evolcore 0.0.35 → 0.0.36

package/dist/config/providers-management.js

@@ -0,0 +1,328 @@
+import { createHash } from 'node:crypto';
+import { posix } from 'node:path';
+import { resolvePaths } from '../paths.js';
+import { ConfigTarget, mutateConfig } from './config-manager.js';
+import { readProvidersFile, validateProvidersFile } from './providers.js';
+import { providerEnvironmentVariable, providerNameFromBaseUrlIfStatic, resolveProviderService, resolveProviderServiceForBaseagent } from './providers-config.js';
+export const PROVIDER_SECRET_MASK = '<redacted>';
+function revisionValue(value) {
+    if (Array.isArray(value))
+        return value.map(revisionValue);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, revisionValue(entry)]));
+}
+export function providersRevision(value) {
+    return createHash('sha256').update(JSON.stringify(revisionValue({ providers: value.providers, ...(value.nextId !== undefined ? { nextId: value.nextId } : {}) }))).digest('hex');
+}
+export function readProvidersSnapshot(file = resolvePaths().providersConfig) {
+    return providersSnapshot(readProvidersFile(file));
+}
+function providersSnapshot(value) {
+    const providers = structuredClone(value.providers);
+    for (const provider of Object.values(providers)) {
+        if (provider.common.apiKey && !providerEnvironmentVariable(provider.common.apiKey))
+            provider.common.apiKey = PROVIDER_SECRET_MASK;
+        for (const field of ['headers', 'queryParams']) {
+            const values = provider.common[field];
+            if (values)
+                for (const key of Object.keys(values))
+                    values[key] = PROVIDER_SECRET_MASK;
+        }
+    }
+    return {
+        ...(value.$schema_version !== undefined ? { $schema_version: value.$schema_version } : {}),
+        ...(value.nextId !== undefined ? { nextId: value.nextId } : {}),
+        providers,
+        revision: providersRevision(value),
+    };
+}
+function retainSecrets(value, previous) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const provider = structuredClone(value);
+    if (!provider.common || typeof provider.common !== 'object' || Array.isArray(provider.common))
+        return provider;
+    const common = provider.common;
+    if (common.apiKey === PROVIDER_SECRET_MASK) {
+        if (!previous?.common.apiKey)
+            throw new Error('A replacement API key is required');
+        common.apiKey = previous.common.apiKey;
+    }
+    for (const field of ['headers', 'queryParams']) {
+        if (!common[field] || typeof common[field] !== 'object' || Array.isArray(common[field]))
+            continue;
+        for (const key of Object.keys(common[field])) {
+            if (common[field][key] !== PROVIDER_SECRET_MASK)
+                continue;
+            const existing = previous?.common[field]?.[key];
+            if (existing === undefined)
+                throw new Error(`A replacement ${field} value is required`);
+            common[field][key] = existing;
+        }
+    }
+    return provider;
+}
+export function resolveProviderDraftService(input, file = resolvePaths().providersConfig) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(input.providerId) || ['__proto__', 'constructor', 'prototype'].includes(input.providerId)) {
+        throw new Error('Invalid provider identifier');
+    }
+    const current = readProvidersFile(file);
+    const previous = Object.hasOwn(current.providers, input.providerId) ? current.providers[input.providerId] : undefined;
+    const provider = resolveDraftProvider(input.value, previous, input.imports);
+    if (input.baseagent) {
+        return resolveProviderServiceForBaseagent(input.providerId, input.baseagent, input.serviceType, {
+            providers: { [input.providerId]: provider },
+        });
+    }
+    return resolveProviderService(input.providerId, input.serviceType, { providers: { [input.providerId]: provider } });
+}
+export async function updateProvider(input, file = resolvePaths().providersConfig) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(input.providerId) || ['__proto__', 'constructor', 'prototype'].includes(input.providerId)) {
+        throw new Error('Invalid provider identifier');
+    }
+    const result = mutateConfig(ConfigTarget.Providers, { providerFile: file }, config => {
