evolcore 0.0.35 → 0.0.37

package/dist/aun/aid/ownership-operation.js

@@ -0,0 +1,58 @@
+import { isValidAid } from './validation.js';
+import { ownerResolver, OwnershipError } from '../../core/ownership/owner-resolver.js';
+import { logger } from '../../utils/logger.js';
+export function ownershipFailure(error) {
+    const details = error && typeof error === 'object' ? error : {};
+    return {
+        ok: false,
+        code: typeof details.stringCode === 'string' ? details.stringCode
+            : typeof details.code === 'string' ? details.code : 'OWNERSHIP_OPERATION_FAILED',
+        error: error instanceof Error ? error.message : typeof details.error === 'string' ? details.error : String(error),
+        ...(typeof details.retryable === 'boolean' ? { retryable: details.retryable } : {}),
+    };
+}
+export function parseOwnershipCommand(argv) {
+    const args = argv[0] === 'aid' ? argv.slice(1) : [...argv];
+    if (args[0] !== 'bind' || !args[1]) {
+        throw new OwnershipError('INVALID_ARGUMENT', 'Use ec aid bind <ownerAid> or ec aid bind status');
+    }
+    const action = args[1] === 'status' ? 'status' : 'bind';
+    if (action === 'bind' && !isValidAid(args[1]))
+        throw new OwnershipError('INVALID_AID', 'A valid owner AID is required');
+    let subjectAid;
+    let formatSeen = false;
+    for (let index = 2; index < args.length; index += 2) {
+        if (args[index] === '--subject' && !subjectAid && isValidAid(args[index + 1] ?? ''))
+            subjectAid = args[index + 1];
+        else if (args[index] === '--format' && args[index + 1] === 'json' && !formatSeen)
+            formatSeen = true;
+        else
+            throw new OwnershipError('INVALID_ARGUMENT', 'Only one --subject <subjectAid> and --format json are supported');
+    }
+    return action === 'status' ? { action, subjectAid } : { action, subjectAid, ownerAid: args[1] };
+}
+export async function executeOwnershipCommand(command, defaultSubjectAid) {
+    const subjectAid = command.subjectAid ?? defaultSubjectAid;
+    if (!subjectAid)
+        throw new OwnershipError('SUBJECT_REQUIRED', 'No local subject AID is available');
+    if (command.action === 'status') {
+        ownerResolver.assertLocalSubject(subjectAid);
+        return ownerResolver.refresh(subjectAid);
+    }
+    logger.info(`[ownership] bind requested subject=${subjectAid} owner=${command.ownerAid}`);
+    try {
+        ownerResolver.assertLocalSubject(subjectAid);
+        const result = await ownerResolver.bind(subjectAid, command.ownerAid);
+        const task = result.task;
+        const log = task && ['rejected', 'stopped', 'error'].includes(task.status) ? logger.warn : logger.info;
+        log(`[ownership] bind result ${JSON.stringify({ subjectAid, ownerAid: command.ownerAid, operationId: task?.operation_id,
+            taskStatus: task?.status, step: task?.step, consensusStatus: result.consensusStatus, requestStatus: result.requestStatus,
+            code: task?.code, reason: task?.reason })}`);
+        return result;
+    }
+    catch (error) {
+        const details = ownershipFailure(error);
+        logger.warn(`[ownership] bind failed subject=${subjectAid} owner=${command.ownerAid} code=${details.code} error=${JSON.stringify(details.error)}`);
+        throw error;
+    }
+}

package/dist/aun/aid/store.js

@@ -55,6 +55,7 @@ export async function getAidStore(opts) {
         aunPath,
         encryptionSeed: AUN_KEYSTORE_ENCRYPTION_SEED,
         slotId: opts.slotId,
+        verifySsl: true,
         debug: opts.debug ?? false,
     };
     if (fs.existsSync(caCertPath))

