evolcore 0.0.35 → 0.0.37

package/dist/config/config-manager.js

@@ -32,6 +32,9 @@ import { writeRoleDefinition, writeRoleRegistry } from './role-service.js';
 import { mutateContactBookTransactionSync } from './contact-book-store.js';
 import { DAEMON_SCHEMA_NAME } from '../product.js';
 import { normalizeDaemonServices } from './daemon-services.js';
+import { assertProviderSelectionWrite, resolveProviderModelOverrides, validateProvidersFile } from './providers-config.js';
+import { assertOwnerConfigRecord, configuredOwnerList, firstConfiguredOwner, normalizeOwnerConfigTree, withOwnerListCompatibility } from './owner-config.js';
+import { getOwners, getPrimaryOwner, ownerResolver } from '../core/ownership/owner-resolver.js';
 // AUN gateway discovery belongs to fastaun. Keep the retired gatewayUrl
 // compatibility handling beside the rest of the configuration read/write
 // policy so all config callers share one implementation.
@@ -105,25 +108,15 @@ export function shouldFailFastForMissingOwners(env = process.env) {
     return value === '1' || value === 'true' || value === 'yes';
 }
 export function validAgentOwnerIds(agent) {
-    return [...new Set((agent?.owners ?? [])
-            .map(value => String(value || '').trim())
-            .filter(isValidAid))];
+    return agent?.aid ? getOwners(agent.aid) : [];
 }
 export function validateAccessPolicyDomain(selfAid, agent) {
-    const access = agent.access;
-    if (!access)
-        return undefined;
-    if (access.policyMode !== 'open' && validAgentOwnerIds(agent).length === 0) {
-        return {
-            code: 'restricted_mode_without_owner',
-            message: `Agent ${selfAid} cannot use ${access.policyMode} without an Owner`,
-        };
-    }
     return undefined;
 }
 export var ConfigTarget;
 (function (ConfigTarget) {
     ConfigTarget["Process"] = "process";
+    ConfigTarget["Providers"] = "providers";
     ConfigTarget["Defaults"] = "defaults";
     ConfigTarget["Agent"] = "agent";
     ConfigTarget["Relation"] = "relation";
@@ -141,6 +134,7 @@ export function onConfigWrite(listener) {
 }
 const TARGET_SCHEMA = {
     [ConfigTarget.Process]: DAEMON_SCHEMA_NAME,
+    [ConfigTarget.Providers]: 'providers',
     [ConfigTarget.Defaults]: 'defaults',
     [ConfigTarget.Agent]: 'agent-config',
     [ConfigTarget.Relation]: 'relation-config',
@@ -175,14 +169,15 @@ export function assertRoleConfigV4Ready() {
     const agentsRoot = resolvePaths().agentsDir;
     if (!fs.existsSync(agentsRoot))
         return;
-    const issues = [];
+    const migrationTargets = [];
+    const degraded = [];
     const inspect = (file, logicalName, minimumVersion) => {
         let value;
         try {
             value = JSON.parse(fs.readFileSync(file, 'utf8'));
         }
         catch (error) {
-            issues.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
+            degraded.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
             return;
         }
         value = stripLegacyAunGatewayConfig(value, file, message => configWarn(message));
@@ -190,7 +185,8 @@ export function assertRoleConfigV4Ready() {
             ? value.$schema_version
             : undefined;
         if (typeof actualVersion !== 'number' || actualVersion < minimumVersion) {
-            issues.push({
+            // 旧形态才是迁移目标；其余问题只影响该文件对应的 agent/relation。
+            migrationTargets.push({
                 file,
                 detail: `$schema_version must be at least ${minimumVersion}, got ${String(actualVersion)}`,
             });
@@ -201,7 +197,7 @@ export function assertRoleConfigV4Ready() {
             schema = loadSchema(logicalName, actualVersion);
         }
         catch {
-            issues.push({ file, detail: `unsupported ${logicalName} schema version ${actualVersion}` });
+            degraded.push({ file, detail: `unsupported ${logicalName} schema version ${actualVersion}` });
             return;
         }
         if (!schema.validate(value)) {
