agent-bridge-aun 1.0.46 → 1.0.49

package/dist/src-ts/plugins/aun/index.js

@@ -20,6 +20,7 @@ const ability_publication_1 = require("./ability-publication");
 const ability_operations_1 = require("./ability-operations");
 const ability_operation_store_1 = require("./ability-operation-store");
 const ability_owner_1 = require("./ability-owner");
+const ability_control_1 = require("./ability-control");
 const fs_1 = require("./fs");
 const fs_commands_1 = require("./fs-commands");
 const fs_transfer_1 = require("./fs-transfer");
@@ -30,7 +31,7 @@ const ownership_1 = require("./ownership");
 const sdk_loader_1 = require("./sdk-loader");
 const owned_profiles_1 = require("./owned-profiles");
 const manifest = {
-    id: "aun", version: "1.0.46", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.49", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
     capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
@@ -107,6 +108,8 @@ class AunPlugin {
     abilitySelections = {};
     abilityLedgers = {};
     abilityOwners = {};
+    abilityOwnerVerifications = {};
+    abilityOwnerVerificationWrites = new Map();
     abilityOperations;
     peerMessages;
     abilityAuditUnavailable = false;
@@ -114,6 +117,7 @@ class AunPlugin {
     abilityPublications = new Map();
     revokingAbilityAids = new Set();
     abilityRevisions = new Map();
+    abilityApprovalViews = new Map();
     creating = false;
     repairingOwners = new Set();
     unregister = [];
@@ -511,8 +515,43 @@ class AunPlugin {
         this.config.ability_selections = this.abilitySelections;
         this.config.ability_ledgers = this.abilityLedgers;
         this.config.ability_owners = this.abilityOwners;
+        this.config.ability_owner_verifications = this.abilityOwnerVerifications;
         await (0, promises_1.writeFile)((0, node_path_1.join)(this.context.dataDir, "config.json"), `${JSON.stringify(this.config, null, 2)}\n`, { mode: 0o600 });
     }
+    async saveAbilityOwnerVerification(aid, ownerAid) {
+        const pending = this.abilityOwnerVerificationWrites.get(aid);
+        if (pending)
+            return pending;
+        if (this.isAbilityOwnerVerified(aid, ownerAid))
+            return;
+        const operation = Promise.resolve().then(async () => {
+            if (this.abilityOwners[aid] !== ownerAid)
+                throw new Error("Provider 的 Owner 配置已改变");
+            const previous = this.abilityOwnerVerifications[aid];
+            this.abilityOwnerVerifications = { ...this.abilityOwnerVerifications, [aid]: ownerAid };
+            try {
+                await this.persist();
+            }
+            catch (error) {
+                if (previous === undefined)
+                    delete this.abilityOwnerVerifications[aid];
+                else
+                    this.abilityOwnerVerifications[aid] = previous;
+                throw error;
+            }
+        });
+        this.abilityOwnerVerificationWrites.set(aid, operation);
+        try {
+            await operation;
+        }
+        finally {
+            if (this.abilityOwnerVerificationWrites.get(aid) === operation)
+                this.abilityOwnerVerificationWrites.delete(aid);
+        }
+    }
+    isAbilityOwnerVerified(aid, ownerAid) {
+        return !this.abilityOwnerVerificationWrites.has(aid) && this.abilityOwners[aid] === ownerAid && this.abilityOwnerVerifications[aid] === ownerAid;
+    }
     async activate(context) {
         this.context = context;
         this.config = { ...context.config };
@@ -554,6 +593,7 @@ class AunPlugin {
         this.sdk ??= await loadSdk();
         await (0, promises_1.mkdir)(this.path(), { recursive: true });
         this.ownerProof.clear();
+        this.abilityApprovalViews.clear();
         this.abilityAuditUnavailable = false;
         try {
             this.abilityOperations = await ability_operation_store_1.AbilityOperationStore.open((0, node_path_1.join)(context.dataDir, "ability-operations.json"));
@@ -610,12 +650,21 @@ class AunPlugin {
             || Object.entries(owners).some(([provider, owner]) => !aidPattern.test(provider) || typeof owner !== "string" || !aidPattern.test(owner))))
             throw new Error("ability_owners 必须按 Provider AID 配置有效的 Owner AID");
         this.abilityOwners = { ...owners };
+        const verifications = this.config.ability_owner_verifications;
+        if (verifications !== undefined && (!verifications || typeof verifications !== "object" || Array.isArray(verifications)
+            || Object.entries(verifications).some(([provider, owner]) => !aidPattern.test(provider) || typeof owner !== "string" || !aidPattern.test(owner))))
+            throw new Error("ability_owner_verifications 必须按 Provider AID 配置有效的 Owner AID");
+        const persistedVerifications = { ...verifications };
+        this.abilityOwnerVerifications = Object.fromEntries(Object.entries(persistedVerifications).filter(([provider, owner]) => this.abilityOwners[provider] === owner));
+        const staleOwnerVerification = Object.keys(this.abilityOwnerVerifications).length !== Object.keys(persistedVerifications).length;
         for (const aid of Array.isArray(this.config.identities) ? this.config.identities : []) {
             if (typeof aid === "string" && aidPattern.test(aid))
                 this.identities.add(aid);
         }
         if (this.aid)
             this.identities.add(this.aid);
+        if (staleOwnerVerification)
+            await this.persist();
         this.acceptingMessages = true;
         // 只订阅明确关联 Agent 的身份，避免接管 EvolCore 或其它 AID 的消息。
         for (const aid of Object.keys(this.bindings)) {
@@ -735,7 +784,11 @@ class AunPlugin {
         const connection = this.clients.get(aid);
         if (!connection || connection.subscription || !this.bindings[aid])
             return;
-        connection.subscription = connection.client.on("message.received", (payload) => this.onMessage(payload, aid));
+        connection.subscription = connection.client.on("message.received", (payload) => this.enqueueMessage(payload, aid));
+    }
+    enqueueMessage(payload, aid) {
+        // SDK 串行等待事件回调；任务由现有入站账本排空，不能占住 SDK 的消息分发队列。
+        void this.onMessage(payload, aid).catch(error => this.context?.logger.warn("AUN 入站消息处理失败", { aid, stage: "处理已接收消息", error: safeError((0, agent_1.errorDetails)(error)) }));
     }
     async connectAid(aid) {
         try {
@@ -747,7 +800,7 @@ class AunPlugin {
             const ownedSubscription = this.ownedProfiles && !this.config.owner_watch_aids?.includes(aid)
                 ? client.on("owned_agentmd.changed", payload => this.onOwnedProfile(aid, payload)) : undefined;
             const subscription = this.bindings[aid]
-                ? client.on("message.received", (payload) => this.onMessage(payload, aid))
+                ? client.on("message.received", (payload) => this.enqueueMessage(payload, aid))
                 : undefined;
             this.clients.set(aid, { client, subscription, ownedSubscription });
             try {
@@ -777,6 +830,7 @@ class AunPlugin {
             clearInterval(this.ownedProfileTimer);
         this.ownedProfileTimer = undefined;
         this.ownerProof.clear();
+        this.abilityApprovalViews.clear();
         for (const { subscription, ownedSubscription } of this.clients.values()) {
             subscription?.unsubscribe();
             ownedSubscription?.unsubscribe();
@@ -932,7 +986,7 @@ class AunPlugin {
             for (const aid of Object.keys(this.bindings)) {
                 const definitions = await this.abilityDefinitions(aid);
                 const ownerAid = this.abilityOwners[aid];
-                const ownerVerified = Boolean(session && ownerAid && this.ownerProof.verified(session, aid, ownerAid));
+                const ownerVerified = Boolean(session && ownerAid && this.isAbilityOwnerVerified(aid, ownerAid));