package/dist/aun/group/fs-download.js

@@ -1,4 +1,61 @@
 import { createHash } from 'node:crypto';
+import { StorageLowLevel, StorageVFS } from '@agentunion/fastaun';
+export const DEFAULT_FS_CAT_BYTES = 128 * 1024;
+export const MAX_FS_CAT_BYTES = 128 * 1024;
+export class FsReadBudgetError extends Error {
+    maxBytes;
+    code = 'FS_CAT_TOO_LARGE';
+    constructor(maxBytes) {
+        super(`cat exceeds read budget ${maxBytes} bytes`);
+        this.maxBytes = maxBytes;
+        this.name = 'FsReadBudgetError';
+    }
+}
+export function validateFsReadBudget(maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_FS_CAT_BYTES) {
+        throw new RangeError(`cat read budget must be an integer from 1 to ${MAX_FS_CAT_BYTES}`);
+    }
+}
+async function downloadWithinBudget(url, maxBytes, headers) {
+    validateFsReadBudget(maxBytes);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const response = await fetch(url, { headers, signal: controller.signal });
+        if (!response.ok)
+            throw new Error(`HTTP GET failed: status=${response.status}`);
+        const contentLength = response.headers.get('content-length');
+        if (contentLength !== null && Number(contentLength) > maxBytes)
+            throw new FsReadBudgetError(maxBytes);
+        if (!response.body)
+            throw new Error('HTTP GET returned no response body');
+        const chunks = [];
+        let totalBytes = 0;
+        for await (const chunk of response.body) {
+            totalBytes += chunk.byteLength;
+            if (totalBytes > maxBytes)
+                throw new FsReadBudgetError(maxBytes);
+            chunks.push(chunk);
+        }
+        return Buffer.concat(chunks, totalBytes);
+    }
+    finally {
+        clearTimeout(timeout);
+        controller.abort();
+    }
+}
+export async function readPersonalFsBytesWithinBudget(client, path, maxBytes, options) {
+    validateFsReadBudget(maxBytes);
+    const lowlevel = new StorageLowLevel(client);
+    const getObject = lowlevel.getObject.bind(lowlevel);
+    lowlevel.getObject = params => getObject({ ...params, offset: 0, limit: maxBytes + 1 });
+    lowlevel.httpGet = (url, headers) => downloadWithinBudget(url, maxBytes, headers);
+    const storage = new StorageVFS(client, { lowlevel, useFsRpc: client.storage.useFsRpc });
+    const bytes = await storage.readBytes(path, options);
+    if (bytes.byteLength > maxBytes)
+        throw new FsReadBudgetError(maxBytes);
+    return bytes;
+}
 export class GroupFsDownloadError extends Error {
     code;
     constructor(code, message) {
@@ -8,7 +65,9 @@ export class GroupFsDownloadError extends Error {
     }
 }
 /** Download a group file into memory through the ticket/data plane. */
-export async function downloadGroupFsBytes(client, path) {
+export async function downloadGroupFsBytes(client, path, options = {}) {
+    if (options.maxBytes !== undefined)
+        validateFsReadBudget(options.maxBytes);
     const ticketValue = await client.call('group.fs.create_download_ticket', { path });
     if (!isRecord(ticketValue)) {
         throw new GroupFsDownloadError('INVALID_TICKET', 'group.fs.create_download_ticket returned invalid response');
@@ -17,7 +76,13 @@ export async function downloadGroupFsBytes(client, path) {
     if (!downloadUrl) {
         throw new GroupFsDownloadError('MISSING_DOWNLOAD_URL', 'group.fs.create_download_ticket did not return download_url');
     }
-    const bytes = await client.group.fs.lowlevel.httpGet(downloadUrl, bearerHeaders(client));
+    const size = ticketValue.size ?? ticketValue.size_bytes;
+    if (options.maxBytes !== undefined && typeof size === 'number' && size > options.maxBytes) {
+        throw new FsReadBudgetError(options.maxBytes);
+    }
+    const bytes = options.maxBytes === undefined
+        ? await client.group.fs.lowlevel.httpGet(downloadUrl, bearerHeaders(client))
+        : await downloadWithinBudget(downloadUrl, options.maxBytes, bearerHeaders(client));
     const expectedSha = stringField(ticketValue, ['sha256']);
     if (expectedSha && sha256Hex(bytes).toLowerCase() !== expectedSha.toLowerCase()) {
         throw new GroupFsDownloadError('HASH_MISMATCH', 'download hash verification failed');

