hasOption(args, '--exec')) {
         throw new Error('创建 trigger 必须显式指定 --exec script|trigger-session|target-session');
     }
@@ -251,7 +276,7 @@ async function createTrigger(args, json) {
             throw new Error('--file（完整定义导入）与 --prompt-file（prompt 正文）不能同时指定');
         }
         const file = requireFlag(args, '--file');
-        const { definition, files } = loadDefinitionWithFiles(file);
+        const { definition, files } = loadDefinitionWithFiles(file, fileScope);
         if (definition.execution.type !== executionType) {
             throw new Error(`--exec ${flagValue(args, '--exec')} 与 trigger.json 的 execution.type=${definition.execution.type} 不一致`);
         }
@@ -272,7 +297,7 @@ async function createTrigger(args, json) {
         throw new Error('--exec script 不接受 --prompt-file；请使用 --script-path 和 --script-runtime');
     }
     const { parseTriggerSetArgv } = await import('../trigger/parser.js');
-    const parseResult = parseTriggerSetArgv(withPromptFromFile(triggerCreateArgs(args)), { allowLongPrompt: usesPromptFile });
+    const parseResult = parseTriggerSetArgv(withPromptFromFile(triggerCreateArgs(args), fileScope), { allowLongPrompt: usesPromptFile });
     if (!parseResult.ok) {
         throw new Error(parseResult.error);
     }
@@ -295,7 +320,7 @@ async function createTrigger(args, json) {
         throw new Error('--target-session thread 需要 --target-thread-id');
     }
     const script = parsed.scriptPath ? {
-        path: parsed.scriptPath,
+        path: path.isAbsolute(parsed.scriptPath) ? path.basename(parsed.scriptPath) : safeRelativePath(parsed.scriptPath),
         runtime: parsed.scriptRuntime,
         args: parsed.scriptArgs,
         timeoutMs: parsed.scriptTimeoutMs ?? 30_000,
@@ -335,10 +360,14 @@ async function createTrigger(args, json) {
         reliability: { concurrency: 'forbid', missedPolicy: 'run_once', retry: { maxAttempts: 0, backoffMs: 30_000 } },
         limits: limitsFromParsed(parsed),
     };
+    const files = script ? [{
+            relativePath: script.path.replace(/\\/g, '/'),
+            contentBase64: readTriggerLocalFile(parsed.scriptPath, fileScope).toString('base64'),
+        }] : [];
     const res = await request({
         type: 'trigger.create',
         definition,
-        files: [],
+        files,
         enable: hasFlag(args, '--enable') ? true : undefined,
     }, 30_000);
     if (json)
@@ -423,14 +452,14 @@ function shellQuoteArg(value) {
         return "''";
     return /[\s"'\\]/.test(value) ? `"${value.replace(/(["\\$`])/g, '\\$1')}"` : value;
 }
-async function updateTrigger(args, json) {
+async function updateTrigger(args, json, fileScope) {
     const agentAid = resolveAgentAid(args);
     const triggerId = positional(args, 0, ['--agent', '--format', '--if-revision', '--prompt-file', '--script-file']);
     const usesPromptFile = hasOption(args, '--prompt-file');
     const usesScriptFile = hasOption(args, '--script-file');
     const scriptFilePath = usesScriptFile ? requireFlag(args, '--script-file') : undefined;
     const { parseTriggerUpdateArgv } = await import('../trigger/parser.js');
-    const parsed = parseTriggerUpdateArgv(triggerId, withPromptFromFile(triggerUpdateArgs(args)), { allowLongPrompt: usesPromptFile });
+    const parsed = parseTriggerUpdateArgv(triggerId, withPromptFromFile(triggerUpdateArgs(args), fileScope), { allowLongPrompt: usesPromptFile });
     if (!parsed.ok)
         throw new Error(parsed.error);
     const scriptFileRequested = parsed.value.scriptFile !== undefined;
@@ -438,7 +467,7 @@ async function updateTrigger(args, json) {
     const patch = scriptFileRequested ? { ...patchFields, scriptFile: true } : patchFields;
     const expectedRevision = flagValue(args, '--if-revision');
     const scriptFileBase64 = scriptFilePath
-        ? fs.readFileSync(scriptFilePath).toString('base64')
+        ? readTriggerLocalFile(scriptFilePath, fileScope).toString('base64')
         : undefined;
     const res = await request({
         type: 'trigger.update',
@@ -474,7 +503,7 @@ function triggerUpdateArgs(args) {
     }
     return out;
 }
-function withPromptFromFile(args) {
+function withPromptFromFile(args, fileScope) {
     const fileIndexes = [];
     const filePaths = [];
     for (let index = 0; index < args.length; index++) {
@@ -502,18 +531,9 @@ function withPromptFromFile(args) {
     if (hasOption(args, '--prompt'))
         throw new Error('--prompt-file 与 --prompt 不能同时指定');
     const filePath = filePaths[0];
-    let stat;
-    try {
-        stat = fs.statSync(filePath);
-    }
-    catch (err) {
-        throw new Error(`无法读取 prompt 文件 ${filePath}: ${err?.message || String(err)}`);
-    }
-    if (!stat.isFile())
-        throw new Error(`prompt 文件必须是普通文件: ${filePath}`);
     let prompt;
     try {
-        prompt = fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '');
+        prompt = readTriggerLocalFile(filePath, fileScope).toString('utf8').replace(/^\uFEFF/, '');
     }
     catch (err) {
         throw new Error(`无法读取 prompt 文件 ${filePath}: ${err?.message || String(err)}`);
@@ -598,16 +618,19 @@ async function request(cmd, timeoutMs = 10_000) {
         throw new Error(res.error || 'trigger command failed');
     return res;
 }
-function loadDefinitionWithFiles(inputPath) {
+function loadDefinitionWithFiles(inputPath, fileScope) {
+    inputPath = resolveTriggerLocalPath(inputPath, fileScope);
     const stat = fs.statSync(inputPath);
     const baseDir = stat.isDirectory() ? inputPath : path.dirname(inputPath);
     const jsonPath = stat.isDirectory() ? path.join(inputPath, 'trigger.json') : inputPath;
-    const definition = normalizeTriggerDefinition(JSON.parse(fs.readFileSync(jsonPath, 'utf-8')));
+    const definition = normalizeTriggerDefinition(JSON.parse(readTriggerLocalFile(jsonPath, fileScope).toString('utf8')));
+    if (fileScope && definition.agentAid !== fileScope.selfAid)
+        throw new Error('imported Trigger must belong to the authorized Agent');
     const files = [];
     if (definition.execution.type === 'script') {
         const scriptAbs = resolveScriptPath(baseDir, definition.execution.script.path);
         const relativePath = path.relative(baseDir, scriptAbs).replace(/\\/g, '/');
-        files.push({ relativePath, contentBase64: fs.readFileSync(scriptAbs).toString('base64') });
+        files.push({ relativePath, contentBase64: readTriggerLocalFile(scriptAbs, fileScope).toString('base64') });
     }
     return { definition, files };
 }

