agent-bridge-aun 1.0.19 → 1.0.21

package/README.md

@@ -4,6 +4,12 @@
 
 安装后在 ABWeb 的插件管理中启动 AUN 通道。配置 `aid` 和可选的 `agent_plugin`；默认 Agent 插件为 `qwenwork`。AID 创建接口为 `POST /api/plugins/aun/aid`，请求内容为 `{"aid":"新AID.agentid.cn","owner_aid":"所有者AID.agentid.cn"}`。
 
+创建使用 SDK 的兼容注册流程；Owner AID 只保存为本地归属配置，不代表 AUN 协议 Owner 关系已签名或激活。Gateway 信任根使用随插件提供并校验指纹的 AUN 根证书，不从 Gateway 下载未经验证的 CA 链。
+
+核心支持插件命令后，可运行 `mab aun status`、`mab aun list`、`mab aun agents`、`mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]`、`mab aun bind <aid> <plugin-id>` 和 `mab aun unbind <plugin-id>`。Agent 从当前已就绪的插件动态发现。创建后连接或关联失败时，响应会标明 AID 已创建；先用 `mab aun list` 检查，不要重试创建。命令不会记录原始参数或 Owner AID。
+
 该插件依赖 `@agentunion/fastaun`，要求 Node.js 22.16 或更高版本。
 
 ABWeb 的 AUN 设置只展示已连接 AID，并按来源分组。插件通过 SDK 密钥库枚举 AID，再逐个建立连接；只有连接成功的身份才会显示。EvolCore 来源身份只用于连接状态检测，不订阅消息，避免重复收信；本工程创建的身份负责消息收发。连接状态检测不调用 `ec agent list/show`。将 EvolCore 身份关联到 Agent 时仍使用既有 `ec agent set/reload` 路由配置，该配置不参与连接状态检测。列表先显示已关联 Agent 的身份，各组按最近成功关联的时间倒序排列，时间相同或旧记录没有时间时按 AID 名称排序。关联时间保存在插件配置的 `binding_times` 中，刷新或重启后保留；旧记录不补造时间，再次关联成功后开始记录。
+
+AUN 独立包支持核心后台每五分钟检测更新；可信提供者在自动安装策略下会下载新副本并重载通道。

package/dist/src-ts/plugins/aun/certs/root.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAYOgAwIBAgIUI/WLfQXFR9KpvBlhnvJFIAtylNQwCgYIKoZIzj0EAwMw
+KzEUMBIGA1UEAwwLQVVOIFJvb3QgQ0ExEzARBgNVBAoMCkFnZW50VW5pb24wIBcN
+MjYwMzE3MDE1NDUyWhgPMjA1NjAzMDkwMTU5NTJaMCsxFDASBgNVBAMMC0FVTiBS
+b290IENBMRMwEQYDVQQKDApBZ2VudFVuaW9uMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEbuQMkmsHjhtwsgoFhfgC4514k2IMQVECNeBtxiwiEe5OTY0D7MvqwtEzz67r
+1jo2OXOuA+BajSW/ZOw89HH2zrWIshw2qVo5WP4ELnrKk/dipfiJBm9IrJXsO0kN
+ope4o2YwZDASBgNVHRMBAf8ECDAGAQH/AgECMA4GA1UdDwEB/wQEAwIBhjAdBgNV
+HQ4EFgQULmOUMJCtK8VatDpoo/iigMIu3hwwHwYDVR0jBBgwFoAULmOUMJCtK8Va
+tDpoo/iigMIu3hwwCgYIKoZIzj0EAwMDaAAwZQIwPcby4jt32sKANZhUuFaOcWiy
+V8rgbF0pF+ROrlg+9JdQ3yRyGWTU2VRNyzd+FlNbAjEAgVKYzN6mpxnVfjk8dHYH
+vh6o6LY9oqw8rdZ/2Q1k1eUSaFxykTZQ9ipR84GIGXrc
+-----END CERTIFICATE-----

package/dist/src-ts/plugins/aun/evolcore.js

@@ -26,7 +26,8 @@ async function configureAidForPlugin(pluginId, aid, port, run = runEc) {
         return;
     if (!/^[a-z0-9_-]+$/.test(pluginId))
         throw new Error("插件 ID 格式无效");
-    const path = pluginId === "dsh" ? "/dsh/v1" : pluginId === "qwenwork" ? "/v1" : `/api/agents/${pluginId}/v1`;
+    // 通过 daemon 的统一插件代理访问所有 Agent；否则 qwenwork 的裸 /v1 路由在有插件 HTTP 注册表时不存在。
+    const path = pluginId === "dsh" ? "/dsh/v1" : `/api/agents/${pluginId}/v1`;
     for (const [key, value] of [
         ["baseagents.ecagent.baseUrl", `http://127.0.0.1:${port}${path}`],
         ["baseagents.ecagent.apiKey", "mab-local"],

package/dist/src-ts/plugins/aun/index.js

@@ -3,16 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AunPlugin = void 0;
 const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
 const node_module_1 = require("node:module");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_url_1 = require("node:url");
 const messages_1 = require("./messages");
-const evolcore_1 = require("./evolcore");
 const manifest = {
-    id: "aun", version: "1.0.19", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.21", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
-    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health"],
+    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
     managementPage: "/abweb/channels/aun",
 };
@@ -31,6 +31,24 @@ async function loadSdk() {
     throw new Error("未找到 @agentunion/fastaun，请确认 AUN 插件依赖已安装");
 }
 const aidPattern = /^[a-z0-9][a-z0-9_-]{2,63}\.[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+const aunRootFingerprint = "DD:09:E9:FD:31:6C:42:DC:7D:F3:5C:98:9C:2C:76:3A:A1:88:D8:4C:9C:C9:FC:D4:2E:A3:10:A2:62:1E:C5:45";
+const cliCommands = [
+    { name: "status", summary: "查看 AUN 通道状态", usage: "mab aun status" },
+    { name: "list", summary: "查看已连接 AID 和 Agent 关联", usage: "mab aun list" },