package/dist/aun/group/history.js

@@ -5,6 +5,8 @@ import { isValidAid } from '../aid/validation.js';
 import { normalizeGroupAid } from './identity.js';
 import { resolvePaths } from '../../paths.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
+import { isMainSessionThreadId, normalizeThreadOptionValue } from '../../core/thread/topic-id.js';
+import { parseTimeArg, TIME_ARG_FORMATS } from '../../cli/cli-argv.js';
 import { isTransientProtocolMessage, messageLogPath, } from '../../core/message/message-log.js';
 export class GroupHistoryError extends Error {
     code;
@@ -59,11 +61,19 @@ export function parseGroupHistoryArgs(argv) {
         const raw = values.get(flag);
         if (raw === undefined)
             return undefined;
-        const result = /^\d+$/.test(raw) ? Number(raw) : Date.parse(raw);
-        if (!Number.isFinite(result) || result < 0)
-            fail('INVALID_ARGUMENT', flag + ' 需要有效时间');
+        const result = parseTimeArg(raw);
+        if (result === undefined)
+            fail('INVALID_ARGUMENT', `${flag} 需要有效时间（支持 ${TIME_ARG_FORMATS}）`);
         return result;
     };
+    // `--thread` 接受 `ec thread list` 打印的 `<群AID>/<id>`；前缀必须就是本次查询的群
+    let thread = values.get('--thread');
+    if (thread !== undefined) {
+        const normalized = normalizeThreadOptionValue(thread, peer => normalizeGroupAid(peer, from.slice(from.indexOf('.') + 1)) === groupId);
+        if (!normalized.ok)
+            return fail('INVALID_ARGUMENT', normalized.error);
+        thread = normalized.threadId;
+    }
     const before = time('--before');
     const after = time('--after');
     if (before !== undefined && after !== undefined && after >= before)
@@ -81,7 +91,7 @@ export function parseGroupHistoryArgs(argv) {
         }
     }
     return {
-        from, groupId, thread: values.get('--thread'),
+        from, groupId, thread,
         limit, direction, before, beforeId: values.get('--before-id'),
         after, afterId: values.get('--after-id'), message: values.get('--message'), offset,
     };
@@ -170,7 +180,12 @@ function* records(file, args) {
     }
 }
 function matchThread(entry, thread) {
-    return thread === 'all' || (thread === 'main' ? !entry.threadId : entry.threadId === thread);
+    if (thread === 'all')
+        return true;
+    // 消息日志里主话题有 '' / null / 规范 id 三种历史形态，与 ec msg history 同样归一。
+    if (isMainSessionThreadId(thread))
+        return isMainSessionThreadId(entry.threadId);
+    return entry.threadId === thread;
 }
 function utf8Prefix(content, bytes) {
     const buffer = Buffer.from(content);

package/dist/aun/group/operations.js

@@ -15,6 +15,7 @@ import { resolvePaths } from '../../paths.js';
 import { readDelegationCredential } from '../../core/auth/agent-delegation.js';
 import { normalizeAunMentionEntries, withAunAttention } from '../msg/mention-schema.js';
 import { downloadGroupFsBytes } from './fs-download.js';
+import { isTopicThreadId } from '../../core/thread/topic-id.js';
 import { normalizeGroupAid, sameGroupAid } from './identity.js';
 /** Map a group directory probe failure to a stable Menu protocol code. */
 export function groupDirectoryErrorCode(rawCode, error) {
@@ -53,10 +54,15 @@ function groupThreadId(args, payload, runtimeContext) {
         : undefined;
     return payloadThread || args.thread || (isCurrentGroupRuntime(args, runtimeContext) ? runtimeContext?.threadId : undefined);
 }
-function applyGroupRoutingPayloadFields(payload, args, runtimeContext) {
+/** 把群发送的话题路由写进线上 payload。导出供单测固定"主话题 id 不上线"的契约。 */
+export function applyGroupRoutingPayloadFields(payload, args, runtimeContext) {
     const threadId = groupThreadId(args, payload, runtimeContext);
-    if (threadId)
+    // 主话题的规范 id（`main:<a>:<b>`）是本端身份，不进线上报文：群里的主话题
+    // 线上形态就是"不带 thread_id"。`args.thread` 已是规范 id 时同样拦掉。
+    if (isTopicThreadId(threadId))
         payload.thread_id = threadId;
+    else if (payload.thread_id !== undefined)
+        delete payload.thread_id;
 }
 function groupSendLogMetadata(args, payload, runtimeContext) {
     const classified = payload ? classifyAunPayloadForLog(payload) : undefined;