package/dist/config/boot-log.js

@@ -12,11 +12,105 @@ import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { logger } from '../utils/logger.js';
-import { readCurrent, readWVersion, writeWVersion, materializeVersion, listAllVersions, diffVersions, snapshot, isConfigSnapshotsEnabled, } from './snapshot.js';
+import { autoMigrateIfNeeded } from '../config-store.js';
+import { initConfigManager } from './config-manager.js';
+import { ensureRoleConfigV4OnStartup, ensureRoleConfigV5OnStartup } from './role-migration-startup.js';
+import { ensureAuxiliaryModelMigrationOnStartup } from './schema-migration.js';
+import { ensureContactBookV2OnStartup } from './contact-book-v2-startup.js';
+import { readInstalledEvolcoreVersion, readFastaunVersion } from '../utils/evolcore-version.js';
+import { readCurrent, readWVersion, writeWVersion, materializeVersion, listAllVersions, diffVersions, snapshot, isConfigSnapshotsEnabled, ensureStartupConfigSnapshot, incrementSuccessCount, retentionCleanup, } from './snapshot.js';
 const MAX_LINES = 300;
 const KEEP_MIN = 150;
 const FALLBACK_MAX_TRIES = 20;
 const FALLBACK_MAX_MS = 120_000;
+export async function prepareStartupConfig(recoverRoleMutations) {
+    recoverRoleMutations();
+    autoMigrateIfNeeded();
+    const auxiliaryModelMigration = await ensureAuxiliaryModelMigrationOnStartup();
+    if (auxiliaryModelMigration) {
+        const message = `✓ Session Renew auxiliary model migration applied automatically: ${auxiliaryModelMigration.changedFiles} file(s)`
+            + (auxiliaryModelMigration.backup ? `; backup: ${auxiliaryModelMigration.backup}` : '');
+        logger.info(message);
+        console.error(message);
+    }
+    const migration = await ensureRoleConfigV4OnStartup();
+    if (migration) {
+        const message = `✓ Role config v4 migration applied automatically: ${migration.changedFiles} file(s)`
+            + (migration.backup ? `; backup: ${migration.backup}` : '');
+        logger.info(message);
+        console.error(message);
+    }
+    const domainMigration = await ensureRoleConfigV5OnStartup();
+    if (domainMigration) {
+        const message = `✓ Standalone role config migration applied automatically: ${domainMigration.changedFiles} file(s)`
+            + (domainMigration.backup ? `; backup: ${domainMigration.backup}` : '');
+        logger.info(message);
+        console.error(message);
+    }
+    const contactMigration = await ensureContactBookV2OnStartup();
+    if (contactMigration) {
+        const message = `✓ Contact book v2 migration applied automatically: ${contactMigration.changedFiles} file(s)`
+            + (contactMigration.backup ? `; backup: ${contactMigration.backup}` : '');
+        logger.info(message);
+        console.error(message);
+    }
+}
+export async function initializeStartupConfig(abort) {
+    try {
+        initConfigManager();
+    }
+    catch (error) {
+        const message = `❌ 配置 schema 校验失败: ${error instanceof Error ? error.message : String(error)}`;
+        logger.error(message);
+        abort(message);
+    }
+    const snapshotsEnabled = isConfigSnapshotsEnabled();
+    if (process.env.EVOLCORE_DIAGNOSE === '1') {
+        if (!snapshotsEnabled) {
+            const message = '配置快照功能已关闭，无法执行版本回落；请设置 configSnapshots=true';
+            logger.error(`[diagnose] ${message}`);
+            abort(message);
+        }
+        logger.info('[diagnose] 进入自检模式，逐版本回落尝试...');
+        const result = await selfDiagnose();
+        if (result.ok) {
+            logger.info(`[diagnose] ✓ 回落到 ${result.actualVersion?.delta} 成功，继续启动。`);
+        }
+        else {
+            const message = result.message ?? '✗ 自检失败：未找到可用版本。';
+            logger.error(message);
+            abort(message);
+        }
+    }
+    return snapshotsEnabled;
+}
+export function recordStartupConfig(snapshotsEnabled) {
+    if (!snapshotsEnabled) {
+        logger.info('[config] snapshots disabled by configSnapshots=false');
+        return;
+    }
+    try {
+        const isDiagnoseMode = process.env.EVOLCORE_DIAGNOSE === '1';
+        const startupVersion = isDiagnoseMode ? readWVersion() : ensureStartupConfigSnapshot();
+        if (startupVersion)
+            incrementSuccessCount(startupVersion.delta);
+        const startMethod = isDiagnoseMode ? 'diagnose'
+            : (process.env.EVOLCORE_LAUNCHED_BY === 'start' ? 'manual' : 'auto');
+        appendBootLog({
+            bootedAt: new Date().toISOString(),
+            startMethod,
+            selectedVersion: readCurrent(),
+            actualVersion: startupVersion,
+            fellBack: !!(isDiagnoseMode && startupVersion && readCurrent()?.delta !== startupVersion.delta),
+            versions: { evolcore: readInstalledEvolcoreVersion(), '@agentunion/fastaun': readFastaunVersion(), node: process.version },
+            platform: `${process.platform}/${process.arch}`,
+        });
+        retentionCleanup();
+    }
+    catch (error) {
+        logger.warn(`[config] startup snapshot/boot-log failed (non-fatal): ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 export function appendBootLog(entry) {
     if (!isConfigSnapshotsEnabled())
         return;

