evolcore 0.0.7 → 0.0.9

package/dist/channels/aun.js

@@ -16,9 +16,8 @@ import { chatDirPath } from '../core/session/session-fs-store.js';
 import { appendHintAdd, appendHintRemove, parseInjectRequest } from '../core/message/pending-hints.js';
 import { appendAidLifecycle } from '../aun/aid/identity.js';
 import { getAidStore, loadClient, SLOT } from '../aun/aid/store.js';
-import { uploadFileAndBuildPayload } from '../aun/msg/upload.js';
+import { MAX_AUN_ATTACHMENT_SIZE, uploadBufferAndBuildPayload, uploadFileAndBuildPayload } from '../aun/msg/upload.js';
 import { loadAgent, saveAgent } from '../config-store.js';
-import { activeBaseagent } from '../core/model/config-scope.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { isManagementRole } from '../config/builtin-roles.js';
 import { mentionModeToDispatch } from '../config/mention-mode.js';
@@ -35,6 +34,19 @@ import { isExplicitGroupId } from '../aun/group-identity.js';
 import { refreshAgentDisplayName, resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { readInstalledEvolcoreVersion } from '../utils/evolcore-version.js';
 export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
+const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+const IMAGE_MIME_TYPE = /^image\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function normalizeImageMimeType(mimeType) {
+    const normalized = mimeType?.split(';', 1)[0].trim().toLowerCase();
+    if (!normalized)
+        return undefined;
+    if (!normalized.startsWith('image/'))
+        return undefined;
+    if (!IMAGE_MIME_TYPE.test(normalized)) {
+        throw new Error('result.image MIME type must be a valid image media type');
+    }
+    return normalized;
+}
 /**
  * 构造 connect extra_info：自描述本进程身份。
  *
@@ -275,8 +287,8 @@ export class AUNChannel {
         }
     }
     /** 判断 channelId 是否为群组 ID
-     *  - 新格式：group.{issuer}/{group_no|group_name}
-     *  - 数字群号：{group_no}.{issuer}（如 11117.agentid.pub）
+     *  - 新格式：group.{aidDomain}/{group_no|group_name}
+     *  - 数字群号：{group_no}.{aidDomain}（如 11117.example.com）
      *  - 兼容旧格式：grp_xxx、g-xxx.agentid.pub
      */
     /** 判断 channelId 是否群组 ID（public：plugin adapter 闭包需调用） */
@@ -359,10 +371,11 @@ export class AUNChannel {
                         || (channelId && !this.isGroupId(channelId) ? channelId : '')
                         || '';
                     if (cardInfo.isCommandCard) {
-                        // CommandCard：action_value 是完整 slash 命令，构造伪入站消息
-                        this.cardMessageIdMap.delete(cardMsgId);
+                        // CommandCard：action_value 是完整 slash 命令，构造伪入站消息。
+                        // 先完成点击者鉴权，再消费 mapping；否则群成员的一次误点会让发起者
+                        // 无法继续操作同一张卡片。
+                        const chatType = channelId ? (this.isGroupId(channelId) ? 'group' : 'private') : 'private';
                         if (this.messageHandler && actionValue.startsWith('/')) {
-                            const chatType = channelId ? (this.isGroupId(channelId) ? 'group' : 'private') : 'private';
                             // Initiator 校验：仅群聊需要（私聊信道一对一，点击者恒为对端 = initiator）。
                             // 身份只信认证信封提取的 cardClickerAid，非 payload 自报。
                             if (chatType === 'group' && !cardClickerAid) {
@@ -376,6 +389,9 @@ export class AUNChannel {
                                 this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId);
                                 return '';
                             }
+                            // 已通过鉴权并即将进入处理流程；此时才消费 mapping，避免非发起者
+                            // 或非法命令点击导致卡片提前失效。
+                            this.cardMessageIdMap.delete(cardMsgId);
                             Promise.resolve(this.messageHandler({
                                 channelId: channelId || '',
