evolcore 0.0.35 → 0.0.36

package/dist/core/agent-ipc-registration.js

@@ -1,9 +1,9 @@
 import fs from 'fs';
 import path from 'path';
-import { loadDaemonConfig } from '../config-store.js';
-import { parseAgentWelcomeArgs, parseInitializationArgs, resolveInitializationPlan, readInitializationPersona, } from '../cli/agent-create.js';
+import { parseAgentWelcomeArgs, parseInitializationArgs, resolveAgentCreateMode, resolveInitializationPlan, readInitializationPersona, } from '../cli/agent-create.js';
 import { trustedExecutionIdentityInput } from './auth/agent-delegation.js';
-import { authorizeOperation, buildAuthSubject } from './auth/auth-gateway.js';
+import { authorizeFreshOperation as authorizeOperation, buildAuthSubject } from './auth/auth-gateway.js';
+import { getDaemonOwners } from './ownership/owner-resolver.js';
 import { authorizationDenialData } from './auth/authorization-denial.js';
 import { parsePeerKey } from './relation/peer-identity.js';
 import { isHClassPath, isLClassPath, isSameOrDescendant } from './permission/protected-paths.js';
@@ -64,12 +64,21 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                         : sub === 'reload'
                             ? (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined)
                             : (argv[2] && !argv[2].startsWith('--') ? argv[2] : undefined);
+        let createMode;
+        if (sub === 'new') {
+            try {
+                createMode = resolveAgentCreateMode(argv.slice(1));
+            }
+            catch (error) {
+                return fail('INVALID_ARGS', error.message);
+            }
+        }
         const operation = sub === 'list' ? 'agent.list'
             : sub === 'show' ? 'agent.show'
                 : sub === 'persona' ? 'agent.persona'
                     : sub === 'welcome' ? 'agent.welcome'
                         : sub === 'rename' ? 'agent.rename'
-                            : sub === 'initialize' || (sub === 'new' && argv.includes('--initialize')) ? 'agent.initialize'
+                            : sub === 'initialize' || createMode === 'initialize' ? 'agent.initialize'
                                 : sub === 'new' ? 'agent.create'
                                     : sub === 'enable' ? 'agent.enable'
                                         : sub === 'disable' ? 'agent.disable'
@@ -77,9 +86,6 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                                                 : sub === 'delete' ? 'agent.delete' : undefined;
         if (!operation)
             return fail('INVALID_ARGS', `unsupported managed agent command: ${sub}`);
-        if (sub === 'new' && !argv.includes('--non-interactive') && !argv.includes('--initialize')) {
-            return fail('MANAGED_NON_INTERACTIVE_REQUIRED', 'interactive Agent creation is unavailable in a managed task', 'MANAGED_NON_INTERACTIVE_REQUIRED');
-        }
         if (sub === 'delete' && argv.includes('--purge') && !argv.includes('--confirm-purge')) {
             return fail('PURGE_CONFIRMATION_REQUIRED', 'agent delete --purge requires explicit --confirm-purge', 'PURGE_CONFIRMATION_REQUIRED');
         }
@@ -98,10 +104,10 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
             channelId: conversationId,
             chatType: delegation.grant.chatType,
             conversationId,
-            processOwners: loadDaemonConfig().owners ?? [],
+            processOwners: getDaemonOwners(),
             ...trustedExecutionIdentityInput(delegation.grant),
         });
-        const decision = authorizeOperation({
+        const decision = await authorizeOperation({
             source: 'agent-tool',
             subject,
             intent: {
@@ -256,15 +262,15 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                     agentInitializationService.resume(parsed.aid, actor);
                     return { ok: true, result: await agentInitializationService.wait(parsed.aid, parsed.wait) };
                 }
-                const createPermission = authorizeOperation({
+                const createPermission = await authorizeOperation({
                     source: 'agent-tool', subject,
                     intent: { operation: 'agent.create', scope: 'control', source: 'agent-tool', args: { aid: parsed.aid } },
                     auditMetadata: { taskId: delegation.grant.taskId, messageId: delegation.grant.messageId },
                 });
                 if (!createPermission.allow)
                     return fail(createPermission.code, createPermission.reason);
-                if (!argv.includes('--owner') && !argv.includes('--owners'))
-                    return fail('INITIALIZE_OWNER_MISMATCH', 'Explicit Owner required');
+                if (!argv.includes('--owner'))
