evolcore 0.0.35 → 0.0.37

package/dist/core/command/menu-handler.js

@@ -7,19 +7,23 @@ import { constrainResolvedModelForRole, filterModelsForRole, validateModelSelect
 import { hasModelSwitcher } from '../../agents/runner-types.js';
 import { resolvePaths, getPackageRoot, daemonControlDir } from '../../paths.js';
 import { buildEnvelope, isDeliveryTarget, isDeliveryTargetForChannel, replyContextFromSession } from '../message/message-utils.js';
+import { isMainSession, isTopicSession, sessionLocalTopicId, sessionTopicThreadId } from '../thread/topic-id.js';
 import path from 'path';
 import fs from 'fs';
+import { parseFileSearchArgs, searchProjectFiles } from './file-search.js';
 import os from 'os';
 import crypto from 'crypto';
 import { CronExpressionParser } from 'cron-parser';
 import { parseDuration } from '../../trigger/parser.js';
-import { isLinkedInstall, resolveGlobalPkg } from '../../utils/npm-ops.js';
+import { resolveGlobalPkg } from '../../utils/npm-ops.js';
 import { refreshManagedPackageVersions, VERSION_INFO_PACKAGES } from '../../utils/package-version-info.js';
-import { resolveCliEntry, launchMonitorAndConfirm } from '../../utils/cross-platform.js';
+import { resolveUpgradeDistTag } from '../../utils/package-version-info.js';
+import { readUpgradeJob, startUpgradeJob, structuredUpgradeCheck, upgradeJobView } from '../../utils/upgrade-jobs.js';
+import { launchMonitorAndConfirm, resolveCliEntry, isProcessRunning } from '../../utils/cross-platform.js';
 import { cachedCliVersion } from '../../utils/cross-platform.js';
 import { scanInstances } from '../../utils/instance-registry.js';
 import { loadDefaults, loadDaemonConfig } from '../../config-store.js';
-import { WEB_PACKAGE_NAME } from '../../product.js';
+import { WEB_PACKAGE_NAME, RESTART_REQUEST_ID_ENV, RUNTIME_HOME_ENV, SESSION_ID_ENV } from '../../product.js';
 import { read as cfgRead, resolveEffective, resolveEffectiveFieldWithSource, routeFieldPath, write as cfgWrite, ConfigTarget, } from '../../config/config-manager.js';
 import { execAgentAction, execAgentQuery, execAgentOptions, execAidAvatar, resolveProjectPath } from './agent-control.js';
 import { gatewayList, gatewayUpdate, gatewayDelete, gatewayTest, gatewayModels, gatewaySetPrice, gatewaySyncEnv } from '../../config/gateway-config.js';
@@ -29,18 +33,20 @@ import { buildForkHistorySnapshot, pageForkHistory } from '../session/session-ma
 import { isCapabilityType, listCapabilityOptions, queryCapabilityTypes, resolveCapabilityContext, updateCapabilityPolicy, } from '../capability/capability-manager.js';
 import { normalizeCliArgv, parseCliIntent, parseLegacyCliCommand, validateCliArgv, withDefaultRelationContext } from './cli-intent-parser.js';
 import { auditCommandAuthorization, auditFullAccessEvent, hashArgv } from '../auth/authorization-audit.js';
-import { authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
+import { authorizeOperation, authorizeFreshOperation, buildAuthSubject } from '../auth/auth-gateway.js';
+import { ownerResolver, getDaemonOwners, refreshOwnershipForAuthorization, OWNERSHIP_CACHE_MAX_AGE_MS } from '../ownership/owner-resolver.js';
+import { parseOwnershipCommand, executeOwnershipCommand, ownershipFailure } from '../../aun/aid/ownership-operation.js';
 import { authorizationDenialData, formatAuthorizationDenial } from '../auth/authorization-denial.js';
 import { evaluateRoleOperationCapability } from '../auth/operation-authorizer.js';
 import { isUnsupportedBaseagentConfigField } from '../../config/config-field-policy.js';
 import { splitConfigBatchGetArgv } from '../../cli/cli-argv.js';
-import { chatmodeFieldForPeer, resolveChatModeForField } from '../message/peer-mode.js';
+import { chatmodeFieldForPeer, isPrivateChatmodeRoleLocked, resolveChatModeForField } from '../message/peer-mode.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
 import { resolveRuntimePermissionMode, resolveRuntimeStringField, validateRuntimeStringFieldOverride, } from '../role/runtime-policy.js';
 import { isManagementRole } from '../../config/builtin-roles.js';
 import { SYSTEM_CONTROL_CHANNEL } from '../system-channels.js';
 import { logger } from '../../utils/logger.js';
-import { shouldSuppressRealRestart } from '../../utils/restart-safety.js';
+import { shouldSuppressRealRestart, createRestartRequest, readRestartRequest, updateRestartRequest, removeRestartRequest } from '../../utils/restart-safety.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { evolMenuResponseTransportMetadata, menuFailure, menuCommandForName, menuSuccess, normalizeMenuError, validateTaskActivityQueryArgs, validateConfigWriteScope, validateMenuRequest, } from './menu-protocol.js';
 import { parseMenuClientProtectedHeaders } from './menu-protocol.js';
@@ -57,6 +63,7 @@ import { dataRootFailure, dataRootResolver } from './data-root-resolver.js';
 import { agentStorageMenuService, isAgentStorageMenuRequest } from './agent-storage-menu.js';
 import { MAX_AUN_ATTACHMENT_SIZE } from '../../aun/msg/upload.js';
 import { normalizeTopicLabel, normalizeTopicStatus, resolveTopicArchiveFilter, } from '../session/session-mapper.js';
+import { notifyThreadRename } from '../thread/thread-operation.js';
 /**
  * 获取 baseagent CLI 的版本号（claude/gemini/codex）。
  * 失败返回 null（命令不存在或执行失败）。
@@ -206,7 +213,7 @@ function buildSessionPayload(session, name) {
     const payload = { id: session.id, name };
     if (session.label)
         payload.label = session.label;
-    if (session.threadId)
+    if (isTopicSession(session))
         payload.topicStatus = session.topicStatus ?? 'pending';
     if (session.agentSessionId)
         payload.agentSessionId = session.agentSessionId;
@@ -217,10 +224,10 @@ function buildSessionPayload(session, name) {
 }
 async function findMainSessionTarget(sessionManager, channel, channelId, target, activeSession) {
     if (!target) {
-        return activeSession && !activeSession.threadId ? activeSession : undefined;
+        return activeSession && isMainSession(activeSession) ? activeSession : undefined;
     }
     const sessions = (await sessionManager.listSessions(channel, channelId))
-        .filter((s) => !s.threadId);
+        .filter((s) => isMainSession(s));
     return sessions.find((s) => s.name === target ||
         s.id === target ||
         (target.length >= 8 && s.id.startsWith(target)) ||
@@ -232,7 +239,7 @@ async function resolveTopicForkSource(sessionManager, channel, channelId, source
     if (threadId)
         return sessionManager.getThreadSession(channel, channelId, threadId);
     const active = await sessionManager.getActiveSession(channel, channelId);
-    return active && !active.threadId ? active : undefined;
+    return active && isMainSession(active) ? active : undefined;
 }
 /**
  * 解析并校验 menu `name=file` 的目标路径（query/fetch 共用）。
