agent-bridge-aun 1.0.20 → 1.0.21

package/README.md

@@ -4,6 +4,10 @@
 
 安装后在 ABWeb 的插件管理中启动 AUN 通道。配置 `aid` 和可选的 `agent_plugin`；默认 Agent 插件为 `qwenwork`。AID 创建接口为 `POST /api/plugins/aun/aid`，请求内容为 `{"aid":"新AID.agentid.cn","owner_aid":"所有者AID.agentid.cn"}`。
 
+创建使用 SDK 的兼容注册流程；Owner AID 只保存为本地归属配置，不代表 AUN 协议 Owner 关系已签名或激活。Gateway 信任根使用随插件提供并校验指纹的 AUN 根证书，不从 Gateway 下载未经验证的 CA 链。
+
+核心支持插件命令后，可运行 `mab aun status`、`mab aun list`、`mab aun agents`、`mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]`、`mab aun bind <aid> <plugin-id>` 和 `mab aun unbind <plugin-id>`。Agent 从当前已就绪的插件动态发现。创建后连接或关联失败时，响应会标明 AID 已创建；先用 `mab aun list` 检查，不要重试创建。命令不会记录原始参数或 Owner AID。
+
 该插件依赖 `@agentunion/fastaun`，要求 Node.js 22.16 或更高版本。
 
 ABWeb 的 AUN 设置只展示已连接 AID，并按来源分组。插件通过 SDK 密钥库枚举 AID，再逐个建立连接；只有连接成功的身份才会显示。EvolCore 来源身份只用于连接状态检测，不订阅消息，避免重复收信；本工程创建的身份负责消息收发。连接状态检测不调用 `ec agent list/show`。将 EvolCore 身份关联到 Agent 时仍使用既有 `ec agent set/reload` 路由配置，该配置不参与连接状态检测。列表先显示已关联 Agent 的身份，各组按最近成功关联的时间倒序排列，时间相同或旧记录没有时间时按 AID 名称排序。关联时间保存在插件配置的 `binding_times` 中，刷新或重启后保留；旧记录不补造时间，再次关联成功后开始记录。

package/dist/src-ts/plugins/aun/certs/root.crt

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAYOgAwIBAgIUI/WLfQXFR9KpvBlhnvJFIAtylNQwCgYIKoZIzj0EAwMw
+KzEUMBIGA1UEAwwLQVVOIFJvb3QgQ0ExEzARBgNVBAoMCkFnZW50VW5pb24wIBcN
+MjYwMzE3MDE1NDUyWhgPMjA1NjAzMDkwMTU5NTJaMCsxFDASBgNVBAMMC0FVTiBS
+b290IENBMRMwEQYDVQQKDApBZ2VudFVuaW9uMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEbuQMkmsHjhtwsgoFhfgC4514k2IMQVECNeBtxiwiEe5OTY0D7MvqwtEzz67r
+1jo2OXOuA+BajSW/ZOw89HH2zrWIshw2qVo5WP4ELnrKk/dipfiJBm9IrJXsO0kN
+ope4o2YwZDASBgNVHRMBAf8ECDAGAQH/AgECMA4GA1UdDwEB/wQEAwIBhjAdBgNV
+HQ4EFgQULmOUMJCtK8VatDpoo/iigMIu3hwwHwYDVR0jBBgwFoAULmOUMJCtK8Va
+tDpoo/iigMIu3hwwCgYIKoZIzj0EAwMDaAAwZQIwPcby4jt32sKANZhUuFaOcWiy
+V8rgbF0pF+ROrlg+9JdQ3yRyGWTU2VRNyzd+FlNbAjEAgVKYzN6mpxnVfjk8dHYH
+vh6o6LY9oqw8rdZ/2Q1k1eUSaFxykTZQ9ipR84GIGXrc
+-----END CERTIFICATE-----