package/dist/aun/menu/client.js

@@ -7,7 +7,7 @@ import { SLOT } from '../aid/store.js';
 import { isValidAid } from '../aid/validation.js';
 import { resolveRoot } from '../../paths.js';
 import { readInstalledEvolcoreVersion } from '../../utils/evolcore-version.js';
-import { buildMenuClientProtectedHeaders, parseMenuResponse, validateMenuRequest, } from '../../core/command/menu-protocol.js';
+import { buildMenuClientProtectedHeaders, parseMenuEvent, parseMenuResponse, validateMenuRequest, } from '../../core/command/menu-protocol.js';
 const DEFAULT_TIMEOUT_MS = 15_000;
 const MAX_TIMEOUT_MS = 120_000;
 const POLL_INTERVAL_MS = 200;
@@ -27,11 +27,30 @@ export class MenuClientError extends Error {
 export class ManagedMenuClient {
     send;
     pending = new Map();
+    eventHandlers = new Map();
     constructor(send) {
         this.send = send;
     }
     accept(fromAid, payload, encrypted) {
-        if (!payload || typeof payload !== 'object' || payload.type !== 'menu.response')
+        if (!payload || typeof payload !== 'object')
+            return false;
+        if (payload.type === 'menu.event') {
+            if (!encrypted)
+                return true;
+            try {
+                const event = parseMenuEvent(payload);
+                const key = this.key(fromAid, event.requestId);
+                const entry = this.eventHandlers.get(key);
+                entry?.handler(event);
+                if (event.event === 'upgrade.result' && entry) {
+                    clearTimeout(entry.timer);
+                    this.eventHandlers.delete(key);
+                }
+            }
+            catch { }
+            return true;
+        }
+        if (payload.type !== 'menu.response')
             return false;
         if (!encrypted)
             return true;
@@ -46,6 +65,9 @@ export class ManagedMenuClient {
         for (const pending of this.pending.values())
             pending.reject(new MenuClientError('AUN_DISCONNECTED', 'AUN channel disconnected'));
         this.pending.clear();
+        for (const entry of this.eventHandlers.values())
+            clearTimeout(entry.timer);
+        this.eventHandlers.clear();
     }
     async request(options) {
         if (!isValidAid(options.fromAid) || !isValidAid(options.targetAid))
@@ -63,6 +85,14 @@ export class ManagedMenuClient {
         if (this.pending.has(key))
             throw new MenuClientError('CLIENT_BUSY', 'Request ID is already in flight for this daemon');
         const headers = buildMenuClientProtectedHeaders({ clientName: 'ec-menu-client', clientVersion: readInstalledEvolcoreVersion(), remoteAccessToken: options.remoteAccessToken ?? options.ecwebToken });
+        if (options.onEvent && request.type === 'menu.action' && request.action === 'upgrade' && request.args?.mode === 'update') {
+            const existing = this.eventHandlers.get(key);
+            if (existing)
+                clearTimeout(existing.timer);
+            const timer = setTimeout(() => this.eventHandlers.delete(key), 6 * 60_000);
+            timer.unref?.();
+            this.eventHandlers.set(key, { handler: options.onEvent, timer });
+        }
         const attempts = request.type === 'menu.query' || request.type === 'menu.options' ? 2 : 1;
         let timer;
         try {
@@ -82,6 +112,13 @@ export class ManagedMenuClient {
                 });
                 try {
                     const [, value] = await Promise.all([sent, response]);
+                    if (value.error || !(value.data && typeof value.data === 'object' && typeof value.data.jobId === 'string')) {
+                        const handler = this.eventHandlers.get(key);
+                        if (handler) {
+                            clearTimeout(handler.timer);
+                            this.eventHandlers.delete(key);
+                        }
+                    }
                     return value;
                 }
                 catch (error) {