@@ -211,7 +207,7 @@ export function assertRoleConfigV4Ready() {
                     : '';
                 return `${error.instancePath || '/'} ${error.message}${extra}`;
             }).join('; ');
-            issues.push({ file, detail });
+            degraded.push({ file, detail });
         }
     };
     const walkRelationConfigs = (dir) => {
@@ -239,33 +235,45 @@ export function assertRoleConfigV4Ready() {
             inspect(relationFile, 'relation-config', 4);
         }
     }
-    if (!issues.length)
+    if (degraded.length) {
+        configWarn(`[config] ${degraded.length} config issue(s) degraded to warnings; the daemon keeps starting:\n`
+            + degraded.slice(0, 20).map(issue => `  - ${path.relative(root, issue.file)}: ${issue.detail}`).join('\n'));
+    }
+    if (!migrationTargets.length)
         return;
-    const shown = issues.slice(0, 20)
+    const shown = migrationTargets.slice(0, 20)
         .map(issue => `- ${path.relative(root, issue.file)}: ${issue.detail}`)
         .join('\n');
-    const omitted = issues.length > 20 ? `\n- ... ${issues.length - 20} more issue(s)` : '';
+    const omitted = migrationTargets.length > 20 ? `\n- ... ${migrationTargets.length - 20} more issue(s)` : '';
     const quotedRoot = JSON.stringify(root);
     throw new ConfigError('ROLE_CONFIG_MIGRATION_REQUIRED', `Role config v4 migration is required before daemon startup:\n${shown}${omitted}\n` +
         `Stop the daemon, then run dry-run and review it:\n` +
         `node kits/migrations/migrate-role-config-v4.mjs --home ${quotedRoot}\n` +
         `Apply only after review:\n` +
-        `node kits/migrations/migrate-role-config-v4.mjs --apply --home ${quotedRoot}`, { issues });
+        `node kits/migrations/migrate-role-config-v4.mjs --apply --home ${quotedRoot}`, { issues: migrationTargets });
 }
-/** Validate the standalone role domain after the v4 -> v5 migration. */
+/**
+ * Validate the standalone role domain after the v4 -> v5 migration.
+ *
+ * 只有「确实需要迁移」的 Agent 才阻止 daemon 启动（仍是旧形态：schema < 5，
+ * 或 v5 还内联 roles 定义）。单个 Agent 的形态问题——坏 JSON、未来版本号、
+ * 缺/坏 roles/index.json——只告警：这类 Agent 由运行时回退注册表和
+ * error-agent 加载路径各自降级，不拖累整个进程。
+ */
 export function assertRoleConfigV5Ready() {
     const root = resolvePaths().root;
     const agentsRoot = resolvePaths().agentsDir;
     if (!fs.existsSync(agentsRoot))
         return;
-    const issues = [];
+    const migrationTargets = [];
+    const degraded = [];
     const registrySchema = loadSchema('role-registry');
-    const readJson = (file) => {
+    const readJson = (file, sink) => {
         try {
             return JSON.parse(fs.readFileSync(file, 'utf8'));
         }
         catch (error) {
-            issues.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
+            sink.push({ file, detail: `invalid JSON: ${error instanceof Error ? error.message : String(error)}` });
             return null;
         }
     };
@@ -278,46 +286,51 @@ export function assertRoleConfigV5Ready() {
         const agentFile = path.join(agentsRoot, aid, 'config.json');
         if (!fs.existsSync(agentFile))
             continue;
-        const agent = readJson(agentFile);
-        const sanitizedAgent = agent
-            ? stripLegacyAunGatewayConfig(agent, agentFile, message => configWarn(message))
-            : agent;
+        const agent = readJson(agentFile, degraded);
+        if (!agent)
+            continue;
+        const sanitizedAgent = stripLegacyAunGatewayConfig(agent, agentFile, message => configWarn(message));
         const agentVersion = sanitizedAgent?.$schema_version;
+        if (typeof agentVersion !== 'number' || agentVersion < 5) {
+            migrationTargets.push({
+                file: agentFile,
+                detail: `agent schema version must be supported and >= 5, got ${String(agentVersion)}`,
+            });
+            continue;
+        }
         let agentSchema = null;
-        if (typeof agentVersion === 'number' && agentVersion >= 5) {