+    { name: "agents", summary: "列出当前已就绪的 Agent 插件", usage: "mab aun agents" },
+    { name: "create", summary: "创建并连接 AID，可选关联 Agent", usage: "mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]", examples: ["mab aun create new.agentid.cn --owner owner.agentid.cn --agent qwenwork"] },
+    { name: "bind", summary: "将 AID 关联到 Agent", usage: "mab aun bind <aid> <plugin-id>", examples: ["mab aun bind new.agentid.cn qwenwork"] },
+    { name: "unbind", summary: "解除 Agent 与 AID 的关联", usage: "mab aun unbind <plugin-id>", examples: ["mab aun unbind qwenwork"] },
+];
+class AunCommandError extends Error {
+    statusCode;
+    data;
+    constructor(message, statusCode = 400, data) {
+        super(message);
+        this.statusCode = statusCode;
+        this.data = data;
+    }
+}
 class AunPlugin {
     options;
     manifest = manifest;
@@ -57,10 +75,9 @@ class AunPlugin {
     }
     identity = {
         list: async () => {
-            const connected = [...this.clients.keys()];
             return {
-                evolcore: connected.filter((aid) => !this.identities.has(aid) && !this.legacyCreatedAids.has(aid)).sort(),
-                muAgentBridge: connected.filter((aid) => this.identities.has(aid) || this.legacyCreatedAids.has(aid)).sort(),
+                evolcore: [],
+                muAgentBridge: [...this.clients.keys()].sort(),
                 localMuAgentBridge: [...this.identities].filter((aid) => !this.clients.has(aid)).sort(),
             };
         },
@@ -73,10 +90,12 @@ class AunPlugin {
             try {
                 if (!this.identities.has(aid)) {
                     // Owner AID 是本地归属配置；身份签发沿用 EvolCore 的兼容注册流程。
-                    await this.prepareTrustRoots(aid);
-                    const result = await this.store.register(aid);
-                    if (!result.ok)
-                        throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    if (!this.listStoreAids().includes(aid)) {
+                        await this.prepareTrustRoots(aid);
+                        const result = await this.store.register(aid);
+                        if (!result.ok)
+                            throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    }
                     const loaded = this.store.load(aid);
                     if (!loaded.ok || !loaded.data)
                         throw new Error(loaded.error?.message ?? "注册后未能加载本地身份");
@@ -85,17 +104,16 @@ class AunPlugin {
                     this.config.owner_aid = owner;
                     this.config.aun_path = this.path();
                     await this.persist();
-                    this.context?.logger.info("AUN 身份已创建", { aid, owner });
+                    this.context?.logger.info("AUN 身份已创建", { aid });
                 }
-                if (!this.clients.has(aid))
-                    await this.connectAid(aid);
-                return { aid, status: "已创建", connection: this.clients.has(aid) ? "ready" : "degraded" };
+                const connectionError = !this.clients.has(aid) ? await this.connectAid(aid) : undefined;
+                return { aid, status: "已创建", connection: this.clients.has(aid) ? "ready" : "degraded", ...(connectionError ? { connectionError } : {}) };
             }
             finally {
                 this.creating = false;
             }
         },
-        bind: async (pluginId, aid, port) => {
+        bind: async (pluginId, aid, _port) => {
             if (pluginId === "aun" || pluginId === "abweb")
                 throw new Error("只能关联 Agent 插件");
             const previous = this.bindings;
@@ -121,15 +139,21 @@ class AunPlugin {
                         this.bindings[aid] = pluginId;
                     }
                     else {
-                        const connected = await this.identity.list();
