@downcity/agent 1.1.7 → 1.1.8

package/src/host/sdk/Agent.ts

@@ -16,6 +16,7 @@ import type { AgentContext } from "@/agent/AgentContextTypes.js";
 import type { AgentRuntime } from "@/agent/AgentRuntimeTypes.js";
 import type { DowncityConfig } from "@/shared/types/DowncityConfig.js";
 import type { JsonValue } from "@/shared/types/Json.js";
+import type { AgentPlatformRuntime } from "@/shared/types/AgentHost.js";
 import type {
   Plugin,
   PluginAvailability,
@@ -43,6 +44,25 @@ import { HookRegistry } from "@/plugin/HookRegistry.js";
 import { PluginRegistry } from "@/plugin/PluginRegistry.js";
 import { isPluginEnabled } from "@/plugin/Activation.js";
 
+const EMPTY_SDK_PLATFORM: AgentPlatformRuntime = {
+  getGlobalEnv: () => ({}),
+  getAgentEnv: () => ({}),
+  listModels: () => [],
+  listProviders: async () => [],
+  getModel: () => null,
+  getChannelAccount: () => null,
+  readChatAuthorizationConfig: () => ({
+    roles: {},
+    channels: {},
+  }),
+  writeChatAuthorizationConfig: async (_projectRoot, nextConfig) => nextConfig,
+  setChatAuthorizationUserRole: async () => ({
+    roles: {},
+    channels: {},
+  }),
+  isPluginEnabled: (pluginName) => pluginName === "auth",
+};
+
 function createFallbackSdkConfig(agentId: string): DowncityConfig {
   return {
     name: agentId,
@@ -69,6 +89,7 @@ export class Agent {
   private readonly pluginRegistry: PluginRegistry;
   private readonly pluginSystemProviders: Plugin[];
   private readonly config: DowncityConfig;
+  private readonly platform: AgentPlatformRuntime;
   private systems: string[];
   private servicesStartPromise: Promise<void> | null = null;
 
@@ -87,6 +108,7 @@ export class Agent {
 
     this.logger = new Logger();
     this.logger.bindProjectRoot(this.path);
+    this.platform = options.platform || EMPTY_SDK_PLATFORM;
     this.systems = loadStaticSystemPrompts(this.path);
     this.config = this.loadConfig();
     this.services = this.createServiceMap(options.services || []);
@@ -193,7 +215,7 @@ export class Agent {
       contextResolver: () => this.serviceContext,
       pluginEnabledChecker: (pluginName) => {
         const plugin = pluginRegistryRef?.get(pluginName);
-        return plugin ? isPluginEnabled({ plugin }) : false;
+        return plugin ? isPluginEnabled({ plugin, context: this.serviceContext }) : false;
       },
     });
     const registry = new PluginRegistry({
@@ -235,7 +257,7 @@ export class Agent {
     for (const plugin of this.pluginSystemProviders) {
       if (typeof plugin.system !== "function") continue;
       try {
-        if (!isPluginEnabled({ plugin })) continue;
+        if (!isPluginEnabled({ plugin, context: this.serviceContext })) continue;
         if (typeof plugin.availability === "function") {
           const availability = await plugin.availability(this.serviceContext);
           if (!availability.available) continue;
@@ -276,6 +298,7 @@ export class Agent {
       systems: this.systems,
       paths: createAgentPathRuntime(this.path),
       pluginConfig: createAgentPluginConfigRuntime(this.path),
+      platform: this.platform,
       model: undefined,
       getSession: (sessionId: string) => {
         return this.getOrCreateSession(sessionId).getServicePort() as never;
@@ -306,6 +329,7 @@ export class Agent {
       systems: this.systems,
       paths: this.runtime.paths,
       pluginConfig: this.runtime.pluginConfig,
+      platform: this.platform,
       session: {
         get: (sessionId) => this.getOrCreateSession(sessionId).getServicePort(),
         listExecutingSessionIds: () => this.runtime.listExecutingSessionIds(),

package/src/host/sdk/AgentSdkTypes.ts

@@ -12,6 +12,7 @@ import type { BaseService } from "@/service/builtins/BaseService.js";
 import type { JsonValue } from "@/shared/types/Json.js";
 import type { Plugin } from "@/shared/types/Plugin.js";
 import type { SessionMessageV1 } from "@/types/session/SessionMessages.js";
+import type { AgentPlatformRuntime } from "@/shared/types/AgentHost.js";
 