+                    return fail('INITIALIZE_OWNER_MISMATCH', 'Explicit --owner is required');
                 const plan = resolveInitializationPlan(argv.slice(1), {
                     projectCwd: taskSession.projectPath, tempDir: delegation.grant.sessionRuntimeDir,
                 });
@@ -284,8 +290,6 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                     }
                     plan.avatarFile = real;
                 }
-                if (!plan.owners.includes(actor))
-                    return fail('INITIALIZE_OWNER_MISMATCH', 'The authenticated requesting Owner must be retained');
                 const result = agentInitializationService.start(plan, actor, parsed.dryRun);
                 return { ok: true, result: parsed.dryRun ? result : await agentInitializationService.wait(parsed.aid, parsed.wait) };
             }
@@ -305,6 +309,8 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
             catch (error) {
                 return fail('INVALID_ARGS', error instanceof Error ? error.message : String(error));
             }
+            if (argv.includes('--handoff'))
+                return fail('INVALID_ARGS', 'Agent creation --handoff has been removed');
             let tags;
             try {
                 tags = parseAgentTags(value('--tags'));
@@ -317,7 +323,6 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                 project: value('--project'),
                 baseagent: value('--baseagent'),
                 ...ownerOptions,
-                handoff: value('--handoff'),
                 name: value('--name'),
                 description: value('--description'),
                 type: value('--type'),
@@ -329,56 +334,13 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
             const validationError = validateAgentCreatePlan(plan);
             if (validationError)
                 return fail('INVALID_ARGS', validationError);
-            if (argv.includes('--handoff')) {
-                if (!delegation.grant.messageId)
-                    return fail('INVALID_ARGS', '--handoff requires an originating message');
-                if (!plan.handoff?.trim())
-                    return fail('INVALID_ARGS', '--handoff requires non-empty context');
-                if ((plan.owners?.[0] ?? plan.owner) !== taskAid) {
-                    return fail('INVALID_ARGS', '--handoff requires the creating Agent to be the first Owner');
-                }
-                if (plan.configExists)
-                    return fail('INVALID_ARGS', '--handoff requires a new Agent');
-            }
             if (argv.includes('--dry-run'))
                 return { ok: true, result: { ok: true, dryRun: true, plan } };
-            let handoffId;
-            if (plan.handoff) {
-                try {
-                    const created = await handoffRuntime.createOutbound({
-                        selfAid: taskAid,
-                        to: aid,
-                        originSessionId: sessionId,
-                        originMessageId: delegation.grant.messageId,
-                        payload: { type: 'text', text: plan.handoff },
-                        encrypt: true,
-                        targetChatType: 'private',
-                        explicitReturnPolicy: 'required',
-                        contextOnly: true,
-                        originAuthorization: {
-                            actorId: delegation.grant.actorId,
-                            channelKey: delegation.grant.channel,
-                            channelType: delegation.grant.channelType,
-                            chatType: delegation.grant.chatType,
-                            peerKey: delegation.grant.peerKey,
-                            approvalInteractionPolicy: delegation.grant.approvalInteractionPolicy,
-                        },
-                        causation: responseEngine.getTaskRuntimeContext(sessionId)?.causation,
-                    });
-                    handoffId = created.handoff?.handoff_id;
-                    if (!handoffId)
-                        return fail('INVALID_ARGS', '--handoff requires a different target session');
-                }
-                catch (error) {
-                    return fail('HANDOFF_PREPARE_FAILED', error instanceof Error ? error.message : String(error));
-                }
-            }
             const createOptions = {
                 aid: plan.aid,
                 project: plan.project,
                 baseagent: plan.baseagent,
                 owner: plan.owner,
-                owners: plan.owners,
                 name: plan.name,
                 description: plan.description,
                 type: plan.type,