+        const current = config;
+        if (providersRevision(current) !== input.revision) {
+            throw Object.assign(new Error('Providers changed after loading; reload before saving'), { statusCode: 409 });
+        }
+        if (input.remove) {
+            current.nextId = nextProviderSequence(current);
+            delete current.providers[input.providerId];
+        }
+        else {
+            const value = retainSecrets(input.value, current.providers[input.providerId]);
+            const normalized = validateProvidersFile({ providers: { [input.providerId]: value } });
+            current.providers[input.providerId] = normalized.providers[input.providerId];
+        }
+        return current;
+    });
+    return providersSnapshot(result.value);
+}
+function rejectMaskedImportSecrets(providers) {
+    for (const [providerId, provider] of Object.entries(providers)) {
+        if (provider.common.apiKey === PROVIDER_SECRET_MASK) {
+            throw new Error(`Provider ${providerId} has a redacted API key; import a file with the original secret`);
+        }
+        for (const field of ['headers', 'queryParams']) {
+            for (const [key, value] of Object.entries(provider.common[field] ?? {})) {
+                if (value === PROVIDER_SECRET_MASK) {
+                    throw new Error(`Provider ${providerId} ${field}.${key} is redacted; import a file with the original secret`);
+                }
+            }
+        }
+    }
+}
+export function parseProviderImport(text) {
+    if (typeof text !== 'string' || !text.trim())
+        throw new Error('Paste one Provider configuration');
+    if (Buffer.byteLength(text, 'utf8') > 1024 * 1024) {
+        throw Object.assign(new Error('Provider configuration exceeds 1 MiB'), { statusCode: 413 });
+    }
+    let source = text.replace(/^\uFEFF/u, '').trim();
+    const fenced = source.match(/^```(?:json)?\s*\n([\s\S]*?)\n```$/iu);
+    if (fenced)
+        source = fenced[1];
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Provider configuration must be valid JSON');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('Provider configuration must be an object');
+    const value = parsed;
+    const isProviderMap = Object.values(value).every(provider => provider && typeof provider === 'object'
+        && !Array.isArray(provider) && Object.hasOwn(provider, 'common'));
+    const isSingleProvider = !isProviderMap && ['name', 'common', 'services'].some(field => Object.hasOwn(value, field));
+    if (!Object.hasOwn(value, 'providers') && isSingleProvider && !Object.hasOwn(value, 'common')) {
+        throw new Error('Provider configuration is missing "common"; check the field spelling');
+    }
+    const normalized = validateProvidersFile(Object.hasOwn(value, 'providers') ? value
+        : { providers: isSingleProvider ? { imported: value } : value });
+    const providers = Object.values(normalized.providers);
+    if (providers.length !== 1)
+        throw new Error('Import exactly one Provider at a time');
+    rejectMaskedImportSecrets(normalized.providers);
+    const provider = providers[0];
+    provider.name ||= providerNameFromBaseUrlIfStatic(provider.common.baseUrl);
+    return provider;
+}
+export function previewProviderImport(text) {
+    return previewProviderValue(parseProviderImport(text));
+}
+export function previewProviderValue(value) {
+    const normalized = validateProvidersFile({ providers: { preview: value } });
+    return { provider: providersSnapshot(normalized).providers.preview };
+}
+function nextProviderSequence(config) {
+    let nextId = config.nextId ?? 1;
+    for (const providerId of Object.keys(config.providers)) {
+        const match = /^provider-(\d+)$/u.exec(providerId);
+        if (match)
+            nextId = Math.max(nextId, Number(match[1]) + 1);
+    }
+    if (!Number.isSafeInteger(nextId) || nextId >= Number.MAX_SAFE_INTEGER)
+        throw new Error('Provider ID sequence is exhausted');
+    return nextId;
+}
+export async function createProvider(input, file = resolvePaths().providersConfig) {
+    if (!/^[a-f0-9]{64}$/u.test(input.revision))
+        throw new Error('A valid providers revision is required');
+    const normalized = validateProvidersFile({ providers: { imported: input.value } });
