agent-bridge-aun 1.0.45-sdk0531.4 → 1.0.46

package/README.md

@@ -6,6 +6,7 @@
 mab directory list --self agentrouter.agentid.cn --page 1 --limit 20 --format json
 mab directory show test001.agentid.cn --self agentrouter.agentid.cn --format json
 mab aun repair-owner old.agentid.cn --owner owner.agentid.cn --json
+mab aun repair-old-aids --json
 ```
 
 `mab aun directory` 与 `mab directory` 等价；新核心提供快捷入口，旧核心可使用前者。`show` 支持完整 AID（可带 `@`）或完整名称，`info` 与 `show` 等价。`--format json` 与 `--json` 等价，输出 `{ok,message,data}`；失败码在 `data.code`，SDK 拒绝读取时附带 `data.sdkCode`。只有一个连接时可省略 `--self`，多连接必须指定。
@@ -14,6 +15,8 @@ mab aun repair-owner old.agentid.cn --owner owner.agentid.cn --json
 
 旧 AID 修复不重新注册、不替换密钥、不改变 Agent 关联、不重启桌面。拥有本地 Owner 私钥时走 SDK 双边修复，否则提交正式请求等待合法 Owner 确认。仅新鲜共识核验成功才返回 `data.status: repaired`；SDK 任务返回 completed 而共识未完成时仍返回 `pending`。`data.directorySync` 单独报告名录同步结果；用户已有的 PA 限制与屏蔽项会保留。
 
+`mab aun repair-old-aids --json` 会串行扫描已连接且关联桌面 Agent 的 AID，按每个 AID 的新鲜签名 Owner 声明执行同一修复流程。只会处理同 Owner 旧关系；无签名 Owner 声明的 AID 会跳过，Owner 需要确认时返回操作号，单项失败不会中断整批操作。CLI 连接关闭后不会启动后续 AID 的修复；已经进入的 SDK 操作不支持取消，仍可能完成当前 AID。
+
 `agent-bridge-aun` 为 mu-agent-bridge 提供 AUN 消息通道，支持使用已有 AID 或通过管理 API 注册 AID，并将收到的文本交给指定 Agent 插件处理。
 
 来源白名单默认留空，表示接受所有 AUN Peer。需要限制来源时，可在 ABWeb 的 AUN 通道设置中填写一个或多个 AID，并用英文逗号分隔；清空白名单也会恢复接受所有 Peer。
@@ -26,6 +29,16 @@ mab aun repair-owner old.agentid.cn --owner owner.agentid.cn --json
 
 该插件依赖 `@agentunion/fastaun`，要求 Node.js 22.16 或更高版本。
 
+## Owner 名片资料同步
+
+已连接的 Agent 身份在连接前订阅 SDK 的 `owned_agentmd.changed`。子 AID 使用 SDK `AIDStore.uploadAgentMd()` 更新名片后，SDK 自动通知其当前 Owner；插件以 Owner 身份刷新 `/data/directories/v2/contacts.json` 中的资料，保留用户自定义名称、备注、屏蔽项、PA 权限和未知字段。签名时间及 `agent_md_etag` 表示已同步版本；更新后的能力说明仍由对应 AID 的 `agent.md` 提供，不把名片正文混入联系人权限。
+
+Owner 没有关联 Agent 时，可在 AUN 插件配置增加 `"owner_watch_aids": ["owner.agentid.cn"]`，重载 AUN 插件生效。默认空列表；仅能加载本地已有身份，不下载私钥。专用监听使用独立稳定 slot，不注册普通聊天处理器，不出现在 Agent 的已连接 AID 列表。健康详情的 `ownerWatchAids` 显示已连接的监听身份，初次连接失败每 30 秒重试。
+
+变更事件先原子写入插件数据目录的 `owned-profiles.json`，完成名录更新后标记处理成功；重复事件不重复执行。失败每 30 秒重试，重载后恢复未完成项；每次处理读取最新验签名片和归属，归属转移后不再写入旧 Owner 名录。账本损坏时停止资料同步并保留原文件，普通聊天继续运行。日志包含 Owner、子 AID、事件编号、阶段和具体错误；健康详情提供 `ownedProfileSync` 与 `ownedProfilePending`。
+
+名片上传成功仅表示提交成功，不能据此声称 Owner 已收到或名录已刷新。SDK 当前没有公开的未发送通知 flush 接口；插件只能重试已经收到的应用事件，不能保证补发未进入服务端持久消息链路的通知。本轮没有增加名片编辑器。
+
 ## 原生文件命令
 
 `mab fs` 与 `mab aun fs` 共用 AUN 插件当前连接，不要求安装或运行 EvolCore。`--as` 只能选择后台已连接的身份；只有一个连接时可省略，多连接时必须指定。远端后端根据经过验证的名片类型选择，不依赖 Owner 名录同步。

package/config.schema.json

@@ -33,6 +33,13 @@
       "type": "string",
       "minLength": 1
     },
+    "owner_watch_aids": {
+      "type": "array",
+      "default": [],
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]{2,63}\\.[a-z0-9-]+(?:\\.[a-z0-9-]+)+$" },
+      "description": "显式监听名片变更的本地 Owner AID。独立连接不转发聊天；修改后重载 AUN 插件生效。"
+    },
     "agent_plugin": {
       "type": "string",
       "description": "兼容旧配置；消息只按 AID 的显式关联路由。"

package/dist/src-ts/plugins/aun/index.js

@@ -28,8 +28,9 @@ const owner_directory_1 = require("./owner-directory");
 const directory_1 = require("./directory");
 const ownership_1 = require("./ownership");
 const sdk_loader_1 = require("./sdk-loader");
+const owned_profiles_1 = require("./owned-profiles");
 const manifest = {
-    id: "aun", version: "1.0.45-sdk0531.4", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.46", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
     capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
@@ -74,6 +75,7 @@ const cliCommands = [
     { name: "unbind", summary: "解除指定 AID 与 Agent 的关联", usage: "mab aun unbind <aid>", examples: ["mab aun unbind old.agentid.cn"] },
     { name: "directory", summary: "只读查询当前身份的 Owner 名录", usage: directory_1.AUN_DIRECTORY_USAGE },
     { name: "repair-owner", summary: "显式修复旧 AID 的同 Owner 归属及名录", usage: "mab aun repair-owner <已连接 AID> --owner <Owner AID> [--json]" },
+    { name: "repair-old-aids", summary: "检查并修复已关联桌面 Agent 的旧 AID", usage: "mab aun repair-old-aids [--json]" },
     { name: "fs", summary: "使用当前 AUN 连接访问原生文件系统", usage: fs_commands_1.AUN_FS_USAGE, examples: ["mab fs stat remote.agentid.cn:/readme.txt --as local.agentid.cn --json", "mab aun fs cat remote.agentid.cn:/readme.txt --as local.agentid.cn"] },
