agent-bridge-aun 1.0.21 → 1.0.23

package/README.md

@@ -2,14 +2,14 @@
 
 `agent-bridge-aun` 为 mu-agent-bridge 提供 AUN 消息通道，支持使用已有 AID 或通过管理 API 注册 AID，并将收到的文本交给指定 Agent 插件处理。
 
-安装后在 ABWeb 的插件管理中启动 AUN 通道。配置 `aid` 和可选的 `agent_plugin`；默认 Agent 插件为 `qwenwork`。AID 创建接口为 `POST /api/plugins/aun/aid`，请求内容为 `{"aid":"新AID.agentid.cn","owner_aid":"所有者AID.agentid.cn"}`。
+安装后在 ABWeb 的插件管理中启动 AUN 通道。配置 `aid` 和可选的 `agent_plugin`；默认 Agent 插件为 `qwenwork`。配置字段 `owner_aid` 是可选字符串，用作默认 Owner。AID 创建接口为 `POST /api/plugins/aun/aid`，请求内容为 `{"aid":"新AID.agentid.cn","owner_aid":"所有者AID.agentid.cn"}`。
 
 创建使用 SDK 的兼容注册流程；Owner AID 只保存为本地归属配置，不代表 AUN 协议 Owner 关系已签名或激活。Gateway 信任根使用随插件提供并校验指纹的 AUN 根证书，不从 Gateway 下载未经验证的 CA 链。
 
-核心支持插件命令后，可运行 `mab aun status`、`mab aun list`、`mab aun agents`、`mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]`、`mab aun bind <aid> <plugin-id>` 和 `mab aun unbind <plugin-id>`。Agent 从当前已就绪的插件动态发现。创建后连接或关联失败时，响应会标明 AID 已创建；先用 `mab aun list` 检查，不要重试创建。命令不会记录原始参数或 Owner AID。
+核心支持插件命令后，可运行 `mab aun status`、`mab aun list`、`mab aun agents`、`mab aun default-owner`、`mab aun default-owner set <owner-aid>`、`mab aun create <aid> [--owner <owner-aid>] [--agent <plugin-id>]`、`mab aun bind <aid> <plugin-id>` 和 `mab aun unbind <plugin-id>`。`default-owner` 不带参数显示当前配置，`default-owner set <owner-aid>` 校验格式并持久化新的默认值。`create` 明确传入 `--owner` 时优先使用该值；省略时回退到同一配置中的 `owner_aid`，两者都没有时返回错误，不会创建 AID。创建新身份时，实际使用的 Owner 会保存为下次默认值。ABWeb 从同一插件配置读取 `owner_aid` 并预填创建表单，因此 CLI 和 ABWeb 共用默认 Owner。Agent 从当前已就绪的插件动态发现。创建后连接或关联失败时，响应会标明 AID 已创建；先用 `mab aun list` 检查，不要重试创建。运行日志不记录原始参数或 Owner AID；默认 Owner 查询会在终端显示当前值。
 
 该插件依赖 `@agentunion/fastaun`，要求 Node.js 22.16 或更高版本。
 
-ABWeb 的 AUN 设置只展示已连接 AID，并按来源分组。插件通过 SDK 密钥库枚举 AID，再逐个建立连接；只有连接成功的身份才会显示。EvolCore 来源身份只用于连接状态检测，不订阅消息，避免重复收信；本工程创建的身份负责消息收发。连接状态检测不调用 `ec agent list/show`。将 EvolCore 身份关联到 Agent 时仍使用既有 `ec agent set/reload` 路由配置，该配置不参与连接状态检测。列表先显示已关联 Agent 的身份，各组按最近成功关联的时间倒序排列，时间相同或旧记录没有时间时按 AID 名称排序。关联时间保存在插件配置的 `binding_times` 中，刷新或重启后保留；旧记录不补造时间，再次关联成功后开始记录。
+ABWeb 的 AUN 设置只展示已连接 AID，并按来源分组。成功注册并记录在插件 `created_aids` 中的 AID 属于本工程；共享密钥库中其余 AID 属于 EvolCore。旧版 `created-aids.json` 记录继续兼容。来源只用于展示，连接和关联由 AUN 插件直接管理。列表先显示已关联 Agent 的身份，各组按最近成功关联的时间倒序排列，时间相同或旧记录没有时间时按 AID 名称排序。关联时间保存在插件配置的 `binding_times` 中，刷新或重启后保留；旧记录不补造时间，再次关联成功后开始记录。
 