package/dist/src-ts/plugins/aun/index.js

@@ -3,16 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AunPlugin = void 0;
 const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
 const node_module_1 = require("node:module");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_url_1 = require("node:url");
 const messages_1 = require("./messages");
-const evolcore_1 = require("./evolcore");
 const manifest = {
-    id: "aun", version: "1.0.20", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.21", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
-    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health"],
+    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
     managementPage: "/abweb/channels/aun",
 };
@@ -31,6 +31,24 @@ async function loadSdk() {
     throw new Error("未找到 @agentunion/fastaun，请确认 AUN 插件依赖已安装");
 }
 const aidPattern = /^[a-z0-9][a-z0-9_-]{2,63}\.[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+const aunRootFingerprint = "DD:09:E9:FD:31:6C:42:DC:7D:F3:5C:98:9C:2C:76:3A:A1:88:D8:4C:9C:C9:FC:D4:2E:A3:10:A2:62:1E:C5:45";
+const cliCommands = [
+    { name: "status", summary: "查看 AUN 通道状态", usage: "mab aun status" },
+    { name: "list", summary: "查看已连接 AID 和 Agent 关联", usage: "mab aun list" },
+    { name: "agents", summary: "列出当前已就绪的 Agent 插件", usage: "mab aun agents" },
+    { name: "create", summary: "创建并连接 AID，可选关联 Agent", usage: "mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]", examples: ["mab aun create new.agentid.cn --owner owner.agentid.cn --agent qwenwork"] },
+    { name: "bind", summary: "将 AID 关联到 Agent", usage: "mab aun bind <aid> <plugin-id>", examples: ["mab aun bind new.agentid.cn qwenwork"] },
+    { name: "unbind", summary: "解除 Agent 与 AID 的关联", usage: "mab aun unbind <plugin-id>", examples: ["mab aun unbind qwenwork"] },
+];
+class AunCommandError extends Error {
+    statusCode;
+    data;
+    constructor(message, statusCode = 400, data) {
+        super(message);
+        this.statusCode = statusCode;
+        this.data = data;
+    }
+}
 class AunPlugin {
     options;
     manifest = manifest;
@@ -57,10 +75,9 @@ class AunPlugin {
     }
     identity = {
         list: async () => {
-            const connected = [...this.clients.keys()];
             return {
-                evolcore: connected.filter((aid) => !this.identities.has(aid) && !this.legacyCreatedAids.has(aid)).sort(),
-                muAgentBridge: connected.filter((aid) => this.identities.has(aid) || this.legacyCreatedAids.has(aid)).sort(),
+                evolcore: [],
+                muAgentBridge: [...this.clients.keys()].sort(),
                 localMuAgentBridge: [...this.identities].filter((aid) => !this.clients.has(aid)).sort(),
             };
         },
@@ -72,11 +89,13 @@ class AunPlugin {
             this.creating = true;
             try {
                 if (!this.identities.has(aid)) {
-                    // 创建身份沿用 EvolCore 的 legacy 注册流程。Owner AID 是本地归属配置，
-                    // 只有明确执行 Owner 关系绑定时才进入 aid_register_* 双签流程。
-                    const result = await this.store.register(aid);
-                    if (!result.ok)
-                        throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    // Owner AID 是本地归属配置；身份签发沿用 EvolCore 的兼容注册流程。
+                    if (!this.listStoreAids().includes(aid)) {
+                        await this.prepareTrustRoots(aid);
+                        const result = await this.store.register(aid);
+                        if (!result.ok)
+                            throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    }
                     const loaded = this.store.load(aid);
                     if (!loaded.ok || !loaded.data)
                         throw new Error(loaded.error?.message ?? "注册后未能加载本地身份");
@@ -85,7 +104,7 @@ class AunPlugin {
                     this.config.owner_aid = owner;
                     this.config.aun_path = this.path();
                     await this.persist();
-                    this.context?.logger.info("AUN 身份已创建", { aid, owner });
+                    this.context?.logger.info("AUN 身份已创建", { aid });
                 }
                 const connectionError = !this.clients.has(aid) ? await this.connectAid(aid) : undefined;
                 return { aid, status: "已创建", connection: this.clients.has(aid) ? "ready" : "degraded", ...(connectionError ? { connectionError } : {}) };
@@ -94,7 +113,7 @@ class AunPlugin {
                 this.creating = false;
             }
         },
-        bind: async (pluginId, aid, port) => {
+        bind: async (pluginId, aid, _port) => {