 /**
  * 本地 Agent 构造参数。
@@ -59,6 +60,15 @@ export interface AgentOptions {
    * - 同名 plugin 会直接报错，避免 action / hook / resolve 行为被静默覆盖。
    */
   plugins?: Plugin[];
+
+  /**
+   * 当前 agent 显式注入的平台能力集合。
+   *
+   * 关键点（中文）
+   * - SDK 侧若不提供，则使用最小空实现。
+   * - 推荐由宿主产品显式传入，避免 SDK 本地实例隐式依赖 city。
+   */
+  platform?: AgentPlatformRuntime;
 }
 
 /**

package/src/http/Server.ts

@@ -21,12 +21,6 @@ import {
 import { pluginsRouter } from "@/http/plugins/plugins.js";
 import { staticRouter } from "@/http/static/static.js";
 import { controlRouter } from "@/http/control/ControlRouter.js";
-import { registerAuthRoutes } from "@/http/auth/AuthRoutes.js";
-import { AuthService } from "@/http/auth/AuthService.js";
-import {
-  createRouteAuthGuardMiddleware,
-  SERVER_AUTH_ROUTE_POLICIES,
-} from "@/http/auth/RoutePolicy.js";
 import {
   listBuiltinPluginRuntimeAuthPolicies,
   registerBuiltinPluginHttpRoutes,
@@ -60,11 +54,6 @@ export interface ServerInstance {
  */
 export function createServerApp(): Hono {
   const app = new Hono();
-  const authService = new AuthService();
-  const authPolicies = [
-    ...SERVER_AUTH_ROUTE_POLICIES,
-    ...listBuiltinPluginRuntimeAuthPolicies(),
-  ];
 
   app.use("*", logger());
   app.use(
@@ -75,7 +64,6 @@ export function createServerApp(): Hono {
       allowHeaders: ["Content-Type", "Authorization"],
     }),
   );
-  app.use("*", createRouteAuthGuardMiddleware(authService, authPolicies));
 
   // 关键点（中文）：service action 路由在 runtime ready 后再注册，避免命令级 import 副作用。
   ensureServiceActionRoutesRegistered();
@@ -91,7 +79,6 @@ export function createServerApp(): Hono {
     app,
     getContext: getAgentContext,
   });
-  registerAuthRoutes({ app, authService });
 
   return app;
 }

package/src/http/auth/AuthEnv.ts

@@ -28,11 +28,6 @@ export function normalizeBearerToken(value: unknown): string | null {
 
 /**
  * 解析本次调用应使用的 token。
- *
- * 优先级（中文）
- * 1. 显式传入 token
- * 2. 用户显式覆盖环境变量 `DC_AUTH_TOKEN`
- * 3. 调用方传入的本地存储 token
  */
 export function resolveInvocationToken(params: {
   explicitToken?: string;
@@ -52,10 +47,6 @@ export function resolveInvocationToken(params: {
 
 /**
  * 从通用子进程环境中剥离 Bearer Token。
- *
- * 关键点（中文）
- * - shell / task script / ACP 等通用执行面不应默认继承任何 HTTP 鉴权信息。
- * - 这样可以强制这些链路优先走 RPC，而不是通过环境变量隐式改走本地 HTTP。
  */
 export function stripInvocationAuthEnv(targetEnv: NodeJS.ProcessEnv): void {
   delete targetEnv[CLI_AUTH_TOKEN_ENV_KEY];

package/src/http/auth/CliAuthStateStore.ts

@@ -24,10 +24,6 @@ export interface CliAuthStateStoreOptions {
 
 /**
  * 解析当前 CLI 应使用的 Bearer Token。
- *
- * 优先级（中文）
- * 1. 显式传入 token
- * 2. 环境变量 `DC_AUTH_TOKEN`
  */
 export function resolveCliAuthToken(params: {
   explicitToken?: string;

package/src/http/control/ModelRoutes.ts

@@ -8,7 +8,6 @@
 
 import fs from "fs-extra";
 import { getDowncityJsonPath } from "@/config/Paths.js";
-import { PlatformStore } from "@shared/utils/store/index.js";
 import type { ControlRouteRegistrationParams } from "@/shared/types/ControlRoutes.js";
 import { buildControlRouteAliases } from "@/http/control/CommonHelpers.js";
 