-                        if (![...connected.evolcore, ...connected.muAgentBridge].includes(aid))
+                        // 本地身份由插件直接接管，不再通过 ec 配置路由。
+                        const loaded = this.store.load(aid);
+                        if (!loaded.ok || !loaded.data)
+                            throw new Error("AID 不在本地密钥库中，无法关联");
+                        this.identities.add(aid);
+                        if (!this.clients.has(aid))
+                            await this.connectAid(aid);
+                        if (!this.clients.has(aid))
                             throw new Error("AID 当前未连接");
-                        await (0, evolcore_1.configureAidForPlugin)(pluginId, aid, port);
                         for (const [identity, target] of Object.entries(this.bindings))
                             if (target === pluginId) {
                                 delete this.bindings[identity];
                                 delete this.bindingTimes[identity];
                             }
+                        this.bindings[aid] = pluginId;
                     }
                 }
                 else {
@@ -198,6 +222,8 @@ class AunPlugin {
             ["GET", "/api/plugins/aun/identities", this.listIdentities],
             ["POST", "/api/plugins/aun/bind", this.bindAgent],
             ["POST", "/api/plugins/aun/settings", this.saveSettings],
+            ["GET", "/api/plugins/aun/commands", this.listCommands],
+            ["POST", "/api/plugins/aun/commands", this.runCommand],
             ...(["", "/app.js", "/style.css"].map((suffix) => ["GET", `/abweb/channels/aun${suffix}`, this.servePage])),
         ]) {
             const dispose = context.http.register({ method, path, handler });
@@ -215,10 +241,12 @@ class AunPlugin {
             this.identities.add(this.aid);
         for (const aid of this.identities)
             await this.connectAid(aid);
-        // AUN 插件直接连接本地密钥库中的所有 AID，不依赖 ec 进程或 CLI。
-        for (const aid of this.listStoreAids())
+        // 密钥库中的其余 AID 也自动连接：不再依赖 ec 或 EvolCore 进程
+        for (const aid of this.listStoreAids()) {
+            this.identities.add(aid);
             if (!this.clients.has(aid))
                 await this.connectAid(aid);
+        }
     }
     async connectAid(aid) {
         try {
@@ -245,7 +273,8 @@ class AunPlugin {
         catch (error) {
             this.status = "degraded";
             this.healthMessage = safeError(error);
-            this.context?.logger.warn("AUN 通道连接失败", { error: this.healthMessage });
+            this.context?.logger.warn("AUN 通道连接失败", { aid, error: this.healthMessage });
+            return this.healthMessage;
         }
     }
     async deactivate(_reason) {
@@ -279,28 +308,27 @@ class AunPlugin {
     rootCaPath() {
         return typeof this.config.root_ca_path === "string" && this.config.root_ca_path
             ? this.config.root_ca_path
-            : (0, node_path_1.join)(this.path(), "CA", "root", "root.crt");
+            : (0, node_path_1.join)(this.context.dataDir, "CA", "root", "root.crt");
     }
     async prepareTrustRoots(aid) {
         const rootCaPath = this.rootCaPath();
-        if ((0, node_fs_1.existsSync)(rootCaPath))
-            return;
-        if (!this.sdk?.GatewayDiscovery) {
-            this.context?.logger.warn("AUN SDK 未提供 GatewayDiscovery，无法预先下载信任根", { aid });
+        const customPath = typeof this.config.root_ca_path === "string" && this.config.root_ca_path.trim();
+        if ((0, node_fs_1.existsSync)(rootCaPath)) {
+            if (customPath)
+                return;
+            const existing = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)(rootCaPath, "utf8"));
+            if (existing.fingerprint256 !== aunRootFingerprint)
+                throw new Error("AUN 插件根证书指纹校验失败");
             return;
         }
+        if (customPath)
+            throw new Error("配置的 AUN 根证书文件不存在");