@@ -416,15 +378,11 @@ export function registerAgentOperationExecutor({ ipcServer, sessionManager, agen
                     ? await agentApplicationService.create(createOptions)
                     : await agentCreateNonInteractive(createOptions);
                 if (!result.ok) {
-                    if (handoffId)
-                        handoffRuntime.store.discard(taskAid, handoffId, 'operation_failed');
                     return fail(result.code ?? 'INTERNAL', result.error);
                 }
-                return { ok: true, result: { ...result, configPath: '[redacted]', ...(handoffId ? { handoff_id: handoffId } : {}) } };
+                return { ok: true, result: { ...result, configPath: '[redacted]' } };
             }
             catch (error) {
-                if (handoffId)
-                    handoffRuntime.store.discard(taskAid, handoffId, 'operation_failed');
                 return fail('INTERNAL', error instanceof Error ? error.message : String(error));
             }
         }

package/dist/core/agent-runtime.js

@@ -8,7 +8,7 @@ import { logger } from '../utils/logger.js';
 import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../paths.js';
-import { loadDaemonConfig } from '../config-store.js';
+import { ownerResolver, OWNERSHIP_AUTHORIZATION_MAX_AGE_MS } from './ownership/owner-resolver.js';
 import { AgentInitializationService, readInitialization } from '../cli/agent-create.js';
 export function loadStartupAgentRegistry(agentRegistry) {
     agentRegistry.loadAll();
@@ -216,11 +216,22 @@ export function createAgentInitializationRuntime({ agentRegistry, agentMap, chan
         && instance.channel.getAidState?.()?.aid === aid
         && instance.channel.getAidState?.()?.status === 'connected');
     return new AgentInitializationService({
-        register: async (aid) => {
+        register: async (aid, ownerAid) => {
             const { aidCreate } = await import('../aun/aid/identity.js');
-            const created = await aidCreate(aid);
+            // Do not leave a pending SDK Ownership intent while initialization is
+            // still publishing agent.md and its optional avatar.
+            const created = await aidCreate(aid, { type: 'agent' });
             await created.client.close();
         },
+        bindOwner: async (aid, ownerAid) => {
+            await ownerResolver.bind(aid, ownerAid);
+        },
+        checkOwner: async (aid, expectedOwnerAid) => {
+            const view = await ownerResolver.refresh(aid, { maxAgeMs: OWNERSHIP_AUTHORIZATION_MAX_AGE_MS });
+            if (view.consensusStatus === 'consensus')
+                return view.ownerAid === expectedOwnerAid ? 'confirmed' : 'conflict';
+            return 'pending';
+        },
         publish: async (aid, content) => {
             const { agentmdPut } = await import('../aun/aid/agentmd.js');
             await agentmdPut(content, { aid });
@@ -231,7 +242,8 @@ export function createAgentInitializationRuntime({ agentRegistry, agentMap, chan
             return { content: card.content, verified: card.verification.status === 'verified' };
         },
         hotLoad: async (aid) => {
-            await hotLoad(aid);
+            if (!isConnected(aid))
+                await hotLoad(aid);
             const until = Date.now() + 20_000;
             while (Date.now() < until) {
                 if (isConnected(aid))
@@ -241,7 +253,6 @@ export function createAgentInitializationRuntime({ agentRegistry, agentMap, chan
             throw Object.assign(new Error('AUN connection unavailable'), { code: 'INITIALIZE_CHANNEL_UNAVAILABLE' });
         },
         activate,
-        authorize: actor => actor === 'local-control' || (loadDaemonConfig().owners ?? []).includes(actor),
         usable: aid => {
             const agent = agentRegistry.get(aid);
             return !!agent && agent.config.enabled !== false && agentMap.has(`${aid}::${agent.baseagent}`) && isConnected(aid);

package/dist/core/auth/agent-delegation.js

@@ -1,6 +1,7 @@
 import { assertAgentPolicyAuthorization } from '../role/runtime-policy.js';
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
+import { refreshOwnershipForAuthorization } from '../ownership/owner-resolver.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 import { logger } from '../../utils/logger.js';
 import { canonicalizeEvolcoreCommandArgv } from '../permission/ec-command-parser.js';
@@ -10,6 +11,7 @@ import { DelegationDiagnostics, } from './delegation-diagnostics.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
 export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
+const INTERNAL_DELEGATION_TTL_MS = 30_000;
 /**
  * Resolve the credential carried by an EC CLI process. A live task token has
  * priority; persistent Codex threads fall back to their session credential.