-            try {
-                agentSchema = loadSchema('agent-config', agentVersion);
-            }
-            catch { }
-        }
-        if (!sanitizedAgent || !agentSchema || !agentSchema.validate(sanitizedAgent)) {
-            if (sanitizedAgent)
-                issues.push({
-                    file: agentFile,
-                    detail: agentSchema
-                        ? schemaErrors(agentSchema)
-                        : `agent schema version must be supported and >= 5, got ${String(agentVersion)}`,
-                });
+        try {
+            agentSchema = loadSchema('agent-config', agentVersion);
+        }
+        catch { }
+        if (!agentSchema) {
+            degraded.push({ file: agentFile, detail: `unsupported agent-config schema version ${agentVersion}` });
+            continue;
+        }
+        if (!agentSchema.validate(sanitizedAgent)) {
+            degraded.push({ file: agentFile, detail: schemaErrors(agentSchema) });
             continue;
         }
         const registryFile = agentRolesIndex(aid);
         if (!fs.existsSync(registryFile)) {
-            issues.push({ file: registryFile, detail: 'roles/index.json is required for Agent config v5' });
+            degraded.push({ file: registryFile, detail: 'roles/index.json is missing (runtime falls back to the builtin role set)' });
             continue;
         }
-        const registry = readJson(registryFile);
-        if (!registry || !registrySchema.validate(registry)) {
-            if (registry)
-                issues.push({ file: registryFile, detail: schemaErrors(registrySchema) });
-            continue;
+        const registry = readJson(registryFile, degraded);
+        if (registry && !registrySchema.validate(registry)) {
+            degraded.push({ file: registryFile, detail: schemaErrors(registrySchema) });
         }
     }
-    if (!issues.length)
+    if (degraded.length) {
+        configWarn(`[config] ${degraded.length} agent config issue(s) degraded to warnings; the daemon keeps starting:\n`
+            + degraded.slice(0, 20).map(issue => `  - ${path.relative(root, issue.file)}: ${issue.detail}`).join('\n'));
+    }
+    if (!migrationTargets.length)
         return;
-    const shown = issues.slice(0, 20).map(issue => `- ${path.relative(root, issue.file)}: ${issue.detail}`).join('\n');
+    const shown = migrationTargets.slice(0, 20).map(issue => `- ${path.relative(root, issue.file)}: ${issue.detail}`).join('\n');
     throw new ConfigError('ROLE_CONFIG_V5_MIGRATION_REQUIRED', `Standalone role config migration is required before daemon startup:\n${shown}\n` +
         `node kits/migrations/migrate-role-config-v5.mjs --home ${JSON.stringify(root)}\n` +
-        `node kits/migrations/migrate-role-config-v5.mjs --apply --home ${JSON.stringify(root)}`, { issues });
+        `node kits/migrations/migrate-role-config-v5.mjs --apply --home ${JSON.stringify(root)}`, { issues: migrationTargets });
 }
 /** Final startup gate for the contact-book authorization migration. */
 export function assertContactBookV2Ready() {
@@ -410,7 +423,8 @@ function inspectContactBookDomain(contactFile, agentFile, issues) {
     catch {
         return;
     }
-    const owners = new Set(Array.isArray(agent?.owners) ? agent.owners.map(String) : []);
+    const configuredOwners = getOwners(String(agent?.aid ?? ''));
+    const owners = new Set(configuredOwners);
     const configuredChannelKeys = new Set((Array.isArray(agent?.channels) ? agent.channels : [])
         .filter((channel) => channel && typeof channel === 'object' && channel.type !== 'aun')
         .map((channel) => {
@@ -521,6 +535,10 @@ export function checkSchemaVersionsOnStartup(selfAid) {
         read(ConfigTarget.Process);
     }
     catch { }
+    try {
+        read(ConfigTarget.Providers);
+    }
+    catch { }
     // 检查 defaults 层
     try {
         read(ConfigTarget.Defaults);
@@ -545,6 +563,7 @@ function targetPath(target, sel) {