 ];
 class AunCommandError extends Error {
@@ -92,6 +94,11 @@ class AunPlugin {
     sdk;
     store;
     clients = new Map();
+    ownerClients = new Map();
+    ownerStore;
+    ownedProfiles;
+    ownedProfileTimer;
+    ownedProfileRetry;
     identities = new Set();
     legacyCreatedAids = new Set();
     createdAids = new Set();
@@ -387,6 +394,7 @@ class AunPlugin {
                         connection.subscription = undefined;
                 }
                 if (!connection) {
+                    this.clients.get(aid)?.ownedSubscription?.unsubscribe();
                     try {
                         await this.clients.get(aid)?.client.close();
                     }
@@ -432,6 +440,7 @@ class AunPlugin {
             }
             const connection = this.clients.get(aid);
             connection?.subscription?.unsubscribe();
+            connection?.ownedSubscription?.unsubscribe();
             try {
                 await connection?.client.close();
             }
@@ -451,7 +460,7 @@ class AunPlugin {
     async syncOwnerDirectory(aid, ownerAid) {
         if (aid === ownerAid)
             throw new Error("新 AID 与 Owner AID 相同，未写入 Owner 名录");
-        let client = this.clients.get(ownerAid)?.client;
+        let client = this.ownerClients.get(ownerAid)?.client ?? this.clients.get(ownerAid)?.client;
         let temporary = false;
         if (!client) {
             const loaded = this.store?.load(ownerAid);
@@ -531,6 +540,8 @@ class AunPlugin {
         }
         if (this.config.verify_ssl !== undefined && typeof this.config.verify_ssl !== "boolean")
             throw new Error("verify_ssl 必须是布尔值");
+        if (this.config.owner_watch_aids !== undefined && (!Array.isArray(this.config.owner_watch_aids) || !this.config.owner_watch_aids.every(aid => typeof aid === "string" && aidPattern.test(aid))))
+            throw new Error("owner_watch_aids 必须是有效 Owner AID 数组");
         if (this.config.delivery_mode !== undefined && !["fanout", "queue"].includes(String(this.config.delivery_mode)))
             throw new Error("delivery_mode 只能是 fanout 或 queue");
         if (this.config.aid && !aidPattern.test(String(this.config.aid)))
@@ -560,6 +571,12 @@ class AunPlugin {
             context.logger.error("AUN 对端消息账本不可读，已停止对端发送与查询；普通聊天仍可用", { error: safeError(error) });
         }
         this.store = this.newStore();
+        try {
+            this.ownedProfiles = await owned_profiles_1.OwnedProfileSync.open((0, node_path_1.join)(context.dataDir, "owned-profiles.json"), (ownerAid, event) => this.refreshOwnedProfile(ownerAid, event));
+        }
+        catch (error) {
+            context.logger.error("Owner 资料同步账本不可读，已停用资料同步；普通聊天仍可用", { error: safeError(error) });
+        }
         for (const [method, path, handler] of [
             ["POST", "/api/plugins/aun/aid", this.createAid],
             ["GET", "/api/plugins/aun/identities", this.listIdentities],
@@ -612,6 +629,107 @@ class AunPlugin {
             if (aidPattern.test(aid))
                 await this.connectAid(aid);
         }
+        if (this.ownedProfiles) {
+            try {
+                await this.retryOwnedProfiles();
+            }
+            catch (error) {
+                context.logger.warn("Owner 资料同步恢复失败，将继续重试；普通聊天仍可用", { stage: "恢复资料同步账本", error: safeError(error) });
+            }
+            this.ownedProfileTimer = setInterval(() => {
+                void this.retryOwnedProfiles().catch(error => context.logger.warn("Owner 资料同步重试失败", { stage: "持久化资料同步结果", error: safeError(error) }));
+            }, 30_000);
+            this.ownedProfileTimer.unref();
+        }
+    }
+    async retryOwnedProfiles() {
+        if (this.ownedProfileRetry)
+            return this.ownedProfileRetry;
+        const run = (async () => {
+            for (const ownerAid of new Set(this.config.owner_watch_aids)) {
+                if (!this.acceptingMessages)
+                    return;
+                if (!this.ownerClients.has(ownerAid))
+                    await this.connectOwner(ownerAid);