                 const publishAvailable = Boolean(this.context?.managementActor?.(request) && ownerVerified && this.context?.callPluginAbility && this.abilityOperations && !this.abilityAuditUnavailable);
                 result[aid] = { agent: this.bindings[aid], selected: this.abilitySelections[aid] ?? [], definitions, published: Object.keys(this.abilityLedgers[aid] ?? {}).length > 0, pluginVersion: this.context?.pluginVersion?.(this.bindings[aid]), ownerAid, ownerVerified, publishAvailable, reason: publishAvailable ? "需本机已认证管理会话，每次执行仍须明确批准。" : "逐次 Owner 确认需本机已认证管理会话，并验证明确配置的 Owner AID；已有索引仍可撤销。" };
             }
@@ -954,42 +1008,52 @@ class AunPlugin {
             const paths = publish ? (Array.isArray(body.paths) && body.paths.every((path) => typeof path === "string") ? body.paths : undefined) : [];
             if (!paths)
                 return this.json(response, 400, { error: "发布路径必须是字符串数组" });
-            if (paths.length) {
-                const session = this.context?.managementSession?.(request);
-                const owner = this.abilityOwners[aid];
-                if (!session || !owner || !this.ownerProof.verified(session, aid, owner) || !this.context?.callPluginAbility || !this.abilityOperations || this.abilityAuditUnavailable)
-                    return this.json(response, 409, { error: "逐次 Owner 确认需可用操作账本、本机已认证管理会话，并先验证该 Provider 的 Owner AID" });
-                const operation = (this.abilityPublications.get(aid) ?? Promise.resolve()).catch(() => undefined).then(async () => {
-                    if (!this.ownerProof.verified(session, aid, owner) || this.abilityOwners[aid] !== owner || this.revokingAbilityAids.has(aid))
-                        throw new Error("Owner 验证已失效或身份正在撤销，请重新确认");
-                    const storage = this.clients.get(aid)?.client.storage;
-                    if (!storage)
-                        throw new Error("AUN 身份存储不可用");
-                    const pluginId = this.bindings[aid];
-                    const definitions = await this.abilityDefinitions(aid);
-                    const published = await (0, ability_publication_1.publishAbilityCatalog)({ storage, aid, pluginId, pluginVersion: this.context?.pluginVersion?.(pluginId) ?? "", definitions: definitions.map(definition => ({ ...definition })), selectedPaths: paths, ledger: this.abilityLedgers[aid] ?? {}, beforeIndexWrite: async (pending) => { this.abilityLedgers[aid] = pending; await this.persist(); } });
-                    this.abilityLedgers[aid] = published.ledger;
-                    this.abilitySelections[aid] = [...new Set(paths)];
-                    await this.persist();
-                });
-                this.abilityPublications.set(aid, operation);
-                try {
-                    await operation;
-                }
-                finally {
-                    if (this.abilityPublications.get(aid) === operation)
-                        this.abilityPublications.delete(aid);
-                }
-                return this.json(response, 200, { ok: true, aid, revoked: false });
-            }
-            await this.revokePublishedAbilities(aid);
-            return this.json(response, 200, { ok: true, aid, revoked: true });
+            const context = this.context;
+            const session = context.managementSession?.(request);
+            await this.setPublishedAbilities(aid, paths, () => this.context === context && Boolean(context.managementActor?.(request))
+                && (!paths.length || Boolean(session && context.managementSession?.(request)?.id === session.id)));
+            return this.json(response, 200, { ok: true, aid, revoked: !paths.length });
         }
         catch (error) {
             this.context?.logger.warn("AUN Ability 能力索引更新失败", { error: safeError(error) });
             return this.json(response, 409, { error: safeError(error) });
         }
     };
+    async setPublishedAbilities(aid, paths, authorized) {
+        const owner = this.abilityOwners[aid];
+        const assertAuthorized = () => {
+            if (paths.length && (!owner || !this.isAbilityOwnerVerified(aid, owner) || !this.context?.callPluginAbility || !this.abilityOperations || this.abilityAuditUnavailable || this.revokingAbilityAids.has(aid)))
+                throw new Error("逐次 Owner 确认需可用操作账本和已验证的 Owner AID，请重新确认");
+            if (!authorized())
+                throw new Error("能力发布的管理身份已失效");
+        };
+        assertAuthorized();
+        if (!paths.length) {
+            await this.revokePublishedAbilities(aid);
+            return;
+        }
+        const operation = (this.abilityPublications.get(aid) ?? Promise.resolve()).catch(() => undefined).then(async () => {
+            assertAuthorized();
+            const storage = this.clients.get(aid)?.client.storage;
+            if (!storage)
+                throw new Error("AUN 身份存储不可用");
+            const pluginId = this.bindings[aid];
+            const definitions = await this.abilityDefinitions(aid);
+            assertAuthorized();
+            const published = await (0, ability_publication_1.publishAbilityCatalog)({ storage, aid, pluginId, pluginVersion: this.context?.pluginVersion?.(pluginId) ?? "", definitions: definitions.map(definition => ({ ...definition })), selectedPaths: paths, ledger: this.abilityLedgers[aid] ?? {}, beforeIndexWrite: async (pending) => { assertAuthorized(); this.abilityLedgers[aid] = pending; await this.persist(); assertAuthorized(); } });
+            this.abilityLedgers[aid] = published.ledger;
+            this.abilitySelections[aid] = [...new Set(paths)];
+            await this.persist();
+        });
+        this.abilityPublications.set(aid, operation);
+        try {
+            await operation;
+        }
+        finally {
+            if (this.abilityPublications.get(aid) === operation)
+                this.abilityPublications.delete(aid);
+        }
+    }
     challengeAbilityOwner = async (request, response) => {
         const session = this.context?.managementSession?.(request);
         if (!this.context?.managementActor?.(request) || !session)
@@ -1000,19 +1064,28 @@ class AunPlugin {
             const ownerAid = typeof body.ownerAid === "string" ? body.ownerAid.trim() : "";
             if (!aidPattern.test(aid) || !this.bindings[aid] || !aidPattern.test(ownerAid))
                 return this.json(response, 400, { error: "需要已关联的 Provider AID 和明确指定的 Owner AID" });
+            if (this.isAbilityOwnerVerified(aid, ownerAid))
+                return this.json(response, 200, { ok: true, aid, ownerAid, alreadyVerified: true });
             if (this.abilityOwners[aid] !== ownerAid) {
                 this.revokingAbilityAids.add(aid);
                 this.abilityRevisions.set(aid, (this.abilityRevisions.get(aid) ?? 0) + 1);
                 this.ownerProof.clear(aid);
+                for (const key of this.abilityApprovalViews.keys())
+                    if (JSON.parse(key)[0] === aid)
+                        this.abilityApprovalViews.delete(key);
                 try {
                     await this.invalidateAbilityOperations(aid);
                     const previous = this.abilityOwners;
+                    const previousVerifications = this.abilityOwnerVerifications;
                     this.abilityOwners = { ...previous, [aid]: ownerAid };
+                    this.abilityOwnerVerifications = { ...previousVerifications };
+                    delete this.abilityOwnerVerifications[aid];
                     try {
                         await this.persist();
                     }
                     catch (error) {
                         this.abilityOwners = previous;
+                        this.abilityOwnerVerifications = previousVerifications;
                         throw error;
                     }
                 }
@@ -1021,7 +1094,7 @@ class AunPlugin {