     const p = resolvePaths();
     switch (target) {
         case ConfigTarget.Process: return p.daemonConfig;
+        case ConfigTarget.Providers: return path.resolve(sel?.providerFile ?? p.providersConfig);
         case ConfigTarget.Defaults: return p.defaultsConfig;
         case ConfigTarget.Agent:
             requireSelf(sel, target);
@@ -593,6 +612,11 @@ export function read(target, sel, opts = {}) {
     else {
         raw = atomicReadJson(file);
     }
+    if (target === ConfigTarget.Providers) {
+        if (raw === null && !fs.existsSync(file) && !fs.existsSync(`${file}_`))
+            return null;
+        return normalizeProvidersConfig(migrateIfNeeded(target, raw, file));
+    }
     if (raw === null)
         return null;
     raw = stripLegacyAunGatewayConfig(raw, file, message => configWarn(message));
@@ -641,7 +665,7 @@ function normalizeBaseagentEffortCompat(value) {
     return { ...value, baseagents };
 }
 function normalizeAgentConfigForRead(value, aid) {
-    const config = foldLegacyProactiveBlock(normalizeAgentLifecycle(value));
+    const config = withOwnerListCompatibility(normalizeOwnerConfigTree(foldLegacyProactiveBlock(normalizeAgentLifecycle(value))));
     const mutable = config;
     normalizeShowActivitiesCompat(mutable);
     // AID 校验（如果提供了 aid）
@@ -678,24 +702,29 @@ function groupFor(target, sel) {
     }
     return 'config';
 }
+function normalizeProvidersConfig(value) {
+    try {
+        return validateProvidersFile(value);
+    }
+    catch (error) {
+        throw new ConfigError('VALIDATION_ERROR', error instanceof Error ? error.message : String(error));
+    }
+}
 function normalizeAgentConfigForWrite(value) {
-    const mutable = normalizeBaseagentEffortCompat({ ...value });
-    normalizeShowActivitiesCompat(mutable);
-    if (Object.prototype.hasOwnProperty.call(mutable, 'owners')) {
-        if (!Array.isArray(mutable.owners)) {
-            throw new ConfigError('VALIDATION_ERROR', 'owners must be an array');
-        }
-        const owners = [];
-        for (const rawOwner of mutable.owners) {
-            if (typeof rawOwner !== 'string' || !rawOwner.trim() || !isValidAid(rawOwner.trim())) {
-                throw new ConfigError('VALIDATION_ERROR', `Invalid owner AID: ${JSON.stringify(rawOwner)}`);
-            }
-            const owner = rawOwner.trim();
-            if (!owners.includes(owner))
-                owners.push(owner);
+    try {
+        assertOwnerConfigRecord(value, 'agent config', isValidAid);
+        for (const [index, channel] of (Array.isArray(value.channels) ? value.channels : []).entries()) {
+            const channelType = channel && typeof channel === 'object' && !Array.isArray(channel)
+                ? String(channel.type || '').trim().toLowerCase()
+                : undefined;
+            assertOwnerConfigRecord(channel, `channels[${index}]`, channelType === 'aun' ? isValidAid : undefined);
         }
-        mutable.owners = owners;
     }
+    catch (error) {
+        throw new ConfigError('VALIDATION_ERROR', error instanceof Error ? error.message : String(error));
+    }
+    const mutable = normalizeOwnerConfigTree(normalizeBaseagentEffortCompat({ ...value }));
+    normalizeShowActivitiesCompat(mutable);
     // AID 格式校验
     if (mutable.aid && !isValidAid(mutable.aid)) {
         throw new ConfigError('VALIDATION_ERROR', `Invalid aid "${mutable.aid}" (must be a valid multi-level domain like mybot.agentid.pub)`);
@@ -717,6 +746,12 @@ function normalizeAgentConfigForWrite(value) {
     return mutable;
 }
 function normalizeProcessConfigForWrite(value) {
+    try {
+        assertOwnerConfigRecord(value, 'daemon.json', isValidAid);
+    }
+    catch (error) {
+        throw new ConfigError('VALIDATION_ERROR', error instanceof Error ? error.message : String(error));
+    }
     let normalized;
     try {
         normalized = normalizeProcessConfigCompat(normalizeDaemonServices(value));
@@ -747,7 +782,7 @@ export function normalizeProcessConfigCompat(value) {