                                 channelType: 'aun',
@@ -495,7 +511,7 @@ export class AUNChannel {
                     }
                 }
                 else if (this.ownedCardMsgIds.has(cardMsgId)) {
-                    // 本 agent 发出的卡片，但 entry 已过期（20min TTL）
+                    // 本 agent 发出的卡片，但 entry 已过期（24h TTL）
                     logger.debug(`${this.logPrefix()} action_card_reply expired: cardMsgId=${cardMsgId}`);
                     this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起');
                 }
@@ -579,6 +595,38 @@ export class AUNChannel {
                 parts.push('---');
                 return parts.join('\n');
             }
+            // 结构化 link/location 必须优先保留业务字段。部分客户端同时提供
+            // 顶层 text（仅供展示），若先返回该字段会丢失 URL、坐标和地址。
+            if (obj.type === 'link') {
+                const parts = [];
+                if (typeof obj.title === 'string' && obj.title)
+                    parts.push(`标题: ${obj.title}`);
+                if (typeof obj.description === 'string' && obj.description)
+                    parts.push(`描述: ${obj.description}`);
+                if (typeof obj.url === 'string' && obj.url)
+                    parts.push(`URL: ${obj.url}`);
+                if (text && !parts.includes(text))
+                    parts.push(text);
+                return parts.length > 0 ? parts.join('\n') : text || JSON.stringify(payload);
+            }
+            if (obj.type === 'location') {
+                const parts = [];
+                if (typeof obj.name === 'string' && obj.name)
+                    parts.push(`地点: ${obj.name}`);
+                if (typeof obj.address === 'string' && obj.address)
+                    parts.push(`地址: ${obj.address}`);
+                if (typeof obj.latitude === 'number' && Number.isFinite(obj.latitude))
+                    parts.push(`纬度: ${obj.latitude}`);
+                if (typeof obj.longitude === 'number' && Number.isFinite(obj.longitude))
+                    parts.push(`经度: ${obj.longitude}`);
+                if (typeof obj.precision_m === 'number' && Number.isFinite(obj.precision_m))
+                    parts.push(`精度: ${obj.precision_m}m`);
+                if (typeof obj.map_url === 'string' && obj.map_url)
+                    parts.push(`地图: ${obj.map_url}`);
+                if (text && !parts.includes(text))
+                    parts.push(text);
+                return parts.length > 0 ? parts.join('\n') : text || JSON.stringify(payload);
+            }
             if (typeof obj.text === 'string')
                 return text;
             return JSON.stringify(payload);
@@ -713,8 +761,11 @@ export class AUNChannel {
             this.messageSeqMap.delete(messageId);
     }
     shouldEncrypt(_peerId) {
-        // Default to plaintext; only encrypt when session is explicitly marked encrypted
-        return false;
+        return this.config.defaultEncrypt ?? true;
+    }
+    /** Effective channel default for callers that must persist a concrete transport choice. */
+    getDefaultEncrypt() {
+        return this.shouldEncrypt(this.config.aid);
     }
     _aid;
     _selfName; // 本地 agent.md 中的 name，首次 connect 时读取
@@ -884,8 +935,12 @@ export class AUNChannel {
         this.store = store;
         const client = await loadClient(store, aidName);
         this.client = client;
-        // 仅作为配置/状态展示。当前 SDK public API 不接受 authenticate gateway override；
-        // 实际 gateway 由 SDK discovery + token-store metadata cache 解析。
+        // fastaun gives a preset in-memory gateway precedence over its metadata
+        // cache and AID discovery. authenticate({ gateway }) is deliberately
+        // rejected by its public API, so set the documented client preset before
+        // authentication instead.