                 }
             }
             const challenge = this.ownerProof.start(session, aid, ownerAid);
-            await this.callAunWithRecovery(aid, { to: ownerAid, encrypt: true, payload: { type: "text", text: `请在本次管理会话发起后回复以下指令，证明你控制 Owner AID。此操作只验证身份，不批准任何能力调用：\n/ability-owner ${challenge.nonce}` } });
+            await this.callAunWithRecovery(aid, { to: ownerAid, encrypt: true, payload: { type: "text", text: `AUN Ability 管理授权确认\nProvider AID：${aid}\nOwner AID：${ownerAid}\n用途：管理本 Provider 已公开的 Ability，并逐项确认能力调用。\n请直接回复：确认\n确认截止：${new Date(challenge.expiresAt).toLocaleString("zh-CN")}（最长 12 小时，受发起管理会话有效期限制）。\n此操作只验证 Owner 身份，不批准任何能力调用。` } });
             this.context?.logger.info("AUN Owner 会话验证已发起，需本机已认证管理会话", { aid, ownerAid });
             this.json(response, 200, { ok: true, aid, ownerAid, expiresAt: challenge.expiresAt });
         }
@@ -1043,82 +1116,233 @@ class AunPlugin {
         const session = this.context?.managementSession?.(request);
         if (!this.context?.managementActor?.(request) || !session)
             return this.json(response, 403, { error: "逐次 Owner 确认需本机已认证管理会话" });
-        const store = this.abilityOperations;
-        if (!store || this.abilityAuditUnavailable)
-            return this.json(response, 503, { error: "持久操作账本不可用" });
         try {
             const body = await this.readJsonBody(request);
             if (typeof body.key !== "string" || typeof body.confirmationFingerprint !== "string" || typeof body.approved !== "boolean")
                 return this.json(response, 400, { error: "必须明确提交操作键、完整确认指纹和批准或拒绝决定" });
-            const original = await store.get(body.key);
-            if (!original)
-                return this.json(response, 404, { error: "能力操作不存在" });
-            const ownerAid = this.abilityOwners[original.providerAid];
-            if (!ownerAid || !this.ownerProof.verified(session, original.providerAid, ownerAid))
-                return this.json(response, 403, { error: "需本机已认证管理会话，并完成该 Provider 的 Owner AID 验证" });
-            if (original.confirmationFingerprint !== body.confirmationFingerprint)
-                return this.json(response, 409, { error: "确认指纹与待确认请求不一致" });
-            const revision = this.abilityRevisions.get(original.providerAid) ?? 0;
-            if (body.approved && original.state === "pending_confirmation") {
-                const failure = await this.abilityInvocationFailure(original.providerAid, original.authenticatedCaller, original.path, original.definitionId, original.params);
-                const pluginId = this.bindings[original.providerAid];
-                if (failure || (this.abilityRevisions.get(original.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(original.providerAid) || original.executionTarget.pluginId !== pluginId || original.executionTarget.ownerAid !== ownerAid || original.executionTarget.pluginVersion !== (this.context?.pluginVersion?.(pluginId) ?? ""))
-                    return this.json(response, 409, { error: failure?.message ?? "能力执行目标或 Owner 配置已改变，请重新发起调用" });
-            }
-            if (!this.acceptingMessages || !this.ownerProof.verified(session, original.providerAid, ownerAid))
-                return this.json(response, 403, { error: "通道或 Owner 管理会话已失效" });
-            const confirmation = body.approved ? await store.approve(original.key, body.confirmationFingerprint) : await store.reject(original.key, body.confirmationFingerprint);
-            let entry = confirmation.entry;
-            if (confirmation.started) {
-                let result;
-                let state;
-                let handlerAuthorized = false;
-                try {
-                    const failure = await this.abilityInvocationFailure(entry.providerAid, entry.authenticatedCaller, entry.path, entry.definitionId, entry.params);
-                    const expired = Date.now() >= entry.expiresAt;
-                    const invalidated = (this.abilityRevisions.get(entry.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(entry.providerAid);
-                    if (failure || expired || invalidated || !this.ownerProof.verified(session, entry.providerAid, ownerAid) || this.abilityOwners[entry.providerAid] !== entry.executionTarget.ownerAid || this.bindings[entry.providerAid] !== entry.executionTarget.pluginId || (this.context?.pluginVersion?.(String(entry.executionTarget.pluginId)) ?? "") !== entry.executionTarget.pluginVersion) {
-                        result = { ...(0, ability_operations_1.abilityFailureResult)({ call_id: entry.callId, operation_id: entry.operationId, ability_path: entry.path, definition_id: entry.definitionId }, expired ? "message_expired" : failure?.code ?? (invalidated ? "provider_invalidated" : "permission_denied"), expired ? "调用已超过最晚启动时间" : failure?.message ?? "Owner 管理会话或执行目标已改变，本次能力没有执行"), execution_state: "not_executed" };
-                        state = "failed";
+            const context = this.context;
+            const result = await this.decideAbilityOperation(body.key, body.confirmationFingerprint, body.approved, () => this.context === context && Boolean(context.managementActor?.(request)) && context.managementSession?.(request)?.id === session.id);
+            this.json(response, 200, result);
+        }
+        catch (error) {
+            this.json(response, error instanceof AunCommandError ? error.statusCode : 409, { error: safeError(error) });
+        }
+    };
+    async decideAbilityOperation(key, fingerprint, approved, authorized, providerAid) {
+        const store = this.abilityOperations;
+        if (!store || this.abilityAuditUnavailable)
+            throw new AunCommandError("持久操作账本不可用", 503);
+        const original = await store.get(key);
+        if (!original || (providerAid !== undefined && original.providerAid !== providerAid))
+            throw new AunCommandError("能力操作不存在", 404);
+        const ownerAid = this.abilityOwners[original.providerAid];
+        if (!ownerAid || !this.isAbilityOwnerVerified(original.providerAid, ownerAid))
+            throw new AunCommandError("需完成该 Provider 的 Owner AID 验证", 403);
+        if (original.confirmationFingerprint !== fingerprint)
+            throw new AunCommandError("确认指纹与待确认请求不一致", 409);
+        const revision = this.abilityRevisions.get(original.providerAid) ?? 0;
+        if (approved && original.state === "pending_confirmation") {
+            const failure = await this.abilityInvocationFailure(original.providerAid, original.authenticatedCaller, original.path, original.definitionId, original.params);
+            const pluginId = this.bindings[original.providerAid];
+            if (failure || (this.abilityRevisions.get(original.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(original.providerAid) || original.executionTarget.pluginId !== pluginId || original.executionTarget.ownerAid !== ownerAid || original.executionTarget.pluginVersion !== (this.context?.pluginVersion?.(pluginId) ?? ""))
+                throw new AunCommandError(failure?.message ?? "能力执行目标或 Owner 配置已改变，请重新发起调用", 409);
+        }
+        if (!authorized() || !this.acceptingMessages || !this.isAbilityOwnerVerified(original.providerAid, ownerAid))
+            throw new AunCommandError("通道或 Owner 管理会话已失效", 403);
+        const confirmation = approved ? await store.approve(original.key, fingerprint) : await store.reject(original.key, fingerprint);
+        let entry = confirmation.entry;
+        if (confirmation.started) {
+            let result;
+            let state;
+            let handlerAuthorized = false;
+            try {
+                const failure = await this.abilityInvocationFailure(entry.providerAid, entry.authenticatedCaller, entry.path, entry.definitionId, entry.params);
+                const messageExpired = Date.now() >= entry.expiresAt;