@@ -392,6 +399,7 @@ const CLI_EXEC_WHITELIST = {
     agent: new Set(['list', 'show', 'get']),
     aid: new Set(['list', 'show', 'lookup']),
     storage: new Set(['ls', 'quota']),
+    thread: new Set(['summary']),
 };
 function tokenizeArgv(line) {
     const out = [];
@@ -588,9 +596,18 @@ function resolveMenuChatmodeTarget(params) {
     }
     if (!peerKey)
         return { error: 'relation scope 需要 peer/peerKey，或可推导的当前对端', code: 'MISSING_PEER' };
-    return { scope, sel: { ...sel, peerKey }, role: params.role, field, fieldPath: `chatmode.${field}` };
+    return {
+        scope,
+        sel: { ...sel, peerKey },
+        role: params.role,
+        roleLocked: !params.fromControlChannel && isPrivateChatmodeRoleLocked(field, params.role),
+        field,
+        fieldPath: `chatmode.${field}`,
+    };
 }
 function readMenuChatmode(target) {
+    if (target.roleLocked)
+        return { value: 'proactive', source: 'role' };
     try {
         const resolved = resolveEffectiveFieldWithSource(target.fieldPath, target.sel, { cache: true });
         const decision = resolveRuntimeStringField({
@@ -774,7 +791,7 @@ function resolveMenuModelTarget(params) {
         return { error: 'relation scope 需要 peer/peerKey，或可推导的当前对端', code: 'MISSING_PEER' };
     return { scope, sel: { ...sel, peerKey }, role: params.role, baseagent, field: params.field, fieldPath: `baseagents.${baseagent}.${params.field}` };
 }
-function readMenuModel(target, agent) {
+function readMenuModel(target, agent, agentSessionId) {
     try {
         const fieldPath = menuModelConfigFieldPath(target);
         const resolved = resolveEffectiveFieldWithSource(fieldPath, target.sel, { cache: true });
@@ -1050,6 +1067,8 @@ function buildMenuIntent(verb, cmdBase, args, action, value, fromControlChannel
     }
     if (verb === 'action') {
         if (cmdBase === '/file') {
+            if (action === 'search')
+                return intent('file.search', 'filesystem', { filePath: args?.path ?? '.' });
             if (action === 'list')
                 return intent('file.list', 'filesystem', { filePath: args?.path });
             if (action === 'fetch')
@@ -1140,7 +1159,7 @@ function buildMenuAuthSubject(owner, params) {
         chatType,
         conversationId: peerKeyId,
         identity: params.identity,
-        processOwners: loadDaemonConfig().owners ?? [],
+        processOwners: getDaemonOwners(),
         fromControlChannel: params.fromControlChannel,
     });
 }
@@ -1173,6 +1192,14 @@ async function authorizeMenuIntent(params) {
     if (intent.operation.startsWith('trigger.') && !subject.selfAid) {
         return { error: 'Trigger operation requires a channel bound to an Agent', code: 'ROLE_ACCESS_DENIED' };
     }
+    if (intent.operation.startsWith('trigger.') && intent.args.triggerScope !== undefined) {
+        if (intent.args.triggerScope !== 'daemon') {
+            return { error: 'triggerScope 仅支持 daemon', code: 'INVALID_ARGUMENT' };
+        }
+        if (!fromControlChannel || subject.selfAid !== this.getDaemonTriggerOwnerAid?.(channel)) {
+            return { error: '主机级 Trigger 必须通过控制 AID 管理', code: 'NOT_SUPPORTED' };
+        }
+    }
     if (intent.scope === 'relation') {
         intent.args = buildRelationIntentArgs({
             args: intent.args,
@@ -1185,7 +1212,7 @@ async function authorizeMenuIntent(params) {
     }
     const source = params.source ?? 'menu';
     intent.source = source;
-    const decision = await authorizeOperation({
+    const decision = await authorizeFreshOperation({
         source,
         intent,
         subject,
@@ -1363,6 +1390,22 @@ function menuResultFailure(error) {
     return { error: normalized.message, code: normalized.code, ...(normalized.data !== undefined ? { data: normalized.data } : {}) };
 }
 function resolveExternalMenuAgentChannel(owner, payload, fallbackChannel, required) {
+    const requestCmd = payload?.name ? menuCommandForName(payload.name) ?? payload.cmd : payload?.cmd;
+    const isTrigger = menuCommandToken(requestCmd) === '/trigger';
+    if (isTrigger && payload?.args?.triggerScope !== undefined) {
+        if (payload.args.triggerScope !== 'daemon') {
+            return { error: 'triggerScope 仅支持 daemon', code: 'INVALID_ARGUMENT' };
+        }
+        if (payload.agent !== undefined
+            || ['aid', 'agentId', 'self', 'context'].some(key => payload.args[key] !== undefined)) {
+            return { error: '主机级 Trigger 不接受 Agent 选择参数', code: 'INVALID_ARGUMENT' };
+        }
+        const channel = owner.getDaemonTriggerChannel?.() ?? 'daemon';
+        if (!owner.getDaemonTriggerOwnerAid?.(channel)) {
+            return { error: '主机调度器不可用', code: 'NOT_SUPPORTED' };
+        }
+        return { channel };
+    }
     const requestedAid = typeof payload?.agent === 'string' && payload.agent.trim()
         ? payload.agent.trim()
         : typeof payload?.args?.aid === 'string'
@@ -1541,7 +1584,7 @@ export function getMenuItems(role, chatType = 'private', scope = 'agent', authSu
     }
     // 记忆管理（紧跟权限管理）：条目与 evolhelp 同源，无参数的一点即执行，需要 slug 的弹输入框
     const memoryOwnerAid = authSubject?.selfAid
-        ? this?.agentRegistry?.get?.(authSubject.selfAid)?.config?.owners?.[0]
+        ? ownerResolver.primaryOwner(authSubject.selfAid)
         : undefined;
     const memoryEntries = isControlScope ? [] : memoryHelpEntries({
         chatType: normalizedChatType,
@@ -1723,7 +1766,12 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             if ('error' in res)
                 throw { code: res.code, message: res.error };
             return res.data.agents.map(ag => ({
-                value: ag.aid, label: ag.name || ag.aid, desc: ag.status, lifecycle: ag.lifecycle ?? null,
+                value: ag.aid,
+                label: ag.name || ag.aid,
+                desc: ag.status,
+                lifecycle: ag.lifecycle ?? null,
+                baseagent: ag.baseagent ?? null,
+                projectPath: ag.projectPath ?? null,
             }));
         }
         // agent channel：直接读取自身，避免先枚举全部 Agent 再过滤。
@@ -1737,7 +1785,12 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             throw { code: res.code, message: res.error };
         const ag = res.data;
         return [{
-                value: ag.aid, label: ag.identity?.name || ag.name || ag.aid, desc: ag.status, lifecycle: ag.lifecycle ?? null,
+                value: ag.aid,
+                label: ag.identity?.name || ag.name || ag.aid,
+                desc: ag.status,
+                lifecycle: ag.lifecycle ?? null,
+                baseagent: ag.baseagent ?? null,
+                projectPath: ag.projectPath ?? null,
             }];
     }
     if (cmd === '/capability') {
@@ -1833,7 +1886,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             }
         }