 AUN 独立包支持核心后台每五分钟检测更新；可信提供者在自动安装策略下会下载新副本并重载通道。

package/config.schema.json

@@ -2,6 +2,7 @@
   "type": "object",
   "properties": {
     "identities": { "type": "array", "items": { "type": "string" } },
+    "created_aids": { "type": "array", "items": { "type": "string" } },
     "bindings": { "type": "object", "additionalProperties": { "type": "string" } },
     "binding_times": { "type": "object", "additionalProperties": { "type": "string" } },
     "aid": { "type": "string", "minLength": 1 },

package/dist/src-ts/attachments.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TOTAL_ATTACHMENT_BYTES = exports.MAX_ATTACHMENTS = exports.MAX_ATTACHMENT_BYTES = void 0;
+exports.detectImageContentType = detectImageContentType;
+exports.attachmentFilename = attachmentFilename;
+exports.validateAttachment = validateAttachment;
+exports.validateAttachments = validateAttachments;
+exports.asAttachments = asAttachments;
+exports.MAX_ATTACHMENT_BYTES = 32 * 1024 * 1024;
+exports.MAX_ATTACHMENTS = 8;
+exports.MAX_TOTAL_ATTACHMENT_BYTES = 64 * 1024 * 1024;
+function detectImageContentType(data) {
+    if (data.length >= 8 && data.slice(0, 8).every((value, index) => value === [137, 80, 78, 71, 13, 10, 26, 10][index]))
+        return "image/png";
+    if (data.length >= 3 && data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff)
+        return "image/jpeg";
+    if (data.length >= 12 && String.fromCharCode(...data.slice(0, 4)) === "RIFF" && String.fromCharCode(...data.slice(8, 12)) === "WEBP")
+        return "image/webp";
+    return undefined;
+}
+function attachmentFilename(filename) {
+    if (typeof filename !== "string" || /[\u0000-\u001f\u007f]/.test(filename))
+        throw new Error("附件文件名无效");
+    const name = filename.split(/[\\/]/).pop() ?? "";
+    if (!name.trim() || name === "." || name === "..")
+        throw new Error("附件文件名无效");
+    return name;
+}
+function validateAttachment(item) {
+    if (!item || !(item.data instanceof Uint8Array) || item.data.byteLength === 0)
+        throw new Error("附件内容不能为空");
+    if (item.data.byteLength > exports.MAX_ATTACHMENT_BYTES)
+        throw new Error("单个附件不能超过 32 MiB");
+    attachmentFilename(item.filename);
+    if (item.kind !== "image" && item.kind !== "file")
+        throw new Error("附件类型无效");
+    if (typeof item.contentType !== "string" || !/^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/.test(item.contentType))
+        throw new Error("附件 MIME 类型无效");
+    if (item.kind === "image") {
+        const detected = detectImageContentType(item.data);
+        if (!detected || detected !== item.contentType.toLowerCase())
+            throw new Error("图片内容与 MIME 类型不一致");
+    }
+}
+function validateAttachments(items) {
+    if (!items)
+        return;
+    if (!Array.isArray(items))
+        throw new Error("附件列表无效");
+    if (items.length > exports.MAX_ATTACHMENTS)
+        throw new Error("单条消息最多包含 8 个附件");
+    let total = 0;
+    for (const item of items) {
+        validateAttachment(item);
+        total += item.data.byteLength;
+    }
+    if (total > exports.MAX_TOTAL_ATTACHMENT_BYTES)
+        throw new Error("单条消息附件总大小不能超过 64 MiB");
+}
+function asAttachments(images) {
+    return (images ?? []).map((image) => ({ ...image, kind: "image" }));
+}