+                const confirmationExpired = Date.now() >= entry.confirmationExpiresAt;
+                const expired = messageExpired || confirmationExpired;
+                const invalidated = (this.abilityRevisions.get(entry.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(entry.providerAid);
+                if (failure || expired || invalidated || !authorized() || !this.isAbilityOwnerVerified(entry.providerAid, ownerAid) || this.abilityOwners[entry.providerAid] !== entry.executionTarget.ownerAid || this.bindings[entry.providerAid] !== entry.executionTarget.pluginId || (this.context?.pluginVersion?.(String(entry.executionTarget.pluginId)) ?? "") !== entry.executionTarget.pluginVersion) {
+                    result = { ...(0, ability_operations_1.abilityFailureResult)({ call_id: entry.callId, operation_id: entry.operationId, ability_path: entry.path, definition_id: entry.definitionId }, expired ? (messageExpired ? "message_expired" : "confirmation_expired") : failure?.code ?? (invalidated ? "provider_invalidated" : "permission_denied"), messageExpired ? "调用已超过最晚启动时间" : confirmationExpired ? "Owner 确认申请已过期，不会执行" : failure?.message ?? "Owner 管理会话或执行目标已改变，本次能力没有执行"), execution_state: "not_executed" };
+                    state = "failed";
+                }
+                else {
+                    const context = this.context;
+                    const confirmed = entry;
+                    const beforeStart = () => {
+                        if (this.context !== context || this.abilityOperations !== store || this.abilityAuditUnavailable || !this.acceptingMessages || !authorized() || !this.isAbilityOwnerVerified(confirmed.providerAid, ownerAid) || this.abilityOwners[confirmed.providerAid] !== ownerAid)
+                            throw Object.assign(new Error("管理会话、Owner 证明或操作账本已失效，本次能力没有执行"), { code: "confirmation_unavailable" });
+                        const pluginId = String(confirmed.executionTarget.pluginId);
+                        const rules = String(this.config.allow_from ?? "").split(",").map(value => value.trim()).filter(Boolean);
+                        if ((this.abilityRevisions.get(confirmed.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(confirmed.providerAid) || !this.clients.has(confirmed.providerAid) || this.bindings[confirmed.providerAid] !== pluginId || this.abilityOwners[confirmed.providerAid] !== confirmed.executionTarget.ownerAid || (context.pluginVersion?.(pluginId) ?? "") !== confirmed.executionTarget.pluginVersion || context.pluginStatus(pluginId) !== "ready" || !this.abilitySelections[confirmed.providerAid]?.includes(confirmed.path) || this.abilityLedgers[confirmed.providerAid]?.[confirmed.path]?.definition_id !== confirmed.definitionId || (rules.length && !rules.includes("*") && !rules.includes(confirmed.authenticatedCaller)))
+                            throw Object.assign(new Error("Provider 发布、Owner policy 或执行目标已改变，本次能力没有执行"), { code: "provider_invalidated" });
+                        handlerAuthorized = true;
+                    };
+                    const value = await context.callPluginAbility(String(entry.executionTarget.pluginId), entry.path, entry.params, { providerAid: entry.providerAid, expiresAt: entry.expiresAt, beforeStart });
+                    result = { type: "ability", role: "result", ok: true, execution_state: "completed", result: value };
+                    state = "succeeded";
+                }
+            }
+            catch (error) {
+                this.context?.logger.warn("AUN Ability 执行失败，结果将持久保存", { aid: entry.providerAid, path: entry.path, error: safeError(error) });
+                const code = error.code;
+                const notExecuted = !handlerAuthorized && ["message_expired", "confirmation_expired", "provider_invalidated", "confirmation_unavailable"].includes(code ?? "");
+                result = { ...(0, ability_operations_1.abilityFailureResult)({ call_id: entry.callId, operation_id: entry.operationId, ability_path: entry.path, definition_id: entry.definitionId }, notExecuted ? code : "execution_failed", notExecuted ? (code === "message_expired" ? "调用已超过最晚启动时间" : code === "confirmation_expired" ? "Owner 确认申请已过期，不会执行" : "管理会话或 Provider 状态已改变，本次能力没有执行") : "能力执行失败，请检查 Provider 运行日志；不会自动重试"), execution_state: notExecuted ? "not_executed" : "failed" };
+                state = "failed";
+            }
+            entry = await store.finish(entry.key, state, result);
+        }
+        const delivered = await this.sendAbilityResponse(entry.providerAid, entry.authenticatedCaller, this.abilityOperationResponse(entry));
+        this.context?.logger.info("AUN Ability 逐次确认完成", { aid: entry.providerAid, callerAid: entry.authenticatedCaller, operationId: entry.operationId, state: entry.state, delivered });
+        return { ok: true, state: entry.state, result: entry.result, delivered };
+    }
+    abilityApprovalViewKey(aid, ownerAid, threadId) {
+        return JSON.stringify([aid, ownerAid, threadId ?? ""]);
+    }
+    async sendAbilityControlText(aid, ownerAid, text, threadId) {
+        const chunks = [];
+        const characters = Array.from(text);
+        for (let offset = 0; offset < characters.length; offset += 4000)
+            chunks.push(characters.slice(offset, offset + 4000).join(""));
+        for (const [index, part] of chunks.entries()) {
+            const message = chunks.length > 1 ? `Ability 管理消息（第 ${index + 1}/${chunks.length} 段，收全后再确认）\n${part}` : part;
+            const sent = await this.callAunWithRecovery(aid, { to: ownerAid, encrypt: true, payload: { type: "text", text: message, ...(threadId ? { thread_id: threadId } : {}) } });
+            if (typeof sent?.status !== "string" || !successfulSendStatuses.has(sent.status))
+                throw new Error(`AUN 管理回复投递状态未确认：${String(sent?.status ?? "未返回状态")}`);
+        }
+    }
+    abilityEntrySummary(entry) {
+        return [
+            `操作键：${entry.key}`,
+            `确认指纹：${entry.confirmationFingerprint}`,
+            `调用方：${entry.authenticatedCaller}`,
+            `Provider AID：${entry.providerAid}`,
+            `能力路径：${entry.path}`,
+            `definition_id：${entry.definitionId}`,
+            `原始参数：${JSON.stringify(entry.params)}`,
+            `影响：${entry.effects.join("、")}`,
+            `执行目标：${String(entry.executionTarget.pluginId)}（${String(entry.executionTarget.pluginVersion)}）`,
+            `operation_id：${entry.operationId}`,
+            `审批截止：${new Date(entry.confirmationExpiresAt).toLocaleString("zh-CN")}`,
+            `最晚启动：${new Date(entry.expiresAt).toLocaleString("zh-CN")}`,
+            `确认：/ability approve ${entry.key} ${entry.confirmationFingerprint}`,
+            `拒绝：/ability reject ${entry.key} ${entry.confirmationFingerprint}`,
+        ].join("\n");
+    }
+    async showAbilityPending(aid, ownerAid, threadId) {
+        const store = this.abilityOperations;
+        if (!store || this.abilityAuditUnavailable)
+            throw new AunCommandError("持久操作账本不可用", 503);
+        const entries = (await store.pending()).filter(entry => entry.providerAid === aid);
+        if (!entries.length) {
+            this.abilityApprovalViews.delete(this.abilityApprovalViewKey(aid, ownerAid, threadId));
+            await this.sendAbilityControlText(aid, ownerAid, "当前没有待确认的 Ability 调用。", threadId);
+            return;
+        }
+        const viewKey = this.abilityApprovalViewKey(aid, ownerAid, threadId);
+        const view = { explicit: true, entries: undefined };
+        this.abilityApprovalViews.set(viewKey, view);
+        const text = `待确认 Ability 调用清单（${entries.length} 项，仅包含本条消息展示的固定记录）\n\n${entries.map((entry, index) => `第 ${index + 1} 项\n${this.abilityEntrySummary(entry)}`).join("\n\n---\n\n")}\n\n回复“确认”或“拒绝”按本清单逐项处理；清单之后的新请求不会加入。`;
+        await this.sendAbilityControlText(aid, ownerAid, text, threadId);