             if (pluginId === "aun" || pluginId === "abweb")
                 throw new Error("只能关联 Agent 插件");
             const previous = this.bindings;
@@ -120,15 +139,21 @@ class AunPlugin {
                         this.bindings[aid] = pluginId;
                     }
                     else {
-                        const connected = await this.identity.list();
-                        if (![...connected.evolcore, ...connected.muAgentBridge].includes(aid))
+                        // 本地身份由插件直接接管，不再通过 ec 配置路由。
+                        const loaded = this.store.load(aid);
+                        if (!loaded.ok || !loaded.data)
+                            throw new Error("AID 不在本地密钥库中，无法关联");
+                        this.identities.add(aid);
+                        if (!this.clients.has(aid))
+                            await this.connectAid(aid);
+                        if (!this.clients.has(aid))
                             throw new Error("AID 当前未连接");
-                        await (0, evolcore_1.configureAidForPlugin)(pluginId, aid, port);
                         for (const [identity, target] of Object.entries(this.bindings))
                             if (target === pluginId) {
                                 delete this.bindings[identity];
                                 delete this.bindingTimes[identity];
                             }
+                        this.bindings[aid] = pluginId;
                     }
                 }
                 else {
@@ -197,6 +222,8 @@ class AunPlugin {
             ["GET", "/api/plugins/aun/identities", this.listIdentities],
             ["POST", "/api/plugins/aun/bind", this.bindAgent],
             ["POST", "/api/plugins/aun/settings", this.saveSettings],
+            ["GET", "/api/plugins/aun/commands", this.listCommands],
+            ["POST", "/api/plugins/aun/commands", this.runCommand],
             ...(["", "/app.js", "/style.css"].map((suffix) => ["GET", `/abweb/channels/aun${suffix}`, this.servePage])),
         ]) {
             const dispose = context.http.register({ method, path, handler });
@@ -214,13 +241,16 @@ class AunPlugin {
             this.identities.add(this.aid);
         for (const aid of this.identities)
             await this.connectAid(aid);
-        // AUN 插件直接连接本地密钥库中的所有 AID，不依赖 ec 进程或 CLI。
-        for (const aid of this.listStoreAids())
+        // 密钥库中的其余 AID 也自动连接：不再依赖 ec 或 EvolCore 进程
+        for (const aid of this.listStoreAids()) {
+            this.identities.add(aid);
             if (!this.clients.has(aid))
                 await this.connectAid(aid);
+        }
     }
     async connectAid(aid) {
         try {
+            await this.prepareTrustRoots(aid);
             const loaded = this.store.load(aid);
             if (!loaded.ok || !loaded.data)
                 throw new Error(loaded.error?.message ?? "本地密钥库中不存在该 AID");
@@ -272,9 +302,49 @@ class AunPlugin {
         return (0, node_path_1.resolve)(process.env.AUN_HOME ?? process.env.EVOLCORE_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".evolcore"));
     }
     newStore() {
-        const rootCaPath = typeof this.config.root_ca_path === "string" && this.config.root_ca_path ? this.config.root_ca_path : (0, node_path_1.join)(this.path(), "CA", "root", "root.crt");
+        const rootCaPath = this.rootCaPath();
         return new this.sdk.AIDStore({ aunPath: this.path(), encryptionSeed: typeof this.config.encryption_seed === "string" && this.config.encryption_seed ? this.config.encryption_seed : "evol", verifySsl: typeof this.config.verify_ssl === "boolean" ? this.config.verify_ssl : true, rootCaPath: (0, node_fs_1.existsSync)(rootCaPath) ? rootCaPath : undefined });
     }
+    rootCaPath() {
+        return typeof this.config.root_ca_path === "string" && this.config.root_ca_path
+            ? this.config.root_ca_path
+            : (0, node_path_1.join)(this.context.dataDir, "CA", "root", "root.crt");
+    }
+    async prepareTrustRoots(aid) {
+        const rootCaPath = this.rootCaPath();
+        const customPath = typeof this.config.root_ca_path === "string" && this.config.root_ca_path.trim();
+        if ((0, node_fs_1.existsSync)(rootCaPath)) {
+            if (customPath)
+                return;
+            const existing = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)(rootCaPath, "utf8"));
+            if (existing.fingerprint256 !== aunRootFingerprint)
+                throw new Error("AUN 插件根证书指纹校验失败");
+            return;
+        }
+        if (customPath)
+            throw new Error("配置的 AUN 根证书文件不存在");
+        try {