package/dist/aun/menu/transport.js

@@ -30,7 +30,7 @@ export function menuTransportParams(method, params) {
     if (method !== 'message.send' || typeof params.payload?.type !== 'string'
         || !params.payload.type.startsWith('menu.'))
         return params;
-    if (params.payload.type !== 'menu.response')
+    if (params.payload.type !== 'menu.response' && params.payload.type !== 'menu.event')
         return { ...params, ttl: MENU_MESSAGE_TTL_SECONDS };
     const { to_device_id: target, menu_client_sdk_version: sdkVersion, menu_client_volatile_v1: capability, ...rest } = params;
     delete rest.device_id;

package/dist/aun/msg/history.js

@@ -4,6 +4,7 @@ import { isTransientProtocolMessage, messageLogPath } from '../../core/message/m
 import { chatDirPath, readAllJsonlLines, readJsonFile, readLastJsonlLine, scanChatDirs, scanMetaFiles } from '../../core/session/session-fs-store.js';
 import { tryParseChannelKey } from '../../core/channel-loader.js';
 import { resolvePaths } from '../../paths.js';
+import { isMainSessionThreadId } from '../../core/thread/topic-id.js';
 const DEFAULT_LIMIT = 50;
 export const MAX_MSG_HISTORY_LIMIT = 500;
 const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/;
@@ -52,7 +53,16 @@ function msgHistoryByLegacyRoute(args, options) {
         return error('INVALID_CHANNEL_NAME', '无效 channel 实例名');
     }
     const chatDir = chatDirPath(options.sessionsDir, channel, target, args.from, channel === 'aun' && !args.channelName ? undefined : `${channel}#${args.from}#${args.channelName ?? 'main'}`);
-    const resolvedSession = resolveLegacySessionFilter(chatDir, args.from, target, channel, args.session ?? 'latest');
+    // --thread <话题id> 且未显式指定 --session 时，从 _threads/ 反查对应 sessionId，
+    // 避免默认 'latest' 锁定主会话导致话题消息被 sessionId 白名单全部过滤掉。
+    let sessionArg = args.session ?? 'latest';
+    if (args.threadId !== undefined && !isMainSessionThreadId(args.threadId) && args.session === undefined) {
+        const found = findSessionIdByThreadId(chatDir, args.threadId);
+        if (!found)
+            return error('SESSION_NOT_FOUND', `找不到话题 ${args.threadId} 对应的会话（话题必须存在于本端索引）`);
+        sessionArg = found;
+    }
+    const resolvedSession = resolveLegacySessionFilter(chatDir, args.from, target, channel, sessionArg);
     if (!resolvedSession.ok)
         return resolvedSession;
     return readHistoryScopes({
@@ -165,13 +175,28 @@ function readHistoryScopes(input) {
     catch (cause) {
         return error('HISTORY_READ_FAILED', cause instanceof Error ? cause.message : String(cause));
     }
+    // 主话题请求不受会话筛选影响（跨会话总线语义）
+    const filteringMainTopic = input.args.threadId !== undefined && isMainSessionThreadId(input.args.threadId);
     const messages = entries
         .filter(({ entry }) => isMessageLogEntry(entry))
         .filter(({ entry }) => !isTransientProtocolMessage(entry))
-        .filter(({ entry, sessionIds }) => sessionIds === undefined
-        || (typeof entry.sessionId === 'string' && sessionIds.has(entry.sessionId)))
+        // 会话筛选：主话题自动放行，其他按 sessionIds 白名单过滤
+        .filter(({ entry, sessionIds }) => {
+        if (filteringMainTopic && isMainSessionThreadId(entry.threadId))
+            return true;
+        return sessionIds === undefined || (typeof entry.sessionId === 'string' && sessionIds.has(entry.sessionId));
+    })
         .filter(({ entry }) => input.direction === 'all' || entry.dir === input.direction)
-        .filter(({ entry }) => input.args.threadId === undefined || entry.threadId === input.args.threadId)
+        // 话题过滤：主话题历史行可能是空值/`main` 或现行规范 id，三者都算同一条主线。
+        .filter(({ entry }) => {
+        const want = input.args.threadId;
+        if (want === undefined)
+            return true;
+        const actual = entry.threadId;
+        if (isMainSessionThreadId(want))
+            return isMainSessionThreadId(actual);
+        return actual === want;
+    })
         .filter(({ entry }) => input.args.after === undefined || entry.ts > input.args.after)
         .filter(({ entry }) => input.args.before === undefined || entry.ts < input.args.before)
         .sort((left, right) => left.entry.ts - right.entry.ts || left.scope - right.scope)
@@ -251,6 +276,20 @@ function nonAunSessionBelongsToPeer(session, selfAid, channelKey, channelType, p
         return false;
     return session.metadata?.peerId === peerId;
 }
+/**
+ * 从 `_threads/` 扫描，找出 threadId 字段等于指定话题 id 的 session，返回其 sessionId。
+ * 用于 `--thread <话题id>` 未指定 `--session` 时自动定位对应会话，避免回落到主会话。
+ */
+function findSessionIdByThreadId(chatDir, threadId) {
+    for (const entry of scanMetaFiles(path.join(chatDir, '_threads'))) {
+        if (entry.includes('.fork-history'))
+            continue;
+        const session = readLastJsonlLine(path.join(chatDir, '_threads', entry));
+        if (session?.id && session.threadId === threadId)
+            return session.id;
+    }
+    return undefined;
+}
 /**
  * `active.json` is only a cache. Session JSONL files are the authoritative
  * history index, including archived and topic sessions, so selector reads