@@ -25,9 +24,8 @@ export function registerControlModelRoutes(
       try {
         const agentState = params.getAgentRuntime();
         const agentPrimaryModelId = String(agentState.config.execution?.type === "api" ? agentState.config.execution.modelId || "" : "").trim();
-        const store = new PlatformStore();
-        const models = store.listModels();
-        const providers = await store.listProviders();
+        const models = agentState.platform.listModels();
+        const providers = await agentState.platform.listProviders();
         const providerMap = new Map(providers.map((x) => [x.id, x] as const));
         const activeModel = agentPrimaryModelId
           ? models.find((x) => x.id === agentPrimaryModelId)
@@ -43,8 +41,6 @@ export function registerControlModelRoutes(
             providerType: String(providerConfig?.type || "").trim(),
           };
         });
-        store.close();
-
         return c.json({
           success: true,
           model: {
@@ -74,9 +70,7 @@ export function registerControlModelRoutes(
         if (!nextPrimaryModelId) {
           return c.json({ success: false, error: "Missing primaryModelId" }, 400);
         }
-        const store = new PlatformStore();
-        const targetModel = store.getModel(nextPrimaryModelId);
-        store.close();
+        const targetModel = agentState.platform.getModel(nextPrimaryModelId);
         if (!targetModel) {
           return c.json(
             { success: false, error: `Model not found: ${nextPrimaryModelId}` },

package/src/index.ts

@@ -108,9 +108,8 @@ export {
   startServiceScheduleRuntime,
   stopServiceScheduleRuntime,
 } from './service/schedule/Runtime.js';
-export { runDueScheduledJobs } from "./service/schedule/Executor.js";
 export { ServiceScheduleStore } from "./service/schedule/Store.js";
-export { scheduledJobsTable } from "./service/schedule/Schema.js";
+export { runDueScheduledJobs } from "./service/schedule/Executor.js";
 export {
   normalizeRunAtMsOrThrow,
   parseScheduledRunAtMsOrThrow,
@@ -121,15 +120,6 @@ export {
   resolveAssistantMessageForPersistence,
 } from "./service/builtins/chat/runtime/UserVisibleText.js";
 export { logger, getLogger, type Logger } from "./shared/utils/logger/Logger.js";
-export { PlatformStore, withPlatformStore } from "./shared/utils/store/index.js";
-export { ensurePlatformStoreSchema } from "./shared/utils/store/StoreSchema.js";
-export {
-  nowIso,
-  normalizeNonEmptyText,
-  optionalTrimmedText,
-  type PlatformDrizzleDb,
-  type PlatformStoreContext,
-} from "./shared/utils/store/StoreShared.js";
 
 // 共享协议类型与控制面常量
 export * from "./shared/types/AgentHost.js";
@@ -157,6 +147,7 @@ export * from "./shared/types/ServiceSchedule.js";
 export * from "./shared/types/Services.js";
 export * from "./shared/types/Start.js";
 export * from "./shared/types/Store.js";
+export * from "./shared/types/PluginLifecycle.js";
 export * from "./shared/types/auth/AuthPermission.js";
 export * from "./shared/types/auth/AuthRoute.js";
 export * from "./shared/types/auth/AuthToken.js";
@@ -209,7 +200,6 @@ export {
   listStaticPluginViews,
   toStaticPluginView,
 } from "./plugin/Catalog.js";
-export { setCityPluginEnabled, isCityPluginEnabled } from "./plugin/Lifecycle.js";
 export { runLocalPluginAction, listLocalPlugins, getLocalPluginAvailability } from "./plugin/LocalExecution.js";
 export { registerAllPluginsForCli } from "./plugin/PluginCommand.js";
 export { listBuiltinPluginRuntimeAuthPolicies } from "./plugin/HttpRoutes.js";

package/src/model/CreateModel.ts

@@ -21,8 +21,8 @@ import { createLlmLoggingFetch } from "@shared/utils/logger/Fetch.js";
 import { getLogger } from "@shared/utils/logger/Logger.js";
 import type { DowncityConfig } from "@/shared/types/DowncityConfig.js";
 import type { LlmProviderType } from "@/shared/types/LlmConfig.js";
-import { PlatformStore } from "@shared/utils/store/index.js";
 import { readProjectExecutionBinding } from "@/agent/project/ProjectExecutionBinding.js";
+import type { AgentPlatformRuntime } from "@/shared/types/AgentHost.js";
 
 type ModelLogContext = {
   sessionId?: string;
@@ -149,7 +149,7 @@ function normalizeProviderType(value: unknown): LlmProviderType | null {
 export async function createModel(input: {
   config: DowncityConfig;
   getSessionRunScope?: () => ModelLogContext | undefined;
-  store?: PlatformStore;
+  platform?: AgentPlatformRuntime;
   projectRoot?: string;
 }): Promise<LanguageModel> {
   const logger = getLogger();
@@ -174,21 +174,23 @@ export async function createModel(input: {
 
   const primaryModelId = execution.modelId;
 