package/dist/src-ts/plugins/aun/attachments.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAunAttachment = parseAunAttachment;
+exports.downloadAunAttachments = downloadAunAttachments;
+exports.downloadAunAttachment = downloadAunAttachment;
+exports.uploadAunAttachments = uploadAunAttachments;
+const node_crypto_1 = require("node:crypto");
+const attachments_1 = require("../../attachments");
+const aidPattern = /^[a-z0-9][a-z0-9_-]{2,63}\.[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+const mimePattern = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/;
+const imageTypes = new Set(["image/png", "image/jpeg", "image/webp"]);
+function digest(data) { return (0, node_crypto_1.createHash)("sha256").update(data).digest("hex"); }
+function validKey(key) { return /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(key) && !key.split("/").some((part) => part === "." || part === ".."); }
+function validHash(value) { return /^[a-f0-9]{64}$/i.test(value); }
+function validateReference(ref) {
+    if (!aidPattern.test(ref.ownerAid) || !/^[A-Za-z0-9_-][A-Za-z0-9._-]{0,63}$/.test(ref.bucket) || !validKey(ref.objectKey))
+        throw new Error("AUN 附件引用路径无效");
+    (0, attachments_1.attachmentFilename)(ref.filename);
+    if (ref.contentType !== undefined && !mimePattern.test(ref.contentType))
+        throw new Error("AUN 附件 MIME 类型无效");
+    if (ref.sizeBytes !== undefined && (!Number.isSafeInteger(ref.sizeBytes) || ref.sizeBytes < 1 || ref.sizeBytes > attachments_1.MAX_ATTACHMENT_BYTES))
+        throw new Error("AUN 附件大小无效，单个附件不能超过 32 MiB");
+    if (ref.sha256 !== undefined && !validHash(ref.sha256))
+        throw new Error("AUN 附件哈希无效");
+    if (ref.token !== undefined && !/^[A-Za-z0-9._~-]{1,4096}$/.test(ref.token))
+        throw new Error("AUN 附件分享令牌无效");
+}
+function pathToken(value, ownerAid, objectKey) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.hash || url.hostname !== ownerAid || url.pathname !== `/${objectKey}`)
+        throw new Error("AUN 附件链接与对象引用不一致");
+    const tokens = url.searchParams.getAll("t");
+    if (tokens.length > 1 || tokens.length === 1 && !tokens[0])
+        throw new Error("AUN 附件分享令牌无效");
+    return tokens[0];
+}
+function parseAunAttachment(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("AUN 附件引用无效");
+    const item = value;
+    const ownerAid = typeof item.owner_aid === "string" ? item.owner_aid : "";
+    const objectKey = typeof item.object_key === "string" ? item.object_key : "";
+    const bucket = item.bucket === undefined ? "default" : typeof item.bucket === "string" ? item.bucket : "";
+    const filename = (0, attachments_1.attachmentFilename)(typeof item.filename === "string" ? item.filename : objectKey);
+    const ref = { ownerAid, bucket, objectKey, filename };
+    if (item.content_type !== undefined) {
+        if (typeof item.content_type !== "string")
+            throw new Error("AUN 附件 MIME 类型无效");
+        ref.contentType = item.content_type.toLowerCase();
+    }
+    if (item.size_bytes !== undefined) {
+        if (typeof item.size_bytes !== "number")
+            throw new Error("AUN 附件大小无效");
+        ref.sizeBytes = item.size_bytes;
+    }
+    if (item.sha256 !== undefined) {
+        if (typeof item.sha256 !== "string")
+            throw new Error("AUN 附件哈希无效");
+        ref.sha256 = item.sha256.toLowerCase();
+    }
+    validateReference(ref);
+    if (item.url !== undefined) {
+        if (typeof item.url !== "string")
+            throw new Error("AUN 附件链接无效");
+        const token = pathToken(item.url, ownerAid, objectKey);
+        if (token)
+            ref.token = token;
+    }
+    validateReference(ref);
+    return ref;
+}
+function metadataValue(meta, field, alias) { return meta[field] ?? (alias ? meta[alias] : undefined); }
+function checkedMetadata(meta, ref) {
+    const size = metadataValue(meta, "size", "size_bytes");
+    if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 1 || size > attachments_1.MAX_ATTACHMENT_BYTES)
+        throw new Error("AUN 附件元数据大小无效");
+    if (ref.sizeBytes !== undefined && ref.sizeBytes !== size)
+        throw new Error("AUN 附件大小校验失败");
+    if (meta.type && meta.type !== "file")
+        throw new Error("AUN 附件对象不是文件");
+    if ([meta.owner, meta.owner_aid].some((owner) => owner && owner !== ref.ownerAid) || meta.bucket && meta.bucket !== ref.bucket
+        || [meta.path, meta.object_key].some((path) => path && path !== `/${ref.objectKey}` && path !== ref.objectKey))
+        throw new Error("AUN 附件元数据引用不一致");
+    const rawType = metadataValue(meta, "contentType", "content_type");
+    if (rawType && (typeof rawType !== "string" || !mimePattern.test(rawType)))
+        throw new Error("AUN 附件元数据 MIME 类型无效");
+    const contentType = typeof rawType === "string" && rawType ? rawType.toLowerCase() : ref.contentType ?? "application/octet-stream";
+    if (ref.contentType && rawType && ref.contentType.toLowerCase() !== contentType)
+        throw new Error("AUN 附件 MIME 类型校验失败");
+    const sha256 = typeof meta.sha256 === "string" && meta.sha256 ? meta.sha256.toLowerCase() : undefined;
+    if (sha256 && !validHash(sha256))
+        throw new Error("AUN 附件元数据哈希无效");
+    if (sha256 && ref.sha256 && sha256 !== ref.sha256.toLowerCase())
+        throw new Error("AUN 附件哈希校验失败");
+    return { size, contentType, ...(sha256 ? { sha256 } : {}) };
+}
+async function downloadAunAttachments(client, refs) {
+    if (refs.length > attachments_1.MAX_ATTACHMENTS)
+        throw new Error("单条消息最多包含 8 个附件");
+    const entries = [];
+    let total = 0;
+    for (const ref of refs) {
+        validateReference(ref);
+        const options = { owner: ref.ownerAid, bucket: ref.bucket, ...(ref.token ? { token: ref.token } : {}) };
+        let inlineContent;
+        let downloadUrl;
+        let rawMetadata;
+        if (ref.token) {
+            if (!client.storage.lowlevel?.getByShare)
+                throw new Error("AUN SDK 不支持受限分享附件");
+            rawMetadata = await client.storage.lowlevel.getByShare({ shareId: ref.token });
+            if (!rawMetadata.object_key && !rawMetadata.path)
+                throw new Error("AUN 分享附件缺少对象引用");
+            if (typeof rawMetadata.content === "string")
+                inlineContent = rawMetadata.content;
+            else if (typeof rawMetadata.download_url === "string")
+                downloadUrl = rawMetadata.download_url;
+            else
+                throw new Error("AUN 分享附件缺少内容或下载票据");
+        }
+        else
+            rawMetadata = await client.storage.stat(`/${ref.objectKey}`, options);
+        const metadata = checkedMetadata(rawMetadata, ref);
+        total += metadata.size;