+    rejectMaskedImportSecrets(normalized.providers);
+    const provider = normalized.providers.imported;
+    provider.name ||= providerNameFromBaseUrlIfStatic(provider.common.baseUrl);
+    const result = mutateConfig(ConfigTarget.Providers, { providerFile: file }, config => {
+        const current = config;
+        if (providersRevision(current) !== input.revision) {
+            throw Object.assign(new Error('Providers changed after loading; reload before saving'), { statusCode: 409 });
+        }
+        const sequence = nextProviderSequence(current);
+        const providerId = `provider-${sequence}`;
+        current.providers[providerId] = provider;
+        current.nextId = sequence + 1;
+        return { current, providerId };
+    });
+    return { ...providersSnapshot(result.value.current), providerId: result.value.providerId };
+}
+function providerHostname(baseUrl) {
+    if (providerEnvironmentVariable(baseUrl))
+        return undefined;
+    return new URL(baseUrl).hostname.toLowerCase().replace(/\.$/u, '');
+}
+function mergeImportedProvider(existing, imported) {
+    const services = structuredClone(existing.services || {});
+    const existingVariable = providerEnvironmentVariable(existing.common.baseUrl);
+    const importedVariable = providerEnvironmentVariable(imported.common.baseUrl);
+    if (existingVariable || importedVariable) {
+        if (existingVariable !== importedVariable) {
+            throw new Error('Cannot merge Providers with different environment-variable base URLs');
+        }
+        for (const [serviceType, service] of Object.entries(imported.services || {})) {
+            if (!Object.hasOwn(services, serviceType))
+                services[serviceType] = structuredClone(service);
+        }
+        return {
+            ...existing,
+            common: {
+                ...existing.common,
+                ...(!existing.common.apiKey?.trim() && imported.common.apiKey ? { apiKey: imported.common.apiKey } : {}),
+            },
+            services,
+        };
+    }
+    const baseUrl = new URL(existing.common.baseUrl);
+    for (const [serviceType, service] of Object.entries(imported.services || {})) {
+        if (Object.hasOwn(services, serviceType))
+            continue;
+        const endpoint = new URL(resolveProviderService('imported', serviceType, { providers: { imported } }).baseUrl);
+        if (baseUrl.protocol !== endpoint.protocol || baseUrl.port !== endpoint.port || providerHostname(baseUrl.href) !== providerHostname(endpoint.href)) {
+            throw new Error('Cannot merge this domain: the source uses a different protocol or port');
+        }
+        const relativePath = posix.relative(baseUrl.pathname.replace(/\/+$/u, '') || '/', endpoint.pathname.replace(/\/+$/u, '') || '/');
+        services[serviceType] = { ...service, path: relativePath ? `./${relativePath}` : '' };
+    }
+    return {
+        ...existing,
+        common: {
+            ...existing.common,
+            ...(!existing.common.apiKey?.trim() && imported.common.apiKey ? { apiKey: imported.common.apiKey } : {}),
+        },
+        services,
+    };
+}
+function resolveDraftProvider(value, previous, imports = []) {
+    if (!Array.isArray(imports))
+        throw new Error('Provider imports must be an array');
+    let secretSource = previous;
+    for (const item of imports) {
+        const imported = validateProvidersFile({ providers: { imported: item } }).providers.imported;
+        rejectMaskedImportSecrets({ imported });
+        const secretSourceHost = secretSource ? providerHostname(secretSource.common.baseUrl) : undefined;
+        const importedHost = providerHostname(imported.common.baseUrl);
+        if (secretSource && secretSourceHost && importedHost && secretSourceHost !== importedHost) {
+            throw new Error('Imported Provider domain does not match the target Provider');
+        }
+        secretSource = secretSource ? mergeImportedProvider(secretSource, imported) : imported;
+    }
+    return validateProvidersFile({ providers: { draft: retainSecrets(value, secretSource) } }).providers.draft;
+}
+export async function saveProviderChanges(input, file = resolvePaths().providersConfig) {
+    if (!Array.isArray(input.changes) || !input.changes.length)