package/dist/aun/msg/managed-operation.js

@@ -7,7 +7,9 @@ import { resolveRoot } from '../../paths.js';
 import { normalizeGroupAid } from '../group/identity.js';
 import { isValidAid } from '../aid/validation.js';
 import { tryParseChannelKey } from '../../core/channel-loader.js';
-import { downloadGroupFsBytes } from '../group/fs-download.js';
+import { normalizeThreadOptionValue } from '../../core/thread/topic-id.js';
+import { parseTimeArg, TIME_ARG_FORMATS } from '../../cli/cli-argv.js';
+import { DEFAULT_FS_CAT_BYTES, MAX_FS_CAT_BYTES, FsReadBudgetError, downloadGroupFsBytes, readPersonalFsBytesWithinBudget, } from '../group/fs-download.js';
 import { groupBan, groupBanlist, groupBlock, groupUnblock, groupBlocklist, groupReportStatus, groupMemberStatuses, groupCreate, groupDissolve, groupInfo, groupInvite, groupJoin, groupKick, groupLeave, groupList, groupMembers, groupOnline, groupPull, groupAck, groupAcceptInvite, groupInvites, groupRejectInvite, groupRevokeInvite, groupResume, groupRules, groupRulesFileGet, groupRulesFilePublish, groupRulesFileSet, groupSetRole, groupSuspend, groupTransferOwner, groupUnban, groupUpdate, groupUpdateRules, } from '../group/operations.js';
 import { handleGroupMenu, GroupMenuError } from '../../core/command/group-menu.js';
 import { readRolesConfig } from '../../config/roles.js';
@@ -604,17 +606,6 @@ const HISTORY_VALUE_FLAGS = new Set([
 function failMsg(code, reason) {
     return { ok: false, code, reason };
 }
-function parseTime(value) {
-    const trimmed = value.trim();
-    if (!trimmed)
-        return undefined;
-    if (/^-?\d+$/.test(trimmed)) {
-        const timestamp = Number(trimmed);
-        return Number.isSafeInteger(timestamp) ? timestamp : undefined;
-    }
-    const timestamp = Date.parse(trimmed);
-    return Number.isFinite(timestamp) ? timestamp : undefined;
-}
 /** Parse the daemon-owned msg read grammar. AUN keeps positional peer AIDs;
  * non-AUN history is selected by its canonical channel key and native peer ID. */
 export function resolveManagedMsgOperation(argv) {
@@ -713,22 +704,28 @@ export function resolveManagedMsgOperation(argv) {
     }
     const beforeRaw = values.get('--before');
     const afterRaw = values.get('--after');
-    const before = beforeRaw === undefined ? undefined : parseTime(beforeRaw);
-    const after = afterRaw === undefined ? undefined : parseTime(afterRaw);
+    const before = beforeRaw === undefined ? undefined : parseTimeArg(beforeRaw);
+    const after = afterRaw === undefined ? undefined : parseTimeArg(afterRaw);
     if (beforeRaw !== undefined && before === undefined)
-        return failMsg('INVALID_ARGUMENT', 'invalid --before time');
+        return failMsg('INVALID_ARGUMENT', `invalid --before time（支持 ${TIME_ARG_FORMATS}）`);
     if (afterRaw !== undefined && after === undefined)
-        return failMsg('INVALID_ARGUMENT', 'invalid --after time');
+        return failMsg('INVALID_ARGUMENT', `invalid --after time（支持 ${TIME_ARG_FORMATS}）`);
     if (before !== undefined && after !== undefined && after >= before) {
         return failMsg('INVALID_ARGUMENT', '--after must be earlier than --before');
     }
     const target = channelKey === undefined ? String(positionals[0] || '').replace(/^@/, '') : undefined;
-    const threadId = values.get('--thread');
-    if (threadId !== undefined) {
+    const threadRaw = values.get('--thread');
+    let threadId;
+    if (threadRaw !== undefined) {
         if (kind !== 'history')
             return failMsg('INVALID_ARGUMENT', '--thread is only supported for history');
         if (channelKey !== undefined)