+        if (configuredGateway)
+            client._gatewayUrl = configuredGateway;
         this.gatewayUrl = configuredGateway;
         // Register event handlers before connecting
         client.on('message.received', (data) => {
@@ -1138,13 +1193,10 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             await this.callAndTrace('message.send', {
                 to: owner,
                 payload: { type: 'text', text: welcomeText },
-                encrypt: true,
+                encrypt: this.shouldEncrypt(owner),
                 persist_required: true,
             });
             logger.info(`${this.logPrefix()} Welcome message sent to owner: ${owner}`);
-            // Send binding credential for Evol App to persist locally
-            // active_baseagent 经 config-scope 解析。
-            await this.sendBindingCredential(owner, agentDisplayName, activeBaseagent(aidName)).catch(e => logger.warn(`${this.logPrefix()} Binding credential failed: ${e}`));
             // Mark agent as initialized in config.json (replaces old agent.md frontmatter flag)
             try {
                 const fresh = loadAgent(aidName);
@@ -1162,17 +1214,6 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             logger.warn(`${this.logPrefix()} Failed to send welcome message: ${e}`);
         }
     }
-    async sendBindingCredential(owner, name, baseagent) {
-        if (!this.client)
-            return;
-        await this.callAndTrace('message.send', {
-            to: owner,
-            payload: { type: 'binding', aid: this.config.aid, name, owner, baseagent },
-            encrypt: true,
-            persist_required: true,
-        });
-        logger.info(`${this.logPrefix()} Binding credential sent to owner: ${owner}`);
-    }
     // ── Event handlers ──────────────────────────────────────────
     /**
      * 统一处理入站附件：下载 → 图片识别+base64 注入 → 拼接文本。
@@ -1364,24 +1405,24 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         return null;
     }
     isTrustedStorageHost(host, normalizedOwner) {
-        const trustedIssuers = new Set();
-        // 对端 issuer（文件所有者 owner_aid）
-        const peerIssuer = this.extractIssuer(normalizedOwner);
-        if (peerIssuer)
-            trustedIssuers.add(peerIssuer);
-        // 本端 issuer（自己的 AID）
-        const selfIssuer = this.extractIssuer((this.getAid() || '').toLowerCase());
-        if (selfIssuer)
-            trustedIssuers.add(selfIssuer);
-        // 校验 host 是否为任一可信 issuer 的存储域名
-        for (const issuer of trustedIssuers) {
-            if (host === `storage.${issuer}`)
+        const trustedAidDomains = new Set();
+        // 对端 AID domain（文件所有者 owner_aid）
+        const peerAidDomain = this.extractAidDomain(normalizedOwner);
+        if (peerAidDomain)
+            trustedAidDomains.add(peerAidDomain);
+        // 本端 AID domain（自己的 AID）
+        const selfAidDomain = this.extractAidDomain((this.getAid() || '').toLowerCase());
+        if (selfAidDomain)
+            trustedAidDomains.add(selfAidDomain);
+        // 校验 host 是否为任一可信 AID domain 的存储域名
+        for (const aidDomain of trustedAidDomains) {
+            if (host === `storage.${aidDomain}`)
                 return true;
         }
         return false;
     }
-    /** 从 AID 提取 issuer（去掉首段 label）。`mybot.agentid.pub` → `agentid.pub` */
-    extractIssuer(aid) {
+    /** 从 AID 提取后缀 domain（去掉首段 label）。`mybot.example.com` → `example.com` */
+    extractAidDomain(aid) {
         if (!aid || !aid.includes('.'))
             return '';
         return aid.split('.').slice(1).join('.');
@@ -1921,7 +1962,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
     //
     // observable=true 时，Agent 收发的每条 AUN 消息（原始信封 + 解密后明文
     // payload）镜像一份给 owners[]。入站在所有过滤之前转发；出站在真实发送
-    // 成功后转发。外层一律明文。详见 docs/observer-mode-design.md。
+    // 成功后转发。Observer 使用 daemon 的全局 AUN 默认加密设置，业务合同保持不变。
     // observable / owners 不在此处缓存——由 daemon 注入 resolver，从 EvolAgent 的
     // in-memory merged config（启动/重启/热重载时统一更新的唯一缓存）读取，避免重复缓存。
     observerConfigResolver;
@@ -1984,7 +2025,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         this.emitForward('outbound', result, recipientOwners);
     }
     /**
-     * 实际投递 observer.forward 给每个 owner，外层一律明文。
+     * 实际投递 observer.forward 给每个 owner，使用 daemon 的全局 AUN 默认加密设置。
      * original 为 SDK 给到的原始对象（入站回调 data / 出站 SendResult），整体透传，
      * 不挑字段、不改字段——SDK 加任何字段都会自动一并转发给 owner。
      */
@@ -1995,9 +2036,10 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             agent_aid: this.config.aid,
             original,
         };
+        const encrypt = this.shouldEncrypt('observer.forward');
         for (const ownerAid of owners) {
-            this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt: false })
-                .catch(e => logger.debug(`${this.logPrefix()} observer.forward to ${ownerAid} failed: ${e}`));
+            this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt })
+                .catch(e => logger.warn(`${this.logPrefix()} observer.forward send to ${ownerAid} failed: ${e}`));
         }
     }
     // ── 观察者插话（Observer Insert，v0.3 待用上下文提示） ──────────────
@@ -2007,7 +2049,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
     // （不 dispatch、不跑 LLM、不回 owner）；下一条对端消息到达时由 message-processor
     // 回放消费、注入渲染层。action=add 加提示 / remove 撤销。
     // 详见 docs/observer-insert-design.md 第一部分。
