evolcore 0.0.31 → 0.0.32

package/CHANGELOG.md

@@ -5,6 +5,17 @@
 
 ## Unreleased
 
+## 0.0.32 (2026-10-12)
+
+- 统一受管命令的原始参数与审批哈希校验，按会话项目目录解析 Agent 初始化、人格和头像文件，强化授权后的文件访问边界。
+- 将 Agent 初始化等待、AUN 发送、Storage、Trigger、handoff、queue、task 和 memory 操作统一纳入 daemon 授权与参数校验。
+- 改进 Codex、EC Agent 和 Gemini 输入提交回执，避免已提交输入重复入队，并完善中断时的未提交输入处理。
+- 移除 AUN SDK 私有游标、分页和事件补丁，改用 SDK 公共能力并记录缺口；群文件下载和 Service Proxy 改用公开 token 与身份接口。
+- 强化 Trigger 脚本会话权限与 H/L 路径保护，保留 Git、SSH 和代理环境；完善 `/restart` 与 EC Web 重启的数据迁移处理。
+- 支持 Owner 通过受管 rename 更新并签名发布 AID 名片显示名称，并修复 Agent welcome 参数中 `--help` / `-h` 的解析。
+- 修正受管 `ec fs` 的存储范围：Agent owner 可在私聊或本地会话访问自身 personal storage，群文件仍严格限制为当前群，并兼容经授权的 fullaccess Trigger。
+- 强制受管文件操作先解析并确认 `targetAid` 与 `storageBackend`，拒绝未解析目标；fullaccess 跨群目标必须通过已验证的群名片，执行身份不能通过 `--as` 切换。
+
 ## 0.0.31 (2026-10-11)
 
 - 修复 `/restart` 和 ECWeb 系统重启在存在待迁移数据时提前终止的问题，统一由 `restart-monitor` 自动预检、停机迁移、严格校验、归档并在成功后启动。

package/dist/agents/codex-runner.js

@@ -1954,6 +1954,8 @@ export class CodexRunner {
             openToolCalls: new Map(),
             activeSubagentThreads: new Set(),
             turnCompleted: false,
+            inputId: turn?.inputId,
+            inputAcceptedEmitted: false,
         };
         const unsubscribe = appServer.onNotification(notification => {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
@@ -4088,18 +4090,32 @@ export class CodexRunner {
         const requiresSandboxExpansionApproval = hasFileChangeExpansion
             || hasFilesystemPermissions
             || hasUnknownPermissions;
+        const resolveRuntimeApproval = (decision) => {
+            if (decision === 'deny' && permissionContext?.approvalInteractionPolicy === 'deny') {
+                return {
+                    decision: 'deny',
+                    decisionSource: 'policy',
+                    policyCode: 'permission_mode_denied',
+                    reason: 'permission mode denied runtime approval',
+                };
+            }
+            return decision;
+        };
         if (requiresSandboxExpansionApproval) {
-            if (!this.permissionGateway || !permissionPrompt)
-                return 'deny';
+            if (!this.permissionGateway || !permissionPrompt) {
+                return permissionContext?.approvalInteractionPolicy === 'deny'
+                    ? resolveRuntimeApproval('deny')
+                    : 'deny';
+            }
             if (policyToolName === 'FileChange') {
-                return this.permissionGateway.requestPermission(sessionKey, policyToolName, policyInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath });
+                return resolveRuntimeApproval(await this.permissionGateway.requestPermission(sessionKey, policyToolName, policyInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath }));
             }
-            return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope);
+            return resolveRuntimeApproval(await this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope));
         }
         if (mode === 'request' || mode === 'bypass') {
             const dangerous = await requestDangerousCommandPermission(this.permissionGateway, sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), grantScope, mode);
             if (dangerous.matched)
-                return dangerous.decision;
+                return resolveRuntimeApproval(dangerous.decision);
             return 'allow';
         }
         // Network is already part of every profile, so a defensive
@@ -4657,6 +4673,13 @@ export class CodexRunner {
                     state.turnId = turnId;
                     this.activeTurns.set(sessionId, { threadId: state.threadId, turnId });
                 }
+                // turn/start 已落地并回执 turn/started ⇒ 用户输入已被 app-server 接受。
+                // 此后中断不能把该输入当作「未提交」重放，否则会产生重复用户轮次。
+                // 缺少 turn lease inputId 时宁可不报，也不要用占位值造成误判。
+                if (!state.inputAcceptedEmitted && state.inputId) {
+                    state.inputAcceptedEmitted = true;
+                    yield { type: 'input_accepted', inputId: state.inputId };
+                }
                 yield { type: 'state_changed', state: 'running' };
                 break;
             }

