evolclaw 3.1.3 → 3.1.4

package/dist/aun/aid/identity.js

@@ -1,56 +1,193 @@
 import fs from 'fs';
 import path from 'path';
-import os from 'os';
 import crypto from 'crypto';
-import { getAunClient, downloadCaRoot } from './client.js';
-import { resolvePaths, aidsDir as evolclawAidsDir, agentMdPath } from '../../paths.js';
+import { getAunClient, createAunClient, downloadCaRoot } from './client.js';
+import { resolvePaths, agentMdPath, aunPath as defaultAunPath } from '../../paths.js';
 // ==================== Validation ====================
 export function isValidAid(name) {
     const labels = name.split('.');
     return labels.length >= 3 && labels.every(l => /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/.test(l));
 }
+/**
+ * 根据扫描得到的状态推断 AID 分类。
+ *  - hasPrivateKey + signVerified=true            → mine
+ *  - hasPrivateKey + (signVerified=false 或未实测) → broken
+ *  - !hasPrivateKey + hasCert                     → peer-cert
+ *  - !hasPrivateKey + !hasCert                    → no-cert
+ */
+function categorizeAid(info) {
+    if (info.hasPrivateKey) {
+        if (info.signVerified === true)
+            return 'mine';
+        return 'broken';
+    }
+    return info.hasCert ? 'peer-cert' : 'no-cert';
+}
 // ==================== AID Operations ====================
 export function aidList(aunPath) {
-    const aunAidsDir = path.join(aunPath ?? path.join(os.homedir(), '.aun'), 'AIDs');
-    const ecAidsDir = evolclawAidsDir();
+    const root = aunPath ?? defaultAunPath();
+    const aunAidsDir = path.join(root, 'AIDs');
     const seen = new Map();
-    // Scan ~/.aun/AIDs (private keys live here)
     if (fs.existsSync(aunAidsDir)) {
         for (const e of fs.readdirSync(aunAidsDir, { withFileTypes: true })) {
             if (!e.isDirectory())
                 continue;
+            const aidDir = path.join(aunAidsDir, e.name);
+            const keyJsonPath = path.join(aidDir, 'private', 'key.json');
+            const hasPrivateKey = fs.existsSync(path.join(aidDir, 'private'));
+            const certPath = path.join(aidDir, 'public', 'cert.pem');
+            let hasCert = false;
+            let certExpired = false;
+            let keyMatchesCert = null;
+            if (fs.existsSync(certPath)) {
+                hasCert = true;
+                try {
+                    const certPem = fs.readFileSync(certPath, 'utf-8');
+                    const x509 = new crypto.X509Certificate(certPem);
+                    certExpired = new Date(x509.validTo) < new Date();
+                    if (hasPrivateKey && fs.existsSync(keyJsonPath)) {
+                        try {
+                            const kp = JSON.parse(fs.readFileSync(keyJsonPath, 'utf-8'));
+                            const localPubB64 = typeof kp?.public_key_der_b64 === 'string' ? kp.public_key_der_b64 : '';
+                            if (localPubB64) {
+                                const certPubDer = x509.publicKey.export({ type: 'spki', format: 'der' });
+                                const localPubDer = Buffer.from(localPubB64, 'base64');
+                                keyMatchesCert = certPubDer.equals(localPubDer);
+                            }
+                        }
+                        catch { /* key.json 不可解析视作不匹配 */
+                            keyMatchesCert = false;
+                        }
+                    }
+                }
+                catch {
+                    // 证书无法解析视为过期 / 不可用
+                    certExpired = true;
+                }
+            }
             seen.set(e.name, {
                 aid: e.name,
-                hasPrivateKey: fs.existsSync(path.join(aunAidsDir, e.name, 'private')),
+                category: categorizeAid({
+                    hasPrivateKey,
+                    hasCert,
+                    // 静态扫描没跑实测，用 canSign 作为 mine/broken 的近似判定