+            const cert = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)((0, node_path_1.join)(__dirname, "certs", "root.crt"), "utf8"));
+            if (cert.fingerprint256 !== aunRootFingerprint)
+                throw new Error("内置 AUN 根证书指纹校验失败");
+            await (0, promises_1.mkdir)((0, node_path_1.dirname)(rootCaPath), { recursive: true });
+            await (0, promises_1.writeFile)(rootCaPath, cert.toString(), { mode: 0o600, flag: "wx" });
+            const oldStore = this.store;
+            const newStore = this.newStore();
+            this.store = newStore;
+            try {
+                await oldStore?.close();
+            }
+            catch (error) {
+                this.context?.logger.warn("关闭旧 AUN Store 失败", { error: safeError(error) });
+            }
+            this.context?.logger.info("AUN 固定信任根证书已安装", { aid });
+        }
+        catch (error) {
+            this.context?.logger.warn("AUN Gateway 信任根证书初始化失败", { aid, error: safeError(error) });
+            throw new Error(`AUN Gateway 信任根证书初始化失败：${safeError(error)}`);
+        }
+    }
     createAid = async (request, response) => {
         let input;
         try {
@@ -367,6 +437,254 @@ class AunPlugin {
             this.json(response, 400, { error: safeError(error) });
         }
     };
+    listCommands = async (_request, response) => {
+        response.setHeader("cache-control", "no-store");
+        this.json(response, 200, { protocolVersion: 1, plugin: "aun", version: manifest.version, commands: cliCommands });
+    };
+    runCommand = async (request, response) => {
+        try {
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of request) {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+                size += buffer.length;
+                if (size > 65536)
+                    throw new AunCommandError("请求内容过大");
+                chunks.push(buffer);
+            }
+            let input;
+            try {
+                input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            }
+            catch {
+                throw new AunCommandError("命令请求 JSON 格式无效");
+            }
+            if (!input || typeof input !== "object" || input.protocolVersion !== 1 || !Array.isArray(input.argv) || !input.argv.every((arg) => typeof arg === "string")) {
+                throw new AunCommandError("命令请求格式无效");
+            }
+            const result = await this.executeCommand(input.argv);
+            this.commandResult(response, 200, true, result.message, result.data);
+        }
+        catch (error) {
+            const failure = error instanceof AunCommandError ? error : new AunCommandError(safeError(error), 502);
+            this.commandResult(response, failure.statusCode, false, failure.message, failure.data);
+        }
+    };
+    async executeCommand(argv) {
+        const [command, ...args] = argv;
+        if (command === "status" && !args.length)
+            return { message: this.healthMessage, data: await this.health() };
+        if (command === "list" && !args.length) {
+            const groups = await this.identity.list();
+            const aids = [...new Set([...groups.evolcore, ...groups.muAgentBridge, ...(groups.localMuAgentBridge ?? []), ...this.listStoreAids()])].sort();
+            return { message: aids.length ? `AID 列表：\n${aids.join("\n")}` : "暂无本地 AID", data: {
+                    aids,
+                    bindings: this.bindings,
+                    bindingTimes: this.bindingTimes,
+                } };
+        }
+        if (command === "agents" && !args.length) {
+            const agents = await this.agents();
+            return { message: agents.length ? `当前已就绪的 Agent 插件：\n${agents.map((agent) => `${agent.id}（${agent.displayName}）`).join("\n")}` : "暂无已就绪的 Agent 插件", data: agents };
+        }
+        if (command === "create")
+            return this.createCommand(args);
+        if (command === "bind" && args.length === 2) {
+            const [aid, pluginId] = args;
+            if (!aidPattern.test(aid))
+                throw new AunCommandError("AID 格式无效");
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId);
+            const replacedAids = (await this.agentBindings(pluginId)).filter((previousAid) => previousAid !== aid);
+            try {
+                await this.patchAgentAid(pluginId, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`AID 关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { aid, agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return {
+                message: replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${pluginId}` : `AID 已关联到 ${pluginId}`,