package/dist/agents/ecagent-runner.js

@@ -923,6 +923,10 @@ export class EcagentRunner {
             const unsubscribe = harness.subscribe(event => this.mapHarnessEvent(queue, event, stats, model, effort));
             queue.push({ type: 'state_changed', state: 'running' });
             queue.push({ type: 'status', subtype: 'started', message: `ecagent is using ${modelId}` });
+            // Ecagent 输入在 harness.prompt 调用时提交，在此前报告
+            if (request.modelOverride?.turn?.inputId) {
+                queue.push({ type: 'input_accepted', inputId: request.modelOverride.turn.inputId });
+            }
             const ecImages = request.images?.map(image => ({
                 type: 'image', data: image.data, mimeType: image.mimeType || 'image/png',
             }));

package/dist/agents/gemini-runner.js

@@ -514,6 +514,10 @@ export class GeminiRunner {
         const pendingToolNames = new Map(); // toolId → toolName
         const recordedDeniedToolIds = new Set();
         const startTime = Date.now();
+        // Gemini 走 spawn + argv，输入在 spawn 时已提交；在第一个业务事件前报告
+        if (turn?.inputId) {
+            yield { type: 'input_accepted', inputId: turn.inputId };
+        }
         const rl = createInterface({ input: child.stdout });
         // Build async queue from readline
         const queue = [];