-  const store = input.store || new PlatformStore();
-  const resolved = await store.getResolvedModel(primaryModelId);
-  if (!input.store) {
-    store.close();
+  const platform = input.platform;
+  const modelConfig = platform?.getModel(primaryModelId) || null;
+  const providerConfigs = await (platform?.listProviders?.() || Promise.resolve([]));
+  const providerMap = new Map(providerConfigs.map((item) => [item.id, item] as const));
+  const providerConfig = modelConfig
+    ? providerMap.get(String(modelConfig.providerId || "").trim()) || null
+    : null;
+  if (!modelConfig || !providerConfig) {
+    await logger.log("warn", `LLM model config not found in platform runtime: ${primaryModelId}`);
+    throw Error(`LLM model config not found in platform runtime: ${primaryModelId}`);
   }
-  if (!resolved) {
-    await logger.log("warn", `LLM model config not found in sqlite store: ${primaryModelId}`);
-    throw Error(`LLM model config not found in sqlite store: ${primaryModelId}`);
-  }
-  const selectedModelConfig = resolved.model;
-  const selectedProviderConfig = resolved.provider;
+  const selectedModelConfig = modelConfig;
+  const selectedProviderConfig = providerConfig;
   if (selectedModelConfig.isPaused === true) {
     await logger.log(
       "warn",
-      `LLM model is paused in sqlite store: ${primaryModelId}`,
+      `LLM model is paused in platform runtime: ${primaryModelId}`,
     );
     throw Error(`LLM model is paused: ${primaryModelId}`);
   }

package/src/plugin/Activation.ts

@@ -7,16 +7,20 @@
  */
 
 import type { Plugin } from "@/shared/types/Plugin.js";
-import { isCityPluginEnabled } from "@/plugin/Lifecycle.js";
+import type { AgentContext } from "@/agent/AgentContextTypes.js";
+import type { AgentRuntimeBase } from "@/agent/AgentRuntimeTypes.js";
 
 /**
  * 读取当前 city 配置下的 plugin 启用态。
  */
 export function isPluginEnabled(params: {
   plugin: Plugin;
+  context?: Pick<AgentContext, "platform">;
+  runtime?: Pick<AgentRuntimeBase, "platform">;
 }): boolean {
   const pluginName = String(params.plugin.name || "").trim();
   if (!pluginName) return false;
   if (pluginName === "auth") return true;
-  return isCityPluginEnabled(pluginName);
+  const platform = params.context?.platform || params.runtime?.platform;
+  return platform ? platform.isPluginEnabled(pluginName) : true;
 }

package/src/plugin/LocalExecution.ts

@@ -16,6 +16,7 @@ import {
   createAgentPathRuntime,
   createAgentPluginConfigRuntime,
 } from "@/host/runtime/AgentHostRuntime.js";
+import { getAgentRuntimeBase } from "@/agent/AgentRuntimeState.js";
 import type { JsonValue } from "@/shared/types/Json.js";
 import type {
   PluginActionResult,
@@ -38,6 +39,26 @@ export function createLocalPluginCommandContext(projectRoot: string): PluginComm
 
   defaultLogger.bindProjectRoot(rootPath);
 
+  const platform = (() => {
+    try {
+      return getAgentRuntimeBase().platform;
+    } catch {
+      return {
+        getGlobalEnv: () => ({}),
+        getAgentEnv: () => ({}),
+        listModels: () => [],
+        listProviders: async () => [],
+        getModel: () => null,
+        getChannelAccount: () => null,
+        readChatAuthorizationConfig: () => ({ roles: {}, channels: {} }),
+        writeChatAuthorizationConfig: async (_projectRoot: string, nextConfig: unknown) =>
+          nextConfig as never,
+        setChatAuthorizationUserRole: async () => ({ roles: {}, channels: {} }),
+        isPluginEnabled: (pluginName: string) => pluginName === "auth",
+      };
+    }
+  })();
+
   return {
     cwd: rootPath,
     rootPath,
@@ -47,6 +68,7 @@ export function createLocalPluginCommandContext(projectRoot: string): PluginComm
     globalEnv,
     paths: createAgentPathRuntime(rootPath),
     pluginConfig: createAgentPluginConfigRuntime(rootPath),
+    platform,
   };
 }
 