+        if (total > attachments_1.MAX_TOTAL_ATTACHMENT_BYTES)
+            throw new Error("单条消息附件总大小不能超过 64 MiB");
+        entries.push({ ref, options, inlineContent, downloadUrl, ...metadata });
+    }
+    const result = [];
+    for (const { ref, options, inlineContent, downloadUrl, size, contentType, sha256 } of entries) {
+        if (inlineContent !== undefined && (inlineContent.length > Math.ceil(attachments_1.MAX_ATTACHMENT_BYTES / 3) * 4 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(inlineContent)))
+            throw new Error("AUN 分享附件 Base64 无效");
+        let data;
+        if (inlineContent !== undefined)
+            data = new Uint8Array(Buffer.from(inlineContent, "base64"));
+        else if (downloadUrl !== undefined)
+            data = await readDownloadTicket(downloadUrl, size);
+        else {
+            try {
+                data = await client.storage.readBytes(`/${ref.objectKey}`, { ...options, limit: attachments_1.MAX_ATTACHMENT_BYTES + 1 });
+            }
+            catch (error) {
+                const failure = error;
+                const inlineLimit = ["EINLINE", "EINLINE_LIMIT", "ERR_INLINE_LIMIT", "INLINE_LIMIT", "-32033"].includes(String(failure.code)) || failure.code === -32602 && /inline/i.test(failure.message ?? "");
+                if (!inlineLimit || !client.storage.lowlevel?.createDownloadTicket)
+                    throw error;
+                const ticket = await client.storage.lowlevel.createDownloadTicket({ owner: ref.ownerAid, bucket: ref.bucket, objectKey: ref.objectKey });
+                if (typeof ticket.download_url !== "string")
+                    throw new Error("AUN 附件缺少下载票据");
+                if (ticket.sha256 && ticket.sha256 !== sha256 && ticket.sha256 !== ref.sha256)
+                    throw new Error("AUN 附件下载票据哈希不一致");
+                data = await readDownloadTicket(ticket.download_url, size);
+            }
+        }
+        if (!(data instanceof Uint8Array) || data.byteLength !== size)
+            throw new Error("AUN 附件大小校验失败");
+        const actualHash = digest(data);
+        if (ref.sha256 && actualHash !== ref.sha256.toLowerCase() || sha256 && actualHash !== sha256)
+            throw new Error("AUN 附件哈希校验失败");
+        result.push({ kind: imageTypes.has(contentType) ? "image" : "file", data, filename: (0, attachments_1.attachmentFilename)(ref.filename), contentType });
+    }
+    (0, attachments_1.validateAttachments)(result);
+    return result;
+}
+function checkedDownloadUrl(url) {
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.hash || !url.hostname.includes(".") || /^(?:localhost|127\.|0\.|10\.|192\.168\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.)/.test(url.hostname) || url.hostname.includes(":"))
+        throw new Error("AUN 下载地址无效");
+    return url;
+}
+async function readDownloadTicket(value, expectedSize) {
+    let url = checkedDownloadUrl(new URL(value));
+    const signal = AbortSignal.timeout(60_000);
+    let response;
+    // 票据和每跳地址都需校验；共用超时，不携带 AID 凭据或向跳转地址补充查询参数。
+    for (let redirects = 0;; redirects++) {
+        response = await fetch(url.href, { redirect: "manual", signal });
+        if (![301, 302, 303, 307, 308].includes(response.status))
+            break;
+        const location = response.headers.get("location");
+        await response.body?.cancel();
+        if (!location)
+            throw new Error("AUN 附件下载重定向缺少地址");
+        if (redirects >= 3)
+            throw new Error("AUN 附件下载重定向次数过多");
+        url = checkedDownloadUrl(new URL(location, url));
+    }
+    if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        throw new Error(`AUN 附件下载失败：HTTP ${response.status}`);
+    }
+    const length = response.headers.get("content-length");
+    if (length !== null && Number(length) !== expectedSize) {
+        await response.body.cancel();
+        throw new Error("AUN 附件大小校验失败");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > expectedSize)
+                throw new Error("AUN 附件大小校验失败");
+            chunks.push(item.value);
+        }
+    }
+    finally {
+        await reader.cancel();
+    }
+    if (size !== expectedSize)
+        throw new Error("AUN 附件大小校验失败");
+    return new Uint8Array(Buffer.concat(chunks));
+}
+async function downloadAunAttachment(client, ref) { return (await downloadAunAttachments(client, [ref]))[0]; }
+async function uploadAunAttachments(client, ownerAid, peerAid, items) {
+    (0, attachments_1.validateAttachments)(items);
+    if (!aidPattern.test(ownerAid) || !aidPattern.test(peerAid))
+        throw new Error("AUN 附件分享 AID 无效");
+    const result = [];
+    for (const item of items) {
+        const filename = (0, attachments_1.attachmentFilename)(item.filename);
+        const objectKey = `shared/${(0, node_crypto_1.randomUUID)()}/${filename.replace(/[^A-Za-z0-9._-]/g, "_")}`;
+        const sha256 = digest(item.data);
+        const ref = { ownerAid, bucket: "default", objectKey, filename, contentType: item.contentType.toLowerCase(), sizeBytes: item.data.byteLength, sha256 };
+        const uploaded = await client.storage.writeBytes(`/${objectKey}`, item.data, { contentType: item.contentType, public: false, overwrite: false });
+        checkedMetadata({ ...uploaded, size: uploaded.size ?? uploaded.size_bytes ?? item.data.byteLength }, ref);
+        const share = await client.storage.lowlevel.createShareLink({ owner: ownerAid, bucket: "default", objectKey, allowedAids: [peerAid], expireInSeconds: 86400 });
+        if (share.owner_aid && share.owner_aid !== ownerAid || share.bucket && share.bucket !== "default" || share.object_key && share.object_key !== objectKey)
+            throw new Error("AUN 附件分享对象不一致");
+        if (share.allowed_aids !== undefined && (!Array.isArray(share.allowed_aids) || share.allowed_aids.length !== 1 || share.allowed_aids[0] !== peerAid))
+            throw new Error("AUN 附件分享授权不一致");
+        const shareId = typeof share.share_id === "string" && /^[A-Za-z0-9]{10}$/.test(share.share_id) ? share.share_id : undefined;
+        if (share.share_id !== undefined && !shareId)
+            throw new Error("AUN 附件分享标识无效");
+        const url = typeof share.path_url === "string" && share.path_url ? share.path_url : shareId ? `https://${ownerAid}/${objectKey}?t=${shareId}` : "";
+        const token = url ? pathToken(url, ownerAid, objectKey) : undefined;
+        if (!token || shareId && shareId !== token)
+            throw new Error("AUN 附件分享链接无效");
+        result.push({ owner_aid: ownerAid, bucket: "default", object_key: objectKey, url, filename, content_type: item.contentType, size_bytes: item.data.byteLength, sha256 });
+    }
+    return result;
+}