+        throw new Error('Provider changes are required');
+    const identifiers = new Set();
+    for (const change of input.changes) {
+        if (!change || typeof change.providerId !== 'string' || !/^[A-Za-z0-9_-]+$/u.test(change.providerId)
+            || ['__proto__', 'constructor', 'prototype'].includes(change.providerId) || identifiers.has(change.providerId)) {
+            throw new Error('Invalid or duplicate provider identifier');
+        }
+        if ((change.create !== undefined && typeof change.create !== 'boolean')
+            || (change.remove !== undefined && typeof change.remove !== 'boolean')
+            || (change.imports !== undefined && !Array.isArray(change.imports))
+            || (change.remove && (change.create || change.value !== undefined || change.imports?.length))) {
+            throw new Error('Invalid provider change');
+        }
+        identifiers.add(change.providerId);
+    }
+    const result = mutateConfig(ConfigTarget.Providers, { providerFile: file }, config => {
+        const current = config;
+        if (providersRevision(current) !== input.revision) {
+            throw Object.assign(new Error('Providers changed after loading; reload before saving'), { statusCode: 409 });
+        }
+        const providerIds = {};
+        const originalIds = new Set(Object.keys(current.providers));
+        if (input.changes.some(change => change.remove))
+            current.nextId = nextProviderSequence(current);
+        for (const change of input.changes) {
+            if (change.create ? originalIds.has(change.providerId) : !originalIds.has(change.providerId)) {
+                throw new Error(change.create ? 'Provider already exists' : 'Provider not found');
+            }
+            if (change.remove) {
+                delete current.providers[change.providerId];
+                continue;
+            }
+            const previous = change.create ? undefined : current.providers[change.providerId];
+            const provider = resolveDraftProvider(change.value, previous, change.imports);
+            provider.name ||= providerNameFromBaseUrlIfStatic(provider.common.baseUrl);
+            const providerId = change.create ? `provider-${nextProviderSequence(current)}` : change.providerId;
+            if (change.create)
+                current.nextId = Number(providerId.slice('provider-'.length)) + 1;
+            current.providers[providerId] = provider;
+            providerIds[change.providerId] = providerId;
+        }
+        return { current, providerIds };
+    });
+    return { ...providersSnapshot(result.value.current), providerIds: result.value.providerIds };
+}
+export async function importOrMergeBaseagentProvider(input, file = resolvePaths().providersConfig) {
+    if (!/^[a-f0-9]{64}$/u.test(input.revision))
+        throw new Error('A valid providers revision is required');
+    const normalized = validateProvidersFile({ providers: { imported: input.value } });
+    rejectMaskedImportSecrets(normalized.providers);
+    const imported = normalized.providers.imported;
+    imported.name ||= providerNameFromBaseUrlIfStatic(imported.common.baseUrl);
+    const result = mutateConfig(ConfigTarget.Providers, { providerFile: file }, config => {
+        const current = config;
+        if (providersRevision(current) !== input.revision) {
+            throw Object.assign(new Error('Providers changed after loading; reload before saving'), { statusCode: 409 });
+        }
+        const importedHost = providerHostname(imported.common.baseUrl);
+        const match = importedHost
+            ? Object.entries(current.providers).find(([, provider]) => providerHostname(provider.common.baseUrl) === importedHost)
+            : undefined;
+        if (match) {
+            const [providerId, existing] = match;
+            current.providers[providerId] = validateProvidersFile({ providers: { [providerId]: mergeImportedProvider(existing, imported) } }).providers[providerId];
+            return { current, providerId, merged: true };
+        }
+        const sequence = nextProviderSequence(current);
+        const providerId = `provider-${sequence}`;
+        current.providers[providerId] = imported;
+        current.nextId = sequence + 1;