+                    signVerified: hasPrivateKey ? (hasCert && !certExpired && keyMatchesCert === true) : null,
+                    canSign: hasPrivateKey && hasCert && !certExpired && keyMatchesCert === true,
+                }),
+                hasPrivateKey,
                 hasAgentMd: fs.existsSync(agentMdPath(e.name)),
+                hasCert,
+                certExpired,
+                keyMatchesCert,
+                canSign: hasPrivateKey && hasCert && !certExpired && keyMatchesCert === true,
+                signVerified: null,
             });
         }
     }
-    // Scan $EVOLCLAW_HOME/AIDs (agent.md lives here)
-    if (fs.existsSync(ecAidsDir) && ecAidsDir !== aunAidsDir) {
-        for (const e of fs.readdirSync(ecAidsDir, { withFileTypes: true })) {
-            if (!e.isDirectory())
-                continue;
-            if (seen.has(e.name))
+    return [...seen.values()];
+}
+// ==================== Sign Self-Test ====================
+/**
+ * 实跑一次本地 sign + verify，验证 AID 是否真能签名/验签。
+ * 全本地（不联网）：用 SDK 解密私钥 → ECDSA 签 payload → 用本地 cert 公钥验。
+ * 任一环节失败都视为不可签——包括私钥 passphrase 解不开、cert 被 SDK 主动 discard 等。
+ */
+export async function verifySignAbility(aid, opts) {
+    const aunPath = opts?.aunPath ?? defaultAunPath();
+    let ownClient = null;
+    try {
+        let client = opts?.client;
+        if (!client) {
+            client = await createAunClient({ aunPath });
+            ownClient = client;
+        }
+        const probe = `# probe\naid: "${aid}"\n`;
+        let signed;
+        try {
+            signed = await client.auth.signAgentMd(probe, { aid });
+        }
+        catch (e) {
+            return { ok: false, reason: `sign failed: ${String(e?.message || e).slice(0, 120)}` };
+        }
+        const certPath = path.join(aunPath, 'AIDs', aid, 'public', 'cert.pem');
+        const certPem = fs.existsSync(certPath) ? fs.readFileSync(certPath, 'utf-8') : '';
+        if (!certPem)
+            return { ok: false, reason: 'cert.pem missing' };
+        let result;
+        try {
+            result = await client.auth.verifyAgentMd(signed, { aid, certPem });
+        }
+        catch (e) {
+            return { ok: false, reason: `verify threw: ${String(e?.message || e).slice(0, 120)}` };
+        }
+        const verified = result?.status === 'verified' || result?.verified === true;
+        if (verified)
+            return { ok: true };
+        return { ok: false, reason: `verify failed: ${result?.status ?? 'unknown'}${result?.reason ? ' — ' + result.reason : ''}` };
+    }
+    finally {
+        if (ownClient) {
+            try {
+                await ownClient.close();
+            }
+            catch { /* ignore */ }
+        }
+    }
+}
+/**
+ * aidList 的"实测版"：先做静态扫描，再对每个 AID 跑一次本地 sign+verify。
+ * 共用同一个 AUNClient 实例，避免重复初始化 secret-store / sqlite。
+ */
+export async function aidListVerified(aunPath) {
+    const list = aidList(aunPath);
+    const root = aunPath ?? defaultAunPath();
+    const client = await createAunClient({ aunPath: root });
+    try {
+        for (const a of list) {
+            // canSign=false 的 AID 不必跑实测，结论已经明确
+            if (!a.canSign) {
+                a.signVerified = false;
+                if (!a.hasPrivateKey)
+                    a.signError = 'no private key';
+                else if (!a.hasCert)
+                    a.signError = 'no cert';
+                else if (a.certExpired)
+                    a.signError = 'cert expired';
+                else if (a.keyMatchesCert === false)
+                    a.signError = 'key/cert public-key mismatch';
+                a.category = categorizeAid({
+                    hasPrivateKey: a.hasPrivateKey, hasCert: a.hasCert,
+                    signVerified: a.signVerified, canSign: a.canSign,
+                });
                 continue;