+            }
+            if (this.acceptingMessages)
+                await this.ownedProfiles?.retry();
+        })();
+        this.ownedProfileRetry = run;
+        try {
+            await run;
+        }
+        finally {
+            this.ownedProfileRetry = undefined;
+        }
+    }
+    async connectOwner(ownerAid) {
+        try {
+            await this.prepareTrustRoots(ownerAid);
+            this.ownerStore ??= this.newStore("mab-owned-profiles");
+            const loaded = this.ownerStore.load(ownerAid);
+            if (!loaded.ok || !loaded.data)
+                throw new Error("Owner AID 不在本地密钥库，无法监听资料变更");
+            const client = new this.sdk.AUNClient(loaded.data.aid);
+            const subscription = client.on("owned_agentmd.changed", payload => this.onOwnedProfile(ownerAid, payload));
+            this.ownerClients.set(ownerAid, { client, subscription });
+            try {
+                await client.connect({ auto_reconnect: true });
+            }
+            catch (error) {
+                this.ownerClients.delete(ownerAid);
+                subscription.unsubscribe();
+                try {
+                    await client.close();
+                }
+                catch (closeError) {
+                    this.context?.logger.warn("Owner 资料监听连接失败后的关闭也失败", { ownerAid, error: safeError(closeError) });
+                }
+                throw error;
+            }
+            this.context?.logger.info("Owner 资料监听已连接", { ownerAid });
+        }
+        catch (error) {
+            this.context?.logger.warn("Owner 资料监听连接失败", { ownerAid, stage: "连接 Owner", error: safeError(error) });
+        }
+    }
+    async onOwnedProfile(ownerAid, payload) {
+        if (!this.acceptingMessages || !this.ownedProfiles)
+            throw new Error("Owner 资料同步尚未就绪");
+        try {
+            await this.ownedProfiles.handle(ownerAid, payload);
+        }
+        catch (error) {
+            this.context?.logger.warn("Owner 资料事件处理失败，未确认完成", { ownerAid, stage: "持久化并处理资料事件", error: safeError(error) });
+            throw error;
+        }
+    }
+    async refreshOwnedProfile(ownerAid, event) {
+        let stage = "读取最新名片及归属";
+        try {
+            const client = this.ownerClients.get(ownerAid)?.client ?? this.clients.get(ownerAid)?.client;
+            if (!client?.storage || !this.store)
+                throw new Error("Owner 当前未连接或 Storage 不可用，保留待同步事件");
+            const verified = await (0, ownership_1.readAunOwnership)(this.store, client, event.aid);
+            if (verified.ownership.status !== "consensus")
+                throw new Error(`归属尚未确认：${verified.ownership.status}`);
+            if (verified.ownership.owner_aid !== ownerAid) {
+                this.context?.logger.info("名片已不属于原 Owner，取消旧名录同步", { ownerAid, aid: event.aid, eventId: event.event_id });
+                return;
+            }
+            const card = verified.agentMd;
+            const signedAt = Number(card.signature?.timestamp);
+            if (!card.etag || !Number.isSafeInteger(signedAt) || signedAt < 0)
+                throw new Error("已验证名片缺少有效 ETag 或签名时间");
+            const document = (0, yaml_1.parseDocument)(card.content.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/)[1], { uniqueKeys: true }).toJS({ maxAliasCount: 0 });
+            stage = "写入 Owner 名录";
+            await (0, owner_directory_1.addOwnerContact)(client.storage, event.aid, ownerAid, Date.now(), { name: typeof document.name === "string" ? document.name : undefined, type: verified.type, signedAt, etag: card.etag });
+            this.context?.logger.info("Owner 名片资料已同步", { ownerAid, aid: event.aid, eventId: event.event_id, etag: card.etag });
+        }
+        catch (error) {
+            this.context?.logger.warn("Owner 名片资料同步失败，将重试", { ownerAid, aid: event.aid, eventId: event.event_id, stage, error: safeError(error) });
+            throw error;
+        }
     }
     subscribeAid(aid) {
         const connection = this.clients.get(aid);
@@ -626,18 +744,22 @@ class AunPlugin {
             if (!loaded.ok || !loaded.data)