@@ -78,7 +100,7 @@ export async function getLocalPluginAvailability(
     return await plugin.availability(context);
   }
 
-  const enabled = isPluginEnabled({ plugin });
+  const enabled = isPluginEnabled({ plugin, context });
   if (!enabled) {
     return {
       enabled: false,
@@ -131,7 +153,7 @@ export async function runLocalPluginAction(params: {
   }
 
   const context = createLocalPluginCommandContext(params.projectRoot);
-  const enabled = isPluginEnabled({ plugin });
+  const enabled = isPluginEnabled({ plugin, context });
   if (!enabled && action.allowWhenDisabled !== true) {
     return {
       success: false,

package/src/plugin/PluginRegistry.ts

@@ -165,7 +165,7 @@ export class PluginRegistry {
     }
 
     const context = this.contextResolver();
-    const enabled = isPluginEnabled({ plugin });
+    const enabled = isPluginEnabled({ plugin, context });
 
     if (!enabled) {
       return {
@@ -217,7 +217,7 @@ export class PluginRegistry {
     }
 
     const context = this.contextResolver();
-    const enabled = isPluginEnabled({ plugin });
+    const enabled = isPluginEnabled({ plugin, context });
     if (!enabled && action.allowWhenDisabled !== true) {
       return {
         success: false,

package/src/plugins/asr/Plugin.ts

@@ -14,7 +14,6 @@ import type { JsonObject, JsonValue } from "@/shared/types/Json.js";
 import type { AgentPluginConfigRuntime } from "@/shared/types/AgentHost.js";
 import { CHAT_PLUGIN_POINTS } from "@/service/builtins/chat/runtime/PluginPoints.js";
 import { isPluginEnabled } from "@/plugin/Activation.js";
-import { setCityPluginEnabled } from "@/plugin/Lifecycle.js";
 import {
   listVoiceModels,
   resolveVoicePluginModelId,
@@ -228,7 +227,7 @@ export const asrPlugin: Plugin = {
     statusAction: "status",
   },
   async availability(context) {
-    if (!isPluginEnabled({ plugin: asrPlugin })) {
+    if (!isPluginEnabled({ plugin: asrPlugin, context })) {
       return {
         enabled: false,
         available: false,
@@ -432,7 +431,7 @@ export const asrPlugin: Plugin = {
         },
       },
       execute: async ({ context, payload }) => {
-        setCityPluginEnabled("asr", true);
+        context.platform.setPluginEnabled?.("asr", true);
         const nextConfig = {
           ...readVoicePluginConfig(context),
           injectPrompt:
@@ -481,7 +480,7 @@ export const asrPlugin: Plugin = {
         },
       },
       execute: async ({ context }) => {
-        setCityPluginEnabled("asr", false);
+        context.platform.setPluginEnabled?.("asr", false);
         return {
           success: true,
           data: {
@@ -629,7 +628,7 @@ export const asrPlugin: Plugin = {
   },
   system(context) {
     const config = readVoicePluginConfig(context);
-    if (!isPluginEnabled({ plugin: asrPlugin }) || config.injectPrompt !== true) {
+    if (!isPluginEnabled({ plugin: asrPlugin, context }) || config.injectPrompt !== true) {
       return "";
     }
     return [

package/src/plugins/auth/Plugin.ts

@@ -140,6 +140,7 @@ export const authPlugin: Plugin = {
         channel,
         userId: String(input.userId || "").trim(),
         rootPath: context.rootPath,
+        platform: context.platform,
       });
       return ((role || null) as unknown) as JsonValue;
     },

package/src/plugins/auth/runtime/AuthorizationConfig.ts

@@ -2,7 +2,7 @@
  * Auth 授权配置读写工具。
  *
  * 关键点（中文）
- * - 静态授权规则统一写入 console `~/.downcity/downcity.db`。
+ * - 静态授权规则通过宿主注入的平台能力读写。
  * - 授权核心模型为 role / permission / binding。
  */
 