package/dist/src-ts/plugins/aun/index.js

@@ -9,13 +9,15 @@ const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_url_1 = require("node:url");
 const messages_1 = require("./messages");
+const attachments_1 = require("./attachments");
 const manifest = {
-    id: "aun", version: "1.0.21", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.23", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
     capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
     managementPage: "/abweb/channels/aun",
 };
+const newSessionCommand = /^\/new(?:[ \t]+[^\r\n]+)?$/;
 async function loadSdk() {
     const resolver = (0, node_module_1.createRequire)(__filename);
     const dynamicImport = new Function("url", "return import(url)");
@@ -36,7 +38,8 @@ const cliCommands = [
     { name: "status", summary: "查看 AUN 通道状态", usage: "mab aun status" },
     { name: "list", summary: "查看已连接 AID 和 Agent 关联", usage: "mab aun list" },
     { name: "agents", summary: "列出当前已就绪的 Agent 插件", usage: "mab aun agents" },
-    { name: "create", summary: "创建并连接 AID，可选关联 Agent", usage: "mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]", examples: ["mab aun create new.agentid.cn --owner owner.agentid.cn --agent qwenwork"] },
+    { name: "default-owner", summary: "查询或设置默认 Owner AID", usage: "mab aun default-owner [set <owner-aid>]", examples: ["mab aun default-owner", "mab aun default-owner set owner.agentid.cn"] },
+    { name: "create", summary: "创建并连接 AID，可选关联 Agent", usage: "mab aun create <aid> [--owner <owner-aid>] [--agent <plugin-id>]", examples: ["mab aun create new.agentid.cn --owner owner.agentid.cn --agent qwenwork"] },
     { name: "bind", summary: "将 AID 关联到 Agent", usage: "mab aun bind <aid> <plugin-id>", examples: ["mab aun bind new.agentid.cn qwenwork"] },
     { name: "unbind", summary: "解除 Agent 与 AID 的关联", usage: "mab aun unbind <plugin-id>", examples: ["mab aun unbind qwenwork"] },
 ];
@@ -58,6 +61,7 @@ class AunPlugin {
     clients = new Map();
     identities = new Set();
     legacyCreatedAids = new Set();
+    createdAids = new Set();
     bindings = {};
     bindingTimes = {};
     creating = false;
@@ -68,6 +72,8 @@ class AunPlugin {
     status = "degraded";
     healthMessage = "尚未配置 AID";
     seen = new messages_1.DuplicateTracker();
+    pendingMessages = new Map();
+    acceptingMessages = false;
     constructor(options = {}) {
         this.options = options;
         this.sdk = options.sdk;
@@ -75,10 +81,11 @@ class AunPlugin {
     }
     identity = {
         list: async () => {
+            const own = new Set([...this.createdAids, ...this.legacyCreatedAids]);
             return {
-                evolcore: [],
-                muAgentBridge: [...this.clients.keys()].sort(),
-                localMuAgentBridge: [...this.identities].filter((aid) => !this.clients.has(aid)).sort(),
+                evolcore: [...this.clients.keys()].filter((aid) => !own.has(aid)).sort(),
+                muAgentBridge: [...this.clients.keys()].filter((aid) => own.has(aid)).sort(),
+                localMuAgentBridge: [...own].filter((aid) => !this.clients.has(aid)).sort(),
             };
         },
         create: async (aid, owner) => {
@@ -95,6 +102,8 @@ class AunPlugin {
                         const result = await this.store.register(aid);
                         if (!result.ok)
                             throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                        this.createdAids.add(aid);
+                        await this.persist();
                     }
                     const loaded = this.store.load(aid);
                     if (!loaded.ok || !loaded.data)
@@ -180,6 +189,7 @@ class AunPlugin {
     };
     async persist() {
         this.config.identities = [...this.identities].sort();
+        this.config.created_aids = [...new Set([...this.createdAids, ...this.legacyCreatedAids])].sort();
         this.config.bindings = this.bindings;
         this.config.binding_times = this.bindingTimes;
         await (0, promises_1.writeFile)((0, node_path_1.join)(this.context.dataDir, "config.json"), `${JSON.stringify(this.config, null, 2)}\n`, { mode: 0o600 });
@@ -188,6 +198,7 @@ class AunPlugin {
         this.context = context;
         this.config = { ...context.config };
         this.legacyCreatedAids.clear();
+        this.createdAids.clear();
         try {
             const created = JSON.parse(await (0, promises_1.readFile)((0, node_path_1.join)(context.dataDir, "..", "created-aids.json"), "utf8"));
             if (Array.isArray(created))
@@ -199,6 +210,10 @@ class AunPlugin {
             if (error.code !== "ENOENT")
                 context.logger.warn("读取旧版身份创建记录失败", { error: safeError(error) });
         }
+        for (const aid of Array.isArray(this.config.created_aids) ? this.config.created_aids : []) {
+            if (typeof aid === "string" && aidPattern.test(aid))
+                this.createdAids.add(aid);
+        }
         for (const key of ["aid", "owner_aid", "aun_path", "encryption_seed", "root_ca_path", "allow_from", "agent_plugin"]) {
             if (this.config[key] !== undefined && typeof this.config[key] !== "string")
                 throw new Error(`${key} 必须是字符串`);
@@ -239,6 +254,7 @@ class AunPlugin {
         }
         if (this.aid)
             this.identities.add(this.aid);
+        this.acceptingMessages = true;
         for (const aid of this.identities)
             await this.connectAid(aid);
         // 密钥库中的其余 AID 也自动连接：不再依赖 ec 或 EvolCore 进程
@@ -279,10 +295,12 @@ class AunPlugin {
     }
     async deactivate(_reason) {
         this.status = "degraded";
-        for (const { client, subscription } of this.clients.values()) {
+        this.acceptingMessages = false;
+        for (const { subscription } of this.clients.values())
             subscription?.unsubscribe();
+        await Promise.allSettled(this.pendingMessages.values());
+        for (const { client } of this.clients.values())
             await client.close();
-        }
         this.clients.clear();
         await this.store?.close();
         this.store = undefined;
@@ -487,6 +505,8 @@ class AunPlugin {
             const agents = await this.agents();
             return { message: agents.length ? `当前已就绪的 Agent 插件：\n${agents.map((agent) => `${agent.id}（${agent.displayName}）`).join("\n")}` : "暂无已就绪的 Agent 插件", data: agents };
         }
+        if (command === "default-owner")
+            return this.defaultOwnerCommand(args);
         if (command === "create")
             return this.createCommand(args);
         if (command === "bind" && args.length === 2) {
@@ -522,10 +542,29 @@ class AunPlugin {
             }
             return { message: `已解除 ${pluginId} 的 AID 关联`, data: { agent: pluginId, unboundAids } };
         }
-        if (!["status", "list", "agents", "create", "bind", "unbind"].includes(command ?? ""))
+        if (!["status", "list", "agents", "default-owner", "create", "bind", "unbind"].includes(command ?? ""))
             throw new AunCommandError(`未知 AUN 命令：${command ?? ""}`);
         throw new AunCommandError(`AUN 命令参数无效：${command}`);
     }
+    async defaultOwnerCommand(args) {
+        const owner = typeof this.config.owner_aid === "string" ? this.config.owner_aid.trim() : "";
+        if (!args.length)
+            return { message: owner ? `默认 Owner：${owner}` : "未配置默认 Owner", data: { owner_aid: owner || undefined } };
+        if (args.length !== 2 || args[0] !== "set")
+            throw new AunCommandError("AUN 默认 Owner 命令参数无效");
+        const nextOwner = args[1].trim();
+        if (!aidPattern.test(nextOwner))
+            throw new AunCommandError("Owner AID 格式无效");
+        this.config.owner_aid = nextOwner;
+        try {
+            await this.persist();
+        }
+        catch (error) {
+            this.config.owner_aid = owner;
+            throw error;
+        }
+        return { message: "默认 Owner 已保存", data: { configured: true } };
+    }
     async createCommand(args) {
         const aid = args[0] ?? "";
         if (!aidPattern.test(aid))
@@ -544,8 +583,10 @@ class AunPlugin {
             else