                 throw new Error(loaded.error?.message ?? "本地密钥库中不存在该 AID");
             const client = new this.sdk.AUNClient(loaded.data.aid);
+            const ownedSubscription = this.ownedProfiles && !this.config.owner_watch_aids?.includes(aid)
+                ? client.on("owned_agentmd.changed", payload => this.onOwnedProfile(aid, payload)) : undefined;
             const subscription = this.bindings[aid]
                 ? client.on("message.received", (payload) => this.onMessage(payload, aid))
                 : undefined;
+            this.clients.set(aid, { client, subscription, ownedSubscription });
             try {
                 await client.connect();
             }
             catch (error) {
+                this.clients.delete(aid);
                 subscription?.unsubscribe();
+                ownedSubscription?.unsubscribe();
                 await client.close();
                 throw error;
             }
-            this.clients.set(aid, { client, subscription });
             this.status = "ready";
             this.healthMessage = "已连接";
         }
@@ -651,9 +773,35 @@ class AunPlugin {
     async deactivate(_reason) {
         this.status = "degraded";
         this.acceptingMessages = false;
+        if (this.ownedProfileTimer)
+            clearInterval(this.ownedProfileTimer);
+        this.ownedProfileTimer = undefined;
         this.ownerProof.clear();
-        for (const { subscription } of this.clients.values())
+        for (const { subscription, ownedSubscription } of this.clients.values()) {
             subscription?.unsubscribe();
+            ownedSubscription?.unsubscribe();
+        }
+        for (const { subscription } of this.ownerClients.values())
+            subscription.unsubscribe();
+        await this.ownedProfileRetry?.catch(() => undefined);
+        await this.ownedProfiles?.close();
+        this.ownedProfiles = undefined;
+        for (const [ownerAid, { client }] of this.ownerClients) {
+            try {
+                await client.close();
+            }
+            catch (error) {
+                this.context?.logger.warn("关闭 Owner 资料监听失败，继续清理", { ownerAid, error: safeError(error) });
+            }
+        }
+        this.ownerClients.clear();
+        try {
+            await this.ownerStore?.close();
+        }
+        catch (error) {
+            this.context?.logger.warn("关闭 Owner 资料密钥库失败，继续清理", { error: safeError(error) });
+        }
+        this.ownerStore = undefined;
         await this.abilityOperations?.interruptExecuting();
         await Promise.allSettled(this.inboundMessages);
         await Promise.allSettled(this.pendingMessages.values());
@@ -671,7 +819,7 @@ class AunPlugin {
         this.context = undefined;
     }
     async health() {
-        return { status: this.clients.size ? "ready" : this.status, message: this.healthMessage, details: { aid: this.aid || undefined, connected: this.clients.size > 0, aids: [...this.clients.keys()], identities: [...this.identities], bindings: this.bindings } };
+        return { status: this.clients.size || this.ownerClients.size ? "ready" : this.status, message: this.healthMessage, details: { aid: this.aid || undefined, connected: this.clients.size > 0, aids: [...this.clients.keys()], identities: [...this.identities], bindings: this.bindings, ownerWatchAids: [...this.ownerClients.keys()], ownedProfileSync: this.ownedProfiles ? "ready" : "unavailable", ownedProfilePending: this.ownedProfiles?.pending } };
     }
     async handle(_request) { throw new Error("AUN 是入站通道插件"); }
     path() {
@@ -680,9 +828,9 @@ class AunPlugin {
             return configured;
         return (0, node_path_1.resolve)(process.env.AUN_HOME ?? process.env.EVOLCORE_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".evolcore"));
     }
-    newStore() {
+    newStore(slotId) {
         const rootCaPath = this.rootCaPath();
-        return new this.sdk.AIDStore({ aunPath: this.path(), encryptionSeed: typeof this.config.encryption_seed === "string" && this.config.encryption_seed ? this.config.encryption_seed : "evol", verifySsl: typeof this.config.verify_ssl === "boolean" ? this.config.verify_ssl : true, rootCaPath: (0, node_fs_1.existsSync)(rootCaPath) ? rootCaPath : undefined });