         try {
-            const discovery = new this.sdk.GatewayDiscovery({ verifySsl: typeof this.config.verify_ssl === "boolean" ? this.config.verify_ssl : true });
-            const gatewayUrl = await discovery.discover(`https://${aid}/.well-known/aun-gateway`);
-            const gatewayHttpUrl = gatewayUrl.replace(/^wss?:/i, "https:").replace(/\/aun\/?$/i, "");
-            const response = await fetch(`${gatewayHttpUrl}/pki/chain`, { redirect: "follow", signal: AbortSignal.timeout(10_000) });
-            if (!response.ok)
-                throw new Error(`下载 Gateway CA 链失败：HTTP ${response.status}`);
-            const chain = await response.text();
-            if (!chain.includes("-----BEGIN CERTIFICATE-----"))
-                throw new Error("Gateway CA 链响应中没有证书");
+            const cert = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)((0, node_path_1.join)(__dirname, "certs", "root.crt"), "utf8"));
+            if (cert.fingerprint256 !== aunRootFingerprint)
+                throw new Error("内置 AUN 根证书指纹校验失败");
             await (0, promises_1.mkdir)((0, node_path_1.dirname)(rootCaPath), { recursive: true });
-            await (0, promises_1.writeFile)(rootCaPath, chain, { mode: 0o600 });
+            await (0, promises_1.writeFile)(rootCaPath, cert.toString(), { mode: 0o600, flag: "wx" });
             const oldStore = this.store;
             const newStore = this.newStore();
             this.store = newStore;
@@ -310,7 +338,7 @@ class AunPlugin {
             catch (error) {
                 this.context?.logger.warn("关闭旧 AUN Store 失败", { error: safeError(error) });
             }
-            this.context?.logger.info("AUN Gateway 信任根证书已下载", { aid });
+            this.context?.logger.info("AUN 固定信任根证书已安装", { aid });
         }
         catch (error) {
             this.context?.logger.warn("AUN Gateway 信任根证书初始化失败", { aid, error: safeError(error) });
@@ -409,6 +437,254 @@ class AunPlugin {
             this.json(response, 400, { error: safeError(error) });
         }
     };
+    listCommands = async (_request, response) => {
+        response.setHeader("cache-control", "no-store");
+        this.json(response, 200, { protocolVersion: 1, plugin: "aun", version: manifest.version, commands: cliCommands });
+    };
+    runCommand = async (request, response) => {
+        try {
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of request) {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+                size += buffer.length;
+                if (size > 65536)
+                    throw new AunCommandError("请求内容过大");
+                chunks.push(buffer);
+            }
+            let input;
+            try {
+                input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            }
+            catch {
+                throw new AunCommandError("命令请求 JSON 格式无效");
+            }
+            if (!input || typeof input !== "object" || input.protocolVersion !== 1 || !Array.isArray(input.argv) || !input.argv.every((arg) => typeof arg === "string")) {
+                throw new AunCommandError("命令请求格式无效");
+            }
+            const result = await this.executeCommand(input.argv);
+            this.commandResult(response, 200, true, result.message, result.data);
+        }
+        catch (error) {
+            const failure = error instanceof AunCommandError ? error : new AunCommandError(safeError(error), 502);
+            this.commandResult(response, failure.statusCode, false, failure.message, failure.data);
+        }
+    };
+    async executeCommand(argv) {
+        const [command, ...args] = argv;
+        if (command === "status" && !args.length)
+            return { message: this.healthMessage, data: await this.health() };
+        if (command === "list" && !args.length) {
+            const groups = await this.identity.list();