package/dist/aun/aid/store.js

@@ -1,13 +1,6 @@
 import fs from 'fs';
 import path from 'path';
 import { AUN_KEYSTORE_ENCRYPTION_SEED } from './encryption-seed-policy.js';
-// fastaun uses maxPages=1 for the background tail -> forward handoff. That is
-// useful as a latency guard, but it can leave a group backlog when no later
-// push arrives to trigger the next page. Bound the daemon recovery pull to ten
-// pages so a large backlog is drained without monopolizing the sync loop.
-const FULL_GROUP_PULL_MAX_PAGES = 10;
-const GROUP_PULL_PAGINATION_PATCH = Symbol('evolcore.groupPullPaginationPatch');
-const RELIABLE_MESSAGE_DELIVERY_PATCH = Symbol('evolcore.reliableMessageDeliveryPatch');
 /**
  * Slot 命名约定（基于 fastaun 0.4.3 隔离键语义）。
  *
@@ -77,80 +70,6 @@ export async function loadClient(store, aid) {
     const { AUNClient } = await import('@agentunion/fastaun');
     return new AUNClient(loadAid(store, aid));
 }
-/**
- * Enable bounded multi-page group pulls for the long-lived daemon client.
- *
- * Older SDK recovery paths used `maxPages=1`; for a daemon that can strand a
- * backlog after a tail sync. SDK 0.5.15 normally chooses a larger recovery
- * window, but this adapter still expands an explicit single-page request and
- * keeps older clients safe. It is isolated to the client that opts in.
- */
-export function enableFullGroupPullPagination(client) {
-    const target = client;
-    if (target[GROUP_PULL_PAGINATION_PATCH])
-        return false;
-    const pull = target._pullGroupV2;
-    if (typeof pull !== 'function')
-        return false;
-    const wrappedPull = function (groupId, afterSeq, limit, opts) {
-        const expandedOpts = opts?.maxPages === 1
-            ? { ...opts, maxPages: FULL_GROUP_PULL_MAX_PAGES }
-            : opts;
-        return pull.call(this, groupId, afterSeq, limit, expandedOpts);
-    };
-    Object.defineProperty(target, GROUP_PULL_PAGINATION_PATCH, {
-        configurable: false,
-        enumerable: false,
-        value: true,
-        writable: false,
-    });
-    target._pullGroupV2 = wrappedPull;
-    return true;
-}
-/**
- * Make SDK pull delivery wait until EvolCore's application handlers finish.
- *
- * fastaun publishes message events asynchronously, while the sequence tracker
- * is a transport watermark. A daemon restart can therefore acknowledge a
- * pulled message before the application has durably claimed it. SDK 0.5.15
- * split protocol and application queues; prefer its application-only flush so
- * an unrelated protocol event cannot delay the pull commit. Older SDKs fall
- * back to the combined flush method.
- */
-export function enableReliableMessageDelivery(client) {
-    const target = client;
-    if (target[RELIABLE_MESSAGE_DELIVERY_PATCH])
-        return false;
-    const publish = target._publishAppEvent;
-    const dispatcher = target._dispatcher;
-    const flushApplication = typeof dispatcher?.flushApplication === 'function'
-        ? dispatcher.flushApplication.bind(dispatcher)
-        : typeof dispatcher?.flush === 'function'
-            ? dispatcher.flush.bind(dispatcher)
-            : undefined;
-    if (typeof publish !== 'function' || !flushApplication)
-        return false;
-    const wrappedPublish = async function (event, payload, source, ...rest) {
-        const result = await publish.call(this, event, payload, source, ...rest);
-        // Pull/recovery paths must not advance SeqTracker until the application
-        // handlers have completed. Push delivery has no pull commit to gate and
-        // remains asynchronous as intended by the SDK.
-        const reliable = (event === 'message.received' || event === 'group.message_created')
-            && source !== 'push'
-            && source !== 'inline-push';
-        if (reliable)
-            await flushApplication();
-        return result;
-    };
-    Object.defineProperty(target, RELIABLE_MESSAGE_DELIVERY_PATCH, {
-        configurable: false,
-        enumerable: false,
-        value: true,
-        writable: false,
-    });
-    target._publishAppEvent = wrappedPublish;
-    return true;
-}
 /** 加载本地 AID 值对象（用于离线签名/验签，无需连接）。load 失败抛 AidLoadError。 */
 export function loadAid(store, aid) {
     const r = store.load(aid);

package/dist/aun/group/fs-download.js

@@ -39,16 +39,7 @@ function sha256Hex(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
 function bearerHeaders(client) {
-    const anyClient = client;
-    if (typeof anyClient.getAccessToken === 'function') {
-        const token = stringValue(anyClient.getAccessToken());
-        if (token)
-            return { Authorization: `Bearer ${token}` };
-    }
-    const token = stringValue(anyClient.accessToken)
-        || stringValue(anyClient.access_token)
-        || stringValue(anyClient._identity?.access_token)
-        || stringValue(anyClient._sessionParams?.access_token);
+    const token = stringValue(client.getAccessToken());
     return token ? { Authorization: `Bearer ${token}` } : undefined;
 }
 function stringValue(value) {