@@ -28,6 +30,8 @@ export class AgentDelegationRegistry {
     activeHashBySession = new Map();
     sessionTokenHashesBySession = new Map();
     approvedCommands = new Map();
+    approvedCommandBindings = new Map();
+    internalGrants = new Map();
     debugRegistry = new DebugDelegationRegistry();
     constructor() {
         this.diagnostics = new DelegationDiagnostics(this.runtimeEpoch);
@@ -57,6 +61,28 @@ export class AgentDelegationRegistry {
         });
         return token;
     }
+    /**
+     * Issue a short-lived in-process grant for a daemon-owned adapter handoff.
+     * The returned bearer is never placed in an environment, prompt, or IPC
+     * payload. It is deliberately separate from the active task grant so an
+     * adapter operation cannot revoke the credentials used by the base agent.
+     */
+    issueInternal(input, ttlMs = INTERNAL_DELEGATION_TTL_MS) {
+        if (input.executionIdentity && !isValidFullAccessExecutionIdentity(input.executionIdentity)) {
+            throw new Error('invalid fullaccess task execution identity');
+        }
+        const token = crypto.randomBytes(32).toString('base64url');
+        const tokenHash = hashDelegationToken(token);
+        const grant = { ...input, tokenHash };
+        const expiresAt = Date.now() + Math.max(1, Math.min(ttlMs, INTERNAL_DELEGATION_TTL_MS));
+        this.grantsByHash.set(tokenHash, grant);
+        this.internalGrants.set(tokenHash, { grant, expiresAt });
+        const release = () => {
+            this.internalGrants.delete(tokenHash);
+            this.grantsByHash.delete(tokenHash);
+        };
+        return { token, release };
+    }
     registerSessionCredential(input) {
         const activeTokenHash = this.activeHashBySession.get(input.sessionId);
         const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
@@ -102,6 +128,14 @@ export class AgentDelegationRegistry {
         }
         const tokenHash = hashDelegationToken(token);
         const grant = this.grantsByHash.get(tokenHash);
+        const internal = this.internalGrants.get(tokenHash);
+        if (internal && internal.expiresAt <= Date.now()) {
+            this.internalGrants.delete(tokenHash);
+            this.grantsByHash.delete(tokenHash);
+        }
+        if (internal && internal.expiresAt > Date.now() && internal.grant.sessionId === sessionId) {
+            return { ok: true, grant: internal.grant };
+        }
         if (grant
             && grant.sessionId === sessionId
             && this.activeHashBySession.get(sessionId) === tokenHash) {
@@ -134,7 +168,8 @@ export class AgentDelegationRegistry {
         if (!grant || grant.taskId !== input.taskId)
             return false;
         const sessionToken = input.sessionToken ?? input.carrierToken;
-        if (!sessionToken || !isDelegationCommandHash(input.commandHash))
+        if (!sessionToken || !isDelegationCommandHash(input.commandHash)
+            || !input.approvalId || input.approvalId.length > 512 || input.approvalId.includes('\0'))
             return false;
         this.deleteExpiredApprovedCommands();
         const sessionTokenHash = hashDelegationToken(sessionToken);
@@ -142,26 +177,74 @@ export class AgentDelegationRegistry {
         if (credential?.taskId !== input.taskId || credential.runtimeEpoch !== this.runtimeEpoch) {
             this.registerSessionCredential({ sessionToken, sessionId: input.sessionId, taskId: input.taskId });
         }
+        const bindingKey = approvedCommandBindingKey(sessionTokenHash, input.sessionId, input.approvalId);
+        const existingBinding = this.approvedCommandBindings.get(bindingKey);
+        if (existingBinding) {
+            if (existingBinding.activeTokenHash !== activeTokenHash
+                || existingBinding.taskId !== input.taskId
+                || existingBinding.expiresAt <= Date.now()) {
+                this.approvedCommandBindings.delete(bindingKey);
+            }
+            else {
+                return existingBinding.commandHash === input.commandHash;
+            }
+        }
         const key = approvedCommandKey(sessionTokenHash, input.sessionId, input.commandHash);
         const existing = this.approvedCommands.get(key);
         const ttlMs = Math.max(1, Math.min(input.ttlMs ?? AGENT_DELEGATION_COMMAND_TTL_MS, AGENT_DELEGATION_COMMAND_TTL_MS));
-        this.approvedCommands.set(key, {
+        const expiresAt = Date.now() + ttlMs;