+            const aids = [...new Set([...groups.evolcore, ...groups.muAgentBridge, ...(groups.localMuAgentBridge ?? []), ...this.listStoreAids()])].sort();
+            return { message: aids.length ? `AID 列表：\n${aids.join("\n")}` : "暂无本地 AID", data: {
+                    aids,
+                    bindings: this.bindings,
+                    bindingTimes: this.bindingTimes,
+                } };
+        }
+        if (command === "agents" && !args.length) {
+            const agents = await this.agents();
+            return { message: agents.length ? `当前已就绪的 Agent 插件：\n${agents.map((agent) => `${agent.id}（${agent.displayName}）`).join("\n")}` : "暂无已就绪的 Agent 插件", data: agents };
+        }
+        if (command === "create")
+            return this.createCommand(args);
+        if (command === "bind" && args.length === 2) {
+            const [aid, pluginId] = args;
+            if (!aidPattern.test(aid))
+                throw new AunCommandError("AID 格式无效");
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId);
+            const replacedAids = (await this.agentBindings(pluginId)).filter((previousAid) => previousAid !== aid);
+            try {
+                await this.patchAgentAid(pluginId, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`AID 关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { aid, agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return {
+                message: replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${pluginId}` : `AID 已关联到 ${pluginId}`,
+                data: { aid, agent: pluginId, replacedAids },
+            };
+        }
+        if (command === "unbind" && args.length === 1) {
+            const [pluginId] = args;
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId, false);
+            const unboundAids = await this.agentBindings(pluginId);
+            try {
+                await this.patchAgentAid(pluginId, "");
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`解除关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return { message: `已解除 ${pluginId} 的 AID 关联`, data: { agent: pluginId, unboundAids } };
+        }
+        if (!["status", "list", "agents", "create", "bind", "unbind"].includes(command ?? ""))
+            throw new AunCommandError(`未知 AUN 命令：${command ?? ""}`);
+        throw new AunCommandError(`AUN 命令参数无效：${command}`);
+    }
+    async createCommand(args) {
+        const aid = args[0] ?? "";
+        if (!aidPattern.test(aid))
+            throw new AunCommandError("AID 格式无效");
+        let owner = "";
+        let agent = "";
+        for (let index = 1; index < args.length; index++) {
+            const option = args[index];
+            const value = args[++index];
+            if (!value || value.startsWith("--"))
+                throw new AunCommandError(`${option} 需要参数`);
+            if (option === "--owner" && !owner)
+                owner = value;
+            else if (option === "--agent" && !agent)
+                agent = value;
+            else
+                throw new AunCommandError(`不支持的创建参数：${option}`);
+        }
+        if (!owner || !aidPattern.test(owner))
+            throw new AunCommandError("需要有效的 --owner AID");
+        if (agent) {
+            this.validatePluginId(agent);
+            await this.requireAgent(agent);
+        }
+        let created;
+        try {
+            created = await this.identity.create(aid, owner);
+        }
+        catch (error) {
+            const exists = this.identities.has(aid) || this.listStoreAids().includes(aid);
+            if (exists)
+                throw new AunCommandError("AID 可能已创建，但后续连接或保存失败；请先执行 mab aun list 确认，不要重试创建", 502, { created: true, aid });
+            throw new AunCommandError(`AID 创建失败：${safeError(error).replaceAll(owner, "[已隐藏]")}`, 502);
+        }
+        const data = { created: true, aid, connection: created.connection ?? "ready" };