-    /** 回 observer.inject.ack 给 owner（明文）。accepted 在成功写盘之后发出。 */
+    /** 回 observer.inject.ack 给 owner；加密使用 daemon 的全局 AUN 默认设置。 */
     emitInjectAck(ownerAid, injectId, data, error) {
         if (!this.connected || !this.client)
             return;
@@ -2018,8 +2060,8 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             ackPayload.data = data;
         if (error)
             ackPayload.error = error;
-        this.callAndTrace('message.send', { to: ownerAid, payload: ackPayload, encrypt: false })
-            .catch(e => logger.debug(`${this.logPrefix()} observer.inject.ack to ${ownerAid} failed: ${e}`));
+        this.callAndTrace('message.send', { to: ownerAid, payload: ackPayload, encrypt: this.shouldEncrypt(ownerAid) })
+            .catch(e => logger.warn(`${this.logPrefix()} observer.inject.ack send to ${ownerAid} failed: ${e}`));
     }
     /** 处理 observer.inject：鉴权 + 校验 + 只落盘到 pending-hints（不触发处理、不回 owner）。 */
     handleObserverInject(fromAid, payload, displayName, peerType) {
@@ -2519,9 +2561,6 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         }
     }
     payloadByteLength(payload, logText) {
-        if (payload.type === 'image' && typeof payload.data_base64 === 'string') {
-            return Buffer.byteLength(payload.data_base64, 'utf-8');
-        }
         return Buffer.byteLength(logText, 'utf-8');
     }
     applyReplyContextToPayload(payload, context) {
@@ -2541,11 +2580,16 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         const timer = setTimeout(() => this.invalidatedInteractions.delete(interactionId), 24 * 60 * 60 * 1000);
         timer.unref?.();
     }
-    async recallInteractionCard(messageId) {
+    async recallInteractionCard(messageId, channelId) {
         if (!this.client || !this.connected)
             return false;
         try {
-            await this.callAndTrace('message.recall', { message_ids: [messageId] }, { silentError: true });
+            const isGroup = channelId ? this.isGroupId(channelId) : false;
+            const method = isGroup ? 'group.recall' : 'message.recall';
+            const params = isGroup
+                ? { group_id: channelId, message_ids: [messageId] }
+                : { message_ids: [messageId] };
+            await this.callAndTrace(method, params, { silentError: true });
             return true;
         }
         catch (error) {
@@ -2566,8 +2610,9 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         }
         const messageIds = [...(this.interactionCardMessageIds.get(interactionId) ?? [])];
         for (const messageId of messageIds) {
+            const channelId = this.cardMessageIdMap.get(messageId)?.channelId;
             this.forgetInteractionCard(messageId, interactionId);
-            await this.recallInteractionCard(messageId);
+            await this.recallInteractionCard(messageId, channelId);
         }
     }
     forgetInteractionCard(messageId, interactionId) {
@@ -2577,13 +2622,14 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         if (ids && ids.size === 0)
             this.interactionCardMessageIds.delete(interactionId);
     }
-    registerCardPostSend(messageId, action) {
+    registerCardPostSend(messageId, action, channelId) {
         if (action.type !== 'register_interaction_card')
             return;
         this.cardMessageIdMap.set(messageId, {
             requestId: action.requestId,
             isCommandCard: action.isCommandCard,
             initiatorAid: action.initiatorAid,
+            channelId,
         });
         this.ownedCardMsgIds.add(messageId);
         let messageIds = this.interactionCardMessageIds.get(action.requestId);
@@ -2595,7 +2641,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         const now = Date.now();
         const mapTtl = action.expiresAt && action.expiresAt > now
             ? action.expiresAt - now
-            : 20 * 60 * 1000;
+            : AUN_INTERACTION_CARD_TTL_MS;
         const mapTimer = setTimeout(() => {
             this.cardMessageIdMap.delete(messageId);
             const ids = this.interactionCardMessageIds.get(action.requestId);
@@ -2609,14 +2655,14 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         const invalidationReason = this.invalidatedInteractions.get(action.requestId);
         if (invalidationReason) {
             this.cardMessageIdMap.delete(messageId);
-            void this.recallInteractionCard(messageId);
+            void this.recallInteractionCard(messageId, channelId);
         }
     }
     runPostSend(entry, messageId) {
         if (!entry.postSend)
             return;
         if (entry.postSend.type === 'register_interaction_card') {
-            this.registerCardPostSend(messageId, entry.postSend);
+            this.registerCardPostSend(messageId, entry.postSend, entry.channelId);
         }
     }
     async sendAunPayload(channelId, payload, context, label) {
@@ -2931,7 +2977,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             finalPayload._evolcore_causation_ref = causationRef;
             registerAunCausation(causationRef, this.config.aid, args.to, outboundCausation);
         }
-        const encrypt = args.encrypt === true;
+        const encrypt = args.encrypt ?? this.shouldEncrypt(args.to);
         const sendParams = {
             to: args.to,