+        const command = existing && existing.activeTokenHash === activeTokenHash
+            && existing.taskId === input.taskId
+            ? existing
+            : {
+                sessionTokenHash,
+                sessionId: input.sessionId,
+                taskId: input.taskId,
+                activeTokenHash,
+                commandHash: input.commandHash,
+                approvalKeys: new Set(),
+            };
+        command.approvalKeys.add(bindingKey);
+        this.approvedCommands.set(key, command);
+        this.approvedCommandBindings.set(bindingKey, {
             sessionTokenHash,
             sessionId: input.sessionId,
             taskId: input.taskId,
+            approvalId: input.approvalId,
             activeTokenHash,
             commandHash: input.commandHash,
-            expiresAt: Date.now() + ttlMs,
-            remainingUses: existing
-                && existing.activeTokenHash === activeTokenHash
-                && existing.expiresAt > Date.now()
-                ? existing.remainingUses + 1
-                : 1,
+            expiresAt,
+            consumed: false,
         });
-        this.recordApproval('approval.issued', this.approvedCommands.get(key), 'active');
+        this.recordApproval('approval.issued', command, 'active');
         return true;
     }
+    /** Remove an approval that its provider has completed without consuming. */
+    revokeApprovedCommand(sessionId, taskId, approvalId) {
+        for (const [bindingKey, binding] of this.approvedCommandBindings) {
+            if (binding.sessionId !== sessionId || binding.taskId !== taskId || binding.approvalId !== approvalId)
+                continue;
+            const commandKey = approvedCommandKey(binding.sessionTokenHash, binding.sessionId, binding.commandHash);
+            const command = this.approvedCommands.get(commandKey);
+            // Record before removing the binding so the diagnostic keeps its real expiry.
+            if (command && command.approvalKeys.size === 1 && !binding.consumed) {
+                this.recordApproval('approval.revoked', command, 'revoked', 'tool_completed');
+            }
+            this.approvedCommandBindings.delete(bindingKey);
+            if (!command)
+                continue;
+            command.approvalKeys.delete(bindingKey);
+            if (command.approvalKeys.size === 0)
+                this.approvedCommands.delete(commandKey);
+        }
+    }
     revokeTask(sessionId, taskId, reason = 'revoked') {
+        for (const [hash, internal] of this.internalGrants) {
+            if (internal.grant.sessionId === sessionId && internal.grant.taskId === taskId) {
+                this.internalGrants.delete(hash);
+                this.grantsByHash.delete(hash);
+            }
+        }
         const tokenHash = this.activeHashBySession.get(sessionId);
         if (!tokenHash)
             return;
@@ -171,6 +254,12 @@ export class AgentDelegationRegistry {
         this.revokeSession(sessionId, reason);
     }
     revokeSession(sessionId, reason = 'revoked') {
+        for (const [hash, internal] of this.internalGrants) {
+            if (internal.grant.sessionId === sessionId) {
+                this.internalGrants.delete(hash);
+                this.grantsByHash.delete(hash);
+            }
+        }
         const tokenHash = this.activeHashBySession.get(sessionId);
         for (const sessionTokenHash of this.sessionTokenHashesBySession.get(sessionId) ?? []) {
             const credential = this.diagnostics.find('session', sessionTokenHash, sessionId);
@@ -202,11 +291,6 @@ export class AgentDelegationRegistry {
         const approved = this.approvedCommands.get(key);
         if (!approved)
             return undefined;
-        if (approved.expiresAt <= Date.now()) {
-            this.recordApproval('approval.expired', approved, 'expired');
-            this.approvedCommands.delete(key);
-            return undefined;
-        }
         const activeTokenHash = this.activeHashBySession.get(sessionId);
         const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
         if (!grant
@@ -216,20 +300,55 @@ export class AgentDelegationRegistry {
             this.approvedCommands.delete(key);
             return undefined;
         }
+        const now = Date.now();
+        const binding = [...approved.approvalKeys]
+            .map(approvalKey => this.approvedCommandBindings.get(approvalKey))