+        return new this.sdk.AIDStore({ aunPath: this.path(), encryptionSeed: typeof this.config.encryption_seed === "string" && this.config.encryption_seed ? this.config.encryption_seed : "evol", verifySsl: typeof this.config.verify_ssl === "boolean" ? this.config.verify_ssl : true, rootCaPath: (0, node_fs_1.existsSync)(rootCaPath) ? rootCaPath : undefined, ...(slotId ? { slotId } : {}) });
     }
     rootCaPath() {
         return typeof this.config.root_ca_path === "string" && this.config.root_ca_path
@@ -1092,6 +1240,11 @@ class AunPlugin {
         this.json(response, 200, { protocolVersion: 1, plugin: "aun", version: manifest.version, commands: cliCommands });
     };
     runCommand = async (request, response) => {
+        const controller = new AbortController();
+        const onClose = () => { if (!response.writableEnded)
+            controller.abort(); };
+        if (typeof response.on === "function")
+            response.on("close", onClose);
         try {
             const chunks = [];
             let size = 0;
@@ -1112,22 +1265,31 @@ class AunPlugin {
             if (!input || typeof input !== "object" || input.protocolVersion !== 1 || !Array.isArray(input.argv) || !input.argv.every((arg) => typeof arg === "string")) {
                 throw new AunCommandError("命令请求格式无效");
             }
-            if (["fs", "directory", "repair-owner"].includes(input.argv[0]) && !this.context?.managementActor?.(request))
+            const command = input.argv[0];
+            const legacyLocalCommand = !this.context?.managementActor && ["directory", "repair-owner", "repair-old-aids"].includes(command) && isLoopback(request.socket?.remoteAddress);
+            if (["fs", "directory", "repair-owner", "repair-old-aids"].includes(command) && !this.context?.managementActor?.(request) && !legacyLocalCommand)
                 throw new AunCommandError("AUN 文件、名录及归属命令需要本机或已认证的管理身份", 403, { code: "MANAGEMENT_AUTH_REQUIRED" });
-            const result = await this.executeCommand(input.argv);
-            this.commandResult(response, 200, true, result.message, result.data);
+            const result = await this.executeCommand(input.argv, controller.signal);
+            const batchFailed = command === "repair-old-aids" && !!result.data && typeof result.data === "object" && Number(result.data.failed) > 0;
+            this.commandResult(response, batchFailed ? 502 : 200, !batchFailed, result.message, result.data);
         }
         catch (error) {
             const failure = error instanceof AunCommandError ? error : error instanceof fs_1.AunFsError ? new AunCommandError(safeError(error), 400, { code: error.code, ...(error.sdkCode === undefined ? {} : { sdkCode: error.sdkCode }) }) : new AunCommandError(safeError(error), 502);
             this.commandResult(response, failure.statusCode, false, failure.message, failure.data);
         }
+        finally {
+            if (typeof response.off === "function")
+                response.off("close", onClose);
+        }
     };
-    async executeCommand(argv) {
+    async executeCommand(argv, signal) {
         const [command, ...args] = argv;
         if (command === "directory")
             return this.directoryCommand(args);
         if (command === "repair-owner")
             return this.repairOwnerCommand(args);
+        if (command === "repair-old-aids")
+            return this.repairOldAidsCommand(args, signal);
         if (command === "fs") {
             if (!args.length || args.length === 1 && ["help", "--help"].includes(args[0]))
                 return { message: fs_commands_1.AUN_FS_USAGE };
@@ -1289,6 +1451,51 @@ class AunPlugin {
             this.repairingOwners.delete(aid);
         }
     }
+    async repairOldAidsCommand(args, signal) {
+        if (args.length)
+            throw new AunCommandError("用法：mab aun repair-old-aids [--json]");
+        const aids = Object.keys(this.bindings).filter(aid => this.clients.has(aid)).sort();
+        const results = [];