             payload: this.truncatePayloadIfNeeded(finalPayload, 'msg-send-ipc'),
@@ -3036,7 +3082,7 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
         const finalPayload = this.stripUndefinedDeep({ ...args.payload });
         if (args.mentions?.length)
             finalPayload.mentions = args.mentions;
-        const encrypt = args.encrypt === true;
+        const encrypt = args.encrypt ?? this.shouldEncrypt(args.groupId);
         try {
             const result = await this.callAndTrace('group.send', {
                 group_id: args.groupId,
@@ -3529,6 +3575,117 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             outbox.remove(this.config.aid, entry.id);
         }
     }
+    async sendImage(channelId, data, mimeType, alt, context) {
+        if (!Buffer.isBuffer(data)) {
+            throw new Error('result.image data must be a Buffer');
+        }
+        if (data.length === 0) {
+            throw new Error('result.image data cannot be empty');
+        }
+        if (data.length > MAX_AUN_ATTACHMENT_SIZE) {
+            throw new Error(`result.image is too large (${formatSize(data.length)}, max ${formatSize(MAX_AUN_ATTACHMENT_SIZE)})`);
+        }
+        let normalizedMimeType = normalizeImageMimeType(mimeType);
+        if (!normalizedMimeType) {
+            const { default: imageType } = await import('image-type');
+            const detected = await imageType(data).catch(() => undefined);
+            normalizedMimeType = detected?.mime;
+            if (!normalizedMimeType) {
+                throw new Error('result.image requires a valid image MIME type or recognizable image data');
+            }
+        }
+        const logText = alt ? `[image] ${alt}` : '[image]';
+        const entry = outbox.enqueue(this.config.aid, {
+            channelId,
+            type: 'image',
+            contentKind: 'image',
+            image: { dataBase64: data.toString('base64'), mimeType: normalizedMimeType, alt },
+            context,
+            logText,
+        });
+        logger.debug(`${this.logPrefix()} Outbox enqueued image: id=${entry.id} channel=${channelId} bytes=${data.length}`);
+        if (!this.connected || !this.client) {
+            logger.warn(`${this.logPrefix()} Not connected, image send queued in outbox (id=${entry.id}). Triggering reconnect.`);
+            if (!this.reconnectTimer && !this.client) {
+                this.initClient().catch(e => logger.error(`${this.logPrefix()} Reconnect from sendImage failed: ${e}`));
+            }
+            return;
+        }
+        const ok = await this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), false);
+        if (ok)
+            outbox.remove(this.config.aid, entry.id);
+    }
+    async buildUploadedImagePayload(data, mimeType, alt) {
+        if (!this.connected || !this.client) {
+            throw new Error('AUN channel is not connected; image cannot be uploaded');
+        }
+        let contentType = normalizeImageMimeType(mimeType);
+        let extension;
+        if (!contentType) {
+            const { default: imageType } = await import('image-type');
+            const detected = await imageType(data).catch(() => undefined);
+            contentType = detected?.mime;
+            extension = detected?.ext;
+        }
+        if (!contentType) {
+            throw new Error('result.image requires a valid image MIME type or recognizable image data');
+        }
+        if (!extension) {
+            const subtype = contentType.slice('image/'.length);
+            extension = subtype === 'jpeg'
+                ? 'jpg'
+                : subtype === 'svg+xml'
+                    ? 'svg'
+                    : subtype.replace(/[^a-z0-9]/g, '') || 'img';
+        }
+        const digest = crypto.createHash('sha256').update(data).digest('hex').slice(0, 12);
+        const filename = `image-${digest}.${extension}`;
+        const connection = {
+            call: (method, params) => this.callAndTrace(method, params),
+            close: async () => { },
+        };
+        const built = await uploadBufferAndBuildPayload(connection, this.config.aid, data, filename, { as: 'image', contentType });
+        const imagePayload = { ...built.payload };
+        setIfDefined(imagePayload, 'alt', alt);
+        return imagePayload;
+    }
+    async deliverImageEntry(entry) {
+        const image = entry.image;
+        if (!image || typeof image.dataBase64 !== 'string') {
+            logger.warn(`${this.logPrefix()} deliverImageEntry: missing image data (outbox id=${entry.id})`);
+            return true;
+        }
+        const data = Buffer.from(image.dataBase64, 'base64');
+        if (data.length === 0) {
+            logger.warn(`${this.logPrefix()} deliverImageEntry: invalid image data (outbox id=${entry.id})`);
+            return true;
+        }
+        const imagePayload = await this.buildUploadedImagePayload(data, image.mimeType, image.alt);
+        entry.type = 'payload';
+        entry.contentKind = 'image';
+        entry.payload = this.applyReplyContextToPayload(imagePayload, entry.context);
+        entry.logText ??= image.alt ? `[image] ${image.alt}` : '[image]';
+        delete entry.image;
+        // Persist the attachment reference before message.send. A failed send then
+        // retries the compact wire payload without re-uploading the same image.