+            .find(candidate => candidate
+            && !candidate.consumed
+            && candidate.expiresAt > now
+            && candidate.activeTokenHash === activeTokenHash
+            && candidate.taskId === grant.taskId
+            && candidate.commandHash === commandHash);
+        if (!binding) {
+            const pending = [...approved.approvalKeys]
+                .map(approvalKey => this.approvedCommandBindings.get(approvalKey))
+                .filter(candidate => candidate && !candidate.consumed);
+            if (pending.length > 0 && pending.every(candidate => candidate.expiresAt <= now)) {
+                this.recordApproval('approval.expired', approved, 'expired');
+            }
+            return undefined;
+        }
         this.diagnostics.accepted(sessionId, sessionTokenHash, commandHash);
         if (consume) {
-            approved.remainingUses--;
-            this.recordApproval('approval.consumed', approved, approved.remainingUses <= 0 ? 'consumed' : 'active');
-            if (approved.remainingUses <= 0)
-                this.approvedCommands.delete(key);
+            binding.consumed = true;
+            const remainingUses = this.approvalStats(approved).remainingUses;
+            this.recordApproval('approval.consumed', approved, remainingUses <= 0 ? 'consumed' : 'active');
         }
         return grant;
     }
     deleteExpiredApprovedCommands() {
         const now = Date.now();
+        const expiredUnconsumed = new Set();
+        for (const [key, binding] of this.approvedCommandBindings) {
+            if (binding.expiresAt > now)
+                continue;
+            if (!binding.consumed)
+                expiredUnconsumed.add(key);
+            this.approvedCommandBindings.delete(key);
+        }
         for (const [key, approved] of this.approvedCommands) {
-            if (approved.expiresAt <= now) {
-                this.recordApproval('approval.expired', approved, 'expired');
+            let expiredPending = false;
+            for (const approvalKey of approved.approvalKeys) {
+                if (this.approvedCommandBindings.has(approvalKey))
+                    continue;
+                if (expiredUnconsumed.has(approvalKey))
+                    expiredPending = true;
+                approved.approvalKeys.delete(approvalKey);
+            }
+            if (approved.approvalKeys.size === 0) {
+                // Fully consumed commands already recorded 'consumed'; keep that cause.
+                if (expiredPending)
+                    this.recordApproval('approval.expired', approved, 'expired');
                 this.approvedCommands.delete(key);
             }
         }
@@ -241,16 +360,35 @@ export class AgentDelegationRegistry {
                 this.approvedCommands.delete(key);
             }
         }
+        for (const [key, binding] of this.approvedCommandBindings) {
+            if (binding.sessionId === sessionId)
+                this.approvedCommandBindings.delete(key);
+        }
     }
     recordApproval(event, approved, status, revocationReason) {
         this.diagnostics.put(event, {
             kind: 'approval', tokenHash: approved.sessionTokenHash, sessionId: approved.sessionId,
             taskId: approved.taskId, runtimeEpoch: this.runtimeEpoch, status, credentialType: 'codex-session',
             activeTokenHash: approved.activeTokenHash, commandHash: approved.commandHash,
-            expiresAt: approved.expiresAt, remainingUses: approved.remainingUses,
+            ...this.approvalStats(approved),
             ...(revocationReason ? { revocationReason } : {}),
         });
     }
+    /** Aggregate per-approvalId bindings into the command-level diagnostic shape. */
+    approvalStats(approved) {
+        const now = Date.now();
+        let expiresAt = 0;
+        let remainingUses = 0;
+        for (const approvalKey of approved.approvalKeys) {
+            const binding = this.approvedCommandBindings.get(approvalKey);
+            if (!binding)
+                continue;
+            expiresAt = Math.max(expiresAt, binding.expiresAt);
+            if (!binding.consumed && binding.expiresAt > now)
+                remainingUses++;
+        }
+        return { expiresAt: expiresAt || now, remainingUses };
+    }
     recordDiagnosticFailure(cause, sessionId, token, commandHash) {
         const tokenHash = token ? hashDelegationToken(token) : undefined;