         return sessions
-            .filter((s) => !!s.threadId && (!hasLabel || s.label === label) && (!topicStatus || s.topicStatus === topicStatus))
+            .filter((s) => isTopicSession(s) && (!hasLabel || s.label === label) && (!topicStatus || s.topicStatus === topicStatus))
             .map((s) => this.buildTopicMenuItem(s));
     }
     if (cmd === '/s' || cmd === '/session' || cmd === '/del') {
@@ -1841,7 +1894,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
         const active = cmd === '/del' ? await this.sessionManager.getActiveSession(channel, channelId) : null;
         const currentSession = session;
         const items = sessions
-            .filter((s) => !s.threadId)
+            .filter((s) => isMainSession(s))
             .filter((s) => !active || s.id !== active.id)
             .map((s) => {
             const displayName = displaySessionTitle(s.name, s.id.slice(0, 8));
@@ -1915,7 +1968,7 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
             const rawModels = catalog.models.map(m => m.id);
             const models = filterModelsForRole(optionsIdentity.role, target.baseagent, rawModels, model => resolveCatalogModel(catalog, model), target.sel.self);
             const requestedModel = menuStringArg(args, 'model') ?? menuStringArg(args, 'current');
-            const currentModel = requestedModel || readMenuModel(target, agent).value || agent.getModel();
+            const currentModel = requestedModel || readMenuModel(target, agent, session?.agentSessionId).value || agent.getModel();
             if (models.length > 0)
                 return models.map((m) => ({ value: m, label: modelDisplayLabel(agent, m) + (catalog.models.find(e => e.id === m)?.verification === 'unverified' ? ' [unverified]' : ''), selected: modelMatches(agent, m, currentModel) }));
         }
@@ -1982,9 +2035,9 @@ export async function getSubMenuItems(cmd, channel, channelId, userId, args, ove
         }
         const requestedModel = menuStringArg(args, 'model') ?? menuStringArg(args, 'currentModel');
         const modelTarget = { ...target, field: 'model', fieldPath: `baseagents.${target.baseagent}.model` };
-        const currentModel = requestedModel || (hasModelSwitcher(agent) ? (readMenuModel(modelTarget, agent).value || agent.getModel()) : agent.name);
+        const currentModel = requestedModel || (hasModelSwitcher(agent) ? (readMenuModel(modelTarget, agent, session?.agentSessionId).value || agent.getModel()) : agent.name);
         const efforts = await getAvailableEfforts(agent, currentModel);
-        const currentEffort = menuStringArg(args, 'effort') ?? menuStringArg(args, 'current') ?? readMenuModel(target, agent).value ?? 'auto';
+        const currentEffort = menuStringArg(args, 'effort') ?? menuStringArg(args, 'current') ?? readMenuModel(target, agent, session?.agentSessionId).value ?? 'auto';
         const allItems = [...efforts, 'auto'];
         return allItems.map(e => ({ value: e, label: e === 'auto' ? 'auto (SDK默认)' : e, selected: e === currentEffort }));
     }
@@ -2506,7 +2559,7 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
                 const page = pageForkHistory(snapshot, before, limit);
                 const forkSource = current.metadata?.forkSource;
                 return { data: {
-                        threadId: current.threadId,
+                        threadId: sessionLocalTopicId(current) ?? '',
                         sourceAssistantMessageId: source.assistantMessageId,
                         historyVersion: 1,
                         historyDigest: forkSource?.historyDigest,
@@ -2538,7 +2591,7 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
             turns = this.sessionManager.getSessionFileInfo(topic.projectPath, topic.agentSessionId, topic.baseagent, topic.selfAID).turns;
         }
         const data = {
-            threadId: topic.threadId,
+            threadId: sessionLocalTopicId(topic) ?? '',
             name: topic.name || null,
             label: topic.label || null,
             topicStatus: topic.topicStatus ?? 'pending',
@@ -2594,7 +2647,7 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if ('error' in target)
             return target;
         const agent = this.getAgent(channel, target.baseagent);
-        const current = readMenuModel(target, agent);
+        const current = readMenuModel(target, agent, session?.agentSessionId);
         return {
             data: {
                 model: current.value,
@@ -2623,7 +2676,7 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
         if ('error' in target)
             return target;
         const agent = this.getAgent(channel, target.baseagent);
-        const current = readMenuModel(target, agent);
+        const current = readMenuModel(target, agent, session?.agentSessionId);
         return {
             data: {
                 effort: current.value,
@@ -2777,6 +2830,7 @@ export async function execMenuQuery(cmd, channel, channelId, userId, args, expli
                     data.fastaunVersion = fp2.version;
             }
             catch { }
+            data.avatarCreateSupported = true;
             return { data };
         }
         if (view === 'monitor') {
@@ -3052,7 +3106,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
         const triggerScheduler = this.getTriggerSchedulerForChannel?.(channel);
         if (!triggerScheduler)
             return { error: '触发器功能未启用', code: 'NOT_SUPPORTED' };
-        const updated = await this.updateTriggerFromPatch(triggerScheduler, patch.nameOrId, patch, channel, channelId, userId ?? '', isAdmin, undefined, undefined, subject.isDaemonOwner, subject.canApprovePersistentFullAccess);
+        const updated = await this.updateTriggerFromPatch(triggerScheduler, patch.nameOrId, patch, channel, channelId, userId ?? '', isAdmin, undefined, undefined, subject.isDaemonOwner, subject.canApprovePersistentFullAccess, session?.chatType);
         if (!updated.ok) {
             return {
                 error: updated.error,
@@ -3108,8 +3162,9 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             return { error: `无效 baseagent: ${arg}，可选: ${valid.join(' / ')}`, code: 'INVALID_VALUE' };
         }
         const previousBaseagent = evolagent.baseagent;
-        if (session?.threadId) {
-            if (transportReplyContext?.threadId !== session.threadId) {
+        const sessionTopicId = sessionTopicThreadId(session);
+        if (session && sessionTopicId) {
+            if (transportReplyContext?.threadId !== sessionTopicId) {
                 return { error: '话题路由上下文不匹配，拒绝切换', code: 'THREAD_CONTEXT_MISMATCH' };
             }
             if (typeof this.messageQueue.withSessionBarrier !== 'function') {
@@ -3119,7 +3174,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             const currentAgent = this.getAgent(channel, session.baseagent);