+        if (this.abilityApprovalViews.get(viewKey) === view && this.abilityOperations === store && this.abilityOwners[aid] === ownerAid && this.acceptingMessages)
+            view.entries = entries.map(({ key, confirmationFingerprint }) => ({ key, confirmationFingerprint }));
+    }
+    async processAbilityControl(payload, aid) {
+        const raw = payload && typeof payload === "object" ? payload : undefined;
+        const body = raw?.payload && typeof raw.payload === "object" && !Array.isArray(raw.payload) ? raw.payload : undefined;
+        const text = typeof raw?.payload === "string" ? raw.payload : typeof body?.text === "string" ? body.text : "";
+        const isControlText = text === "确认" || text === "拒绝" || /^ *\/ability(?:\s|$)/.test(text);
+        if (!isControlText)
+            return false;
+        const ownerAid = this.abilityOwners[aid];
+        const envelope = raw?.envelope && typeof raw.envelope === "object" ? raw.envelope : undefined;
+        const sender = typeof raw?.from === "string" ? raw.from : typeof envelope?.from === "string" ? envelope.from : undefined;
+        if (ownerAid && sender !== ownerAid)
+            return text === "确认" || text === "拒绝" ? false : true;
+        if (!ownerAid && (text === "确认" || text === "拒绝"))
+            return false;
+        let authenticated = false;
+        const context = this.context;
+        const store = this.abilityOperations;
+        const revision = this.abilityRevisions.get(aid) ?? 0;
+        const authorized = () => this.context === context && this.abilityOperations === store && this.acceptingMessages && !this.revokingAbilityAids.has(aid) && this.clients.has(aid) && Boolean(this.bindings[aid]) && (this.abilityRevisions.get(aid) ?? 0) === revision && this.abilityOwners[aid] === ownerAid && this.isAbilityOwnerVerified(aid, ownerAid);
+        try {
+            const authPayload = typeof raw?.payload === "string" ? "/ability help" : { ...body, text: "/ability help" };
+            (0, ability_control_1.parseAbilityControlMessage)({ ...raw, payload: authPayload }, aid, ownerAid);
+            authenticated = true;
+            const message = (0, ability_control_1.parseAbilityControlMessage)(payload, aid, ownerAid);
+            if (!message)
+                return false;
+            if (message.messageId && !this.seen.add(`ability-control:${aid}:${message.messageId}`))
+                return true;
+            if (!this.isAbilityOwnerVerified(aid, ownerAid))
+                await this.saveAbilityOwnerVerification(aid, ownerAid);
+            const { command, peerId, threadId } = message;
+            if (command.action === "confirm-view" || command.action === "reject-view") {
+                const key = this.abilityApprovalViewKey(aid, ownerAid, threadId);
+                const view = this.abilityApprovalViews.get(key);
+                this.abilityApprovalViews.delete(key);
+                if (!view?.entries?.length) {
+                    await this.sendAbilityControlText(aid, peerId, "当前话题没有已展示的待确认清单。请先发送 /ability pending，核对清单后再回复确认或拒绝。", threadId);
+                    return true;
+                }
+                const approved = command.action === "confirm-view";
+                const results = [];
+                for (const entry of view.entries) {
+                    try {
+                        const result = await this.decideAbilityOperation(entry.key, entry.confirmationFingerprint, approved, authorized, aid);
+                        results.push(`${entry.key.slice(0, 12)}：${String(result.state)}`);
                     }
-                    else {
-                        const context = this.context;
-                        const confirmed = entry;
-                        const beforeStart = () => {
-                            const currentSession = context.managementSession?.(request);
-                            if (this.context !== context || this.abilityOperations !== store || this.abilityAuditUnavailable || !this.acceptingMessages || !context.managementActor?.(request) || !currentSession || currentSession.id !== session.id || !this.ownerProof.verified(session, confirmed.providerAid, ownerAid) || !this.ownerProof.verified(currentSession, confirmed.providerAid, ownerAid))
-                                throw Object.assign(new Error("管理会话、Owner 证明或操作账本已失效，本次能力没有执行"), { code: "confirmation_unavailable" });
-                            const pluginId = String(confirmed.executionTarget.pluginId);
-                            const rules = String(this.config.allow_from ?? "").split(",").map(value => value.trim()).filter(Boolean);
-                            if ((this.abilityRevisions.get(confirmed.providerAid) ?? 0) !== revision || this.revokingAbilityAids.has(confirmed.providerAid) || !this.clients.has(confirmed.providerAid) || this.bindings[confirmed.providerAid] !== pluginId || this.abilityOwners[confirmed.providerAid] !== confirmed.executionTarget.ownerAid || (context.pluginVersion?.(pluginId) ?? "") !== confirmed.executionTarget.pluginVersion || context.pluginStatus(pluginId) !== "ready" || !this.abilitySelections[confirmed.providerAid]?.includes(confirmed.path) || this.abilityLedgers[confirmed.providerAid]?.[confirmed.path]?.definition_id !== confirmed.definitionId || (rules.length && !rules.includes("*") && !rules.includes(confirmed.authenticatedCaller)))
-                                throw Object.assign(new Error("Provider 发布、Owner policy 或执行目标已改变，本次能力没有执行"), { code: "provider_invalidated" });
-                            handlerAuthorized = true;
-                        };
-                        const value = await context.callPluginAbility(String(entry.executionTarget.pluginId), entry.path, entry.params, { providerAid: entry.providerAid, expiresAt: entry.expiresAt, beforeStart });
-                        result = { type: "ability", role: "result", ok: true, execution_state: "completed", result: value };
-                        state = "succeeded";
+                    catch (error) {
+                        results.push(`${entry.key.slice(0, 12)}：未处理（${safeError(error)}）`);
                     }
                 }
-                catch (error) {
-                    this.context?.logger.warn("AUN Ability 执行失败，结果将持久保存", { aid: entry.providerAid, path: entry.path, error: safeError(error) });
-                    const code = error.code;
-                    const notExecuted = !handlerAuthorized && ["message_expired", "provider_invalidated", "confirmation_unavailable"].includes(code ?? "");
-                    result = { ...(0, ability_operations_1.abilityFailureResult)({ call_id: entry.callId, operation_id: entry.operationId, ability_path: entry.path, definition_id: entry.definitionId }, notExecuted ? code : "execution_failed", notExecuted ? (code === "message_expired" ? "调用已超过最晚启动时间" : "管理会话或 Provider 状态已改变，本次能力没有执行") : "能力执行失败，请检查 Provider 运行日志；不会自动重试"), execution_state: notExecuted ? "not_executed" : "failed" };
-                    state = "failed";
-                }
-                entry = await store.finish(entry.key, state, result);
+                await this.sendAbilityControlText(aid, peerId, `${approved ? "确认" : "拒绝"}处理完成：\n${results.join("\n")}`, threadId);
+                return true;
+            }
+            if (command.action === "help") {
+                await this.sendAbilityControlText(aid, peerId, "AUN Ability 管理命令：\n/ability list：查看当前 Provider 的能力\n/ability publish <路径...>：按完整路径列表发布\n/ability revoke：撤销本 Provider 的能力索引\n/ability pending：展示固定待确认清单\n/ability approve <操作键> <确认指纹>：批准单项\n/ability reject <操作键> <确认指纹>：拒绝单项\n也可在清单投递成功后回复“确认”或“拒绝”。", threadId);
+            }
+            else if (command.action === "list") {
+                const definitions = await this.abilityDefinitions(aid);
+                const selected = new Set(this.abilitySelections[aid] ?? []);