+        if (created.connection !== "ready")
+            throw new AunCommandError("AID 已创建，但连接失败；请先执行 mab aun list 确认，不要重试创建", 502, { ...data, connectionError: created.connectionError });
+        let replacedAids = [];
+        if (agent) {
+            try {
+                replacedAids = (await this.agentBindings(agent)).filter((previousAid) => previousAid !== aid);
+                await this.patchAgentAid(agent, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(agent).catch(() => undefined);
+                throw new AunCommandError(`AID 已创建，但 Agent 关联失败，已回读当前状态：${safeError(error)}`, 502, { ...data, agent, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+        }
+        return {
+            message: agent ? (replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${agent}` : `AID 已创建并关联到 ${agent}`) : "AID 已创建并连接",
+            data: { ...data, ...(agent ? { agent, replacedAids } : {}) },
+        };
+    }
+    async agents(readyOnly = true) {
+        const payload = await this.controlRequest("/api/plugins");
+        if (!Array.isArray(payload.plugins))
+            throw new AunCommandError("控制 API 插件列表格式无效", 502);
+        return payload.plugins.filter((plugin) => !!plugin && typeof plugin === "object" && !Array.isArray(plugin))
+            .filter((plugin) => plugin.type === "agent" && (!readyOnly || plugin.status === "ready") && typeof plugin.id === "string" && /^[a-z][a-z0-9-]{1,63}$/.test(plugin.id))
+            .map((plugin) => ({ id: plugin.id, displayName: typeof plugin.displayName === "string" ? plugin.displayName : plugin.id }))
+            .sort((left, right) => left.id.localeCompare(right.id));
+    }
+    async requireAgent(pluginId, readyOnly = true) {
+        if (!(await this.agents(readyOnly)).some((agent) => agent.id === pluginId))
+            throw new AunCommandError(readyOnly ? "目标 Agent 不存在或尚未就绪" : "目标插件不存在或不是 Agent 插件");
+    }
+    validatePluginId(pluginId) {
+        if (!/^[a-z][a-z0-9-]{1,63}$/.test(pluginId) || pluginId === "aun" || pluginId === "abweb")
+            throw new AunCommandError("Agent 插件 ID 无效");
+    }
+    async patchAgentAid(pluginId, aid) {
+        await this.controlRequest(`/api/plugins/${encodeURIComponent(pluginId)}/aid`, "PATCH", { aid });
+    }
+    async agentBindings(pluginId) {
+        const aun = await this.controlPayload("/api/plugins/aun/identities");
+        if (!aun.bindings || typeof aun.bindings !== "object" || Array.isArray(aun.bindings))
+            throw new AunCommandError("AUN 身份列表格式无效", 502);
+        const bindings = aun.bindings;
+        return Object.entries(bindings).filter(([, target]) => target === pluginId).map(([aid]) => aid).sort();
+    }
+    async bindingState(pluginId) {
+        const [aun, agent] = await Promise.all([
+            this.agentBindings(pluginId),
+            this.controlPayload(`/api/plugins/${encodeURIComponent(pluginId)}/config`),
+        ]);
+        return {
+            aunAids: aun,
+            agentAid: typeof agent.aid === "string" ? agent.aid : "",
+        };
+    }
+    async controlRequest(path, method = "GET", body) {
+        const result = await this.controlPayload(path, method, body);
+        if (result.ok !== true)
+            throw new AunCommandError("本机控制 API 响应未确认操作成功", 502);
+        return result;
+    }
+    async controlPayload(path, method = "GET", body) {
+        const base = this.controlUrl();
+        let response;
+        try {
+            response = await fetch(new URL(path, base), {
+                method,
+                headers: { accept: "application/json", ...(body === undefined ? {} : { "content-type": "application/json" }) },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: AbortSignal.timeout(5000),
+                redirect: "error",
+            });
+        }
+        catch (error) {