                 throw new AunCommandError(`不支持的创建参数：${option}`);
         }
+        if (!owner)
+            owner = typeof this.config.owner_aid === "string" ? this.config.owner_aid.trim() : "";
         if (!owner || !aidPattern.test(owner))
-            throw new AunCommandError("需要有效的 --owner AID");
+            throw new AunCommandError("需要有效的 --owner AID，或先设置默认 Owner");
         if (agent) {
             this.validatePluginId(agent);
             await this.requireAgent(agent);
@@ -700,26 +741,109 @@ class AunPlugin {
         }
     };
     async onMessage(payload, aid) {
+        if (!this.acceptingMessages)
+            return;
         const message = (0, messages_1.normalizeAunMessage)(payload, aid, typeof this.config.allow_from === "string" ? this.config.allow_from : undefined);
         if (!message || !this.seen.add(message.messageId ? `${aid}:${message.messageId}` : ""))
             return;
+        const sourceKey = JSON.stringify([aid, message.peerId, message.threadId ?? ""]);
+        const pending = this.pendingMessages.get(sourceKey);
+        if (pending && !message.attachments?.length && !message.attachmentError && newSessionCommand.test(message.text.trim())) {
+            try {
+                await this.sendText(aid, message.peerId, "新建会话失败：当前会话正在执行任务，请等待完成后再新建会话", message.threadId);
+            }
+            catch (error) {
+                this.context?.logger.warn("AUN 错误回复失败", { error: safeError(error) });
+            }
+            return;
+        }
+        const current = (pending ?? Promise.resolve()).catch(() => undefined).then(() => this.processMessage(message, aid));
+        this.pendingMessages.set(sourceKey, current);
+        try {
+            await current;
+        }
+        finally {
+            if (this.pendingMessages.get(sourceKey) === current)
+                this.pendingMessages.delete(sourceKey);
+        }
+    }
+    async processMessage(message, aid) {
+        let replyAttempted = false;
+        const client = this.clients.get(aid)?.client;
+        let attachments = [];
+        let uploadedItems;
+        let uploadedRefs;
+        try {
+            if (message.attachmentError)
+                throw new Error(message.attachmentError);
+            if (message.attachments?.length) {
+                if (!client?.storage)
+                    throw new Error("AUN SDK 不支持附件存储接口");
+                attachments = await (0, attachments_1.downloadAunAttachments)({ storage: client.storage }, message.attachments);
+            }
+        }
+        catch (error) {
+            this.context?.logger.warn("AUN 附件下载失败", { error: safeError(error) });
+            try {
+                await this.sendText(aid, message.peerId, `附件接收失败：${safeError(error)}`, message.threadId);
+            }
+            catch { /* 尽力反馈 */ }
+            return;
+        }
         const channelMessage = {
             channel: "aun", recipientId: aid, peerId: message.peerId, messageId: message.messageId, text: message.text, threadId: message.threadId,
+            ...(attachments.length ? { attachments } : {}),
             agentPlugin: this.bindings[aid] || (typeof this.config.agent_plugin === "string" && this.config.agent_plugin.trim() ? this.config.agent_plugin.trim() : "qwenwork"),
             reply: async (text) => {
                 if (!text.trim())
                     return;
-                const payload = { type: "text", text };
-                if (message.threadId)
-                    payload.thread_id = message.threadId;
-                const params = { to: message.peerId, payload, encrypt: true };
+                replyAttempted = true;
+                await this.sendText(aid, message.peerId, text, message.threadId);
+            },
+            replyAttachments: async (items, text) => {
+                if (!items.length)
+                    return;
+                replyAttempted = true;
+                let sent = 0;
+                let groupsCount = 0;
+                let sending = false;
                 try {
-                    await this.clients.get(aid).client.call("message.send", params);
+                    if (!client?.storage)
+                        throw new Error("AUN SDK 不支持附件存储接口");
+                    const refs = uploadedRefs && uploadedItems === items ? uploadedRefs : await (0, attachments_1.uploadAunAttachments)({ storage: client.storage }, aid, message.peerId, items);
+                    if (!uploadedRefs || uploadedItems !== items) {
+                        uploadedItems = items;
+                        uploadedRefs = refs;
+                    }
+                    const groups = new Map();
+                    for (const [index, item] of items.entries()) {
+                        const kind = item.kind;
+                        const ref = refs[index];
+                        const group = groups.get(kind) ?? [];
+                        group.push(ref);
+                        groups.set(kind, group);
+                    }
+                    groupsCount = groups.size;
+                    for (const [kind, group] of groups) {
+                        const payload = { type: kind, text: text || (kind === "image" ? "图片已生成。" : "文件已生成。"), attachments: group };
+                        if (message.threadId)
+                            payload.thread_id = message.threadId;
+                        if (message.messageId)
+                            payload.ref_message_id = message.messageId;
+                        sending = true;
+                        // message.send 失败时可能已送达，不自动重试或降级明文，避免重复发送和泄露引用。
+                        await client.call("message.send", { to: message.peerId, payload, encrypt: true });
+                        sending = false;
+                        sent++;
+                    }
                 }
                 catch (error) {
-                    if (!this.isE2eeError(error))
-                        throw error;
-                    await this.clients.get(aid).client.call("message.send", { ...params, encrypt: false });
+                    const progress = sending ? `（已确认发送 ${sent}/${groupsCount} 组，当前组结果未确认，请勿重复发送）` : "";
+                    try {
+                        await this.sendText(aid, message.peerId, `附件回传失败${progress}：${safeError(error)}`, message.threadId);
+                    }
+                    catch { /* 尽力反馈 */ }
+                    throw error;
                 }
             },
         };
@@ -728,6 +852,29 @@ class AunPlugin {
         }
         catch (error) {
             this.context?.logger.warn("AUN 消息处理失败", { error: safeError(error) });
+            if (!replyAttempted) {
+                const action = attachments.length > 0 ? "附件处理失败" : newSessionCommand.test(message.text.trim()) ? "新建会话失败" : "消息处理失败";
+                try {
+                    await channelMessage.reply(`${action}：${safeError(error)}`);
+                }
+                catch (replyError) {
+                    this.context?.logger.warn("AUN 错误回复失败", { error: safeError(replyError) });
+                }
+            }
+        }
+    }
+    async sendText(aid, peerId, text, threadId) {
+        const payload = { type: "text", text };
+        if (threadId)
+            payload.thread_id = threadId;
+        const params = { to: peerId, payload, encrypt: true };
+        try {
+            await this.clients.get(aid).client.call("message.send", params);
+        }
+        catch (error) {
+            if (!this.isE2eeError(error))
+                throw error;
+            await this.clients.get(aid).client.call("message.send", { ...params, encrypt: false });
         }
     }
     isE2eeError(error) {
@@ -775,5 +922,6 @@ async function readResponse(response, limit) {
     return Buffer.concat(chunks).toString("utf8");
 }
 function redact(message) {
-    return message.replace(/(private[_ -]?key|seed|token|certificate)\s*[:=]\s*[^\s,;]+/gi, "$1=[已隐藏]");
+    return message.replace(/https?:\/\/[^\s"'<>]+/gi, (value) => value.includes("?") ? `${value.slice(0, value.indexOf("?"))}?[已隐藏]` : value)
+        .replace(/(private[_ -]?key|seed|token|share_id|certificate)["']?\s*[:=]\s*["']?[^\s,;"'}]+/gi, "$1=[已隐藏]");
 }