+                const lines = definitions.map(item => `${selected.has(item.path) ? "已发布" : "未发布"} ${item.path} | ${item.name} | ${(0, ability_publication_1.abilityDefinitionId)({ ...item })}`);
+                await this.sendAbilityControlText(aid, peerId, lines.length ? lines.join("\n") : "当前关联 Agent 没有可发布的 Ability。", threadId);
+            }
+            else if (command.action === "publish") {
+                await this.setPublishedAbilities(aid, command.paths, authorized);
+                await this.sendAbilityControlText(aid, peerId, `已发布 ${command.paths.length} 项 Ability：\n${command.paths.join("\n")}`, threadId);
+            }
+            else if (command.action === "revoke") {
+                this.abilityApprovalViews.delete(this.abilityApprovalViewKey(aid, ownerAid, threadId));
+                await this.setPublishedAbilities(aid, [], authorized);
+                await this.sendAbilityControlText(aid, peerId, "已撤销本 Provider 的 Ability 索引，并使现有待确认操作失效。", threadId);
+            }
+            else if (command.action === "pending")
+                await this.showAbilityPending(aid, peerId, threadId);
+            else if (command.action === "approve" || command.action === "reject") {
+                const result = await this.decideAbilityOperation(command.key, command.confirmationFingerprint, command.action === "approve", authorized, aid);
+                await this.sendAbilityControlText(aid, peerId, `Ability 操作状态：${String(result.state)}；结果已${result.delivered ? "回传 Peer" : "保存，等待重投"}。`, threadId);
             }
-            const delivered = await this.sendAbilityResponse(entry.providerAid, entry.authenticatedCaller, this.abilityOperationResponse(entry));
-            this.context?.logger.info("AUN Ability 逐次确认完成，需本机已认证管理会话", { aid: entry.providerAid, callerAid: entry.authenticatedCaller, operationId: entry.operationId, state: entry.state, delivered });
-            this.json(response, 200, { ok: true, state: entry.state, result: entry.result, delivered });
         }
         catch (error) {
-            this.json(response, 409, { error: safeError(error) });
+            const replyAid = authenticated ? ownerAid : error.code === "ability_owner_unconfigured" ? sender : undefined;
+            if (replyAid) {
+                try {
+                    await this.sendAbilityControlText(aid, replyAid, `Ability 管理操作未完成：${safeError(error)}`, typeof body?.thread_id === "string" ? body.thread_id : undefined);
+                }
+                catch (replyError) {
+                    this.context?.logger.warn("AUN Ability 管理错误回复失败", { aid, ownerAid, error: safeError(replyError) });
+                }
+            }
         }
-    };
+        return true;
+    }
     async revokePublishedAbilities(aid) {
         this.revokingAbilityAids.add(aid);
         this.abilityRevisions.set(aid, (this.abilityRevisions.get(aid) ?? 0) + 1);
+        for (const key of this.abilityApprovalViews.keys())
+            if (JSON.parse(key)[0] === aid)
+                this.abilityApprovalViews.delete(key);
         const operation = (this.abilityPublications.get(aid) ?? Promise.resolve()).catch(() => undefined).then(async () => {
             await this.invalidateAbilityOperations(aid);
             this.abilitySelections[aid] = [];
@@ -1713,18 +1937,74 @@ class AunPlugin {
             return;
         }
         const body = raw?.payload && typeof raw.payload === "object" && !Array.isArray(raw.payload) ? raw.payload : undefined;
+        const envelope = raw?.envelope && typeof raw.envelope === "object" ? raw.envelope : undefined;
+        const sender = typeof raw?.from === "string" ? raw.from : typeof envelope?.from === "string" ? envelope.from : undefined;
+        const inboundText = typeof raw?.payload === "string" ? raw.payload : typeof body?.text === "string" ? body.text : "";
+        const inboundThreadId = typeof body?.thread_id === "string" ? body.thread_id : undefined;
+        if (inboundText === "确认" && this.ownerProof.hasPendingConfirmation(aid)) {
+            const ownerAid = this.abilityOwners[aid];
+            let authenticated = false;
+            try {
+                authenticated = Boolean((0, ability_control_1.parseAbilityControlMessage)(payload, aid, ownerAid));
+            }
+            catch { /* 无效信封不能验证 Owner 身份。 */ }
+            if (!authenticated || !this.ownerProof.acceptConfirmation(aid, sender, inboundText, true)) {
+                this.context?.logger.warn("AUN Owner 确认未通过验证", { traceId: inboundId, aid, sender: sender ?? "", stage: "Owner 确认校验", reason: authenticated ? "没有有效的待确认通知" : "需要配置 Owner AID 通过加密消息直接回复确认" });
+                return;
+            }
+            if (typeof raw?.message_id === "string")
+                this.seen.add(`ability-control:${aid}:${raw.message_id}`);
+            for (const key of this.abilityApprovalViews.keys())
+                if (JSON.parse(key)[0] === aid)
+                    this.abilityApprovalViews.delete(key);
+            try {
+                await this.saveAbilityOwnerVerification(aid, ownerAid);
+            }
+            catch (error) {
+                this.context?.logger.error("AUN Owner 验证状态保存失败", { traceId: inboundId, aid, ownerAid, stage: "保存 Owner 验证", error: safeError((0, agent_1.errorDetails)(error)) });
+                try {
+                    await this.sendText(aid, sender, "Owner 控制权确认失败：验证结果无法持久保存，请检查 AUN 插件配置写入权限。", inboundThreadId, true);
+                }
+                catch (replyError) {
+                    this.context?.logger.warn("AUN Owner 验证结果回复失败", { aid, peer: sender, verified: false, stage: "发送 Owner 验证回执", error: safeError((0, agent_1.errorDetails)(replyError)) });
+                }
+                return;
+            }
+            try {
+                await this.sendText(aid, sender, `Owner 控制权验证成功：${aid} 的 Owner 已保存。此操作不会批准任何能力调用，请发送 /ability help 查看管理命令。`, inboundThreadId, true);
+            }
+            catch (error) {
+                this.context?.logger.warn("AUN Owner 验证结果回复失败", { aid, peer: sender, verified: true, stage: "发送 Owner 验证回执", error: safeError((0, agent_1.errorDetails)(error)) });
+            }
+            this.context?.logger.info("AUN Owner 确认验证成功并已持久保存", { traceId: inboundId, aid, ownerAid });
+            return;
+        }
         const ownerCommand = typeof body?.text === "string" && /^\/ability-owner(?:\s|$)/.test(body.text) ? body.text.match(/^\/ability-owner ([0-9a-f]{64})$/) : undefined;
         if (typeof body?.text === "string" && /^\/ability-owner(?:\s|$)/.test(body.text)) {
-            const envelope = raw?.envelope && typeof raw.envelope === "object" ? raw.envelope : undefined;
-            const sender = typeof raw?.from === "string" ? raw.from : typeof envelope?.from === "string" ? envelope.from : undefined;
-            const verified = Boolean(ownerCommand && (envelope?.from === undefined || envelope.from === sender) && this.ownerProof.accept(aid, sender, ownerCommand[1], raw?.encrypted === true));
+            let verified = Boolean(ownerCommand && (envelope?.from === undefined || envelope.from === sender) && this.ownerProof.accept(aid, sender, ownerCommand[1], raw?.encrypted === true));
+            if (verified) {
+                for (const key of this.abilityApprovalViews.keys())
+                    if (JSON.parse(key)[0] === aid)
+                        this.abilityApprovalViews.delete(key);
+                const ownerAid = this.abilityOwners[aid];
+                try {
+                    if (ownerAid === sender)
+                        await this.saveAbilityOwnerVerification(aid, ownerAid);
+                    else
+                        verified = false;
+                }
+                catch (error) {
+                    verified = false;
+                    this.context?.logger.error("AUN Owner 验证状态保存失败", { traceId: inboundId, aid, stage: "保存 Owner 验证", error: safeError((0, agent_1.errorDetails)(error)) });