-            seen.set(e.name, {
-                aid: e.name,
-                hasPrivateKey: fs.existsSync(path.join(aunAidsDir, e.name, 'private')),
-                hasAgentMd: fs.existsSync(agentMdPath(e.name)),
+            }
+            const r = await verifySignAbility(a.aid, { aunPath: root, client });
+            a.signVerified = r.ok;
+            if (!r.ok)
+                a.signError = r.reason;
+            a.category = categorizeAid({
+                hasPrivateKey: a.hasPrivateKey, hasCert: a.hasCert,
+                signVerified: a.signVerified, canSign: a.canSign,
             });
         }
     }
-    return [...seen.values()];
+    finally {
+        try {
+            await client.close();
+        }
+        catch { /* ignore */ }
+    }
+    return list;
 }
 export async function aidCreate(aid, opts) {
-    const aunPath = opts?.aunPath ?? path.join(os.homedir(), '.aun');
+    const aunPath = opts?.aunPath ?? defaultAunPath();
     const aidDir = path.join(aunPath, 'AIDs', aid);
     if (fs.existsSync(aidDir) && fs.existsSync(path.join(aidDir, 'private'))) {
         const client = await getAunClient(aid, { aunPath });
         return { aid, alreadyExisted: true, gateway: '', client };
     }
-    const { AUNClient, GatewayDiscovery } = await import('@agentunion/fastaun');
-    let client = new AUNClient({ aun_path: aunPath });
+    const { GatewayDiscovery } = await import('@agentunion/fastaun');
+    let client = await createAunClient({ aunPath });
     try {
         const result = await client.auth.createAid({ aid });
         const gateway = result.gateway || '';
@@ -61,7 +198,7 @@ export async function aidCreate(aid, opts) {
                 await client.close();
             }
             catch { /* ignore */ }
-            client = new AUNClient({ aun_path: aunPath, root_ca_path: caCertPath });
+            client = await createAunClient({ aunPath });
             await client.auth.createAid({ aid });
         }
         let gatewayUrl = gateway;
@@ -86,34 +223,183 @@ export async function aidCreate(aid, opts) {
     }
 }
 // ==================== Show ====================
-export function aidShow(aid, opts) {
-    const aunPath = opts?.aunPath ?? path.join(os.homedir(), '.aun');
+export async function aidShow(aid, opts) {
+    const aunPath = opts?.aunPath ?? defaultAunPath();
     const aidDir = path.join(aunPath, 'AIDs', aid);
     const hasPrivateKey = fs.existsSync(path.join(aidDir, 'private'));
     const hasAgentMd = fs.existsSync(agentMdPath(aid));
     let certExpiresAt = null;
     let certSubject = null;
+    let certExpired = false;
+    let certPem = null;
+    let keyMatchesCert = null;
     const certPath = path.join(aidDir, 'public', 'cert.pem');
     if (fs.existsSync(certPath)) {
         try {
-            const pem = fs.readFileSync(certPath, 'utf-8');
-            const x509 = new crypto.X509Certificate(pem);
+            certPem = fs.readFileSync(certPath, 'utf-8');
+            const x509 = new crypto.X509Certificate(certPem);
             certExpiresAt = x509.validTo;
             certSubject = x509.subject;
+            certExpired = new Date(x509.validTo) < new Date();
+            const keyJsonPath = path.join(aidDir, 'private', 'key.json');
+            if (hasPrivateKey && fs.existsSync(keyJsonPath)) {
+                try {
+                    const kp = JSON.parse(fs.readFileSync(keyJsonPath, 'utf-8'));
+                    const localPubB64 = typeof kp?.public_key_der_b64 === 'string' ? kp.public_key_der_b64 : '';
+                    if (localPubB64) {
+                        const certPubDer = x509.publicKey.export({ type: 'spki', format: 'der' });
+                        const localPubDer = Buffer.from(localPubB64, 'base64');
+                        keyMatchesCert = certPubDer.equals(localPubDer);
+                    }