package/dist/src-ts/plugins/aun/messages.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DuplicateTracker = void 0;
 exports.normalizeAunMessage = normalizeAunMessage;
+const attachments_1 = require("./attachments");
+const attachments_2 = require("../../attachments");
 function normalizeAunMessage(payload, selfAid, allowFrom) {
     if (!payload || typeof payload !== "object")
         return undefined;
@@ -12,13 +14,35 @@ function normalizeAunMessage(payload, selfAid, allowFrom) {
         return undefined;
     const body = data.payload && typeof data.payload === "object" ? data.payload : {};
     const text = typeof data.payload === "string" ? data.payload : typeof body.text === "string" ? body.text : "";
-    if (!text.trim())
+    let attachments = [];
+    let attachmentError;
+    if (body.attachments !== undefined) {
+        try {
+            if (!Array.isArray(body.attachments))
+                throw new Error("AUN 附件列表无效");
+            if (body.attachments.length > attachments_2.MAX_ATTACHMENTS)
+                throw new Error("单条消息最多包含 8 个附件");
+            attachments = body.attachments.map((item) => {
+                const ref = (0, attachments_1.parseAunAttachment)(item);
+                if (!ref.token && ref.ownerAid !== peerId)
+                    throw new Error("AUN 附件所有者必须是消息对端，第三方对象需要显式分享令牌");
+                return ref;
+            });
+        }
+        catch (error) {
+            attachments = [];
+            attachmentError = error instanceof Error ? error.message : "AUN 附件引用无效";
+        }
+    }
+    if (!text.trim() && !attachments.length && !attachmentError)
         return undefined;
     return {
         peerId,
         ...(typeof data.message_id === "string" ? { messageId: data.message_id } : {}),
         text,
         ...(typeof body.thread_id === "string" ? { threadId: body.thread_id } : {}),
+        ...(attachments.length ? { attachments } : {}),
+        ...(attachmentError ? { attachmentError } : {}),
     };
 }
 class DuplicateTracker {