             const outcome = await this.messageQueue.withSessionBarrier(sessionKey, async (snapshot) => {
                 const latest = await this.sessionManager.getSessionById?.(session.id);
-                if (!latest || latest.threadId !== session.threadId) {
+                if (!latest || sessionTopicThreadId(latest) !== sessionTopicId) {
                     return { error: '话题会话不存在或归属已变化', code: 'NOT_FOUND' };
                 }
                 const busy = !!latest.processingState
@@ -3137,7 +3192,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
                     evolagent.setActiveBaseagent(arg);
                     await this.sessionManager.rotateTopicBackend({
                         sessionId: latest.id,
-                        expectedThreadId: latest.threadId,
+                        expectedThreadId: sessionTopicId,
                         baseagent: arg,
                     });
                     return { ok: true };
@@ -3166,7 +3221,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
                     baseagentChanged: previousBaseagent !== arg,
                     scope: 'agent',
                     sessionId: session.id,
-                    threadId: session.threadId,
+                    threadId: sessionTopicId,
                     sessionIdChanged: false,
                     notice: '已切换 Baseagent: ' + previousBaseagent + ' → ' + arg + '，话题会话 ID 保持不变',
                 } };
@@ -3291,7 +3346,7 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
             return target;
         const agent = this.getAgent(channel, target.baseagent);
         const modelTarget = { ...target, field: 'model', fieldPath: `baseagents.${target.baseagent}.model` };
-        const currentModel = hasModelSwitcher(agent) ? (readMenuModel(modelTarget, agent).value || agent.getModel()) : agent.name;
+        const currentModel = hasModelSwitcher(agent) ? (readMenuModel(modelTarget, agent, session?.agentSessionId).value || agent.getModel()) : agent.name;
         const validEfforts = await getAvailableEfforts(agent, currentModel);
         const allValid = [...validEfforts, 'auto'];
         if (!allValid.includes(arg)) {
@@ -3346,6 +3401,9 @@ export async function execMenuUpdate(cmd, value, channel, channelId, userId, ove
         });
         if ('error' in target)
             return target;
+        if (arg === 'interactive' && target.roleLocked) {
+            return { error: '私聊交互模式仅限 owner/admin，当前角色固定为 proactive', code: 'ROLE_VALUE_NOT_ALLOWED' };
+        }
         const roleDecision = validateRuntimeStringFieldOverride({
             selfAid: target.sel.self,
             role: target.role,
@@ -3458,6 +3516,17 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         return { error: '缺少命令', code: 'MISSING_CMD' };
     if (!action)
         return { error: '缺少 action', code: 'MISSING_VALUE' };
+    if (cmdBase === '/file' && action === 'search') {
+        try {
+            parseFileSearchArgs(args);
+        }
+        catch (error) {
+            return { error: error.message, code: 'INVALID_ARGUMENT' };
+        }
+        if (fromControlChannel || authSubject?.fromControlChannel) {
+            return { error: 'File search must be addressed to the current Agent AID', code: 'NOT_SUPPORTED' };
+        }
+    }
     const gated = gateControlScope.call(this, { cmdBase, action, args, channel, fromControlChannel });
     if (gated)
         return gated;
@@ -3943,7 +4012,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                             success: true,
                             topic: {
                                 ...buildSessionPayload(existingTopic, existingTopic.name || ''),
-                                threadId: existingTopic.threadId,
+                                threadId: sessionLocalTopicId(existingTopic) ?? '',
                                 sourceSessionId: forkSource.sessionId,
                                 sourceThreadId: forkSource.threadId,
                                 sourceAssistantMessageId: forkSource.assistantMessageId,
@@ -3977,7 +4046,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 || (this.messageQueue.getQueueLength?.(sourceKey) ?? 0) > 0
                 || currentAgent.hasActiveStream(sourceKey)
                 || (this.processor?.isPauseRequested?.(sourceKey) ?? false);
-            if (!source.threadId && sourceIsBusy(source, agent)) {
+            if (isMainSession(source) && sourceIsBusy(source, agent)) {
                 return { error: '来源会话正在处理消息，请完成后重试', code: 'BUSY' };
             }
             const targetKey = JSON.stringify([source.channelType || source.channel, source.selfAID || '', channelId, targetThreadId]);
@@ -4023,7 +4092,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                         sessionId: topic.id,
                         sourceSessionId: current.id,
                         name: topic.name,
-                        threadId: topic.threadId,
+                        threadId: sessionTopicThreadId(topic),
                         sourceAssistantMessageId: actualSourceMessageId,
                         sourceTurn: forkTurn.index,
                     });
@@ -4033,9 +4102,9 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                             success: true,
                             topic: {
                                 ...buildSessionPayload(topic, topic.name || ''),
-                                threadId: topic.threadId,
+                                threadId: sessionTopicThreadId(topic) ?? '',
                                 sourceSessionId: current.id,
-                                sourceThreadId: current.threadId || null,
+                                sourceThreadId: sessionTopicThreadId(current) ?? null,
                                 sourceAssistantMessageId: actualSourceMessageId,
                                 sourceTurn: forkTurn.index,
                             },
@@ -4043,7 +4112,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                     };
                 };
                 const runForkUnderBarrier = async () => {
-                    if (source.threadId) {
+                    if (isTopicSession(source)) {
                         if (typeof this.messageQueue.withSessionBarrier !== 'function') {
                             return { error: '当前运行环境不支持安全话题分叉', code: 'NOT_SUPPORTED' };
                         }
@@ -4053,7 +4122,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                             if (!current) {
                                 return { error: '来源会话不存在或归属已变化', code: 'NOT_FOUND' };
                             }
-                            if (current.id !== source.id || (current.threadId || '') !== (source.threadId || '')) {