     const idleMonitor = value.idleMonitor;
     const debug = value.debug;
     let changed = false;
-    let normalized = value;
+    let normalized = normalizeOwnerConfigTree(value, { projectChannels: false });
     if (Object.prototype.hasOwnProperty.call(normalized, 'fullaccess')) {
         normalized = { ...normalized };
         delete normalized.fullaccess;
@@ -860,10 +895,24 @@ export function write(target, value, sel, opts = {}) {
             ? normalizeRelationConfigForWrite(canonicalized)
             : target === ConfigTarget.Process
                 ? normalizeProcessConfigForWrite(canonicalized)
-                : canonicalized;
+                : target === ConfigTarget.Providers
+                    ? normalizeProvidersConfig(canonicalized)
+                    : canonicalized;
     // 1. Schema 校验
     if (!opts.skipValidate) {
         validateOrThrow(schema, normalized, target);
+        if (target === ConfigTarget.Defaults || target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
+            const previous = atomicReadJson(file) ?? {};
+            const inherited = target === ConfigTarget.Defaults ? {}
+                : target === ConfigTarget.Agent ? read(ConfigTarget.Defaults, undefined, { cache: false }) ?? {}
+                    : resolveAgentConfig({ self: sel?.self }, { cache: false });
+            try {
+                assertProviderSelectionWrite(normalized, previous, inherited, (providerId, serviceType) => resolveProviderModelOverrides(providerId, serviceType, read(ConfigTarget.Providers) ?? { providers: {} }));
+            }
+            catch (error) {
+                throw new ConfigError('VALIDATION_ERROR', error instanceof Error ? error.message : String(error));
+            }
+        }
         // 1b. responseModeParams 桶内容校验：主 schema 把 responseModeParams 当黑箱，
         //     此处使用“模式桶 schema”逐桶校验内容（桶键 = 已登记的响应模式 id）。
         if (target === ConfigTarget.Defaults || target === ConfigTarget.Agent || target === ConfigTarget.Relation) {
@@ -876,30 +925,48 @@ export function write(target, value, sel, opts = {}) {
                 throw new ConfigError(issue.code, issue.message);
         }
     }
-    // Owner 是实际联系人。将 Agent 配置和缺失的 Owner 联系人写入同一可恢复事务，
-    // 避免渠道身份绑定承担联系人创建职责。
-    const ownerIds = target === ConfigTarget.Agent && Array.isArray(normalized.owners)
-        ? [...new Set(normalized.owners
-                .map((value) => String(value || '').trim())
-                .filter((value) => isValidAid(value)))]
-        : [];
-    if (target === ConfigTarget.Agent && sel?.self && ownerIds.length > 0) {
+    if (target === ConfigTarget.Contact && sel?.self) {
+        const contact = { ...normalized, $schema_version: currentVersion('contact-book') };
+        mutateContactBookTransactionSync({
+            selfAid: sel.self,
+            actor: 'contact-config-write',
+            mutation: { type: 'replace', contact },
+        }, []);
+        return;
+    }
+    if ((target === ConfigTarget.Agent || target === ConfigTarget.Relation) && sel?.self) {
+        const syncAid = sel.self;
+        if (target === ConfigTarget.Relation && sel.peerKey) {
+            ensureRelationSharedDirectory(syncAid, sel.peerKey);
+        }
         const before = readTextOrNull(file);
         const after = `${JSON.stringify(normalized, null, 2)}\n`;
         mutateContactBookTransactionSync({
-            selfAid: sel.self,
-            actor: 'agent-owner-sync',
-            mutation: { type: 'ensure-contacts', primaryIds: ownerIds },
+            selfAid: syncAid,
+            actor: target === ConfigTarget.Agent ? 'agent-management-role-sync' : 'relation-management-role-sync',
+            mutation: { type: 'sync-management-roles' },
         }, [{ file, before, after }]);
+        if (target === ConfigTarget.Agent) {
+            ownerResolver.setAgentConfiguredOwners(syncAid, configuredOwnerList(normalized));
+        }
         finishConfigWrite(target, sel, file);