+        let scanned = 0;
+        for (const aid of aids) {
+            if (signal?.aborted)
+                break;
+            scanned++;
+            try {
+                const client = this.clients.get(aid).client;
+                const verified = await (0, ownership_1.readAunOwnership)(this.store, client, aid);
+                if (signal?.aborted) {
+                    results.push({ aid, status: "cancelled", reason: "CLI 连接已关闭，未开始归属修复" });
+                    break;
+                }
+                if (verified.type !== "agent" || !verified.declaredOwner || !["consensus", "single_sided", "unbound"].includes(verified.ownership.status)) {
+                    results.push({ aid, status: "skipped", reason: "没有可验证的同 Owner 旧关系，未执行修复" });
+                    continue;
+                }
+                const repaired = await this.repairOwnerCommand([aid, "--owner", verified.declaredOwner]);
+                results.push({ aid, ...repaired.data, message: repaired.message });
+            }
+            catch (error) {
+                const details = error instanceof AunCommandError && error.data && typeof error.data === "object" ? error.data : undefined;
+                const ownerAid = typeof details?.ownerAid === "string" ? details.ownerAid : undefined;
+                results.push({
+                    aid,
+                    ...(ownerAid ? { ownerAid } : {}),
+                    nextAction: ownerAid ? "请将 AID、Owner AID 和错误码交给对应 Owner 或主机管理员" : "请将 AID 和错误码交给本机 AUN 或主机管理员核查签名归属；不要猜测 Owner",
+                    status: "failed",
+                    code: details?.code ?? (error instanceof fs_1.AunFsError ? error.code : "OWNERSHIP_REPAIR_FAILED"),
+                    ...(details?.stage ? { stage: details.stage } : {}),
+                    ...(details?.operationId ? { operationId: details.operationId } : {}),
+                    ...(error instanceof fs_1.AunFsError && error.sdkCode !== undefined ? { sdkCode: error.sdkCode } : {}),
+                    message: safeError(error),
+                });
+            }
+        }
+        const count = (status) => results.filter(result => result.status === status).length;
+        const summary = { scanned, repaired: count("repaired"), pending: count("pending"), skipped: count("skipped"), failed: count("failed"), cancelled: signal?.aborted ?? false, results };
+        this.context?.logger.info(signal?.aborted ? "AUN 批量旧身份修复因 CLI 连接关闭而停止" : "AUN 批量旧身份修复完成", { scanned: summary.scanned, repaired: summary.repaired, pending: summary.pending, skipped: summary.skipped, failed: summary.failed, cancelled: summary.cancelled });
+        return { message: `已检查 ${summary.scanned} 个已连接并关联桌面 Agent 的 AID：修复 ${summary.repaired}，等待 Owner ${summary.pending}，跳过 ${summary.skipped}，失败 ${summary.failed}`, data: summary };
+    }
     async defaultOwnerCommand(args) {
         const owner = typeof this.config.owner_aid === "string" ? this.config.owner_aid.trim() : "";
         if (!args.length)
@@ -1981,6 +2188,9 @@ exports.default = AunPlugin;
 function safeError(error) {
     return redact(error instanceof Error ? error.message : String(error));
 }
+function isLoopback(address) {
+    return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
 function fsOutput(result, management = false) {
     return JSON.parse(JSON.stringify(result, (key, value) => /previewBase64|private[_-]?key/i.test(key) || !management && /token|share_id/i.test(key) ? "[已隐藏]" : !management && typeof value === "string" && key !== "text" ? redact(value) : value));
 }

package/dist/src-ts/plugins/aun/owned-profiles.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnedProfileSync = void 0;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const aidPattern = /^[a-z0-9][a-z0-9_-]{2,63}\.[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+function valid(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const entry = value;
+    return [entry.ownerAid, entry.aid].every(aid => typeof aid === "string" && aidPattern.test(aid))
+        && [entry.etag, entry.event_id].every(text => typeof text === "string" && text.length > 0 && text.length <= 512) && typeof entry.pending === "boolean";