+                            if (current.id !== source.id || sessionTopicThreadId(current) !== sessionTopicThreadId(source)) {
                                 return { error: '来源会话不存在或归属已变化', code: 'NOT_FOUND' };
                             }
                             if (!current.agentSessionId) {
@@ -4148,6 +4217,9 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         const topic = await this.sessionManager.getThreadSession(channel, channelId, target);
         if (!topic)
             return { error: '话题不存在', code: 'NOT_FOUND' };
+        // target 可能是主话题规范 id，getThreadSession 会解析到主会话；这些动作只针对话题。
+        if (!isTopicSession(topic))
+            return { error: '主会话不支持此操作，请指定话题', code: 'NOT_SUPPORTED' };
         const chatType = topic.chatType === 'group'
             ? 'group'
             : topic.chatType === 'private'
@@ -4163,7 +4235,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             return {
                 data: {
                     action: 'label', success: true,
-                    topic: { ...buildSessionPayload(topic, topic.name || ''), threadId: topic.threadId, label: label ?? null },
+                    topic: { ...buildSessionPayload(topic, topic.name || ''), threadId: sessionLocalTopicId(topic) ?? '', label: label ?? null },
                 },
             };
         }
@@ -4171,7 +4243,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             const success = await this.sessionManager.setTopicStatus(topic.id, topicStatus);
             if (!success)
                 return { error: '话题不存在', code: 'NOT_FOUND' };
-            return { data: { action: 'status', success: true, topic: { ...buildSessionPayload(topic, topic.name || ''), threadId: topic.threadId, topicStatus } } };
+            return { data: { action: 'status', success: true, topic: { ...buildSessionPayload(topic, topic.name || ''), threadId: sessionLocalTopicId(topic) ?? '', topicStatus } } };
         }
         if (action === 'rename') {
             const newName = renameName;
@@ -4179,7 +4251,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             if (existing && existing.id !== topic.id) {
                 return { error: `名称 "${newName}" 已存在`, code: 'CONFLICT' };
             }
-            const oldName = displaySessionTitle(topic.name, topic.threadId || '(未命名)');
+            const oldName = displaySessionTitle(topic.name, sessionTopicThreadId(topic) || '(未命名)');
             const success = await this.sessionManager.renameSession(topic.id, newName);
             if (!success)
                 return { error: '重命名失败', code: 'EXEC_FAILED' };
@@ -4191,14 +4263,25 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 catch { }
             }
             // P1a.5.3: 若为话题会话，同步更新话题索引
-            if (topic.threadId) {
+            const renamedTopicThreadId = sessionTopicThreadId(topic);
+            if (renamedTopicThreadId) {
                 try {
                     const { ThreadService } = await import('../../core/thread/index.js');
                     const selfAid = topic.selfAID;
                     const peer = topic.channelId;
                     if (selfAid && peer) {
                         const svc = new ThreadService(this.sessionManager);
-                        await svc.renameThread({ selfAid, peer, threadId: topic.threadId, name: newName });
+                        const result = await svc.renameThread({ selfAid, peer, threadId: renamedTopicThreadId, name: newName });
+                        await notifyThreadRename({
+                            selfAid,
+                            peer,
+                            threadId: renamedTopicThreadId,
+                            result,
+                            threadService: svc,
+                            sendSystemMsg: (topic.channelType || channel.split('#', 1)[0]) === 'aun'
+                                ? this.getThreadSystemMsgSender?.()
+                                : undefined,
+                        });
                     }
                 }
                 catch (err) {
@@ -4212,7 +4295,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                     success: true,
                     topic: {
                         ...buildSessionPayload(topic, newName),
-                        threadId: topic.threadId,
+                        threadId: sessionLocalTopicId(topic) ?? '',
                     },
                 },
             };
@@ -4316,7 +4399,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
     }
     // ── /system 系列 ──
     if (cmdBase === '/system') {
-        // D1 迁移：进程级鉴权统一查 daemon.json owners，替代各 action 内联的 identity.role 判断
+        // 进程级鉴权统一使用 Control AID 的协议 Owner，替代各 action 内联的 identity.role 判断。
         if (!subject.isDaemonOwner && subject.processRole !== 'daemon-service') {
             return {
                 error: formatAuthorizationDenial('This daemon-level operation requires DaemonOwner.', 'DAEMON_OWNER_REQUIRED'),
@@ -4358,63 +4441,97 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                         : 'AUN_OUTBOUND_ROUTE_REQUIRED',
                 };
             }
+            let restartRequestId;
             if (!suppressRealRestart) {
-                // 这条路径同样以 daemon 自杀收尾，入口缺失必须在写 pending 和自杀之前拦下。
-                const restartEntry = resolveCliEntry(getPackageRoot());
-                if (!fs.existsSync(restartEntry.entry)) {
-                    return {
-                        error: `找不到重启入口：${restartEntry.entry}。请先执行 npm run build 重建产物。`,
-                        code: 'RESTART_ENTRY_MISSING',
-                        data: { reasonCode: 'RESTART_ENTRY_MISSING', entry: restartEntry.entry },
-                    };
-                }
+                restartRequestId = crypto.randomUUID();
                 const restartInfo = {
                     channel,
                     channelId,
                     timestamp: Date.now(),
+                    requestId: restartRequestId,
+                    requesterPid: process.pid,
+                    status: 'requested',
                     ...(restartReplyContext?.threadId ? { threadId: restartReplyContext.threadId } : {}),
                     ...(restartDelivery ? { delivery: restartDelivery } : {}),
                     ...(restartReplyContext?.replyToMessageId ? { rootId: restartReplyContext.replyToMessageId } : {}),
                 };
                 const controlDir = daemonControlDir();
                 fs.mkdirSync(controlDir, { recursive: true });
-                fs.writeFileSync(path.join(controlDir, 'restart-pending.json'), JSON.stringify(restartInfo));
-                // Use the canonical CLI restart path so the restart itself performs
-                // the version check and automatic upgrades before replacing the daemon.