+        return { current, providerId, merged: false };
+    });
+    return { ...providersSnapshot(result.value.current), providerId: result.value.providerId, merged: result.value.merged };
+}

package/dist/config/providers.js

@@ -0,0 +1,22 @@
+import { resolvePaths } from '../paths.js';
+import { ConfigTarget, read, write } from './config-manager.js';
+import { assertProviderSelectionWrite as validateSelectionWrite, resolveProviderModelOverrides as resolveModelOverrides, resolveProviderService as resolveService, resolveProviderServiceForBaseagent as resolveServiceForBaseagent, resolveServiceSelection as resolveSelection, } from './providers-config.js';
+export { providerIsConfigured, providerServiceTypeForBaseagent, providerServiceTypesForBaseagent, providerServiceTypeForPurpose, validateProvidersFile, } from './providers-config.js';
+export function readProvidersFile(file = resolvePaths().providersConfig) {
+    return read(ConfigTarget.Providers, { providerFile: file }) ?? { providers: {} };
+}
+export function writeProvidersFile(value, file = resolvePaths().providersConfig) {
+    write(ConfigTarget.Providers, value, { providerFile: file });
+}
+export function resolveProviderService(providerId, serviceType, file = resolvePaths().providersConfig) {
+    return resolveService(providerId, serviceType, readProvidersFile(file));
+}
+export function resolveProviderServiceForBaseagent(providerId, baseagent, preferredServiceType, file = resolvePaths().providersConfig) {
+    return resolveServiceForBaseagent(providerId, baseagent, preferredServiceType, readProvidersFile(file));
+}
+export function resolveServiceSelection(selections, serviceType) {
+    return resolveSelection(selections, serviceType, resolveProviderService);
+}
+export function assertProviderSelectionWrite(next, previous = {}, inherited = {}) {
+    validateSelectionWrite(next, previous, inherited, (providerId, serviceType) => resolveModelOverrides(providerId, serviceType, readProvidersFile()));
+}

package/dist/config/resolved-config-op.js

@@ -26,7 +26,7 @@ export function resolveConfigCommand(inputArgv, options = {}) {
         return { ok: false, code: 'MISSING_ARG', reason: 'A config subcommand is required' };
     }
     if (options.defaultRelation?.self && options.defaultRelation.peerKey
-        && isScopedConfigSubcommand(subcommand)
+        && (isScopedConfigSubcommand(subcommand) || subcommand === 'get' || subcommand === 'set' || subcommand === 'unset')
         && !hasExplicitConfigSelector(argv)) {
         argv = [...argv, '--self', options.defaultRelation.self, '--peer', options.defaultRelation.peerKey];
     }
@@ -118,14 +118,14 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: 'Agent role policies are managed through the role policy editor',
         };
     }
-    const canContainFallbackModels = field === 'baseagents'
+    const canContainFallback = field === 'baseagents'
         || /^baseagents\.[^.]+$/.test(field)
-        || /^baseagents\.[^.]+\.fallbackModels(?:\.|$)/.test(field);
-    if (subcommand !== 'get' && canContainFallbackModels) {
+        || /^baseagents\.[^.]+\.fallback(?:\.|$)/.test(field);
+    if (subcommand !== 'get' && canContainFallback) {
         return {
             ok: false,
             code: 'DEFAULTS_FILE_ONLY',
-            reason: 'fallbackModels is configured only by editing agents/defaults.json',
+            reason: 'Baseagent fallback is configured only by editing agents/defaults.json',
         };
     }
     const fieldRule = resolveConfigFieldRule(field, selector.scope);
@@ -176,7 +176,13 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
     const rawValue = subcommand === 'set' ? business.values[1] : undefined;
     let value;
     if (subcommand === 'set') {
-        if (field === 'owners') {
+        if (field === 'owner') {
+            const owner = rawValue.trim();
+            if (!isValidAid(owner))
+                return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: `Invalid owner AID: ${JSON.stringify(rawValue)}` };
+            value = owner;
+        }
+        else if (field === 'owners') {
             const parsedOwners = parseOwnersValue(rawValue);
             if (!parsedOwners.ok)
                 return parsedOwners;
@@ -556,14 +562,11 @@ function parseOwnersValue(raw) {