+                data: { aid, agent: pluginId, replacedAids },
+            };
+        }
+        if (command === "unbind" && args.length === 1) {
+            const [pluginId] = args;
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId, false);
+            const unboundAids = await this.agentBindings(pluginId);
+            try {
+                await this.patchAgentAid(pluginId, "");
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`解除关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return { message: `已解除 ${pluginId} 的 AID 关联`, data: { agent: pluginId, unboundAids } };
+        }
+        if (!["status", "list", "agents", "create", "bind", "unbind"].includes(command ?? ""))
+            throw new AunCommandError(`未知 AUN 命令：${command ?? ""}`);
+        throw new AunCommandError(`AUN 命令参数无效：${command}`);
+    }
+    async createCommand(args) {
+        const aid = args[0] ?? "";
+        if (!aidPattern.test(aid))
+            throw new AunCommandError("AID 格式无效");
+        let owner = "";
+        let agent = "";
+        for (let index = 1; index < args.length; index++) {
+            const option = args[index];
+            const value = args[++index];
+            if (!value || value.startsWith("--"))
+                throw new AunCommandError(`${option} 需要参数`);
+            if (option === "--owner" && !owner)
+                owner = value;
+            else if (option === "--agent" && !agent)
+                agent = value;
+            else
+                throw new AunCommandError(`不支持的创建参数：${option}`);
+        }
+        if (!owner || !aidPattern.test(owner))
+            throw new AunCommandError("需要有效的 --owner AID");
+        if (agent) {
+            this.validatePluginId(agent);
+            await this.requireAgent(agent);
+        }
+        let created;
+        try {
+            created = await this.identity.create(aid, owner);
+        }
+        catch (error) {
+            const exists = this.identities.has(aid) || this.listStoreAids().includes(aid);
+            if (exists)
+                throw new AunCommandError("AID 可能已创建，但后续连接或保存失败；请先执行 mab aun list 确认，不要重试创建", 502, { created: true, aid });
+            throw new AunCommandError(`AID 创建失败：${safeError(error).replaceAll(owner, "[已隐藏]")}`, 502);
+        }
+        const data = { created: true, aid, connection: created.connection ?? "ready" };
+        if (created.connection !== "ready")
+            throw new AunCommandError("AID 已创建，但连接失败；请先执行 mab aun list 确认，不要重试创建", 502, { ...data, connectionError: created.connectionError });
+        let replacedAids = [];
+        if (agent) {
+            try {
+                replacedAids = (await this.agentBindings(agent)).filter((previousAid) => previousAid !== aid);
+                await this.patchAgentAid(agent, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(agent).catch(() => undefined);
+                throw new AunCommandError(`AID 已创建，但 Agent 关联失败，已回读当前状态：${safeError(error)}`, 502, { ...data, agent, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+        }
+        return {
+            message: agent ? (replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${agent}` : `AID 已创建并关联到 ${agent}`) : "AID 已创建并连接",
+            data: { ...data, ...(agent ? { agent, replacedAids } : {}) },
+        };
+    }
+    async agents(readyOnly = true) {
+        const payload = await this.controlRequest("/api/plugins");
+        if (!Array.isArray(payload.plugins))
+            throw new AunCommandError("控制 API 插件列表格式无效", 502);
+        return payload.plugins.filter((plugin) => !!plugin && typeof plugin === "object" && !Array.isArray(plugin))
+            .filter((plugin) => plugin.type === "agent" && (!readyOnly || plugin.status === "ready") && typeof plugin.id === "string" && /^[a-z][a-z0-9-]{1,63}$/.test(plugin.id))
+            .map((plugin) => ({ id: plugin.id, displayName: typeof plugin.displayName === "string" ? plugin.displayName : plugin.id }))
+            .sort((left, right) => left.id.localeCompare(right.id));
+    }
+    async requireAgent(pluginId, readyOnly = true) {
+        if (!(await this.agents(readyOnly)).some((agent) => agent.id === pluginId))
+            throw new AunCommandError(readyOnly ? "目标 Agent 不存在或尚未就绪" : "目标插件不存在或不是 Agent 插件");
+    }
+    validatePluginId(pluginId) {
+        if (!/^[a-z][a-z0-9-]{1,63}$/.test(pluginId) || pluginId === "aun" || pluginId === "abweb")
+            throw new AunCommandError("Agent 插件 ID 无效");
+    }
+    async patchAgentAid(pluginId, aid) {
+        await this.controlRequest(`/api/plugins/${encodeURIComponent(pluginId)}/aid`, "PATCH", { aid });