-                // Do not inherit managed-session credentials: otherwise cmdRestart can
-                // delegate back to this daemon and recursively enqueue another restart.
-                //
-                // `ec restart` owns the monitor liveness check, but it can itself die on
-                // load (tsx + a broken source tree), and this path kills the daemon
-                // afterwards — so confirm the CLI process survived before proceeding.
-                const restartLaunch = await launchMonitorAndConfirm([...restartEntry.args, 'restart'], {
-                    EVOLCORE_HOME: resolvePaths().root,
-                    EVOLCORE_SESSION_ID: '',
+                const pendingFile = path.join(controlDir, 'restart-pending.json');
+                const monitorEntry = resolveCliEntry(getPackageRoot());
+                if (!fs.existsSync(monitorEntry.entry)) {
+                    return {
+                        error: `找不到重启监控入口：${monitorEntry.entry}。请先执行 npm run build 重建产物。`,
+                        code: 'RESTART_ENTRY_MISSING',
+                        data: { reasonCode: 'RESTART_ENTRY_MISSING', entry: monitorEntry.entry },
+                    };
+                }
+                if (scanInstances().restartMonitors.some(item => item.alive)
+                    || !createRestartRequest(pendingFile, restartInfo, isProcessRunning)) {
+                    return { error: '已有重启请求正在处理，请等待其结果，不要重复发起。', code: 'RESTART_ALREADY_PENDING' };
+                }
+                const requestId = restartRequestId;
+                const accepted = () => {
+                    const request = readRestartRequest(pendingFile, requestId);
+                    return request?.status === 'accepted' || request?.status === 'ready';
+                };
+                const logFilePath = path.join(resolvePaths().logs, `restart-launch-${requestId}.log`);
+                const restartLaunch = await launchMonitorAndConfirm([...monitorEntry.args, 'restart'], {
+                    [RUNTIME_HOME_ENV]: resolvePaths().root,
+                    [SESSION_ID_ENV]: '',
                     [AGENT_DELEGATION_TOKEN_ENV]: '',
-                }, 
-                // `ec restart` does not register itself; staying alive is the signal.
-                () => false, pid => scanInstances().restartMonitors.some(m => m.alive && m.record.pid !== pid), 8_000);
+                    [RESTART_REQUEST_ID_ENV]: requestId,
+                }, () => accepted(), () => scanInstances().restartMonitors.some(item => item.alive && item.record.requestId === requestId && item.record.phase === 'accepted'), {
+                    requestId,
+                    timeoutMs: 8_000,
+                    logFilePath,
+                    onSpawn: pid => { updateRestartRequest(pendingFile, requestId, { launcherPid: pid }); },
+                    isPendingInRegistry: () => scanInstances().restartMonitors.some(item => item.alive && item.record.requestId === requestId),
+                });
                 if (!restartLaunch.ok) {
-                    try {
-                        fs.rmSync(path.join(controlDir, 'restart-pending.json'), { force: true });
+                    if (restartLaunch.pending) {
+                        logger.error(`[System] Restart ownership is still unconfirmed (requestId=${restartRequestId}, PID=${restartLaunch.pid ?? 'unknown'})`);
+                        return {
+                            error: `重启请求状态暂不可确认（requestId=${restartRequestId}）。启动链仍在运行，可能继续执行；请勿立即重复发起。诊断日志：${logFilePath}，monitor 记录见 restart.log。`,
+                            code: 'RESTART_PENDING_CONFIRMATION',
+                            data: {
+                                action: 'restart',
+                                success: false,
+                                status: 'pending-confirmation',
+                                requestId: restartRequestId,
+                                ...(restartLaunch.pid ? { pid: restartLaunch.pid } : {}),
+                            },
+                        };
                     }
-                    catch { }
-                    logger.error(`[System] Refusing menu restart: launcher did not survive (${restartLaunch.reason})`);
+                    removeRestartRequest(pendingFile, requestId);
+                    logger.error(`[System] Refusing menu restart: restart-monitor did not take ownership (${restartLaunch.reason})`);
                     for (const line of (restartLaunch.stderrTail ?? '').split(/\r?\n/).filter(Boolean).slice(-8)) {
                         logger.error(`[System]   | ${line}`);
                     }
                     return {
-                        error: `重启已中止：启动器未能运行（${restartLaunch.reason}）。服务未停止，仍在运行当前版本。`,
-                        code: 'RESTART_LAUNCH_FAILED',
-                        data: { reasonCode: 'RESTART_LAUNCH_FAILED', reason: restartLaunch.reason },
+                        error: `重启已中止：重启监控未接管（${restartLaunch.reason}）。服务未停止，仍在运行当前版本。`,
+                        code: 'RESTART_MONITOR_DEAD',
+                        data: {
+                            reasonCode: 'RESTART_MONITOR_DEAD',
+                            reason: restartLaunch.reason,
+                            requestId: restartRequestId,
+                            ...(restartLaunch.pid ? { pid: restartLaunch.pid } : {}),
+                        },
                     };
                 }
+                logger.info(`[System] Restart monitor accepted request ${restartRequestId} (PID ${restartLaunch.pid ?? 'unknown'})`);
             }
             else {
                 logger.info('[System] Suppressed real menu restart in test runtime');
             }
             this.eventBus.publish({ type: 'system:restart', channel, channelId });
-            return { data: { action: 'restart', success: true } };
+            return {
+                data: {
+                    action: 'restart',
+                    success: true,
+                    ...(restartRequestId ? { status: 'accepted', requestId: restartRequestId } : {}),
+                },
+            };
         }
         if (action === 'paircode') {
             // Keep Menu pairing on the same daemon-owned store as /pair, ECWeb, and
@@ -4428,26 +4545,28 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             return r;
         }