         return;
     }
     // 2. 写入文件
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    if (target === ConfigTarget.Relation && sel?.self && sel.peerKey) {
-        ensureRelationSharedDirectory(sel.self, sel.peerKey);
-    }
+    fs.mkdirSync(path.dirname(file), { recursive: true, ...(target === ConfigTarget.Providers ? { mode: 0o700 } : {}) });
     atomicWriteJson(file, normalized);
+    if (target === ConfigTarget.Providers && process.platform !== 'win32') {
+        for (const protectedFile of [file, `${file}_`]) {
+            if (fs.existsSync(protectedFile))
+                fs.chmodSync(protectedFile, 0o600);
+        }
+    }
+    if (target === ConfigTarget.Agent && sel?.self) {
+        ownerResolver.setAgentConfiguredOwners(sel.self, configuredOwnerList(normalized));
+    }
+    if (target === ConfigTarget.Process && typeof normalized?.aid === 'string') {
+        ownerResolver.setConfiguredOwners(normalized.aid, configuredOwnerList(normalized));
+    }
     finishConfigWrite(target, sel, file);
 }
 /**
@@ -1206,6 +1273,8 @@ export function validateConfig(target, value) {
     try {
         if (target === ConfigTarget.Process)
             normalized = normalizeProcessConfigCompat(normalizeDaemonServices(withVer));
+        if (target === ConfigTarget.Providers)
+            normalized = normalizeProvidersConfig(withVer);
     }
     catch (error) {
         return [error instanceof Error ? error.message : String(error)];
@@ -1239,8 +1308,12 @@ export function validateConfig(target, value) {
 export function validateConfigFile(target, sel) {
     const file = targetPath(target, sel);
     const value = atomicReadJson(file);
-    if (value === null)
+    if (value === null) {
+        if (target === ConfigTarget.Providers && fs.existsSync(file)) {
+            return { exists: true, errors: validateConfig(target, value) };
+        }
         return { exists: false, errors: [] };
+    }
     // Persisted pre-removal files remain readable: validate the same sanitized
     // view used by runtime reads, while new writes are still rejected by write().
     let sanitized;
@@ -1269,6 +1342,10 @@ export function ensureFile(target, sel) {
     if (fs.existsSync(file))
         return;
     const skeleton = configSkeleton(target, sel);
+    if (target === ConfigTarget.Providers) {
+        write(target, skeleton, sel);
+        return;
+    }
     fs.mkdirSync(path.dirname(file), { recursive: true });
     atomicWriteJson(file, skeleton);
 }
@@ -1323,6 +1400,12 @@ export function resolveAgentConfig(sel, opts = {}) {
     // gateway credentials and endpoint. Keep the generic dictionary merge
     // contract unchanged for every other field.
     merged.baseagents = mergeBaseagentBlocks(layers);
+    merged.Services = layers.reduce((selections, layer) => {
+        for (const [serviceType, selection] of Object.entries(layer?.Services ?? {})) {
+            selections[serviceType] = { ...selections[serviceType], ...selection };
+        }
+        return selections;
+    }, {});
     return merged;
 }
 function mergeBaseagentBlocks(layers) {
@@ -1371,7 +1454,8 @@ export function normalizeDefaultsBehaviorCompat(defaults) {
 function stripStaticOwnerField(config) {
     if (!config)
         return config;
-    if (!Object.prototype.hasOwnProperty.call(config, 'owners')
+    if (!Object.prototype.hasOwnProperty.call(config, 'owner')
+        && !Object.prototype.hasOwnProperty.call(config, 'owners')
         && !Object.prototype.hasOwnProperty.call(config, 'admins')
         && !Object.prototype.hasOwnProperty.call(config, 'access')
         && !Object.prototype.hasOwnProperty.call(config, 'groupSlashRequireMentions')
@@ -1380,7 +1464,7 @@ function stripStaticOwnerField(config) {
     // fullaccess and groupSlashRequireMentions are Agent-only. Relation/defaults
     // files allow forward-compatible unknown properties, so strip it before the
     // generic merge chain can treat a manually written value as an override.