+                }
+            }
             this.context?.logger.info("AUN 宿主委托的 Owner 控制权验证已处理", { aid, verified });
             if (sender && raw?.encrypted === true && (envelope?.from === undefined || envelope.from === sender)) {
                 const text = verified
-                    ? `Owner 控制权验证成功：${aid} 的当前管理会话已通过验证。此操作不会批准任何能力调用，请回到 ABWeb 继续操作。`
+                    ? `Owner 控制权验证成功：${aid} 的 Owner 已保存。此操作不会批准任何能力调用，请发送 /ability help 查看管理命令。`
                     : !ownerCommand
-                        ? "Owner 控制权验证失败：指令格式不正确，请复制最新验证消息中的完整 /ability-owner 指令。"
-                        : "Owner 控制权验证失败：验证指令已过期、已使用，或与本次 Owner 身份不匹配。请在 ABWeb 重新发起验证，并使用指定 Owner AID 回复。";
+                        ? "Owner 控制权验证失败：指令格式不正确。请使用已配置的 Owner AID 发送 /ability help。"
+                        : "Owner 控制权验证失败：验证指令已过期、已使用，或与本次 Owner 身份不匹配。请使用已配置的 Owner AID 发送 /ability help 重新验证。";
                 try {
                     await this.sendText(aid, sender, text, typeof body.thread_id === "string" ? body.thread_id : undefined, true);
                 }
@@ -1734,6 +2014,8 @@ class AunPlugin {
             }
             return;
         }
+        if (await this.processAbilityControl(payload, aid))
+            return;
         if ((0, ability_operations_1.isAbilityMessage)(payload)) {
             if (this.revokingAbilityAids.has(aid)) {
                 this.context?.logger.warn("AUN 身份正在撤销能力索引，能力调用已阻止", { aid, traceId: inboundId, stage: "撤销保护" });
@@ -1764,14 +2046,51 @@ class AunPlugin {
             }
             return;
         }
-        const current = (pending ?? Promise.resolve()).catch(() => undefined).then(() => this.processMessage(message, aid, agentPlugin, inboundId));
+        const queuedAt = Date.now();
+        const notices = new Set();
+        let queueTimer;
+        const reportQueue = (started = false) => {
+            if (!started && notices.size)
+                return;
+            const elapsedSeconds = Math.floor((Date.now() - queuedAt) / 1000);
+            const stage = started ? "结束会话排队" : "等待同会话前序任务";
+            const text = started ? `本条消息已结束会话排队，开始处理（排队 ${elapsedSeconds} 秒）。`
+                : elapsedSeconds === 0 ? "消息已排队：当前会话仍有任务未完成，本条将按接收顺序处理。"
+                    : `本条消息仍在排队，已等待 ${elapsedSeconds} 秒；尚未转交 Agent，前序任务完成后自动处理。`;
+            const payload = {
+                type: "notice", subtype: started ? "task.dequeued" : "task.queued", severity: "info", text,
+                task_id: message.messageId || inboundId, sent_at: Date.now(),
+                ...(message.threadId ? { thread_id: message.threadId } : {}),
+                ...(message.messageId ? { ref_message_id: message.messageId } : {}),
+            };
+            this.context?.logger.info("AUN 会话排队状态", { traceId: message.messageId || inboundId, aid, peer: message.peerId, threadId: message.threadId ?? "", agentPlugin, stage, elapsedSeconds });
+            // 通知不占执行队列；notice 不会被对端作为普通任务自动互答。
+            const notice = this.callAunWithRecovery(aid, { to: message.peerId, payload, encrypt: true })
+                .then(() => undefined)
+                .catch(error => this.context?.logger.warn("AUN 排队通知发送失败", { aid, peer: message.peerId, traceId: message.messageId || inboundId, stage, error: safeError((0, agent_1.errorDetails)(error)) }))
+                .finally(() => { notices.delete(notice); });
+            notices.add(notice);
+        };
+        const current = (pending ?? Promise.resolve()).catch(() => undefined).then(() => {
+            clearInterval(queueTimer);
+            if (pending)
+                reportQueue(true);
+            return this.processMessage(message, aid, agentPlugin, inboundId);
+        });
         this.pendingMessages.set(sourceKey, current);
+        if (pending) {
+            reportQueue();
+            queueTimer = setInterval(reportQueue, 60_000);
+            queueTimer.unref();
+        }
         try {
             await current;
         }
         finally {
+            clearInterval(queueTimer);
             if (this.pendingMessages.get(sourceKey) === current)
                 this.pendingMessages.delete(sourceKey);
+            await Promise.allSettled(notices);
         }
     }
     async onFsMessage(raw, message, aid) {
@@ -1840,6 +2159,7 @@ class AunPlugin {
         const { payload, callerAid } = call;
         const rules = String(this.config.allow_from ?? "").split(",").map(value => value.trim()).filter(Boolean);
         let result;
+        let ownerNotice;
         if (rules.length && !rules.includes("*") && !rules.includes(callerAid))
             result = (0, ability_operations_1.abilityFailureResult)(payload, "permission_denied", "调用来源不在 AUN 允许名单中");
         else if (payload.ability_path === "protocol/discover") {
@@ -1895,6 +2215,8 @@ class AunPlugin {
                             else {
                                 const draft = await store.draft({ providerAid: aid, authenticatedCaller: callerAid, operationId: String(payload.operation_id), callId: String(payload.call_id), path, definitionId: String(payload.definition_id), params, effects: definition.effects, dedupeRetentionSeconds: definition.dedupe_retention_seconds, executionTarget: { pluginId, pluginVersion, ownerAid }, expiresAt, ...(payload.async === undefined ? {} : { async: payload.async }) });
                                 result = this.abilityOperationResponse(draft.entry);
+                                if (draft.created)
+                                    ownerNotice = draft.entry;
                             }
                         }
                     }
@@ -1907,6 +2229,31 @@ class AunPlugin {
             }
         }
         await this.sendAbilityResponse(aid, callerAid, result);
+        if (ownerNotice)
+            await this.notifyAbilityOwner(ownerNotice);
+    }
+    async notifyAbilityOwner(entry) {
+        const ownerAid = String(entry.executionTarget.ownerAid ?? "");
+        const viewKey = this.abilityApprovalViewKey(entry.providerAid, ownerAid);
+        const existingView = this.abilityApprovalViews.get(viewKey);
+        const view = existingView ?? {};
+        if (!existingView)
+            this.abilityApprovalViews.set(viewKey, view);
+        const pending = (await this.abilityOperations?.pending() ?? []).filter(item => item.providerAid === entry.providerAid);
+        if (pending.length !== 1 && !view.explicit)
+            view.entries = undefined;
+        const text = `有新的远程 Ability 调用申请\n${this.abilityEntrySummary(entry)}\n\n审批窗口最长 12 小时，不会延长调用最晚启动时间或协议 TTL。\n只有本话题中唯一、已完整投递的申请可直接回复“确认”或“拒绝”；多项、已处理或不确定时先发送 /ability pending 查看固定清单。`;
+        try {
+            await this.sendAbilityControlText(entry.providerAid, ownerAid, text);
+            const current = (await this.abilityOperations?.pending() ?? []).filter(item => item.providerAid === entry.providerAid);
+            if (!existingView && this.abilityApprovalViews.get(viewKey) === view)
+                view.entries = current.length === 1 && current[0].key === entry.key && this.abilityOwners[entry.providerAid] === ownerAid && this.acceptingMessages
+                    ? [{ key: entry.key, confirmationFingerprint: entry.confirmationFingerprint }] : undefined;
+            this.context?.logger.info("AUN Ability Owner 申请通知已投递", { aid: entry.providerAid, ownerAid, callerAid: entry.authenticatedCaller, path: entry.path, operationId: entry.operationId, stage: "Owner 申请通知" });
+        }
+        catch (error) {
+            this.context?.logger.warn("AUN Ability Owner 申请通知发送失败，请用 /ability pending 读取保留的待确认请求", { aid: entry.providerAid, ownerAid, callerAid: entry.authenticatedCaller, path: entry.path, operationId: entry.operationId, stage: "Owner 申请通知", error: safeError((0, agent_1.errorDetails)(error)) });
+        }
     }
     async abilityInvocationFailure(aid, callerAid, path, definitionId, params) {