         if (action === 'upgrade') {
-            const devMode = isLinkedInstall();
-            const results = await refreshManagedPackageVersions(VERSION_INFO_PACKAGES, { source: 'menu-upgrade' });
-            const [evolcore, fastaunWeb, web] = [results[0], results[2], results[1]];
-            const item = (result) => ({
-                local: result.entry.currentVersion,
-                remote: result.status === 'ok' ? result.entry.latestVersion ?? null : null,
-                hasUpdate: result.status === 'ok' && result.hasUpdate,
-                status: result.status,
-                checkedAt: result.status === 'ok' ? result.entry.checkedAt ?? null : null,
-                lastCheckedAt: result.entry.checkedAt ?? null,
-                ...(result.error ? { error: result.error } : {}),
-            });
-            return {
-                data: {
-                    devMode,
-                    evolcore: item(evolcore),
-                    fastaun: { ...item(fastaunWeb), managedBy: 'evolcore' },
-                    ecweb: item(web),
-                },
-            };
+            const mode = args?.mode ?? 'check';
+            if (!['check', 'update', 'status'].includes(mode)
+                || Object.keys(args ?? {}).some(key => !['mode', 'jobId', 'context'].includes(key))
+                || (mode !== 'status' && args?.jobId !== undefined))
+                return { error: '无效的更新参数', code: 'INVALID_ARGUMENT' };
+            if (mode === 'status') {
+                if (typeof args?.jobId !== 'string' || !/^job_[a-f0-9-]{36}$/.test(args.jobId))
+                    return { error: '缺少或无效的 jobId', code: 'INVALID_ARGUMENT' };
+                const job = readUpgradeJob(args.jobId);
+                const scope = JSON.stringify([source, channel, channelId, subject.actorId, transportReplyContext?.toDeviceId, transportReplyContext?.threadId]);
+                const expectedKey = job ? crypto.createHash('sha256').update(JSON.stringify([scope, job.requestId])).digest('hex') : undefined;
+                return job && job.requestKey === expectedKey
+                    ? { data: upgradeJobView(job) }
+                    : { error: '更新任务不存在或不可访问', code: 'NOT_FOUND' };
+            }
+            if (mode === 'update') {
+                const result = await startUpgradeJob(requestId || crypto.randomUUID(), JSON.stringify([source, channel, channelId, subject.actorId, transportReplyContext?.toDeviceId, transportReplyContext?.threadId]));
+                return { data: { ...upgradeJobView(result.job), reused: result.reused } };
+            }
+            const distTag = resolveUpgradeDistTag();
+            const results = await refreshManagedPackageVersions(VERSION_INFO_PACKAGES, { source: 'menu-upgrade', distTag, includeUninstalled: true });
+            return { data: structuredUpgradeCheck(results, distTag) };
         }
         return { error: `不支持的 system action: ${action}`, code: 'NOT_SUPPORTED' };
     }
@@ -4466,7 +4585,8 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         const requestedArgv = [...argvValidation.argv];
         argv = normalizeCliArgv(argv);
         const cliAgent = this.getOwningAgent?.(channel);
-        const cliSelfAid = cliAgent?.aid;
+        const cliSelfAid = cliAgent?.aid ?? (argv[0] === 'aid' && argv[1] === 'bind'
+            ? session?.selfAID ?? authSubject?.selfAid ?? ownerResolver.getDaemonAid() : undefined);
         const cliChannelType = this.resolveChannelType?.(channel);
         const cliChatType = session?.chatType ?? explicitChatType;
         const cliPeerKeyId = cliChatType === 'group'
@@ -4529,7 +4649,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
         for (let i = 0; i < parsedCommands.length; i++) {
             const parsed = parsedCommands[i];
             const authArgv = parsed.resolvedConfigCommand?.canonicalArgv ?? intentArgvs[i] ?? argv;
-            const decision = await authorizeOperation({
+            const decision = await authorizeFreshOperation({
                 source: 'menu.cli',
                 intent: parsed.intent,
                 subject,
@@ -4562,7 +4682,35 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
             }
             authorizedCommands.push({ parsed, decision });
         }
-        const rawExecution = await this.execCliPassthrough(argv, subject.role);
+        const executionIntent = parsedCommands[0]?.intent;
+        const ownershipOperation = executionIntent?.operation;
+        let rawExecution;
+        if (ownershipOperation === 'ec.aid.bind' || ownershipOperation === 'ec.aid.bind.status') {
+            try {
+                rawExecution = { data: { ok: true, state: await executeOwnershipCommand(parseOwnershipCommand(argv), cliSelfAid) } };
+            }
+            catch (error) {
+                const failure = ownershipFailure(error);
+                const code = ['INVALID_ARGUMENT', 'INVALID_AID', 'INVALID_OWNER'].includes(failure.code) ? 'INVALID_ARGUMENT'
+                    : ['SUBJECT_REQUIRED', 'SUBJECT_UNAVAILABLE'].includes(failure.code) ? 'NOT_FOUND'
+                        : ['OWNER_ALREADY_BOUND', 'BIND_CONFLICT', 'BIND_UNCERTAIN', 'CONSENSUS_REQUIRED', 'CLIENT_REPLACED', 'conflict', 'owner_locked'].includes(failure.code)
+                            ? 'CONFLICT' : 'INTERNAL_ERROR';
+                rawExecution = { error: failure.error, code, data: failure };
+            }
+        }
+        else if (executionIntent?.operation === 'ec.thread.summary-show'
+            || executionIntent?.operation === 'ec.thread.summary-log') {
+            rawExecution = await this.executeThreadSummaryCli({
+                action: String(executionIntent.args.action),
+                selfAid: String(executionIntent.args.self),
+                peer: String(executionIntent.args.peer),
+                threadId: String(executionIntent.args.threadId),
+                authenticatedSelfAid: subject.selfAid ?? '',
+            });
+        }
+        else {
+            rawExecution = await this.execCliPassthrough(argv, subject.role);
+        }
         const execution = appendGroupRulesCompatibilityNote(rawExecution, parsedCommands[0]?.resolvedConfigCommand, session);
         const executionData = 'data' in execution ? execution.data : undefined;