+                }
+                catch {
+                    keyMatchesCert = false;
+                }
+            }
         }
         catch { /* ignore parse errors */ }
     }
-    return { aid, hasPrivateKey, hasAgentMd, certExpiresAt, certSubject };
+    let agentMdSignature = 'unknown';
+    let agentMdSignatureReason;
+    let signVerified = null;
+    let signError;
+    // 先做一次签名自检（共享 client，避免重复起 SDK）
+    const client = await createAunClient({ aunPath });
+    try {
+        if (hasPrivateKey && certPem && !certExpired && keyMatchesCert !== false) {
+            const r = await verifySignAbility(aid, { aunPath, client });
+            signVerified = r.ok;
+            if (!r.ok)
+                signError = r.reason;
+        }
+        else {
+            signVerified = false;
+            if (!hasPrivateKey)
+                signError = 'no private key';
+            else if (!certPem)
+                signError = 'no cert';
+            else if (certExpired)
+                signError = 'cert expired';
+            else if (keyMatchesCert === false)
+                signError = 'key/cert public-key mismatch';
+        }
+        if (hasAgentMd) {
+            try {
+                const content = fs.readFileSync(agentMdPath(aid), 'utf-8');
+                if (!content.includes('AUN-SIGNATURE')) {
+                    agentMdSignature = 'unsigned';
+                }
+                else {
+                    const result = await client.auth.verifyAgentMd(content, { aid, ...(certPem ? { certPem } : {}) });
+                    if (result.status === 'verified' || result.verified) {
+                        agentMdSignature = 'verified';
+                    }
+                    else if (result.status === 'unsigned') {
+                        agentMdSignature = 'unsigned';
+                    }
+                    else {
+                        agentMdSignature = 'invalid';
+                        agentMdSignatureReason = result.reason;
+                    }
+                }
+            }
+            catch (e) {
+                agentMdSignature = 'unknown';
+                agentMdSignatureReason = String(e?.message || e).slice(0, 100);
+            }
+        }
+    }
+    finally {
+        try {
+            await client.close();
+        }
+        catch { }
+    }
+    return { aid, hasPrivateKey, hasAgentMd, certExpiresAt, certSubject, certExpired, keyMatchesCert, signVerified, signError, agentMdSignature, agentMdSignatureReason };
 }
 // ==================== Delete ====================
 export function aidDelete(aid, opts) {
-    const aunPath = opts?.aunPath ?? path.join(os.homedir(), '.aun');
+    const aunPath = opts?.aunPath ?? defaultAunPath();
     const aidDir = path.join(aunPath, 'AIDs', aid);
     if (!fs.existsSync(aidDir))
         return false;
     fs.rmSync(aidDir, { recursive: true, force: true });
     return true;
 }
+export async function probePkiRecoverability(aid, opts) {
+    const aunPath = opts?.aunPath ?? defaultAunPath();
+    const timeoutMs = opts?.timeoutMs ?? 8000;
+    const keyJsonPath = path.join(aunPath, 'AIDs', aid, 'private', 'key.json');
+    if (!fs.existsSync(keyJsonPath))
+        return { kind: 'no-key' };
+    let localPubB64 = '';
+    try {
+        const kp = JSON.parse(fs.readFileSync(keyJsonPath, 'utf-8'));
+        if (typeof kp?.public_key_der_b64 !== 'string' || !kp.public_key_der_b64) {
+            return { kind: 'unknown', reason: 'key.json missing public_key_der_b64' };
+        }
+        localPubB64 = kp.public_key_der_b64;
+    }
+    catch (e) {
+        return { kind: 'unknown', reason: `key.json parse failed: ${String(e?.message || e).slice(0, 80)}` };
+    }
+    // 1. 发现网关
+    let gateway = '';
+    try {
+        const ctl = AbortSignal.timeout(timeoutMs);