         if (this.abilityAuditUnavailable)
@@ -1961,6 +2308,7 @@ class AunPlugin {
     }
     async processMessage(message, aid, agentPlugin, inboundId) {
         let deliveryFailed = false;
+        let failureText;
         const trace = { traceId: message.messageId || inboundId, aid, peer: message.peerId, threadId: message.threadId ?? "", messageId: message.messageId ?? "", agentPlugin };
         this.context?.logger.info("AUN 收到任务", { ...trace, stage: "接收消息", attachments: message.attachments?.length ?? 0 });
         const client = this.clients.get(aid)?.client;
@@ -2008,7 +2356,9 @@ class AunPlugin {
                 }
                 catch (error) {
                     deliveryFailed = true;
-                    throw new agent_1.AgentOperationError("AUN_TEXT_SEND_FAILED", "发送 AUN 文本消息（结果未确认，不自动重发）", error);
+                    const failure = new agent_1.AgentOperationError("AUN_TEXT_SEND_FAILED", "发送 AUN 文本消息（结果未确认，不自动重发）", error);
+                    failureText = `回复回传失败：${safeError((0, agent_1.errorDetails)(failure))}`;
+                    throw failure;
                 }
             },
             replyAttachments: async (items, text, signal) => {
@@ -2038,17 +2388,18 @@ class AunPlugin {
                         groups.set(kind, group);
                     }
                     groupsCount = groups.size;
+                    const captionKind = (groupsCount === 1 ? groups.keys().next().value : undefined) ?? "attachment";
+                    const payloadText = withAttachmentDownloadLinks(text || (captionKind === "image" ? "图片已生成。" : captionKind === "video" ? "视频已生成。" : captionKind === "file" ? "文件已生成。" : "附件已生成。"), captionKind, refs);
+                    fallbackText = payloadText;
+                    fallbackLinks = attachmentDownloadLinks(refs);
                     for (const [kind, group] of groups) {
                         signal?.throwIfAborted();
-                        const payloadText = withAttachmentDownloadLinks(text || (kind === "image" ? "图片已生成。" : kind === "video" ? "视频已生成。" : "文件已生成。"), kind, group);
-                        // AUN 网页会隐藏带普通正文的单图卡片，图片说明需另发文本。
-                        const payload = { type: kind, ...(kind === "image" ? {} : { text: payloadText, format: "markdown" }), attachments: group };
+                        // AUN 网页可能隐藏附件卡片的正文；所有附件发完后只另发一次完整正文。
+                        const payload = { type: kind, attachments: group };
                         if (message.threadId)
                             payload.thread_id = message.threadId;
                         if (message.messageId)
                             payload.ref_message_id = message.messageId;
-                        fallbackText = payloadText;
-                        fallbackLinks = attachmentDownloadLinks(group);
                         sending = true;
                         // message.send 失败时可能已送达，不自动重试或降级明文，避免重复发送和泄露引用。
                         const sendResult = await this.callAunWithRecovery(aid, { to: message.peerId, payload, encrypt: true });
@@ -2057,17 +2408,17 @@ class AunPlugin {
                         this.context?.logger.info("AUN 附件消息已发送", { ...trace, stage: "发送附件消息", kind, count: group.length });
                         sending = false;
                         sent++;
-                        if (kind === "image" && payloadText) {
+                        if (sent === groupsCount && payloadText) {
                             try {
                                 signal?.throwIfAborted();
                                 const { attachments: _attachments, ...caption } = payload;
                                 const result = await this.callAunWithRecovery(aid, { to: message.peerId, payload: { ...caption, type: "text", text: payloadText, format: "markdown" }, encrypt: true });
                                 if (typeof result?.status !== "string" || !successfulSendStatuses.has(result.status))
-                                    throw new Error(`AUN 图片说明发送状态未确认：${result?.status === undefined ? "未返回状态" : String(result.status)}`);
-                                this.context?.logger.info("AUN 图片说明已发送", { ...trace, stage: "发送图片说明" });
+                                    throw new Error(`AUN 附件正文发送状态未确认：${result?.status === undefined ? "未返回状态" : String(result.status)}`);
+                                this.context?.logger.info("AUN 附件正文已发送", { ...trace, stage: "发送附件正文" });
                             }
                             catch (error) {
-                                throw new agent_1.AgentOperationError("AUN_ATTACHMENT_CAPTION_SEND_FAILED", "图片已发送，发送 AUN 图片说明（结果未确认，不自动重发）", error);
+                                throw new agent_1.AgentOperationError("AUN_ATTACHMENT_CAPTION_SEND_FAILED", "附件已发送，发送 AUN 附件正文（结果未确认，不自动重发）", error);
                             }
                         }
                     }
@@ -2077,6 +2428,7 @@ class AunPlugin {
                     deliveryFailed = true;
                     const failure = sending ? new agent_1.AgentOperationError("AUN_ATTACHMENT_SEND_FAILED", "发送 AUN 附件消息（FS 上传已完成）", error) : error;
                     const progress = sending ? `（已确认发送 ${sent}/${groupsCount} 组，当前组结果未确认，请勿重复发送）` : "";
+                    failureText = `附件回传失败${progress}：${safeError((0, agent_1.errorDetails)(failure))}`;
                     const fallback = fallbackText && fallbackLinks.length ? `\n${withFailureDownloadLinks(fallbackText, fallbackLinks.map((url) => ({ url })))}` : "";
                     try {
                         await this.sendText(aid, message.peerId, `附件回传失败${progress}：${safeError((0, agent_1.errorDetails)(failure))}${fallback}`, message.threadId, true, "markdown");
@@ -2087,12 +2439,13 @@ class AunPlugin {
             },
         };
         const taskId = message.messageId || inboundId;
-        const notifyStatus = (status) => {
+        const notifyStatus = (status, text) => {
             if (!client?.notify)
                 return;
             const params = {
                 type: "task.status", status, task_id: taskId, session_id: taskId,
                 severity: status === "error" ? "error" : "info", initiator: message.peerId,
+                ...(text ? { text } : {}),
                 ...(message.threadId ? { thread_id: message.threadId } : {}),
                 ...(message.messageId ? { ref_message_id: message.messageId } : {}),
             };
@@ -2117,10 +2470,11 @@ class AunPlugin {
         catch (error) {
             failed = true;
             this.context?.logger.warn("AUN 消息处理失败", { ...trace, stage: deliveryFailed ? "回传回复" : "执行 Agent 任务", error: safeError((0, agent_1.errorDetails)(error)) });
+            const action = deliveryFailed ? "回复回传失败" : attachments.length > 0 ? "附件处理失败" : newSessionCommand.test(message.text.trim()) ? "新建会话失败" : "消息处理失败";
+            failureText ??= `${action}：${safeError((0, agent_1.errorDetails)(error))}`;
             if (!deliveryFailed) {
-                const action = attachments.length > 0 ? "附件处理失败" : newSessionCommand.test(message.text.trim()) ? "新建会话失败" : "消息处理失败";
                 try {
-                    await channelMessage.reply(`${action}：${safeError((0, agent_1.errorDetails)(error))}`);
+                    await channelMessage.reply(failureText);
                 }
                 catch (replyError) {
                     this.context?.logger.warn("AUN 错误回复失败", { ...trace, stage: "发送最终错误消息", error: safeError((0, agent_1.errorDetails)(replyError)) });
@@ -2129,7 +2483,7 @@ class AunPlugin {
         }
         finally {
             clearInterval(progressTimer);
-            notifyStatus(failed || deliveryFailed ? "error" : "completed");
+            notifyStatus(failed || deliveryFailed ? "error" : "completed", failureText);
         }
     }
     async sendText(aid, peerId, text, threadId, encryptedOnly = false, format) {