         let diagnosticCause = cause;
@@ -264,13 +402,30 @@ export class AgentDelegationRegistry {
         this.diagnostics.close();
     }
 }
-export function authorizeDelegatedAunMsgSend(registry, input) {
-    if (!input.sessionId) {
+export async function authorizeDelegatedAunMsgSend(registry, input) {
+    if (!input.sessionId && !input.isSystemEvent) {
         return { ok: false, code: 'DELEGATION_REQUIRED', reason: 'Origin session is required' };
     }
+    // 系统事件豁免：不校验 delegation token，直接通过，但不构造 grant（调用方不应依赖它）。
+    if (input.isSystemEvent) {
+        return { ok: true, grant: null };
+    }
+    if (!input.sessionId) {
+        throw new Error('[agent-delegation] Unreachable: sessionId checked earlier');
+    }
     const validation = registry.validate(input.delegationToken, input.sessionId, input.delegationCommandHash);
-    if (!validation.ok)
-        return validation;
+    if (!validation.ok) {
+        return {
+            ok: false,
+            code: validation.code,
+            reason: validation.reason,
+            detailCode: delegationFailureDetailCode(validation.diagnosticCause),
+            retryable: false,
+            sent: false,
+            diagnosticCause: validation.diagnosticCause,
+            ...(validation.diagnosticEventId ? { diagnosticEventId: validation.diagnosticEventId } : {}),
+        };
+    }
     const grant = validation.grant;
     if (grant.selfAid !== input.aid && !hasTrustedFullAccessDelegation(grant)) {
         return { ok: false, code: 'INVALID_DELEGATION', reason: 'Delegation self agent does not match sender' };
@@ -285,6 +440,7 @@ export function authorizeDelegatedAunMsgSend(registry, input) {
     catch {
         return { ok: false, code: 'INVALID_DELEGATION', reason: 'Delegation relation key is invalid' };
     }
+    await refreshOwnershipForAuthorization(grant.selfAid);
     const builtSubject = buildAuthSubject({
         selfAid: grant.selfAid,
         actorId: grant.actorId,
@@ -364,9 +520,27 @@ function hashDelegationToken(token) {
 function approvedCommandKey(sessionTokenHash, sessionId, commandHash) {
     return JSON.stringify([sessionTokenHash, sessionId, commandHash]);
 }
+function approvedCommandBindingKey(sessionTokenHash, sessionId, approvalId) {
+    return JSON.stringify([sessionTokenHash, sessionId, approvalId]);
+}
 function isDelegationCommandHash(value) {
     return /^[a-f0-9]{64}$/.test(value);
 }
+function delegationFailureDetailCode(cause) {
+    switch (cause) {
+        case 'missing_token': return 'DELEGATION_TOKEN_MISSING';
+        case 'unknown_token': return 'DELEGATION_TOKEN_UNKNOWN';
+        case 'session_mismatch': return 'DELEGATION_SESSION_MISMATCH';
+        case 'task_replaced': return 'DELEGATION_TASK_REPLACED';
+        case 'task_revoked': return 'DELEGATION_TASK_REVOKED';
+        case 'daemon_restarted': return 'DELEGATION_DAEMON_RESTARTED';
+        case 'approval_not_found':
+        case 'approval_expired':
+        case 'approval_consumed':
+        case 'command_hash_mismatch':
+            return 'APPROVED_COMMAND_UNAVAILABLE';
+    }
+}
 export function hashDelegatedCommandArgv(argv) {
     if (argv.length === 0 || argv.some(value => typeof value !== 'string' || value.includes('\0')))
         return undefined;

package/dist/core/auth/auth-gateway.js

@@ -4,6 +4,8 @@ import { formatPeerKey } from '../relation/peer-identity.js';
 import { authorizeCommand, authorizeResolvedConfigCommand } from './operation-authorizer.js';
 import { auditCommandAuthorization } from './authorization-audit.js';
 import { hasTrustedPrincipal } from './authenticated-actor.js';
+import { ownerResolver, refreshOwnershipForAuthorization, OWNERSHIP_CACHE_MAX_AGE_MS } from '../ownership/owner-resolver.js';
+import { getOperationMeta } from './operation-catalog.js';
 import { resolveRuntimePermissionMode } from '../role/runtime-policy.js';
 export function isCrossAgentTriggerOperationAllowed(input) {
     return input.control || input.daemonOwner === true || input.taskAgentAid === input.targetAgentAid;
@@ -26,7 +28,7 @@ export function buildAuthSubject(input) {
         conversationId,
         peerType: input.peerType,
     });
-    const processOwners = input.processOwners ?? [];
+    const processOwners = ownerResolver.daemonOwners();
     const fullAccessAuthorization = input.trustedFullAccessAuthorization;
     const isFullAccessRun = input.trustedProcessRole === 'fullaccess-run'