     if (!Array.isArray(values) || values.length === 0) {
         return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'owners must contain at least one AID' };
     }
-    const owners = [];
-    for (const value of values) {
-        if (typeof value !== 'string' || !value.trim() || !isValidAid(value.trim())) {
-            return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: `Invalid owner AID: ${JSON.stringify(value)}` };
-        }
-        const owner = value.trim();
-        if (!owners.includes(owner))
-            owners.push(owner);
+    const owners = [...new Set(values
+            .filter((value) => typeof value === 'string' && !!value.trim())
+            .map(value => value.trim()))];
+    if (owners.length === 0 || owners.some(owner => !isValidAid(owner))) {
+        return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: `Invalid owner AID: ${JSON.stringify(owners)}` };
     }
     return { ok: true, value: owners };
 }

package/dist/config/snapshot.js

@@ -1,8 +1,8 @@
 /**
  * snapshot —— 配置快照与回滚。
  *
- * v3 设计快照范围：daemon.json + agents/defaults.json + 每 agent 的 config.json
- * + 每关系的 config.json + extra_backup 声明文件。**不含 .env**（凭证不进版本库）。
+ * v3 设计快照范围：daemon.json + providers.json + agents/defaults.json + 每 agent 的 config.json
+ * + 每关系的 config.json + extra_backup 声明文件。**不含 .env**。
  *
  * 版本号：全量百位递增（v100/v200…），增量嵌套其下（v101…v199，每全量 ≤99 个增量）。
  * 目录：{root}/backups/config/v100/{meta.json, snapshot/...} + v101/{meta.json, delta/...}
@@ -16,7 +16,7 @@ import fs from 'fs';
 import path from 'path';
 import { resolvePaths } from '../paths.js';
 import { logger } from '../utils/logger.js';
-import { ConfigTarget, read } from './config-manager.js';
+import { ConfigTarget, notifyConfigWrite, read } from './config-manager.js';
 const RETAIN_FULL = 10;
 const RETAIN_DELTA = 20;
 /** Process-level master switch. Missing config remains enabled for compatibility. */
@@ -56,6 +56,7 @@ export function collectConfigFiles(root) {
     const pushIf = (abs) => { if (fs.existsSync(abs))
         out.push(rel(abs)); };
     pushIf(path.join(root, 'daemon.json'));
+    pushIf(path.join(root, 'providers.json'));
     const agentsRoot = path.join(root, 'agents');
     pushIf(path.join(agentsRoot, 'defaults.json'));
     if (fs.existsSync(agentsRoot)) {
@@ -342,9 +343,7 @@ function createFull(root, work, trigger, description) {
     const verDir = path.join(backupsDir(), version);
     const snapDir = path.join(verDir, 'snapshot');
     for (const [rel, content] of work) {
-        const dest = path.join(snapDir, rel);
-        fs.mkdirSync(path.dirname(dest), { recursive: true });
-        fs.writeFileSync(dest, content, 'utf-8');
+        writeSnapshotConfigFile(snapDir, rel, content);
     }
     const meta = {
         version, type: 'full', createdAt: nowIso(), trigger, description,
@@ -388,9 +387,25 @@ function createDelta(root, work, baseFull, baseMap, trigger, description) {
     return { created: true, version, type: 'delta' };
 }
 function writeDeltaFile(filesDir, rel, content) {
-    const dest = path.join(filesDir, rel);
-    fs.mkdirSync(path.dirname(dest), { recursive: true });
-    fs.writeFileSync(dest, content, 'utf-8');
+    writeSnapshotConfigFile(filesDir, rel, content);
+}
+export function writeSnapshotConfigFile(root, rel, content) {
+    const dest = path.join(root, rel);
+    const protectedProvider = rel === 'providers.json';
+    fs.mkdirSync(path.dirname(dest), { recursive: true, ...(protectedProvider ? { mode: 0o700 } : {}) });
+    fs.writeFileSync(dest, content, { encoding: 'utf8', ...(protectedProvider ? { mode: 0o600 } : {}) });
+    if (protectedProvider && process.platform !== 'win32')
+        fs.chmodSync(dest, 0o600);
+}
+export function removeSnapshotConfigFile(root, rel) {
+    const dest = path.join(root, rel);
+    const files = rel === 'providers.json' ? [dest, `${dest}_`, `${dest}__`] : [dest];
+    for (const file of files) {
+        try {
+            fs.unlinkSync(file);
+        }
+        catch { }
+    }
 }
 function nowIso() {
     // Date 在 workflow 脚本里被禁；此处是运行时模块，正常可用。
@@ -422,20 +437,17 @@ export function restore(version) {
     // 删除工作目录中目标版本没有的配置文件
     for (const rel of current.keys()) {
         if (!target.has(rel)) {
-            try {