package/dist/aun/msg/managed-operation.js

@@ -807,27 +807,30 @@ function positiveInteger(value, flag, max) {
 }
 function parseRemote(value, allowEmpty) {
     if (!value)
-        return failFs('INVALID_ARGUMENT', 'missing remote group path');
+        return failFs('INVALID_ARGUMENT', 'missing remote storage path');
     const separator = value.indexOf(':');
     if (separator <= 0)
         return failFs('INVALID_PATH', 'remote path must use <group-aid>:<absolute-path>');
-    let groupId;
+    let targetAid;
     const remotePath = value.slice(separator + 1);
+    const rawId = value.slice(0, separator).trim();
     try {
-        groupId = normalizeGroupAid(value.slice(0, separator).trim());
+        targetAid = normalizeGroupAid(rawId);
     }
     catch (error) {
-        return failFs('INVALID_GROUP', `invalid group AID: ${error.message}`);
+        if (!isValidAid(rawId))
+            return failFs('INVALID_GROUP', `invalid group AID: ${error.message}`);
+        targetAid = rawId;
     }
     if (remotePath === '' && allowEmpty)
-        return { groupId, remotePath: '' };
+        return { targetAid, remotePath: '' };
     if (!remotePath.startsWith('/') || remotePath.length > MAX_REMOTE_PATH_LENGTH || /[\u0000-\u001f\u007f]/.test(remotePath)
         || remotePath.split('/').includes('..')) {
-        return failFs('INVALID_PATH', 'remote group path must be a bounded absolute path');
+        return failFs('INVALID_PATH', 'remote storage path must be a bounded absolute path');
     }
-    return { groupId, remotePath };
+    return { targetAid, remotePath };
 }
-/** Parse the daemon-owned, current-group filesystem grammar. */
+/** Parse the daemon-owned managed filesystem grammar for group or self storage. */
 export function resolveManagedFsOperation(argv) {
     const raw = argv[0] === 'fs' ? argv.slice(1) : argv;
     const rawKind = raw[0];
@@ -904,11 +907,11 @@ export function resolveManagedFsOperation(argv) {
         if (values.has('-m') || values.has('-x'))
             return failFs('NOT_ALLOWED', 'getfacl does not accept ACL mutation flags');
         const remote = remoteOrError(positionals[0]);
-        if (!('groupId' in remote))
+        if (!('targetAid' in remote))
             return remote;
         return { ok: true, command: {
                 kind: 'getfacl', operationId: 'ec.fs.getfacl', canonicalArgv: ['fs', 'getfacl', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: remote.groupId, remotePath: remote.remotePath,
+                actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath,
             } };
     }
     if (rawKind === 'setfacl') {
@@ -921,17 +924,17 @@ export function resolveManagedFsOperation(argv) {
         if (!('grantee' in parsedAcl))
             return parsedAcl;
         const remote = remoteOrError(positionals[0]);
-        if (!('groupId' in remote))
+        if (!('targetAid' in remote))
             return remote;
         return { ok: true, command: {
                 kind: 'setfacl', operationId: 'ec.fs.setfacl', canonicalArgv: ['fs', 'setfacl', positionals[0], modify !== undefined ? '-m' : '-x', spec, ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: remote.groupId, remotePath: remote.remotePath,
+                actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath,
                 aclGrantee: parsedAcl.grantee, ...(parsedAcl.perms ? { aclPerms: parsedAcl.perms } : {}), aclRemove: remove !== undefined,
             } };
     }
     if (rawKind === 'cp') {
         const destination = remoteOrError(positionals[1]);
-        if (!('groupId' in destination))
+        if (!('targetAid' in destination))
             return destination;
         // Windows absolute paths contain a drive-letter colon, but are local
         // upload sources rather than managed group references.
@@ -939,46 +942,46 @@ export function resolveManagedFsOperation(argv) {
         const source = positionals[0].includes(':') && !isWindowsAbsolutePath
             ? remoteOrError(positionals[0])
             : undefined;
-        if (source && !('groupId' in source))
+        if (source && !('targetAid' in source))
             return source;
-        if (source && source.groupId !== destination.groupId)
-            return failFs('INVALID_GROUP', 'managed cp cannot cross groups');
+        if (source && source.targetAid !== destination.targetAid)
+            return failFs('INVALID_GROUP', 'managed cp cannot cross targets');
         const kind = source ? 'copy' : 'upload';
         return { ok: true, command: {