+}
+class OwnedProfileSync {
+    file;
+    apply;
+    entries = new Map();
+    work = Promise.resolve();
+    closed = false;
+    constructor(file, apply) {
+        this.file = file;
+        this.apply = apply;
+    }
+    static async open(file, apply) {
+        const store = new OwnedProfileSync(file, apply);
+        let raw;
+        try {
+            raw = await (0, promises_1.readFile)(file, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return store;
+            throw error;
+        }
+        let snapshot;
+        try {
+            snapshot = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Owner 资料同步账本损坏");
+        }
+        if (!snapshot || snapshot.version !== 1 || !Array.isArray(snapshot.entries) || !snapshot.entries.every(valid))
+            throw new Error("Owner 资料同步账本格式无效");
+        for (const entry of snapshot.entries) {
+            const key = JSON.stringify([entry.ownerAid, entry.aid]);
+            if (store.entries.has(key))
+                throw new Error("Owner 资料同步账本存在重复身份");
+            store.entries.set(key, entry);
+        }
+        return store;
+    }
+    get pending() { return [...this.entries.values()].filter(entry => entry.pending).length; }
+    serial(run) {
+        if (this.closed)
+            return Promise.reject(new Error("Owner 资料同步已关闭"));
+        const next = this.work.catch(() => undefined).then(run);
+        this.work = next;
+        return next;
+    }
+    async persist(key, entry) {
+        const next = new Map(this.entries).set(key, entry);
+        await (0, promises_1.mkdir)((0, node_path_1.dirname)(this.file), { recursive: true, mode: 0o700 });
+        const temp = `${this.file}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+        try {
+            const handle = await (0, promises_1.open)(temp, "wx", 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify({ version: 1, entries: [...next.values()] })}\n`, "utf8");
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await (0, promises_1.rename)(temp, this.file);
+            this.entries = next;
+        }
+        finally {
+            await (0, promises_1.rm)(temp, { force: true });
+        }
+    }
+    handle(ownerAid, value) {
+        if (!value || typeof value !== "object" || !valid({ ...value, ownerAid, pending: true }))
+            return Promise.reject(new Error("Owner 名片变更事件格式无效"));
+        const event = value;
+        return this.serial(async () => {
+            const key = JSON.stringify([ownerAid, event.aid]), previous = this.entries.get(key);
+            if (previous?.event_id === event.event_id && !previous.pending)
+                return;
+            const entry = { aid: event.aid, etag: event.etag, event_id: event.event_id, ownerAid, pending: true };
+            this.entries.set(key, entry);
+            await this.persist(key, entry);
+            await this.apply(ownerAid, event);
+            await this.persist(key, { ...entry, pending: false });
+        });
+    }
+    retry() {
+        return this.serial(async () => {
+            for (const [key, entry] of this.entries) {
+                if (!entry.pending)
+                    continue;
+                await this.persist(key, entry);
+                try {
+                    await this.apply(entry.ownerAid, entry);
+                }
+                catch {
+                    continue;
+                }
+                await this.persist(key, { ...entry, pending: false });
+            }
+        });
+    }
+    async close() { this.closed = true; await this.work.catch(() => undefined); }
+}
+exports.OwnedProfileSync = OwnedProfileSync;

package/dist/src-ts/plugins/aun/owner-directory.js

@@ -124,7 +124,9 @@ async function readOwnerDirectory(storage, ownerAid) {
         throw new fs_1.AunFsError("DIRECTORY_INVALID", `Owner 名录校验失败：${error instanceof Error ? error.message : String(error)}`);
     }
 }
-async function addOwnerContact(storage, aid, ownerAid, now = Date.now()) {
+async function addOwnerContact(storage, aid, ownerAid, now = Date.now(), profile) {