-    const { owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, fullaccess: _fullaccess, ...rest } = config;
+    const { owner: _owner, owners: _owners, admins: _admins, access: _access, groupSlashRequireMentions: _groupSlashRequireMentions, fullaccess: _fullaccess, ...rest } = config;
     return rest;
 }
 function stripRelationRoleData(config) {
@@ -1406,7 +1490,8 @@ export function resolveEffective(sel, opts = {}) {
         lifecycle: config.lifecycle,
         initialized: config.initialized,
         initialization: config.initialization,
-        owners: config.owners,
+        owner: getPrimaryOwner(sel.self ?? config.aid ?? '') ?? firstConfiguredOwner(config),
+        owners: [...new Set([...getOwners(sel.self ?? config.aid ?? ''), ...configuredOwnerList(config)])],
         fullaccess: config.fullaccess,
         aun: config.aun,
         decision_model: config.decision_model,
@@ -1422,6 +1507,7 @@ export function resolveEffective(sel, opts = {}) {
         // Runtime configuration parameters
         active_baseagent: config.active_baseagent,
         baseagents: config.baseagents,
+        Services: config.Services,
         chatmode: config.chatmode,
         mentionMode: config.mentionMode,
         autoMentionQuietWindowMs: config.autoMentionQuietWindowMs

package/dist/config/config-operation-service.js

@@ -394,6 +394,13 @@ function executeGet(op, options) {
             ...(note ? { note } : {}),
         };
     }
+    // Management fields (e.g. 'owners') are computed by resolveEffective() rather than
+    // stored in any config file, so source is always null. op.route is undefined for these
+    // cases (routeFieldPath threw but was swallowed because routeRequired=false).
+    // Return the effective value directly when it is present.
+    if (withSource.value !== undefined && !op.route) {
+        return { ok: true, subcommand: 'get', field: op.field, value: withSource.value, scope: op.configScope };
+    }
     return getWithSchemaDefault(op, null, note);
 }
 /**
@@ -455,14 +462,6 @@ function executeSet(op, options) {
         return { ok: false, code: 'UNKNOWN_FIELD', error: `Unknown config field: ${op.field}` };
     const selector = selectorFor(op, options);
     const mutation = mutateConfig(op.route.target, selector, existing => {
-        if (op.field === 'owners' && op.route.target === ConfigTarget.Agent) {
-            const nextOwners = Array.isArray(op.value) ? op.value : [];
-            if (nextOwners.length === 0) {
-                throw new ConfigError('LAST_OWNER_PROTECTED', 'owners must contain at least one owner');
-            }
-            setNested(existing, op.field, nextOwners);
-            return nextOwners;
-        }
         if (op.route.merge === 'list') {
             const previous = getNested(existing, op.field);
             const previousItems = Array.isArray(previous) ? previous : [];
@@ -506,12 +505,6 @@ function executeUnset(op, options) {
     const selector = selectorFor(op, options);
     const target = op.route.target;
     const { value: removed } = mutateConfig(target, selector, existing => {
-        if (op.field === 'owners' && target === ConfigTarget.Agent) {
-            const current = getNested(existing, op.field);
-            if (Array.isArray(current) && current.length > 0) {
-                throw new ConfigError('LAST_OWNER_PROTECTED', 'cannot unset owners while an Agent still has owners; use owners replace with another owner');
-            }
-        }
         const parts = op.field.split('.');
         let current = existing;
         for (let i = 0; i < parts.length - 1; i++) {