evolcore 0.0.3 → 0.0.4

package/dist/core/auth/operation-authorizer.js

@@ -18,6 +18,8 @@ export const USER_PLANE_CAPABILITY_CEILING = {
         'chatmode.update',
         'mentionmode.current',
         'mentionmode.update',
+        'group.mentionmode.current',
+        'group.rulespolicy.current',
         'session.list',
         'session.create',
         'session.rename',
@@ -415,6 +417,12 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     if (!resolvedConfigOp.route || (resolvedConfigOp.fieldRule.class !== 'safe-scalar' && resolvedConfigOp.fieldRule.class !== 'safe-readonly-object')) {
         return { ok: false, reason: `Config field ${field} is not available to user roles` };
     }
+    if (policy === 'role-overridable-write'
+        && resolvedConfigOp.fieldRule.access === 'owner-only'
+        && ctx.role !== 'owner'
+        && !ctx.isDaemonOwner) {
+        return { ok: false, reason: `Config field ${field} can only be changed by an owner` };
+    }
     const roleDef = getRoleDefinition(ctx.role, ctx.selfAid);
     const fieldPermission = roleDef
         ? resolveRoleFieldPermission(roleDef.permissions || {}, field)

package/dist/core/auth/operation-catalog.js

@@ -133,6 +133,46 @@ const OPERATIONS = [
         description: 'Update group mention mode',
         sources: ['slash', 'menu'],
     },
+    {
+        id: 'group.list',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'List joined AUN groups',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.mentionmode.current',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Read a group mention mode',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.mentionmode.update',
+        category: 'write-own',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Update a group mention mode',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.rulespolicy.current',
+        category: 'read',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Read a group rules loading policy',
+        sources: ['menu'],
+    },
+    {
+        id: 'group.rulespolicy.update',
+        category: 'write-own',
+        dangerous: false,
+        defaultScopes: ['relation', 'agent'],
+        description: 'Update a group rules loading policy',
+        sources: ['menu'],
+    },
     {
         id: 'session.list',
         category: 'read',
@@ -180,7 +220,7 @@ const OPERATIONS = [
         dangerous: false,
         defaultScopes: ['filesystem'],
         description: '获取文件内容（需路径沙箱检查）',
-        sources: ['menu'],
+        sources: ['slash', 'menu'],
     },
     // ── Trigger Operations ──
     {
@@ -317,7 +357,7 @@ const OPERATIONS = [
         category: 'write-agent',
         dangerous: false,
         defaultScopes: ['agent'],
-        description: 'Block or unblock an AUN contact',
+        description: 'Block or unblock a canonical contact across bound private channels',
         sources: ['agent-tool'],
     },
     {
@@ -357,7 +397,15 @@ const OPERATIONS = [
         category: 'write-agent',
         dangerous: false,
         defaultScopes: ['agent'],
-        description: 'Add contacts or modify contact status (block/unblock)',
+        description: 'Manage contacts, contact requests, and allowed group channels',
+        sources: ['menu', 'ecweb', 'control'],
+    },
+    {
+        id: 'connect.access.write',
+        category: 'write-agent',
+        dangerous: false,
+        defaultScopes: ['agent'],
+        description: 'Manage owner-only Agent access policy and request limit settings',
         sources: ['menu', 'ecweb', 'control'],
     },
     // Agent Operations

package/dist/core/auth/trigger-authorization.js

@@ -0,0 +1,15 @@
+const CROSS_AGENT_READ_OPERATIONS = new Set([
+    'trigger.list',
+    'trigger.show',
+    'trigger.history',
+]);
+export function isCrossAgentTriggerOperationAllowed(input) {
+    if (input.control || input.taskAgentAid === input.targetAgentAid)
+        return true;
+    if (!input.taskAgentAid || !input.targetManagement)
+        return false;
+    return CROSS_AGENT_READ_OPERATIONS.has(input.operation);
+}
+export function isCrossAgentTriggerReadOperation(operation) {
+    return CROSS_AGENT_READ_OPERATIONS.has(operation);
+}

package/dist/core/bootstrap-service.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { randomBytes } from 'crypto';
 import { kitsTemplatesDir, agentMdPath } from '../paths.js';
+import { resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { logger } from '../utils/logger.js';
 import { loadAgent, saveAgent } from '../config-store.js';
 import { normalizeAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
@@ -130,15 +131,7 @@ export class BootstrapService {
         return renderTemplate(template, vars).trim();
     }
     resolveAgentDisplayName(aid) {
-        try {
-            const content = fs.readFileSync(agentMdPath(aid), 'utf-8');
-            const fm = content.match(/^---\n([\s\S]*?)\n---/)?.[1] || '';
-            const name = fm.match(/^name:\s*["']?(.+?)["']?\s*$/m)?.[1]?.trim();
-            if (name)
-                return name;
-        }
-        catch { }
-        return aid.split('.')[0];
+        return resolveAgentDisplayName(aid) || aid.split('.')[0];
     }
     resolveBaseagent(agent, aid) {
         try {