                 kind, operationId: `ec.fs.${kind}`, canonicalArgv: ['fs', 'cp', positionals[0], positionals[1], ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: destination.groupId, remotePath: destination.remotePath, destinationPath: destination.remotePath,
+                actorAid, targetAid: destination.targetAid, remotePath: destination.remotePath, destinationPath: destination.remotePath,
                 ...(source ? { remoteSourcePath: source.remotePath } : { localPath: positionals[0] }), overwrite, recursive,
             } };
     }
     if (rawKind === 'mv') {
         const source = remoteOrError(positionals[0]);
         const destination = remoteOrError(positionals[1]);
-        if (!('groupId' in source))
+        if (!('targetAid' in source))
             return source;
-        if (!('groupId' in destination))
+        if (!('targetAid' in destination))
             return destination;
-        if (source.groupId !== destination.groupId)
-            return failFs('INVALID_GROUP', 'managed mv cannot cross groups');
+        if (source.targetAid !== destination.targetAid)
+            return failFs('INVALID_GROUP', 'managed mv cannot cross targets');
         return { ok: true, command: {
                 kind: 'move', operationId: 'ec.fs.move', canonicalArgv: ['fs', 'mv', positionals[0], positionals[1], ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: destination.groupId, remotePath: destination.remotePath, destinationPath: destination.remotePath,
+                actorAid, targetAid: destination.targetAid, remotePath: destination.remotePath, destinationPath: destination.remotePath,
                 remoteSourcePath: source.remotePath, overwrite,
             } };
     }
     const remote = remoteOrError(positionals[0], rawKind === 'df');
-    if (!('groupId' in remote))
+    if (!('targetAid' in remote))
         return remote;
     if (rawKind === 'mkdir')
         return { ok: true, command: {
                 kind: 'mkdir', operationId: 'ec.fs.mkdir', canonicalArgv: ['fs', 'mkdir', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: remote.groupId, remotePath: remote.remotePath, parents: booleanFlags.has('-p') || booleanFlags.has('--parents'),
+                actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath, parents: booleanFlags.has('-p') || booleanFlags.has('--parents'),
             } };
     if (rawKind === 'rm' && remote.remotePath === '/')
         return failFs('INVALID_PATH', 'managed rm cannot target the group root');
     if (rawKind === 'rm')
         return { ok: true, command: {
                 kind: 'remove', operationId: 'ec.fs.remove', canonicalArgv: ['fs', 'rm', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
-                actorAid, groupId: remote.groupId, remotePath: remote.remotePath, recursive, overwrite,
+                actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath, recursive, overwrite,
             } };
     const effectiveKind = rawKind === 'stat' && !follow ? 'lstat' : rawKind;
     const maxBytes = positiveInteger(values.get('--max-bytes'), '--max-bytes', MAX_MANAGED_FS_CAT_BYTES);
@@ -998,7 +1001,7 @@ export function resolveManagedFsOperation(argv) {
         return failFs('INVALID_ARGUMENT', '--type only supports f|d|l');
     return { ok: true, command: {
             kind: effectiveKind, operationId: `ec.fs.${effectiveKind}`, canonicalArgv: ['fs', effectiveKind, positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
-            actorAid, groupId: remote.groupId, remotePath: remote.remotePath, maxBytes, headBytes,
+            actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath, maxBytes, headBytes,
             name: values.get('--name') ?? values.get('--pattern'), nodeType, size: values.get('--size'), mtime: values.get('--mtime'), page, pageSize,
         } };
 }
@@ -1055,9 +1058,104 @@ async function withClient(actorAid, fn) {
 export async function executeManagedFsOperation(command) {
     if (!command.actorAid)
         throw new ManagedFsOperationError('INVALID_ACTOR', 'managed fs actor is required');
-    const ref = `${command.groupId}:${command.remotePath}`;
+    if (!command.storageBackend)
+        throw new ManagedFsOperationError('INVALID_TARGET', 'managed fs storage backend must be resolved before execution');
+    return withClient(command.actorAid, client => executeManagedFsOperationWithClient(command, client));
+}
+/** Execute against an already authenticated SDK client; used by integration tests. */
+export async function executeManagedFsOperationWithClient(command, client) {