+    if (profile && (!Number.isSafeInteger(profile.signedAt) || profile.signedAt < 0 || !profile.etag || typeof profile.etag !== "string" || !profile.type || typeof profile.type !== "string" || profile.name !== undefined && typeof profile.name !== "string"))
+        throw new Error("名片资料格式无效，未更新 Owner 名录");
     for (let attempt = 0; attempt < 3; attempt++) {
         let version = 0;
         let directory = newDirectory(ownerAid, now);
@@ -152,12 +154,31 @@ async function addOwnerContact(storage, aid, ownerAid, now = Date.now()) {
             }
             validate(directory, ownerAid);
         }
-        if (directory.entries.some((entry) => entry.aid === aid))
+        const existing = directory.entries.find((entry) => entry.aid === aid);
+        if (existing && !profile)
             return { status: "synced" };
         if (directory.groups.some((group) => group.group_aid === aid)
-            || directory.blocked_aids.some((item) => item.target_id === aid))
+            || directory.blocked_aids.some((item) => item.target_id === aid)) {
+            if (profile)
+                return { status: "synced" };
             throw new Error("新 AID 已被 Owner 名录中的群组或屏蔽项占用");
-        directory.entries.push({ aid, name: aid, remark: "", agent_md_signed_at: null, owner_aid: ownerAid, type: "agent", allow_pa_use: true });
+        }
+        const entry = existing ?? { aid, name: aid, remark: "", agent_md_signed_at: null, owner_aid: ownerAid, type: "agent", allow_pa_use: true };
+        if (profile) {
+            const updated = { ...entry, owner_aid: ownerAid, type: profile.type, agent_md_signed_at: profile.signedAt, agent_md_etag: profile.etag };
+            if ((!entry.name || entry.name === aid || entry.name === entry.agent_md_name) && profile.name)
+                updated.name = profile.name;
+            if (profile.name)
+                updated.agent_md_name = profile.name;
+            if (existing && canonical(updated) === canonical(existing))
+                return { status: "synced" };
+            if (existing)
+                Object.assign(existing, updated);
+            else
+                directory.entries.push(updated);
+        }
+        else
+            directory.entries.push(entry);
         directory.total = directory.entries.length;
         directory.group_total = directory.groups.length;
         directory.updated_at_ms = now;
@@ -181,7 +202,7 @@ async function addOwnerContact(storage, aid, ownerAid, now = Date.now()) {
                 await storage.stat(exports.OWNER_CONTACTS_PATH, { owner: ownerAid, bucket: "default" });
                 const latest = JSON.parse(Buffer.from(await storage.readBytes(exports.OWNER_CONTACTS_PATH, { owner: ownerAid, bucket: "default" })).toString("utf8"));
                 validate(latest, ownerAid);
-                if (latest.entries.some((entry) => entry.aid === aid))
+                if (latest.entries.some((entry) => entry.aid === aid && (!profile || entry.agent_md_etag === profile.etag && entry.agent_md_signed_at === profile.signedAt)))
                     return { status: "synced" };
             }
             catch { /* 写入结果仍未知，向调用方报告原始错误。 */ }

package/dist/src-ts/plugins/aun/ownership.js

@@ -39,5 +39,5 @@ async function readAunOwnership(store, client, aid) {
     }
     if (ownership.status === "consensus" && (!declared || ownership.owner_aid !== declared))
         throw new fs_1.AunFsError("OWNERSHIP_UNVERIFIED", "归属核验失败：Owner 共识与签名声明不一致");
-    return { type: meta.type, declaredOwner: typeof declared === "string" ? declared : undefined, ownership };
+    return { type: meta.type, declaredOwner: typeof declared === "string" ? declared : undefined, ownership, agentMd: card };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bridge-aun",
-  "version": "1.0.45-sdk0531.4",
+  "version": "1.0.46",
   "description": "mu-agent-bridge 的 AUN 通道插件。",
   "keywords": [
     "mu-agent-bridge-plugin",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "aun",
-  "version": "1.0.45-sdk0531.4",
+  "version": "1.0.46",
   "type": "channel",
   "displayName": "AUN 通道",
   "entry": "dist/src-ts/plugins/aun/index.js",