             return failMsg('INVALID_ARGUMENT', '--thread cannot be combined with --channel-key/--peer-id');
+        // 接受 `ec thread list` 打印的 `<peer>/<id>`；前缀必须就是本次查询的对端
+        const normalized = normalizeThreadOptionValue(threadRaw, peer => peer === target);
+        if (!normalized.ok)
+            return failMsg('INVALID_ARGUMENT', normalized.error);
+        threadId = normalized.threadId;
         if (!/^thread-[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(threadId))
             return failMsg('INVALID_ARGUMENT', 'invalid --thread id');
     }
@@ -747,8 +744,9 @@ export function resolveManagedMsgOperation(argv) {
         canonicalArgv.push('--after', values.get('--after'));
     if (values.has('--direction'))
         canonicalArgv.push('--direction', values.get('--direction'));
-    if (threadId !== undefined)
-        canonicalArgv.push('--thread', threadId);
+    // canonicalArgv 进审计 hash，保留调用方原文；归一后的 id 只用于执行
+    if (threadRaw !== undefined)
+        canonicalArgv.push('--thread', threadRaw);
     return {
         ok: true,
         command: {
@@ -793,7 +791,6 @@ export async function executeManagedMsgOperation(command) {
     }
     return result;
 }
-export const MAX_MANAGED_FS_CAT_BYTES = 256 * 1024;
 const MAX_MANAGED_FS_HEAD_BYTES = 4096;
 const MAX_REMOTE_PATH_LENGTH = 2048;
 export class ManagedFsOperationError extends Error {
@@ -816,8 +813,10 @@ function positiveInteger(value, flag, max) {
     if (value === undefined)
         return undefined;
     const number = Number(value);
-    if (!Number.isInteger(number) || number < 1 || number > max) {
-        return failFs('INVALID_ARGUMENT', `${flag} must be an integer from 1 to ${max}`);
+    if (!Number.isSafeInteger(number) || number < 1 || (max !== undefined && number > max)) {
+        return failFs('INVALID_ARGUMENT', max === undefined
+            ? `${flag} must be a positive safe integer`
+            : `${flag} must be an integer from 1 to ${max}`);
     }
     return number;
 }
@@ -846,7 +845,7 @@ function parseRemote(value, allowEmpty) {
     }
     return { targetAid, remotePath };
 }
-/** Parse the daemon-owned managed filesystem grammar for group or self storage. */
+/** Parse the daemon-owned managed filesystem grammar; the daemon resolves the permitted target backend. */
 export function resolveManagedFsOperation(argv) {
     const raw = argv[0] === 'fs' ? argv.slice(1) : argv;
     const rawKind = raw[0];
@@ -1000,7 +999,7 @@ export function resolveManagedFsOperation(argv) {
                 actorAid, targetAid: remote.targetAid, remotePath: remote.remotePath, recursive, overwrite,
             } };
     const effectiveKind = rawKind === 'stat' && !follow ? 'lstat' : rawKind;
-    const maxBytes = positiveInteger(values.get('--max-bytes'), '--max-bytes', MAX_MANAGED_FS_CAT_BYTES);
+    const maxBytes = positiveInteger(values.get('--max-bytes'), '--max-bytes', MAX_FS_CAT_BYTES);
     if (typeof maxBytes !== 'number' && maxBytes !== undefined)
         return maxBytes;
     const headBytes = positiveInteger(values.get('--head-bytes'), '--head-bytes', MAX_MANAGED_FS_HEAD_BYTES);
@@ -1041,14 +1040,6 @@ function parseManagedGroupAclSpec(value, requirePerms) {
     }
     return { grantee, perms };
 }
-function numberFrom(value, keys) {
-    for (const key of keys) {
-        const number = Number(value?.[key]);
-        if (Number.isFinite(number))
-            return number;
-    }
-    return undefined;
-}
 async function withClient(actorAid, fn) {
     const store = await getAidStore({ slotId: SLOT.cli, aunPath: resolveRoot() });
     let client;