+    if (!command.actorAid)
+        throw new ManagedFsOperationError('INVALID_ACTOR', 'managed fs actor is required');
+    if (!command.storageBackend)
+        throw new ManagedFsOperationError('INVALID_TARGET', 'managed fs storage backend must be resolved before execution');
+    const ref = `${command.targetAid}:${command.remotePath}`;
     try {
-        return await withClient(command.actorAid, async (client) => {
+        return await (async () => {
+            if (command.storageBackend === 'personal') {
+                const owner = command.targetAid;
+                switch (command.kind) {
+                    case 'mkdir':
+                        return { ok: true, command: 'mkdir', path: ref,
+                            result: await client.storage.mkdir(command.remotePath, { owner, parents: command.parents }) };
+                    case 'upload': {
+                        if (!command.localPath)
+                            throw new ManagedFsOperationError('INVALID_SOURCE', 'managed upload source is required');
+                        return { ok: true, command: 'upload', path: ref, localPath: command.localPath,
+                            result: await client.storage.uploadFile(command.localPath, command.remotePath, { owner, overwrite: command.overwrite }) };
+                    }
+                    case 'copy': {
+                        if (!command.remoteSourcePath)
+                            throw new ManagedFsOperationError('INVALID_SOURCE', 'managed copy source is required');
+                        const source = `${owner}:${command.remoteSourcePath}`;
+                        return { ok: true, command: 'copy', src: source, path: ref,
+                            result: await client.storage.copy(command.remoteSourcePath, command.remotePath, {
+                                owner, dstOwner: owner, overwrite: command.overwrite, recursive: command.recursive,
+                            }) };
+                    }
+                    case 'move': {
+                        if (!command.remoteSourcePath)
+                            throw new ManagedFsOperationError('INVALID_SOURCE', 'managed move source is required');
+                        const source = `${owner}:${command.remoteSourcePath}`;
+                        return { ok: true, command: 'move', src: source, path: ref,
+                            result: await client.storage.rename(command.remoteSourcePath, command.remotePath, { owner, overwrite: command.overwrite }) };
+                    }
+                    case 'remove':
+                        return { ok: true, command: 'remove', path: ref,
+                            result: await client.storage.remove(command.remotePath, { owner, recursive: command.recursive }) };
+                    case 'ls':
+                        return { ok: true, command: 'ls', path: ref,
+                            items: await client.storage.list(command.remotePath || '/', { owner }) };
+                    case 'stat':
+                        return { ok: true, command: 'stat', path: ref,
+                            node: await client.storage.stat(command.remotePath, { owner }) };
+                    case 'lstat':
+                        return { ok: true, command: 'lstat', path: ref,
+                            node: await client.storage.lstat(command.remotePath, { owner }) };
+                    case 'find':
+                        return { ok: true, command: 'find', path: ref,
+                            items: await client.storage.find(command.remotePath, {
+                                owner, name: command.name, nodeType: command.nodeType, size: command.size,
+                                mtime: command.mtime, page: command.page, pageSize: command.pageSize,
+                            }) };
+                    case 'df':
+                        return { ok: true, command: 'df', path: `${owner}:`, usage: await client.storage.df({ owner }) };
+                    case 'getfacl':
+                        return { ok: true, command: 'getfacl', path: ref, result: await client.storage.listAcl(command.remotePath, { owner }) };
+                    case 'setfacl':
+                        throw new ManagedFsOperationError('NOT_ALLOWED', 'Managed personal storage ACL changes are not supported');
+                    case 'cat': {
+                        const node = await client.storage.stat(command.remotePath, { owner });
+                        const size = numberFrom(node, ['size', 'sizeBytes', 'size_bytes']);