+        let payloadEntry = entry;
+        if (!outbox.replace(this.config.aid, entry)) {
+            payloadEntry = outbox.enqueue(this.config.aid, {
+                channelId: entry.channelId,
+                type: 'payload',
+                contentKind: 'image',
+                payload: entry.payload,
+                context: entry.context,
+                logText: entry.logText,
+                ttl: entry.ttl,
+            });
+        }
+        const sent = await this.deliverPayloadEntry(payloadEntry);
+        if (sent.ok && payloadEntry.id !== entry.id) {
+            outbox.remove(this.config.aid, payloadEntry.id);
+        }
+        return sent.ok;
+    }
     async deliverFileEntry(entry) {
         const channelId = entry.channelId;
         const absPath = entry.filePath;
@@ -3715,6 +3872,9 @@ EvolCore AI Agent 网关，支持多项目会话管理和多 AI 后端切换。
             else if (entry.type === 'file') {
                 return this.withOutboxInFlight(entry, () => this.deliverFileEntry(entry), false);
             }
+            else if (entry.type === 'image') {
+                return this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), false);
+            }
             else if (entry.type === 'payload') {
                 const sent = await this.withOutboxInFlight(entry, () => this.deliverPayloadEntry(entry), { ok: false });
                 return sent.ok;
@@ -4021,6 +4181,7 @@ export class AUNChannelPlugin {
             aid,
             keystorePath: inst.keystorePath,
             gatewayUrl: inst.gatewayUrl,
+            defaultEncrypt: ctx.aunDefaultEncrypt,
             accessToken: inst.accessToken,
             flushDelay: inst.flushDelay,
             agentName: ctx.agentName,
@@ -4087,16 +4248,7 @@ export class AUNChannelPlugin {
                         return;
                     }
                     case 'result.image': {
-                        const buf = payload.data;
-                        const b64 = buf.toString('base64');
-                        const imagePayload = { type: 'image', data_base64: b64 };
-                        setIfDefined(imagePayload, 'alt', payload.alt);
-                        setIfDefined(imagePayload, 'mime_type', payload.mimeType);
-                        await channel.sendContentPayload(channelId, imagePayload, {
-                            contentKind: 'image',
-                            context: replyCtx,
-                            logText: payload.alt ? `[image] ${payload.alt}` : '[image]',
-                        });
+                        await channel.sendImage(channelId, payload.data, payload.mimeType, payload.alt, replyCtx);
                         return;
                     }
                     case 'activity.batch': {
@@ -4147,7 +4299,7 @@ export class AUNChannelPlugin {
                         return;
                     case 'interaction': {
                         const req = payload.interaction;
-                        const cardTtlMs = 20 * 60 * 1000;
+                        const cardTtlMs = AUN_INTERACTION_CARD_TTL_MS;
                         if (req.kind.kind === 'action') {
                             const action = req.kind;
                             const aunCard = {
@@ -4204,6 +4356,8 @@ export class AUNChannelPlugin {
                                 aunCard.text = card.body;
                                 setIfDefined(aunCard, 'format', card.bodyFormat);
                             }
+                            if (req.initiatorId && channel.isGroupId(channelId))
+                                aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