+        const gwResp = await fetch(`https://${aid}/.well-known/aun-gateway`, { redirect: 'follow', signal: ctl });
+        if (gwResp.ok) {
+            const text = (await gwResp.text()).trim();
+            try {
+                const parsed = JSON.parse(text);
+                gateway = parsed?.gateways?.[0]?.url || text;
+            }
+            catch {
+                gateway = text;
+            }
+        }
+    }
+    catch (e) {
+        return { kind: 'no-server-record', reason: `gateway discovery failed: ${String(e?.message || e).slice(0, 80)}` };
+    }
+    if (!gateway)
+        return { kind: 'no-server-record', reason: 'no gateway for AID' };
+    // 2. 拉云端 cert
+    let certPem = '';
+    try {
+        const parsed = new URL(gateway);
+        const scheme = parsed.protocol === 'wss:' ? 'https:' : 'http:';
+        const certUrl = `${scheme}//${parsed.host}/pki/cert/${encodeURIComponent(aid)}`;
+        const ctl = AbortSignal.timeout(timeoutMs);
+        const resp = await fetch(certUrl, { redirect: 'follow', signal: ctl });
+        if (!resp.ok) {
+            return { kind: 'no-server-record', reason: `pki/cert HTTP ${resp.status}` };
+        }
+        certPem = (await resp.text()).trim();
+        if (!certPem.includes('BEGIN CERTIFICATE')) {
+            return { kind: 'no-server-record', reason: 'pki/cert returned non-cert content' };
+        }
+    }
+    catch (e) {
+        return { kind: 'no-server-record', reason: `pki/cert fetch failed: ${String(e?.message || e).slice(0, 80)}` };
+    }
+    // 3. 比对公钥
+    try {
+        const x509 = new crypto.X509Certificate(certPem);
+        const certPubDer = x509.publicKey.export({ type: 'spki', format: 'der' });
+        const localPubDer = Buffer.from(localPubB64, 'base64');
+        if (certPubDer.equals(localPubDer)) {
+            return { kind: 'recoverable', serverCertPubB64: certPubDer.toString('base64') };
+        }
+        return {
+            kind: 'unrecoverable',
+            reason: 'server has different public key registered, current local private key cannot be used',
+        };
+    }
+    catch (e) {
+        return { kind: 'unknown', reason: `cert parse failed: ${String(e?.message || e).slice(0, 80)}` };
+    }
+}
 // ==================== Lookup ====================
 export async function aidLookup(aid) {
     let gateway = '';

package/dist/aun/aid/index.js

@@ -1,3 +1,3 @@
-export { isValidAid, aidList, aidCreate, aidShow, aidDelete, aidLookup, appendAidLifecycle, readAidLifecycle } from './identity.js';
+export { isValidAid, aidList, aidListVerified, aidCreate, aidShow, aidDelete, aidLookup, verifySignAbility, probePkiRecoverability, appendAidLifecycle, readAidLifecycle } from './identity.js';
 export { buildInitialAgentMd, agentmdGet, agentmdPut, agentmdSync } from './agentmd.js';
 export { MIN_AUN_CORE_SDK, AUN_CORE_SDK_PKG, isAunSdkVersionOk, resolveAunCoreSdkPkg, ensureAunSdk, isAunSdkReady, downloadCaRoot, getAunClient, suppressSdkLogs, } from './client.js';

package/dist/aun/rpc/connection.js

@@ -1,18 +1,13 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
+import { aunPath as defaultAunPath } from '../../paths.js';
+import { createAunClient } from '../aid/client.js';
+import { loadProcessConfig } from '../../config-store.js';
 export async function createShortConnection(aid, opts) {
-    const aunPath = opts?.aunPath ?? path.join(os.homedir(), '.aun');
+    const aunPath = opts?.aunPath ?? defaultAunPath();
     const slotId = opts?.slotId ?? '';
-    const caCertPath = path.join(aunPath, 'CA', 'root', 'root.crt');
-    const { AUNClient } = await import('@agentunion/fastaun');
-    const encryptionSeed = process.env.AUN_ENCRYPTION_SEED || undefined;
-    const clientOpts = { aun_path: aunPath, debug: false };
-    if (fs.existsSync(caCertPath))
-        clientOpts.root_ca_path = caCertPath;
-    if (encryptionSeed)