@@ -19,9 +19,7 @@ import {
   CHAT_AUTHORIZATION_PERMISSIONS,
   createDefaultChatAuthorizationRoles,
 } from "@/shared/types/AuthPlugin.js";
-import { PlatformStore } from "@/shared/utils/store/index.js";
 
-const CHAT_AUTHORIZATION_STORE_KEY = "chat_authorization";
 const CHANNELS: ChatAuthorizationChannel[] = [...CHAT_AUTHORIZATION_CHANNELS];
 
 export const DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS: ChatAuthorizationPermission[] = [
@@ -139,40 +137,41 @@ function cloneAuthorizationConfig(
   return normalizeAuthorizationConfig(input ? JSON.parse(JSON.stringify(input)) : {});
 }
 
-function readAuthorizationConfigFromStoreSync(projectRoot: string): ChatAuthorizationConfig {
-  const normalizedProjectRoot = normalizeText(projectRoot);
+function readAuthorizationConfigFromPlatformSync(params: {
+  projectRoot: string;
+  readConfig: (projectRoot: string) => ChatAuthorizationConfig;
+}): ChatAuthorizationConfig {
+  const normalizedProjectRoot = normalizeText(params.projectRoot);
   if (!normalizedProjectRoot) return normalizeAuthorizationConfig({});
-  const store = new PlatformStore();
   try {
-    return normalizeAuthorizationConfig(
-      store.getAgentSecureSettingJsonSync<ChatAuthorizationConfig>(
-        normalizedProjectRoot,
-        CHAT_AUTHORIZATION_STORE_KEY,
-      ) || {},
-    );
+    return normalizeAuthorizationConfig(params.readConfig(normalizedProjectRoot) || {});
   } catch {
     return normalizeAuthorizationConfig({});
-  } finally {
-    store.close();
   }
 }
 
-async function writeAuthorizationConfigToStore(params: {
+function readAuthorizationConfigFromProjectRoot(projectRoot: string): ChatAuthorizationConfig {
+  const normalizedProjectRoot = normalizeText(projectRoot);
+  if (!normalizedProjectRoot) return normalizeAuthorizationConfig({});
+  throw new Error(
+    `Platform authorization runtime is not available for project: ${normalizedProjectRoot}`,
+  );
+}
+
+async function writeAuthorizationConfigToPlatform(params: {
   projectRoot: string;
   nextConfig: ChatAuthorizationConfig;
+  writeConfig: (
+    projectRoot: string,
+    nextConfig: ChatAuthorizationConfig,
+  ) => Promise<ChatAuthorizationConfig>;
 }): Promise<void> {
   const normalizedProjectRoot = normalizeText(params.projectRoot);
   if (!normalizedProjectRoot) throw new Error("projectRoot is required");
-  const store = new PlatformStore();
-  try {
-    await store.setAgentSecureSettingJson(
-      normalizedProjectRoot,
-      CHAT_AUTHORIZATION_STORE_KEY,
-      normalizeAuthorizationConfig(params.nextConfig),
-    );
-  } finally {
-    store.close();
-  }
+  await params.writeConfig(
+    normalizedProjectRoot,
+    normalizeAuthorizationConfig(params.nextConfig),
+  );
 }
 
 function ensureChannelConfig(
@@ -189,32 +188,37 @@ function ensureChannelConfig(
  * 同步读取当前 agent 的授权配置。
  */
 export function readChatAuthorizationConfigSync(projectRoot: string): ChatAuthorizationConfig {
-  return readAuthorizationConfigFromStoreSync(projectRoot);
+  return readAuthorizationConfigFromProjectRoot(projectRoot);
 }
 
 /**
  * 读取当前 agent 的授权配置。
  */
 export function readChatAuthorizationConfig(
-  contextOrProjectRoot: Pick<AgentContext, "rootPath"> | string,
+  contextOrProjectRoot: Pick<AgentContext, "rootPath" | "platform"> | string,
 ): ChatAuthorizationConfig {
-  const projectRoot =
-    typeof contextOrProjectRoot === "string"
-      ? contextOrProjectRoot
-      : contextOrProjectRoot.rootPath;
-  return readAuthorizationConfigFromStoreSync(projectRoot);
+  if (typeof contextOrProjectRoot === "string") {
+    return readAuthorizationConfigFromProjectRoot(contextOrProjectRoot);
+  }
+  return readAuthorizationConfigFromPlatformSync({
+    projectRoot: contextOrProjectRoot.rootPath,
+    readConfig: (projectRoot) =>
+      contextOrProjectRoot.platform.readChatAuthorizationConfig(projectRoot),
+  });
 }
 