package/dist/core/channel-loader.js

@@ -26,7 +26,11 @@ export function showActivitiesPolicy(mode, chatType, _identity) {
 }
 // ── ChannelLoader ──────────────────────────────────────────────────────────
 export class ChannelLoader {
+    processDebug;
     plugins = new Map();
+    constructor(processDebug) {
+        this.processDebug = processDebug;
+    }
     register(plugin) {
         if (this.plugins.has(plugin.name)) {
             throw new Error(`Channel plugin '${plugin.name}' already registered`);
@@ -46,7 +50,7 @@ export class ChannelLoader {
         const ctx = {
             agentName: agent.aid,
             defaultProjectPath: agent.config.projects?.defaultPath ?? process.cwd(),
-            debug: agent.config.debug,
+            debug: this.processDebug,
         };
         // Build the full list of config instances to create.
         // AUN is synthesised from agent.aid; any explicit aun entry in channels[] is skipped.
@@ -252,7 +256,7 @@ export function buildReloadHooks(deps) {
             const ctx = {
                 agentName: agent.aid ?? agent.config?.aid,
                 defaultProjectPath: agent.config?.projects?.defaultPath ?? process.cwd(),
-                debug: agent.config?.debug,
+                debug: channelLoader.processDebug,
             };
             const plugin = channelLoader.getPlugin(cfgInst.type);
             if (!plugin)

package/dist/core/command/command-handler.js

@@ -814,12 +814,9 @@ export class CommandHandler {
             item.lastActive = s.updatedAt;
         return item;
     }
-    /**
-     * 返回结构化命令菜单（供 menu.query 使用）
-     * owner 看到全部命令，admin 看到管理级命令（不含 owner-only），visitor/member 仅看到用户级命令
-     */
-    getMenuItems(role, chatType = 'private', scope = 'agent') {
-        return menuGetMenuItems.call(this, role, chatType, scope);
+    /** 返回结构化命令菜单，已迁移的命令按当前授权主体过滤。 */
+    getMenuItems(role, chatType = 'private', scope = 'agent', authSubject) {
+        return menuGetMenuItems.call(this, role, chatType, scope, authSubject);
     }
     /** 动态子菜单：根据 cmd 路径返回选项列表（供 menu.query + cmd 使用） */
     async getSubMenuItems(cmd, channel, channelId, userId, args, overrideIdentity, explicitChatType, fromControlChannel = false, authSubject, source = 'menu') {
@@ -843,8 +840,8 @@ export class CommandHandler {
         return await menuExecMenuUpdate.call(this, cmd, value, channel, channelId, userId, overrideIdentity, fromControlChannel, args, authSubject, source);
     }
     /** menu.action — 触发动词。 */
-    async execMenuAction(cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel = false, authSubject, source = 'menu') {
-        return await menuExecMenuAction.call(this, cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel, authSubject, source);
+    async execMenuAction(cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel = false, authSubject, source = 'menu', transportReplyContext, deferSideEffect) {
+        return await menuExecMenuAction.call(this, cmd, action, args, channel, channelId, userId, overrideIdentity, explicitChatType, requestId, fromControlChannel, authSubject, source, transportReplyContext, deferSideEffect);
     }
     /** ECWeb 专用入口：身份只取可信 IPC 信封。 */
     async execMenuForEcweb(payload, auth) {
@@ -1168,7 +1165,7 @@ export class CommandHandler {
 /trigger list [--all] — 查看所有触发器
 /trigger create <参数> — 创建触发器（set 为兼容别名）
 /trigger update <名称|ID> <参数> — 修改触发器
-常用参数：--delay/--at/--cron/--every、--prompt、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）
+常用参数：--exec script|trigger-session|target-session（create 必填）、--delay/--at/--cron/--every、--prompt、--model、--effort、--permission（省略则继承；update 可用 inherit 清除覆盖）
 /trigger enable <名称|ID> — 启用触发器
 /trigger disable <名称|ID> — 暂停触发器
 /trigger show <名称|ID> — 查看触发器详情
@@ -1451,11 +1448,11 @@ export class CommandHandler {
      * Agent managed CLI config entrypoint. Identity and relation are resolved
      * from the daemon-owned session rather than caller-provided flags.
      */
-    async handleConfigOperation(argv, sessionId, delegationToken) {
+    async handleConfigOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
         }
-        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId);
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
         const session = await this.sessionManager.getSessionById(sessionId);
@@ -1513,11 +1510,11 @@ export class CommandHandler {
             : { ok: false, code: result.code, error: result.error, ...(result.data !== undefined ? { data: result.data } : {}) };
     }
     /** Agent-managed contact CLI entrypoint. The daemon owns actor resolution and authorization. */
-    async handleContactOperation(argv, sessionId, delegationToken) {
+    async handleContactOperation(argv, sessionId, delegationToken, delegationCommandHash) {
         if (!this.agentDelegationRegistry) {
             return { ok: false, code: 'DELEGATION_REQUIRED', error: 'Task delegation is not configured' };
         }
-        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId);
+        const delegation = this.agentDelegationRegistry.validate(delegationToken, sessionId, delegationCommandHash);
         if (!delegation.ok)
             return { ok: false, code: delegation.code, error: delegation.reason };
         const session = await this.sessionManager.getSessionById(sessionId);