-        clientOpts.encryption_seed = encryptionSeed;
-    const client = new AUNClient(clientOpts);
+    const encryptionSeed = loadProcessConfig().aun?.encryptionSeed
+        || process.env.AUN_ENCRYPTION_SEED
+        || 'evol';
+    const client = await createAunClient({ aunPath, encryptionSeed });
     await client.auth.createAid({ aid });
     const authResult = await client.auth.authenticate({ aid });
     const accessToken = authResult?.access_token ?? client._access_token;

package/dist/channels/aun.js

@@ -1,4 +1,4 @@
-import { AUNClient, GatewayDiscovery, E2EEError } from '@agentunion/fastaun';
+import { GatewayDiscovery, E2EEError } from '@agentunion/fastaun';
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
@@ -12,7 +12,8 @@ import { appendAidEvent } from '../utils/instance-registry.js';
 import { appendMessageLog, buildOutboundEntry } from '../core/message/message-log.js';
 import { chatDirPath } from '../core/session/session-fs-store.js';
 import { appendAidLifecycle } from '../aun/aid/identity.js';
-import { loadAgent, saveAgent } from '../config-store.js';
+import { createAunClient } from '../aun/aid/client.js';
+import { loadAgent, saveAgent, loadProcessConfig } from '../config-store.js';
 import { getProcessStartTime } from '../utils/process-introspect.js';
 import * as outbox from '../aun/outbox.js';
 import { guessMime, formatSize } from '../utils/media-cache.js';
@@ -57,46 +58,6 @@ function getEvolclawVersion() {
     }
     return _cachedVersion;
 }
-function migrateAunData(targetPath) {
-    const legacyPath = path.join(os.homedir(), '.aun');
-    if (legacyPath === targetPath)
-        return;
-    // AIDs 迁移：逐个检查每个 AID，缺少 private 的就从 legacy 复制
-    const srcAIDs = path.join(legacyPath, 'AIDs');
-    const dstAIDs = path.join(targetPath, 'AIDs');
-    if (fs.existsSync(srcAIDs)) {
-        fs.mkdirSync(dstAIDs, { recursive: true });
-        try {
-            for (const entry of fs.readdirSync(srcAIDs, { withFileTypes: true })) {
-                if (!entry.isDirectory())
-                    continue;
-                const aidName = entry.name;
-                const srcAidDir = path.join(srcAIDs, aidName);
-                const dstAidDir = path.join(dstAIDs, aidName);
-                const srcPrivate = path.join(srcAidDir, 'private');
-                const dstPrivate = path.join(dstAidDir, 'private');
-                // 如果目标 AID 目录不存在或缺少 private，从源复制整个 AID 目录
-                if (fs.existsSync(srcPrivate) && !fs.existsSync(dstPrivate)) {
-                    fs.cpSync(srcAidDir, dstAidDir, { recursive: true });
-                }
-            }
-        }
-        catch { }
-    }
-    // CA 迁移
-    const srcCA = path.join(legacyPath, 'CA');
-    const dstCA = path.join(targetPath, 'CA');
-    if (fs.existsSync(srcCA) && !fs.existsSync(dstCA)) {
-        fs.cpSync(srcCA, dstCA, { recursive: true });
-    }
-    for (const file of ['.seed', '.device_id']) {
-        const src = path.join(legacyPath, file);
-        const dst = path.join(targetPath, file);
-        if (fs.existsSync(src) && !fs.existsSync(dst)) {
-            fs.copyFileSync(src, dst);
-        }
-    }
-}
 export class AUNChannel {
     config;
     client = null;
@@ -587,9 +548,10 @@ export class AUNChannel {
         this.connected = false;
         const aunPath = this.config.keystorePath || resolveRoot();
         const aidName = this.config.aid;
-        const encryptionSeed = this.config.encryptionSeed || process.env.AUN_ENCRYPTION_SEED || undefined;
-        // Migrate legacy ~/.aun data to EVOLCLAW_HOME on first run
-        migrateAunData(aunPath);
+        const encryptionSeed = loadProcessConfig().aun?.encryptionSeed
+            || process.env.AUN_ENCRYPTION_SEED
+            || 'evol';
+        // Migration from ~/.aun is handled by ensureDataDirs() at startup with a marker file.