+    }
+    async agentBindings(pluginId) {
+        const aun = await this.controlPayload("/api/plugins/aun/identities");
+        if (!aun.bindings || typeof aun.bindings !== "object" || Array.isArray(aun.bindings))
+            throw new AunCommandError("AUN 身份列表格式无效", 502);
+        const bindings = aun.bindings;
+        return Object.entries(bindings).filter(([, target]) => target === pluginId).map(([aid]) => aid).sort();
+    }
+    async bindingState(pluginId) {
+        const [aun, agent] = await Promise.all([
+            this.agentBindings(pluginId),
+            this.controlPayload(`/api/plugins/${encodeURIComponent(pluginId)}/config`),
+        ]);
+        return {
+            aunAids: aun,
+            agentAid: typeof agent.aid === "string" ? agent.aid : "",
+        };
+    }
+    async controlRequest(path, method = "GET", body) {
+        const result = await this.controlPayload(path, method, body);
+        if (result.ok !== true)
+            throw new AunCommandError("本机控制 API 响应未确认操作成功", 502);
+        return result;
+    }
+    async controlPayload(path, method = "GET", body) {
+        const base = this.controlUrl();
+        let response;
+        try {
+            response = await fetch(new URL(path, base), {
+                method,
+                headers: { accept: "application/json", ...(body === undefined ? {} : { "content-type": "application/json" }) },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: AbortSignal.timeout(5000),
+                redirect: "error",
+            });
+        }
+        catch (error) {
+            throw new AunCommandError(`本机控制 API 请求失败：${safeError(error)}`, 502);
+        }
+        let raw;
+        try {
+            raw = await readResponse(response, 65536);
+        }
+        catch (error) {
+            if (error instanceof AunCommandError)
+                throw error;
+            throw new AunCommandError(`本机控制 API 响应读取失败：${safeError(error)}`, 502);
+        }
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            throw new AunCommandError("本机控制 API 返回的 JSON 无效", 502);
+        }
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            throw new AunCommandError("本机控制 API 响应格式无效", 502);
+        const result = payload;
+        if (!response.ok) {
+            const message = typeof result.error === "string" ? result.error : `HTTP ${response.status}`;
+            throw new AunCommandError(`本机控制 API 操作失败：${message}`, response.status >= 400 && response.status < 500 ? response.status : 502);
+        }
+        return result;
+    }
+    controlUrl() {
+        const controlUrl = this.context?.runtime?.controlUrl;
+        if (!controlUrl)
+            throw new AunCommandError("运行时未提供 controlUrl，请更新核心服务", 502);
+        let url;
+        try {
+            url = new URL(controlUrl);
+        }
+        catch {
+            throw new AunCommandError("运行时 controlUrl 无效", 502);
+        }
+        const hostname = url.hostname.replace(/^\[|\]$/g, "");
+        if (url.protocol !== "http:" || !["127.0.0.1", "::1"].includes(hostname) || url.username || url.password || (url.pathname !== "/") || url.search || url.hash) {
+            throw new AunCommandError("运行时 controlUrl 必须指向本机回环地址", 502);
+        }
+        return url;
+    }
+    commandResult(response, status, ok, message, data) {
+        response.statusCode = status;
+        response.setHeader("content-type", "application/json; charset=utf-8");
+        response.setHeader("cache-control", "no-store");
+        response.end(JSON.stringify({ ok, message, ...(data === undefined ? {} : { data }) }));
+    }
     servePage = async (request, response) => {
         const path = new URL(request.url ?? "/", "http://localhost").pathname;
         const file = path.endsWith("/app.js") ? "app.js" : path.endsWith("/style.css") ? "style.css" : "index.html";
@@ -428,6 +746,34 @@ exports.default = AunPlugin;
 function safeError(error) {
     return redact(error instanceof Error ? error.message : String(error)).slice(0, 240);
 }
+async function readResponse(response, limit) {
+    if (!response.body) {
+        const raw = await response.text();
+        if (Buffer.byteLength(raw) > limit)
+            throw new AunCommandError("响应内容过大", 502);
+        return raw;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > limit) {
+                await reader.cancel();
+                throw new AunCommandError("响应内容过大", 502);
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 function redact(message) {
     return message.replace(/(private[_ -]?key|seed|token|certificate)\s*[:=]\s*[^\s,;]+/gi, "$1=[已隐藏]");
 }