+            throw new AunCommandError(`本机控制 API 请求失败：${safeError(error)}`, 502);
+        }
+        let raw;
+        try {
+            raw = await readResponse(response, 65536);
+        }
+        catch (error) {
+            if (error instanceof AunCommandError)
+                throw error;
+            throw new AunCommandError(`本机控制 API 响应读取失败：${safeError(error)}`, 502);
+        }
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            throw new AunCommandError("本机控制 API 返回的 JSON 无效", 502);
+        }
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            throw new AunCommandError("本机控制 API 响应格式无效", 502);
+        const result = payload;
+        if (!response.ok) {
+            const message = typeof result.error === "string" ? result.error : `HTTP ${response.status}`;
+            throw new AunCommandError(`本机控制 API 操作失败：${message}`, response.status >= 400 && response.status < 500 ? response.status : 502);
+        }
+        return result;
+    }
+    controlUrl() {
+        const controlUrl = this.context?.runtime?.controlUrl;
+        if (!controlUrl)
+            throw new AunCommandError("运行时未提供 controlUrl，请更新核心服务", 502);
+        let url;
+        try {
+            url = new URL(controlUrl);
+        }
+        catch {
+            throw new AunCommandError("运行时 controlUrl 无效", 502);
+        }
+        const hostname = url.hostname.replace(/^\[|\]$/g, "");
+        if (url.protocol !== "http:" || !["127.0.0.1", "::1"].includes(hostname) || url.username || url.password || (url.pathname !== "/") || url.search || url.hash) {
+            throw new AunCommandError("运行时 controlUrl 必须指向本机回环地址", 502);
+        }
+        return url;
+    }
+    commandResult(response, status, ok, message, data) {
+        response.statusCode = status;
+        response.setHeader("content-type", "application/json; charset=utf-8");
+        response.setHeader("cache-control", "no-store");
+        response.end(JSON.stringify({ ok, message, ...(data === undefined ? {} : { data }) }));
+    }
     servePage = async (request, response) => {
         const path = new URL(request.url ?? "/", "http://localhost").pathname;
         const file = path.endsWith("/app.js") ? "app.js" : path.endsWith("/style.css") ? "style.css" : "index.html";
@@ -470,6 +746,34 @@ exports.default = AunPlugin;
 function safeError(error) {
     return redact(error instanceof Error ? error.message : String(error)).slice(0, 240);
 }
+async function readResponse(response, limit) {
+    if (!response.body) {
+        const raw = await response.text();
+        if (Buffer.byteLength(raw) > limit)
+            throw new AunCommandError("响应内容过大", 502);
+        return raw;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > limit) {
+                await reader.cancel();
+                throw new AunCommandError("响应内容过大", 502);
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 function redact(message) {
     return message.replace(/(private[_ -]?key|seed|token|certificate)\s*[:=]\s*[^\s,;]+/gi, "$1=[已隐藏]");
 }

package/dist/src-ts/plugins/aun/public/app.js

@@ -15,6 +15,12 @@
     return result;
   }
   function show(message, failed = false) { status.textContent = message; status.className = failed ? "error" : ""; }
+  function notify(title, message, failed = false) {
+    show(message, failed);
+    if (window.parent !== window) window.parent.postMessage({ type: "mab:operation-result", title, message, failed }, window.location.origin);
+    else window.alert(`${title}\n${message}`);
+  }
+  const errorMessage = (error) => error instanceof Error ? error.message : String(error);
   async function load(refreshForm = true) {
     if (loading) return;
     loading = true;
@@ -57,15 +63,22 @@
   async function bind(aid, pluginId) {
     try {
       await request(`/api/plugins/${encodeURIComponent(pluginId)}/aid`, "PATCH", { aid });