         // Gateway URL 解析：优先用配置的 gatewayUrl，否则通过 well-known 自动发现
         let gateway = this.config.gatewayUrl || '';
         if (!gateway) {
@@ -611,39 +573,39 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} Initializing: aid=${aidName}, gateway=${gateway}, aun_path=${aunPath}`);
         // Create client with FileSecretStore (AES-256-GCM)
         // 不传 encryption_seed 时，SDK 自动从 {aun_path}/.seed 文件派生密钥（与 aun_cli.py 对齐）
-        const rootCaPath = path.join(aunPath, 'CA', 'root', 'root.crt');
-        this.client = new AUNClient({
-            aun_path: aunPath,
-            root_ca_path: rootCaPath,
-            ...(encryptionSeed && { encryption_seed: encryptionSeed }),
-        }, this.config.aunSdkLog ?? true);
+        const client = await createAunClient({
+            aunPath,
+            encryptionSeed,
+            aunSdkLog: this.config.aunSdkLog ?? true,
+        });
+        this.client = client;
         // Set gateway URL (internal property, same as Python SDK)
-        this.client._gatewayUrl = gateway;
+        client._gatewayUrl = gateway;
         // Register event handlers before connecting
-        this.client.on('message.received', (data) => {
+        client.on('message.received', (data) => {
             this.trace('IN', 'message.received', data);
             const kind = (data && typeof data === 'object') ? data.kind ?? '' : '';
             const keys = (data && typeof data === 'object') ? Object.keys(data).join(',') : typeof data;
             logger.debug(`${this.logPrefix()}[DIAG] message.received: kind=${kind} keys=${keys}`);
             this.handleIncomingPrivateMessage(data);
         });
-        this.client.on('group.message_created', (data) => {
+        client.on('group.message_created', (data) => {
             this.trace('IN', 'group.message_created', data);
             const gid = (data && typeof data === 'object') ? data.group_id ?? '' : '';
             const sender = (data && typeof data === 'object') ? data.sender_aid ?? '' : '';
             logger.debug(`${this.logPrefix()}[DIAG] group.message_created: group_id=${gid} sender=${sender}`);
             this.handleIncomingGroupMessage(data);
         });
-        this.client.on('connection.state', (data) => {
+        client.on('connection.state', (data) => {
             // trace is handled inside handleConnectionState with throttling
             this.handleConnectionState(data);
         });
         // gateway 被踢/服务端主动断开（含同槽位互踢的 self/new extra_info）
-        this.client.on('gateway.disconnect', (data) => {
+        client.on('gateway.disconnect', (data) => {
             this.trace('IN', 'gateway.disconnect', data);
             this.handleGatewayDisconnect(data);
         });
-        this.client.on('message.recalled', (data) => {
+        client.on('message.recalled', (data) => {
             this.trace('IN', 'message.recalled', data);
             if (data && typeof data === 'object') {
                 const ids = data.message_ids;
@@ -657,12 +619,12 @@ export class AUNChannel {
                 }
             }
         });
-        this.client.on('message.undecryptable', (data) => {
+        client.on('message.undecryptable', (data) => {
             this.trace('IN', 'message.undecryptable', data);
             const d = data;
             logger.warn(`${this.logPrefix()} Message undecryptable: from=${d.from} mid=${d.message_id} err=${d._decrypt_error}`);
         });
-        this.client.on('group.message_undecryptable', (data) => {
+        client.on('group.message_undecryptable', (data) => {
             this.trace('IN', 'group.message_undecryptable', data);
             const d = data;
             logger.warn(`${this.logPrefix()} Group message undecryptable: group=${d.group_id} from=${d.from} mid=${d.message_id} err=${d._decrypt_error}`);
@@ -670,7 +632,7 @@ export class AUNChannel {
         // Authenticate
         // Workaround: SDK 0.3.x _loadIdentityOrRaise doesn't set identity.aid from requested aid,
         // causing gateway "missing aid" error. Patch to backfill aid on loaded identity.