+                        const maxBytes = Math.min(command.maxBytes ?? MAX_MANAGED_FS_CAT_BYTES, MAX_MANAGED_FS_CAT_BYTES);
+                        if (size === undefined)
+                            throw new ManagedFsOperationError('FS_SIZE_REQUIRED', 'personal file size is required before managed cat');
+                        if (size > maxBytes)
+                            throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
+                        const bytes = await client.storage.readBytes(command.remotePath, { owner });
+                        if (bytes.byteLength > maxBytes)
+                            throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
+                        const headBytes = Math.min(command.headBytes ?? 256, MAX_MANAGED_FS_HEAD_BYTES, bytes.byteLength);
+                        if (bytes.subarray(0, Math.min(bytes.byteLength, 8192)).some(byte => byte === 0)) {
+                            return {
+                                ok: true,
+                                command: 'cat',
+                                path: ref,
+                                size: bytes.byteLength,
+                                binary: true,
+                                head: { encoding: 'base64', bytes: headBytes, data: Buffer.from(bytes.subarray(0, headBytes)).toString('base64') },
+                            };
+                        }
+                        let text;
+                        try {
+                            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+                        }
+                        catch {
+                            throw new ManagedFsOperationError('FS_NOT_UTF8', 'managed cat only returns UTF-8 text or a bounded binary head');
+                        }
+                        return { ok: true, command: 'cat', path: ref, size: bytes.byteLength, binary: false, text };
+                    }
+                }
+            }
             switch (command.kind) {
                 case 'mkdir':
                     return { ok: true, command: 'mkdir', path: ref, result: await client.group.fs.mkdir(ref, { parents: command.parents }) };
@@ -1070,14 +1168,14 @@ export async function executeManagedFsOperation(command) {
                 case 'copy': {
                     if (!command.remoteSourcePath)
                         throw new ManagedFsOperationError('INVALID_SOURCE', 'managed copy source is required');
-                    const source = `${command.groupId}:${command.remoteSourcePath}`;
+                    const source = `${command.targetAid}:${command.remoteSourcePath}`;
                     return { ok: true, command: 'copy', src: source, path: ref,
                         result: await client.group.fs.cp(source, ref, { recursive: command.recursive, overwrite: command.overwrite, force: command.overwrite }) };
                 }
                 case 'move': {
                     if (!command.remoteSourcePath)
                         throw new ManagedFsOperationError('INVALID_SOURCE', 'managed move source is required');
-                    const source = `${command.groupId}:${command.remoteSourcePath}`;
+                    const source = `${command.targetAid}:${command.remoteSourcePath}`;
                     return { ok: true, command: 'move', src: source, path: ref,
                         result: await client.group.fs.mv(source, ref, { overwrite: command.overwrite, force: command.overwrite }) };
                 }
@@ -1109,7 +1207,7 @@ export async function executeManagedFsOperation(command) {
                     return { ok: true, command: 'find', path: ref, items };
                 }
                 case 'df':
-                    return { ok: true, command: 'df', path: `${command.groupId}:`, usage: await client.group.fs.df(`${command.groupId}:`) };
+                    return { ok: true, command: 'df', path: `${command.targetAid}:`, usage: await client.group.fs.df(`${command.targetAid}:`) };
                 case 'getfacl':
                     return { ok: true, command: 'getfacl', path: ref, result: await client.group.fs.getAcl(ref) };
                 case 'setfacl': {
@@ -1152,7 +1250,7 @@ export async function executeManagedFsOperation(command) {
                     return { ok: true, command: 'cat', path: ref, size: bytes.byteLength, binary: false, text };
                 }
             }
-        });
+        })();
     }
     catch (error) {
         if (error instanceof ManagedFsOperationError)