package/dist/src-ts/plugins/aun/public/index.html

@@ -6,7 +6,7 @@
     <header><h1>AUN 身份</h1><button id="refresh" type="button">刷新</button></header>
     <p id="status" role="status"></p>
     <div class="table-scroll"><table><thead><tr><th>AID</th><th>来源</th><th>已关联 Agent</th><th>操作</th></tr></thead><tbody id="identities"></tbody></table></div>
-    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner 保存为本地归属配置；不代表 AUN 协议中的 Owner 关系已激活。</small></label></div><button type="submit">创建</button></form>
+    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" placeholder="例如：owner.agentid.cn"><small class="hint">留空时使用已配置的默认 Owner；未配置时需填写。Owner 保存为本地归属配置；不代表 AUN 协议中的 Owner 关系已激活。</small></label></div><button type="submit">创建</button></form>
     <form id="config-form"><h2>通道配置</h2><div class="fields"><label>默认 Agent<select name="agent_plugin"></select></label><label>允许的来源<input name="allow_from"></label><label>AUN 存储路径<input name="aun_path"></label><label>加密种子<input name="encryption_seed" type="password" autocomplete="new-password" placeholder="留空则不修改"></label></div><button type="submit">保存配置</button></form>
   </main>
   <script src="/abweb/channels/aun/app.js"></script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bridge-aun",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "mu-agent-bridge 的 AUN 通道插件。",
   "keywords": [
     "mu-agent-bridge-plugin",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "aun",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "type": "channel",
   "displayName": "AUN 通道",
   "entry": "dist/src-ts/plugins/aun/index.js",