                             await channel.sendContentPayload(channelId, aunCard, {

package/dist/cli/aun-commands.js

@@ -808,7 +808,7 @@ Options:
   --app <name>          指定应用 slot（独立消费通道，不影响 daemon）
   --aun-path <path>     指定 AUN keystore 根
   --format json         输出 JSON 格式
-  --encrypt             启用端到端加密（密文发送）
+  --encrypt             强制端到端加密（未指定时使用 daemon 默认值）
   --no-encrypt          强制明文发送（优先于 --encrypt）
   --thread <id>         指定话题 ID（用于多话题路由）
   --session <latest|all|id> 按 EvolCore 逻辑会话过滤历史（默认 latest）
@@ -1048,9 +1048,10 @@ Options:
             }
             body = { mode: 'text', text };
         }
-        // 加密态：--encrypt 密文，--no-encrypt 明文，都不带默认明文（人类终端直用即此）。
-        // 模型自主发送时由系统提示规则要求按入站消息加密态显式带参。--no-encrypt 优先于 --encrypt。
-        const encrypt = args.includes('--encrypt') && !args.includes('--no-encrypt');
+        // 显式 flag 覆盖 daemon 默认值；未指定时保留 undefined。
+        const encrypt = args.includes('--no-encrypt')
+            ? false
+            : args.includes('--encrypt') ? true : undefined;
         const thread = getArgValue(args, '--thread');
         const returnPolicyRaw = getArgValue(args, '--return');
         if (returnPolicyRaw && returnPolicyRaw !== 'required' && returnPolicyRaw !== 'none') {
@@ -1292,7 +1293,7 @@ Options:
   --app <name>          指定应用 slot（独立消费通道，不影响 daemon）
   --aun-path <path>     指定 AUN keystore 根
   --format json         输出 JSON 格式
-  --encrypt             启用端到端加密（仅 send）
+  --encrypt             强制端到端加密（未指定时使用 daemon 默认值；仅 send）
   --no-encrypt          强制明文发送（优先于 --encrypt；仅 send）
   --thread <id>         指定话题 ID（仅 send）
   --return <none|required> 跨会话发送必填（仅 send；Trigger 只能使用 none）
@@ -1469,8 +1470,10 @@ Options:
             body = { mode: 'text', text };
         }
         const mentions = collectMentions();
-        // --encrypt 密文，--no-encrypt 明文，都不带默认明文。--no-encrypt 优先。
-        const encryptGroup = args.includes('--encrypt') && !args.includes('--no-encrypt');
+        // 显式 flag 覆盖 daemon 默认值；未指定时保留 undefined。
+        const encryptGroup = args.includes('--no-encrypt')
+            ? false
+            : args.includes('--encrypt') ? true : undefined;
         const thread = getArgValue(args, '--thread');
         const returnPolicyRaw = getArgValue(args, '--return');
         if (returnPolicyRaw && returnPolicyRaw !== 'required' && returnPolicyRaw !== 'none') {

package/dist/cli/bench.js

@@ -5,9 +5,10 @@ import os from 'os';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { aidList, aidCreate } from '../aun/aid/identity.js';
-import { resolveControlIssuer } from '../aun/aid/control-aid.js';
+import { resolveControlAidDomain } from '../aun/aid/control-aid.js';
 import { msgSend, msgPull } from '../aun/msg/index.js';
 import { getPackageRoot, aunPath as defaultAunPath } from '../paths.js';
+import { loadDaemonConfig } from '../config-store.js';
 import { getAidStore, loadClient, SLOT } from '../aun/aid/store.js';
 import { isHelpFlag, wantsHelp, getArgValue } from './help.js';
 const execFileAsync = promisify(execFile);
@@ -476,10 +477,10 @@ Options:
         const need = numAids - usableAids.length;
         if (!formatJson)
             console.log(warn(`仅 ${usableAids.length} 个可用，需创建 ${need} 个新 AID`));
-        const issuer = resolveControlIssuer();
+        const aidDomain = resolveControlAidDomain(loadDaemonConfig().aun?.defaultAidDomain);
         for (let i = 0; i < need; i++) {
             const hex = crypto.randomBytes(4).toString('hex');
-            const newAid = `bench-${hex}.${issuer}`;
+            const newAid = `bench-${hex}.${aidDomain}`;
             try {
                 await aidCreate(newAid, { aunPath });
                 aids.push(newAid);