@@ -1140,16 +1131,7 @@ export async function executeManagedFsOperationWithClient(command, client) {
                     case 'setfacl':
                         throw new ManagedFsOperationError('NOT_ALLOWED', 'Managed personal storage ACL changes are not supported');
                     case 'cat': {
-                        const node = await client.storage.stat(command.remotePath, { owner });
-                        const size = numberFrom(node, ['size', 'sizeBytes', 'size_bytes']);
-                        const maxBytes = Math.min(command.maxBytes ?? MAX_MANAGED_FS_CAT_BYTES, MAX_MANAGED_FS_CAT_BYTES);
-                        if (size === undefined)
-                            throw new ManagedFsOperationError('FS_SIZE_REQUIRED', 'personal file size is required before managed cat');
-                        if (size > maxBytes)
-                            throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
-                        const bytes = await client.storage.readBytes(command.remotePath, { owner });
-                        if (bytes.byteLength > maxBytes)
-                            throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
+                        const bytes = await readPersonalFsBytesWithinBudget(client, command.remotePath, command.maxBytes ?? DEFAULT_FS_CAT_BYTES, { owner });
                         const headBytes = Math.min(command.headBytes ?? 256, MAX_MANAGED_FS_HEAD_BYTES, bytes.byteLength);
                         if (bytes.subarray(0, Math.min(bytes.byteLength, 8192)).some(byte => byte === 0)) {
                             return {
@@ -1235,16 +1217,9 @@ export async function executeManagedFsOperationWithClient(command, client) {
                     return { ok: true, command: 'setfacl', path: ref, grantee: command.aclGrantee, removed: !!command.aclRemove, result };
                 }
                 case 'cat': {
-                    const node = await client.group.fs.stat(ref);
-                    const size = numberFrom(node, ['size', 'size_bytes', 'bytes']);
-                    const maxBytes = Math.min(command.maxBytes ?? MAX_MANAGED_FS_CAT_BYTES, MAX_MANAGED_FS_CAT_BYTES);
-                    if (size === undefined)
-                        throw new ManagedFsOperationError('FS_SIZE_REQUIRED', 'group file size is required before managed cat');
-                    if (size > maxBytes)
-                        throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
-                    const { bytes } = await downloadGroupFsBytes(client, ref);
-                    if (bytes.byteLength > maxBytes)
-                        throw new ManagedFsOperationError('FS_CAT_TOO_LARGE', `managed cat is limited to ${maxBytes} bytes`);
+                    const { bytes } = await downloadGroupFsBytes(client, ref, {
+                        maxBytes: command.maxBytes ?? DEFAULT_FS_CAT_BYTES,
+                    });
                     const headBytes = Math.min(command.headBytes ?? 256, MAX_MANAGED_FS_HEAD_BYTES, bytes.byteLength);
                     if (bytes.subarray(0, Math.min(bytes.byteLength, 8192)).some(byte => byte === 0)) {
                         return {
@@ -1271,6 +1246,8 @@ export async function executeManagedFsOperationWithClient(command, client) {
     catch (error) {
         if (error instanceof ManagedFsOperationError)
             throw error;
+        if (error instanceof FsReadBudgetError)
+            throw new ManagedFsOperationError(error.code, error.message);
         throw new ManagedFsOperationError('FS_OPERATION_FAILED', error instanceof Error ? error.message : String(error));
     }
 }