         && fullAccessAuthorization?.permissionMode === 'fullaccess'
@@ -67,7 +69,7 @@ export function buildAuthSubject(input) {
         dataScope,
         authorizedBy: isFullAccessRun ? fullAccessAuthorization.authorizedBy : undefined,
         roleSource: roleDetail.source,
-        identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
+        identity: { ...input.identity, ...roleToSessionIdentity(role === 'none' ? null : role) },
         isDaemonOwner,
         fromControlChannel: !!input.fromControlChannel,
         ecwebManagement: input.ecwebManagement === true && isTrustedDaemonOwner && input.fromControlChannel === true,
@@ -99,6 +101,46 @@ export function authorizeAccess(subject) {
         subject,
     };
 }
+export async function authorizeFreshOperation(params) {
+    const subject = params.subject;
+    if (subject.processRole !== 'daemon-service' && !subject.ecwebManagement) {
+        const configCommand = params.resolvedConfigCommand;
+        const changesOwner = configCommand?.kind === 'field' && configCommand.subcommand !== 'get'
+            && ['owner', 'owners'].includes(configCommand.field.split('.')[0]);
+        const force = changesOwner || params.intent.operation === 'ec.aid.bind' || params.intent.operation === 'config.restore';
+        const operation = getOperationMeta(params.intent.operation);
+        const sensitive = force || params.intent.dangerous || operation?.dangerous || operation?.category !== 'read'
+            || configCommand?.dangerous || subject.processRole === 'fullaccess-run';
+        await refreshOwnershipForAuthorization(subject.selfAid, {
+            force,
+            ...(sensitive ? {} : { maxAgeMs: OWNERSHIP_CACHE_MAX_AGE_MS }),
+            includeDaemon: subject.isDaemonOwner || subject.processRole === 'fullaccess-run'
+                || params.intent.scope === 'process' || params.intent.scope === 'control' || force,
+        });
+        const current = buildAuthSubject({
+            selfAid: subject.selfAid, agentName: subject.agentName, actorId: subject.actorId,
+            channel: subject.channel, channelType: subject.channelType, channelId: subject.channelId,
+            chatType: subject.chatType, conversationId: subject.conversationId,
+            fromControlChannel: subject.fromControlChannel,
+            identity: subject.role === 'owner' && subject.principalId ? undefined : subject.identity,
+        });
+        if (subject.processRole === 'fullaccess-run') {
+            if (!subject.authorizedBy || !ownerResolver.daemonOwners().includes(subject.authorizedBy)) {
+                return { allow: false, code: 'OWNER_UNAVAILABLE', reason: 'Current protocol Owner no longer authorizes this fullaccess execution', subject };
+            }
+        }
+        else {
+            Object.assign(subject, {
+                role: current.role, relationRole: current.relationRole, roleSource: current.roleSource,
+                principalId: current.principalId, processRole: current.processRole, dataScope: current.dataScope,
+                identity: current.identity, isDaemonOwner: current.isDaemonOwner, allowAccess: current.allowAccess,
+                permissionMode: current.permissionMode,
+                canApprovePersistentFullAccess: subject.canApprovePersistentFullAccess === false ? false : current.canApprovePersistentFullAccess,
+            });
+        }
+    }
+    return authorizeOperation(params);
+}
 export function authorizeOperation(params) {
     const access = authorizeAccess(params.subject);
     if (!access.allow) {

package/dist/core/auth/authorization-denial.js

@@ -1,5 +1,5 @@
 const NEXT_STEPS = {
-    DAEMON_OWNER_REQUIRED: 'Ask an AID listed in daemon.json.owners to run this operation from the daemon control channel or ECWeb.',
+    DAEMON_OWNER_REQUIRED: 'Ask the verified protocol Owner of the daemon Control AID to run this operation from the daemon control channel or ECWeb. Check with ec aid bind status; first binding requires the local host CLI.',
     TARGET_SELF_ONLY: 'Target the current Agent, or ask a DaemonOwner to perform the cross-Agent operation.',
     MANAGED_NON_INTERACTIVE_REQUIRED: 'Use the structured non-interactive Agent command (for example `ec agent new <aid> --non-interactive`) or ECWeb.',
     PURGE_CONFIRMATION_REQUIRED: 'Run the purge from the daemon control plane and add --confirm-purge after verifying the target Agent.',