-                fs.unlinkSync(path.join(root, rel));
-            }
-            catch { /* best effort */ }
+            removeSnapshotConfigFile(root, rel);
         }
     }
     // 写入目标版本所有文件
     let applied = 0;
     for (const [rel, content] of target) {
-        const dest = path.join(root, rel);
-        fs.mkdirSync(path.dirname(dest), { recursive: true });
-        fs.writeFileSync(dest, content, 'utf-8');
+        writeSnapshotConfigFile(root, rel, content);
         applied++;
     }
+    if (current.has('providers.json') || target.has('providers.json'))
+        notifyConfigWrite(ConfigTarget.Providers);
     writeCurrent({ full: loc.full, delta: loc.delta });
     writeWVersion({ full: loc.full, delta: loc.delta });
     logger.info(`[snapshot] restored ${version} (${applied} files)`);

package/dist/config-store.js

@@ -32,6 +32,7 @@ import { parseStableSemver } from './utils/stable-semver.js';
 import { isSupportedBaseagent } from './agents/baseagent.js';
 import { normalizeDaemonServices } from './config/daemon-services.js';
 import { currentVersion } from './config/schema-registry.js';
+import { assertOwnerConfigRecord } from './config/owner-config.js';
 const SERVICE_METADATA_SENSITIVE_KEY = /(?:^|[_-])(endpoint|url|uri|token|access[_-]?token|authorization|cookie|secret|password|private[_-]?key|key|cert|certificate)(?:$|[_-])/i;
 function assertLocalServiceEndpoint(value, fieldPath) {
     if (typeof value !== 'string' || value.trim() === '' || value.length > 2048) {
@@ -56,7 +57,8 @@ function assertLocalServiceEndpoint(value, fieldPath) {
 export function loadDaemonConfig() {
     const raw = atomicReadJson(resolvePaths().daemonConfig);
     const sanitized = stripLegacyAunGatewayConfig(raw ?? {}, resolvePaths().daemonConfig, message => logger.warn(message));
-    return validateDaemonConfig(normalizeProcessConfigCompat(normalizeDaemonServices(sanitized)), false);
+    const normalized = validateDaemonConfig(normalizeProcessConfigCompat(normalizeDaemonServices(sanitized)), false);
+    return normalized;
 }
 export function isRestartRecoveryEnabled(config = loadDaemonConfig()) {
     return config.restartRecovery?.enabled === true;
@@ -111,6 +113,15 @@ export function saveDaemonConfig(value) {
     catch { /* best-effort */ }
 }
 function validateDaemonConfig(value, validateAidDomain) {
+    assertOwnerConfigRecord(value, 'daemon.json', isValidAid);
+    if (value.upgrade !== undefined) {
+        if (!value.upgrade || typeof value.upgrade !== 'object' || Array.isArray(value.upgrade))
+            throw new Error('daemon.json.upgrade must be an object');
+        for (const [field, enabled] of Object.entries(value.upgrade)) {
+            if (!['autoOnStart', 'testPackages'].includes(field) || typeof enabled !== 'boolean')
+                throw new Error(`daemon.json.upgrade.${field} must be a supported boolean setting`);
+        }
+    }
     if (value.restartRecovery !== undefined) {
         if (!value.restartRecovery || typeof value.restartRecovery !== 'object' || Array.isArray(value.restartRecovery)) {
             throw new Error('daemon.json.restartRecovery must be an object');
@@ -498,24 +509,17 @@ export function validateAgentConfig(cfg) {
         errs.push('channels must be an array');
         return errs;
     }
+    if (cfg.owner !== undefined && (typeof cfg.owner !== 'string' || !isValidAid(cfg.owner))) {
+        errs.push(`invalid owner: ${cfg.owner}`);
+    }
     if (cfg.owners !== undefined) {
-        if (!Array.isArray(cfg.owners)) {
+        if (!Array.isArray(cfg.owners))
             errs.push('owners must be an array');
-        }
-        else {
-            const seenOwners = new Set();
+        else
             cfg.owners.forEach((owner, i) => {
-                if (typeof owner !== 'string' || !isValidAid(owner)) {
+                if (typeof owner !== 'string' || !isValidAid(owner))
                     errs.push(`owners[${i}] invalid aid: ${owner}`);
-                    return;
-                }
-                if (seenOwners.has(owner)) {
-                    errs.push(`owners[${i}] duplicate aid: ${owner}`);
-                    return;
-                }
-                seenOwners.add(owner);
             });
-        }
     }
     let aunCount = 0;
     const seenNamesByType = new Map();