package/dist/src-ts/plugins/aun/public/app.js

@@ -37,8 +37,15 @@
         configForm.elements.encryption_seed.value = "";
       }
       list.replaceChildren();
-      const entries = [["本工程 · 已连接", identities.groups.muAgentBridge || []], ["EvolCore · 已连接", identities.groups.evolcore || []]]
-        .flatMap(([label, values], group) => values.map((aid) => ({ aid, label, group, bound: identities.bindings?.[aid] || agents.find((agent) => agent.id && agent.configAid === aid)?.id || "", time: Date.parse(identities.bindingTimes?.[aid] || "") || 0 })));
+      const entries = [];
+      const seen = new Set();
+      for (const [group, label, values] of [[0, "本工程 · 已连接", identities.groups.muAgentBridge || []], [1, "EvolCore · 已连接", identities.groups.evolcore || []]]) {
+        for (const aid of values) {
+          if (seen.has(aid)) continue;
+          seen.add(aid);
+          entries.push({ aid, label, group, bound: identities.bindings?.[aid] || agents.find((agent) => agent.id && agent.configAid === aid)?.id || "", time: Date.parse(identities.bindingTimes?.[aid] || "") || 0 });
+        }
+      }
       entries.sort((a, b) => Number(Boolean(b.bound)) - Number(Boolean(a.bound)) || a.group - b.group || b.time - a.time || a.aid.localeCompare(b.aid));
       for (const { aid, label, bound } of entries) {
           const row = document.createElement("tr");
@@ -49,7 +56,7 @@
           cell.append(select); row.append(cell); list.append(row);
       }
       if (!list.children.length) { const row = document.createElement("tr"); const cell = document.createElement("td"); cell.colSpan = 4; cell.textContent = "暂无已连接 AID"; row.append(cell); list.append(row); }
-      show(`${(identities.groups.evolcore || []).length + (identities.groups.muAgentBridge || []).length} 个已连接 AID`);
+      show(`${entries.length} 个已连接 AID`);
     } catch (error) { show(String(error), true); }
     finally { loading = false; }
   }

package/dist/src-ts/plugins/aun/public/index.html

@@ -6,7 +6,7 @@
     <header><h1>AUN 身份</h1><button id="refresh" type="button">刷新</button></header>
     <p id="status" role="status"></p>
     <div class="table-scroll"><table><thead><tr><th>AID</th><th>来源</th><th>已关联 Agent</th><th>操作</th></tr></thead><tbody id="identities"></tbody></table></div>
-    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner AID 用于本地归属和 Agent 关联；创建身份本身沿用 AUN 的普通注册流程</small></label></div><button type="submit">创建</button></form>
+    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner 保存为本地归属配置；不代表 AUN 协议中的 Owner 关系已激活。</small></label></div><button type="submit">创建</button></form>
     <form id="config-form"><h2>通道配置</h2><div class="fields"><label>默认 Agent<select name="agent_plugin"></select></label><label>允许的来源<input name="allow_from"></label><label>AUN 存储路径<input name="aun_path"></label><label>加密种子<input name="encryption_seed" type="password" autocomplete="new-password" placeholder="留空则不修改"></label></div><button type="submit">保存配置</button></form>
   </main>
   <script src="/abweb/channels/aun/app.js"></script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bridge-aun",
-  "version": "1.0.20",
+  "version": "1.0.21",
   "description": "mu-agent-bridge 的 AUN 通道插件。",
   "keywords": [
     "mu-agent-bridge-plugin",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "aun",
-  "version": "1.0.20",
+  "version": "1.0.21",
   "type": "channel",
   "displayName": "AUN 通道",
   "entry": "dist/src-ts/plugins/aun/index.js",
@@ -11,7 +11,8 @@
     "channel.identity.create",
     "channel.receive",
     "channel.send",
-    "health"
+    "health",
+    "cli"
   ],
   "configSchema": "config.schema.json",
   "managementPage": "/abweb/channels/aun"