 /**
  * 覆盖写入整份授权配置。
  */
 export async function writeChatAuthorizationConfig(params: {
-  context: Pick<AgentContext, "rootPath">;
+  context: Pick<AgentContext, "rootPath" | "platform">;
   nextConfig: ChatAuthorizationConfig;
 }): Promise<void> {
-  await writeAuthorizationConfigToStore({
+  await writeAuthorizationConfigToPlatform({
     projectRoot: params.context.rootPath,
     nextConfig: params.nextConfig,
+    writeConfig: (projectRoot, nextConfig) =>
+      params.context.platform.writeChatAuthorizationConfig(projectRoot, nextConfig),
   });
 }
 
@@ -232,7 +236,7 @@ export function listChatAuthorizationRoles(params: {
  * 设置用户角色。
  */
 export async function setChatAuthorizationUserRole(params: {
-  context: Pick<AgentContext, "rootPath">;
+  context: Pick<AgentContext, "rootPath" | "platform">;
   channel: ChatAuthorizationChannel;
   userId: string;
   roleId: string;
@@ -241,15 +245,21 @@ export async function setChatAuthorizationUserRole(params: {
   const roleId = normalizeText(params.roleId);
   if (!userId || !roleId) throw new Error("userId and roleId are required");
   const authorization = cloneAuthorizationConfig(
-    readAuthorizationConfigFromStoreSync(params.context.rootPath),
+    readAuthorizationConfigFromPlatformSync({
+      projectRoot: params.context.rootPath,
+      readConfig: (projectRoot) =>
+        params.context.platform.readChatAuthorizationConfig(projectRoot),
+    }),
   );
   authorization.roles = normalizeRoleMap(authorization.roles);
   const channelConfig = ensureChannelConfig(authorization, params.channel);
   if (!authorization.roles?.[roleId]) throw new Error(`Unknown roleId: ${roleId}`);
   channelConfig.userRoles ??= {};
   channelConfig.userRoles[userId] = roleId;
-  await writeAuthorizationConfigToStore({
+  await writeAuthorizationConfigToPlatform({
     projectRoot: params.context.rootPath,
     nextConfig: authorization,
+    writeConfig: (projectRoot, nextConfig) =>
+      params.context.platform.writeChatAuthorizationConfig(projectRoot, nextConfig),
   });
 }

package/src/plugins/auth/runtime/AuthorizationPolicy.ts

@@ -7,6 +7,7 @@
  */
 
 import type { DowncityConfig } from "@/shared/types/DowncityConfig.js";
+import type { AgentPlatformRuntime } from "@/shared/types/AgentHost.js";
 import type {
   ChatAuthorizationConfig,
   ChatAuthorizationChannel,
@@ -17,7 +18,6 @@ import type {
   ChatChannelAuthorizationConfig,
 } from "@/shared/types/AuthPlugin.js";
 import { createDefaultChatAuthorizationRoles } from "@/shared/types/AuthPlugin.js";
-import { readChatAuthorizationConfigSync } from "@/plugins/auth/runtime/AuthorizationConfig.js";
 
 function normalizeText(value: unknown): string | undefined {
   const text = String(value || "").trim();
@@ -92,12 +92,15 @@ export function resolveAuthorizedUserRole(params: {
   userId?: string;
   authorizationConfig?: ChatAuthorizationConfig;
   rootPath?: string;
+  platform?: Pick<AgentPlatformRuntime, "readChatAuthorizationConfig">;
 }): ChatAuthorizationRole | undefined {
   const userId = normalizeText(params.userId);
   if (!userId) return undefined;
   const authorizationConfig =
     params.authorizationConfig ||
-    (params.rootPath ? readChatAuthorizationConfigSync(params.rootPath) : undefined);
+    (params.rootPath && params.platform
+      ? params.platform.readChatAuthorizationConfig(params.rootPath)
+      : undefined);
   const roles = resolveAuthorizationRoles(authorizationConfig);
   const channelConfig = resolveChannelAuthorizationConfig(params.channel, authorizationConfig);
   return resolveUserRole({