package/dist/aun/service-proxy.js

@@ -9,7 +9,7 @@
  * - providerAid = 控制 AID（daemon 进程身份，pureIdentity 常驻 AUN）
  * - aunClient 生命周期陷阱：AUNChannel 重连会销毁重建底层 client，
  *   所以不能把 client 引用直接交给 ServiceProxyClient；传一个动态解引用的
- *   facade，每次 .call()/.authenticate()/._tokenStore 都读 channel 当前 client。
+ *   facade，每次 .call()/.authenticate()/getAccessToken() 都读 channel 当前 client。
  *   serveForever(persistent) 的指数退避会在 client 缺失时自动等待恢复。
  * - endpoint 发现：source='instance' 时读服务实例登记文件的 port；source='static' 时使用显式 endpoint。
  * - 失败降级：任何异常只 warn，绝不影响 daemon 主流程。
@@ -143,31 +143,25 @@ export function startServiceProxy(controlChannel, providerAid, configuredService
                 },
                 authenticate: () => {
                     const client = controlChannel.getClient();
-                    if (!client || typeof client.authenticate !== 'function') {
+                    if (!client) {
                         return Promise.reject(new Error('AUN control client not connected'));
                     }
+                    const accessToken = client.getAccessToken();
+                    if (accessToken)
+                        return Promise.resolve({ access_token: accessToken });
                     return client.authenticate();
                 },
                 on: (event, handler) => {
-                    const client = controlChannel.getClient();
-                    return client?.on?.(event, handler);
-                },
-                get _tokenStore() {
-                    return controlChannel.getClient()?._tokenStore;
+                    return controlChannel.getClient()?.on(event, handler);
                 },
-                // ServiceProxyClient._resolveCachedAccessToken 依次读取 _identity / _auth /
-                // _tokenStore + deviceId 来复用 AUNChannel 已签发的 access_token。控制 AID 在
-                // connect 时已 authenticate（client 处于 ready 态），若这些字段不透出，
-                // _ensureAccessToken 会回退到 authenticate() 并抛 "authenticate not allowed
-                // in state ready"，导致隧道永远连不上 proxy-server。动态解引用，规避重连换 client。
-                get _identity() {
-                    return controlChannel.getClient()?._identity;
+                getAccessToken: () => {
+                    return controlChannel.getClient()?.getAccessToken() ?? null;
                 },
-                get _auth() {
-                    return controlChannel.getClient()?._auth;
+                get access_token() {
+                    return controlChannel.getClient()?.getAccessToken() ?? null;
                 },
-                get _deviceId() {
-                    return controlChannel.getClient()?._deviceId;
+                get currentAid() {
+                    return controlChannel.getClient()?.currentAid ?? null;
                 },
             };
             // endpoint 白名单：只允许回连本机回环（127.0.0.1 / localhost 默认放行）。

package/dist/aun/storage/index.js

@@ -1,2 +1,31 @@
 export { storageUpload, storageUploadBuffer, storageLs, storageRm, storageQuota } from './client.js';
 export { storageDownload } from './download.js';
+import { isValidAid } from '../aid/validation.js';
+export function resolveStorageCommandArgv(argv) {
+    if (argv[0] !== 'storage')
+        throw new Error('Expected a storage command');
+    const positionals = [];
+    let isPublic = false;
+    for (let index = 1; index < argv.length; index++) {
+        const value = argv[index];
+        if (value === '--public')
+            isPublic = true;
+        else if (value === '--format' && argv[index + 1] === 'json')
+            index++;
+        else if (value.startsWith('--'))
+            throw new Error(`Unsupported managed storage option: ${value}`);
+        else
+            positionals.push(value);
+    }
+    const [sub, aid, source, destination] = positionals;
+    const operation = { upload: 'storage.upload', download: 'storage.download', ls: 'storage.list', rm: 'storage.delete', quota: 'storage.quota' }[sub];
+    if (!operation || !aid || !isValidAid(aid))
+        throw new Error('Invalid storage command or AID');
+    const counts = { upload: [4], download: [3, 4], ls: [2, 3], rm: [3], quota: [2] };
+    if (!counts[sub].includes(positionals.length) || (isPublic && sub !== 'upload'))
+        throw new Error('Invalid storage arguments');
+    return { sub, aid, operation, isPublic, localFile: sub === 'upload' ? source : undefined,
+        remotePath: sub === 'upload' ? destination : sub === 'rm' ? source : undefined,
+        url: sub === 'download' ? source : undefined, localPath: sub === 'download' ? destination : undefined,
+        prefix: sub === 'ls' ? source ?? '' : undefined };
+}