-        const authFlow = this.client._auth;
+        const authFlow = client._auth;
         if (authFlow && typeof authFlow._loadIdentityOrRaise === 'function') {
             const origLoad = authFlow._loadIdentityOrRaise.bind(authFlow);
             authFlow._loadIdentityOrRaise = (aid) => {
@@ -684,12 +646,12 @@ export class AUNChannel {
         try {
             logger.info(`${this.logPrefix()} Authenticating as ${aidName}...`);
             this.trace('OUT', 'auth.authenticate', { aid: aidName });
-            const auth = await this.client.auth.authenticate(aidName ? { aid: aidName } : undefined);
+            const auth = await client.auth.authenticate(aidName ? { aid: aidName } : undefined);
             this.trace('OUT', 'auth.authenticate.ok', { aid: auth.aid, gateway: auth.gateway, hasToken: !!auth.access_token });
             this.trace('IN', 'auth.result', { aid: auth.aid, gateway: auth.gateway, hasToken: !!auth.access_token });
             accessToken = auth.access_token;
             const resolvedGateway = auth.gateway || gateway;
-            this.client._gatewayUrl = resolvedGateway;
+            client._gatewayUrl = resolvedGateway;
             logger.info(`${this.logPrefix()} Authenticated as ${auth.aid ?? '?'}, gateway=${resolvedGateway}`);
         }
         catch (e) {
@@ -716,12 +678,12 @@ export class AUNChannel {
                 agentName: this.config.agentName,
                 channelName: this.config.channelName,
             });
-            this.trace('OUT', 'client.connect', { gateway: this.client._gatewayUrl, extra_info: extraInfo });
-            await this.client.connect({ access_token: accessToken, gateway: this.client._gatewayUrl, extra_info: extraInfo }, 
+            this.trace('OUT', 'client.connect', { gateway: client._gatewayUrl, extra_info: extraInfo });
+            await client.connect({ access_token: accessToken, gateway: client._gatewayUrl, extra_info: extraInfo }, 
             // max_attempts=0 = 无限重试（与 Go/Python 对齐），交由 SDK 自己跑指数退避
             // initial_delay=1s，max_delay=300s（5min 封顶）
             { auto_reconnect: true, retry: { max_attempts: 0, initial_delay: 1.0, max_delay: 300.0 } });
-            this.trace('OUT', 'client.connect.ok', { aid: this.client.aid });
+            this.trace('OUT', 'client.connect.ok', { aid: client.aid });
             this._aid = this.client.aid ?? undefined;
             const deviceId = this.client._device_id ?? '';
             this._chatId = this._aid ? `${this._aid}:${deviceId}:` : '';
@@ -2418,13 +2380,10 @@ EvolClaw AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         if (!this.client)
             return { type: null };
         try {
-            const { agentmdSync } = await import('../aun/aid/agentmd.js');
-            const result = await agentmdSync(aid, { client: this.client });
-            const md = result.content ?? '';
-            const typeMatch = md.match(/^type:\s*["']?(\w+)["']?/m);
-            const nameMatch = md.match(/^name:\s*["']?(.+?)["']?\s*$/m);
-            const type = typeMatch?.[1] === 'human' ? 'human' : 'ai';
-            const name = nameMatch?.[1]?.trim() || undefined;
+            const selfAgentDir = path.join(resolvePaths().agentsDir, this.config.aid);
+            const identity = await PeerIdentityCache.resolve('aun', aid, selfAgentDir, this.client, false);
+            const type = identity.type === 'human' ? 'human' : 'ai';
+            const name = identity.name || undefined;
             const info = { type, name };
             this.peerInfoCache.set(aid, info);
             setTimeout(() => this.peerInfoCache.delete(aid), 30 * 60 * 1000);