         for (const { parsed, decision } of authorizedCommands) {
@@ -4575,7 +4723,7 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
                 channel, channelId, role: identity.role, isDaemonOwner,
                 fromControlChannel: fromControlChannel ?? false, decision: 'allow',
                 executed: true,
-                executionState: executionData?.exitCode === undefined || executionData.exitCode === 0 ? 'completed' : 'failed',
+                executionState: 'error' in execution || executionData?.ok === false || (executionData?.exitCode !== undefined && executionData.exitCode !== 0) ? 'failed' : 'completed',
                 matchedRule: decision.command?.matchedRule, taskId: requestId, argvHash: hashArgv(argv),
                 name: 'cli', action: 'exec',
                 args: { argv: [...requestedArgv] },
@@ -4589,6 +4737,41 @@ export async function execMenuAction(cmd, action, args, channel, channelId, user
     // fetch 文件作为独立 result.file 消息异步发回；把请求 id 作为 correlationId 透传，
     // 客户端用它把异步到达的文件消息对回这次 fetch 点击。
     if (cmdBase === '/file') {
+        if (action === 'search') {
+            for (const operation of ['file.list', ...(args.content !== undefined ? ['file.fetch'] : [])]) {
+                const denied = await authorizeMenuIntent.call(this, {
+                    intent: { operation, scope: 'filesystem', source, args: { ...args, filePath: args.path ?? '.' } },
+                    identity: authIdentity, subject, session: authSession, explicitChatType,
+                    channel, channelId, userId, fromControlChannel, source,
+                });
+                if (denied)
+                    return denied;
+            }
+            const projectPath = session?.projectPath ?? evolagent?.projectPath ?? this.getOwningAgent?.(channel)?.projectPath;
+            try {
+                const data = await searchProjectFiles(projectPath, args, {
+                    canAccessFile: async (relative, absolute, isDirectory) => {
+                        const filePath = path.isAbsolute(args.path ?? '.') ? absolute : relative;
+                        const operations = [
+                            'file.search', 'file.list', ...(!isDirectory && args.content !== undefined ? ['file.fetch'] : []),
+                        ];
+                        for (const operation of operations) {
+                            const decision = await authorizeOperation({
+                                source, subject, audit: false,
+                                intent: { operation, scope: 'filesystem', source, args: { ...args, path: filePath, filePath } },
+                            });
+                            if (!decision.allow)
+                                return false;
+                        }
+                        return true;
+                    },
+                });
+                return { data };
+            }
+            catch (error) {
+                return menuResultFailure(error);
+            }
+        }
         if (action === 'list') {
             const dirArg = (args?.path ?? '.').toString().trim() || '.';
             const offset = parseFileListOffset(args?.offset);
@@ -4739,7 +4922,7 @@ export function resolveControlMenuAuthorization(input) {
         return {
             allowed: false,
             code: 'NOT_ALLOWED',
-            message: formatAuthorizationDenial('Configure daemon.json.owners before using Control Menu operations.', 'DAEMON_OWNER_REQUIRED'),
+            message: formatAuthorizationDenial('Verify the protocol Owner of the daemon Control AID before using Control Menu operations.', 'DAEMON_OWNER_REQUIRED'),
             data: authorizationDenialData('DAEMON_OWNER_REQUIRED'),
         };
     }
@@ -4771,7 +4954,7 @@ async function execMenuForSystemControl(payload, context) {
     // operation is available through Host/control: file operations must be
     // addressed to the current Agent AID so the Agent project boundary applies.
     const isFileFetch = (payload?.type === 'menu.query'
-        || (payload?.type === 'menu.action' && payload?.action === 'fetch'))
+        || (payload?.type === 'menu.action' && (payload?.action === 'fetch' || payload?.action === 'search')))
         && (name === 'file' || compatCmd === '/file');
     const isDataRootQuery = payload?.type === 'menu.query'
         && (name === 'agent-data-root'
@@ -4973,6 +5156,7 @@ async function execMenuForSystemControl(payload, context) {
 }
 /** ECWeb 专用入口：只信任 IPC 信封中的服务端认证上下文，不信任 Menu payload 自报身份。 */
 export async function execMenuForEcweb(payload, trusted) {
+    await refreshOwnershipForAuthorization(undefined, { maxAgeMs: OWNERSHIP_CACHE_MAX_AGE_MS });
     const id = payload?.id ?? '';
     const name = payload?.name;
     const validationError = validateMenuRequest(payload ?? {});
@@ -4988,7 +5172,7 @@ export async function execMenuForEcweb(payload, trusted) {
     // ECWeb authentication grants daemon-owner authority independently of the
     // configured owners. Prefer an owner for audit/Trigger attribution when
     // available; otherwise keep local and remote management actors distinct.
-    const owners = loadDaemonConfig().owners ?? [];
+    const owners = getDaemonOwners();
     const userId = (trusted.actorAid && owners.includes(trusted.actorAid))
         ? trusted.actorAid
         : owners[0] ?? (trusted.localDirect ? 'local-direct' : 'ecweb-remote');
@@ -5016,12 +5200,13 @@ export async function execMenuForEcweb(payload, trusted) {
  * process authorization path. The authenticated envelope peerId remains the
  * requester; token mode maps to a configured owner as its management actor. */
 export async function execMenuForControl(payload, peerId, auth = {}) {
+    await refreshOwnershipForAuthorization(undefined, { maxAgeMs: OWNERSHIP_CACHE_MAX_AGE_MS });
     const id = payload?.id ?? '';
     const name = payload?.name;
     const validationError = validateMenuRequest(payload ?? {});
     if (validationError)
         return menuFailure({ id, ...(name ? { name } : {}) }, validationError);
-    const owners = loadDaemonConfig().owners ?? [];
+    const owners = getDaemonOwners();
     const compatCmd = menuCommandToken(payload?.cmd);
     const isRoleRequest = name === 'role' || compatCmd === '/role';
     const isConnectRequest = name === 'connect' || compatCmd === '/connect';