-      await load(); show(`${aid} 已关联 ${pluginId}`);
-    } catch (error) { show(`关联失败：${String(error)}`, true); }
+      await load(); notify("关联成功", `${aid} 已关联 ${pluginId}`);
+    } catch (error) { notify("关联失败", errorMessage(error), true); }
   }
   createForm.onsubmit = (event) => { event.preventDefault(); const aid = createForm.elements.aid.value.trim(); const owner = createForm.elements.ownerAid.value.trim();
-    void request("/api/plugins/aun/aid", "POST", { aid, ownerAid: owner }).then((result) => load().then(() => show(result.status === "等待 Owner 确认" ? `${aid} 等待 Owner 确认` : `${aid} 已创建`))).catch((error) => show(String(error), true));
+    show("正在创建 AID 并连接，请稍候……");
+    void request("/api/plugins/aun/aid", "POST", { aid, ownerAid: owner }).then((result) => {
+      const failed = result.connection === "degraded";
+      const message = failed ? `${aid} 已创建，但连接失败：${result.connectionError || "未提供连接失败原因，请查看运行日志"}\n身份已经保存在本地，请勿重复注册。`
+        : result.status === "等待 Owner 确认" ? `${aid} 等待 Owner 确认` : `${aid} 已创建并连接`;
+      notify(failed ? "AID 创建完成，连接失败" : "AID 创建结果", message, failed);
+      return load();
+    }).catch((error) => notify("创建 AID 失败", errorMessage(error), true));
   };
   configForm.onsubmit = (event) => { event.preventDefault(); const changes = { agent_plugin: configForm.elements.agent_plugin.value, allow_from: configForm.elements.allow_from.value, aun_path: configForm.elements.aun_path.value };
     if (configForm.elements.encryption_seed.value) changes.encryption_seed = configForm.elements.encryption_seed.value;
-    void request("/api/plugins/aun/settings", "POST", changes).then(() => request("/api/plugins/aun/reload", "POST")).then(() => load()).then(() => show("配置已保存")).catch((error) => show(String(error), true));
+    void request("/api/plugins/aun/settings", "POST", changes).then(() => request("/api/plugins/aun/reload", "POST")).then(() => load()).then(() => notify("保存成功", "配置已保存")).catch((error) => notify("保存配置失败", errorMessage(error), true));
   };
   find("#refresh").onclick = () => void load();
   void load();

package/dist/src-ts/plugins/aun/public/index.html

@@ -6,7 +6,7 @@
     <header><h1>AUN 身份</h1><button id="refresh" type="button">刷新</button></header>
     <p id="status" role="status"></p>
     <div class="table-scroll"><table><thead><tr><th>AID</th><th>来源</th><th>已关联 Agent</th><th>操作</th></tr></thead><tbody id="identities"></tbody></table></div>
-    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="new.agentid.cn"></label><label>Owner AID<input name="ownerAid" required></label></div><button type="submit">创建</button></form>
+    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner 保存为本地归属配置；不代表 AUN 协议中的 Owner 关系已激活。</small></label></div><button type="submit">创建</button></form>
     <form id="config-form"><h2>通道配置</h2><div class="fields"><label>默认 Agent<select name="agent_plugin"></select></label><label>允许的来源<input name="allow_from"></label><label>AUN 存储路径<input name="aun_path"></label><label>加密种子<input name="encryption_seed" type="password" autocomplete="new-password" placeholder="留空则不修改"></label></div><button type="submit">保存配置</button></form>
   </main>
   <script src="/abweb/channels/aun/app.js"></script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bridge-aun",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "mu-agent-bridge 的 AUN 通道插件。",
   "keywords": [
     "mu-agent-bridge-plugin",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "aun",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "type": "channel",
   "displayName": "AUN 通道",
   "entry": "dist/src-ts/plugins/aun/index.js",
@@ -11,7 +11,8 @@
     "channel.identity.create",
     "channel.receive",
     "channel.send",
-    "health"
+    "health",
+    "cli"
   ],
   "configSchema": "config.schema.json",
   "managementPage": "/abweb/channels/aun"