package/dist/config/builtin-roles.js

@@ -62,6 +62,7 @@ export function getManagementCommandPermissions(role) {
         'ec.aid.lookup': { allow: true, scopes: ['agent'] },
         'ec.aid.agentmd.get': { allow: true, scopes: ['agent'] },
         'ec.aid.agentmd.put': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
+        'ec.aid.agentmd.set': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentAdmin: true } },
         'ec.aid.avatar': { allow: true, dangerous: true, scopes: ['agent'], constraints: { targetCurrentAgentOnly: true, requireAgentOwner: true } },
         'ec.fs.mkdir': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },
         'ec.fs.upload': { allow: true, permissionMode: 'auto', scopes: ['relation'], constraints: { groupOnly: true, currentRelationOnly: true, targetCurrentAgentOnly: true } },

package/dist/config/peer-role-resolver.js

@@ -9,6 +9,7 @@ import { isManagementRole } from './builtin-roles.js';
 import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from './roles.js';
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
+import { tryParseChannelKey } from '../core/channel-loader.js';
 import { isValidAid } from '../aun/aid/validation.js';
 import { isExplicitGroupId } from '../aun/group/index.js';
 export function isAuthenticated(userId) {
@@ -131,6 +132,26 @@ export function resolvePeerRoleDetail(ctx) {
         ? resultFor(fallbackRole, 'builtin-fallback', actor, ctx.selfAid)
         : resultFor(null, 'none', actor, ctx.selfAid);
 }
+export function createSessionIdentityResolver(agentRegistry) {
+    return (channel, userId, chatType, conversationId) => {
+        const parsed = tryParseChannelKey(channel);
+        const owningAgent = agentRegistry.resolveByChannel(channel);
+        const selfAid = owningAgent?.aid ?? parsed?.selfAID;
+        if (!selfAid || !userId)
+            return { role: 'none', mode: 'interactive' };
+        const actualChatType = chatType || 'private';
+        const actualConversationId = actualChatType === 'group' ? (conversationId || userId) : userId;
+        const detail = resolvePeerRoleDetail({
+            selfAid,
+            channelKey: channel,
+            channelType: parsed?.type || channel,
+            chatType: actualChatType,
+            actorId: userId,
+            conversationId: actualConversationId,
+        });
+        return roleToSessionIdentity(detail.effectiveRole);
+    };
+}
 export function roleToSessionIdentity(role) {
     return { role: role ?? 'none', mode: 'interactive' };
 }