mu-agent-bridge 1.0.23 → 1.0.24

package/README.md

@@ -20,6 +20,8 @@ OpenAI 兼容 API 为 `/v1/models` 和 `/v1/chat/completions`。管理页面位
 安装后使用 `mab start` 启动。旧桥仍可使用 `17893`，不会与管理页面冲突。局域网访问时设置
 `AGENT_BRIDGE_HOST=0.0.0.0` 和 `AGENT_BRIDGE_TOKEN`，然后访问
 `http://<Windows 主机 IP>:26107/abweb/`。页面使用一次性配置码配对后管理插件；请只在可信网络使用。
+如果 26107 被旧的 mab 进程占用，可执行 `mab restart`；命令会结束旧 daemon 并重新启动。`mab stop` 只停止 daemon，
+`mab update` 会结束旧 daemon、安装最新核心包并启动新版本。不会把自己的旧进程误当成新的 daemon，也不会因此默认改用临时端口。
 已有 AID 的连接状态由 AUN 插件自己建立和查询，只有当前已连接的身份才能关联 Agent。
 AUN 插件通过 SDK 枚举 EvolCore 的本地 AID，并逐个建立连接；ABWeb 只展示已连接 AID，并按 EvolCore 与 mu-agent-bridge 分组，未连接身份不显示。状态检测不调用 `ec agent list/show`。
 创建新 AID 必须填写 Owner AID，并安装、启动 AUN 插件；创建与通信由该插件完成。
@@ -60,6 +62,8 @@ mab start
 
 插件更新策略可在 ABWeb 的“版本管理”中选择：默认“自动下载并安装”；“自动下载，手动安装”会把新版本缓存到状态目录并等待页面操作；“手动下载和安装”只检查版本。策略保存在 `state/update-policy.json`，插件下载缓存位于 `state/downloads`。
 
+自动升级信任可在 ABWeb 的“自动升级信任”中设置。npm 提供者 `m2lihui` 默认可信，其他提供者默认不可信；用户可以取消提供者信任，也可以对单个插件设置允许或禁止。插件单独设置优先于提供者设置。信任配置保存在 `state/plugin-trust.json`，npm 发布者信息以 registry 元数据为准；查询失败时插件保持发现状态，但不会自动升级。旧的 `AGENT_BRIDGE_TRUSTED_PACKAGES` 包名名单继续兼容，直到对应提供者或插件存在明确设置。
+
 运行时会发现核心包依赖和 `AGENT_BRIDGE_PLUGIN_PACKAGES` 中声明的 npm 包。插件包在自己的
 `package.json` 中声明 `agentBridge.plugin`，平台复用统一的 `activate`、`deactivate`、`health`、
 `handle` 生命周期。已加载插件可以通过管理 API 重载；新增 npm 包后重启 daemon 最可靠。

package/dist/src-ts/cli.js

@@ -114,9 +114,63 @@ async function update() {
         console.error("当前平台未配置后台升级器");
         return 2;
     }
+    await stopDaemon();
     await execFileAsync("npm.cmd", ["install", "-g", "mu-agent-bridge@latest", "--no-fund", "--no-audit"], { timeout: 120_000 });
-    await execFileAsync("schtasks.exe", ["/Run", "/TN", "mab"]);
-    console.log("核心已更新，已请求 mab 计划任务重新启动");
+    await startDaemon();
+    console.log("核心已更新，旧 daemon 已结束并启动新版本");
+    return 0;
+}
+async function stopDaemon(stopTask = true) {
+    let pid;
+    try {
+        const address = JSON.parse(await (0, promises_1.readFile)((0, node_path_1.resolve)(stateDirectory(), "daemon-address.json"), "utf8"));
+        if (Number.isInteger(address.pid) && address.pid > 0)
+            pid = address.pid;
+    }
+    catch { /* 地址文件不存在时继续尝试计划任务 */ }
+    if (pid && process.platform === "win32") {
+        try {
+            await execFileAsync("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { timeout: 15_000 });
+        }
+        catch { /* 进程已退出 */ }
+    }
+    else if (pid) {
+        try {
+            process.kill(pid);
+        }
+        catch { /* 进程已退出 */ }
+    }
+    if (stopTask && process.platform === "win32") {
+        try {
+            await execFileAsync("schtasks.exe", ["/End", "/TN", "mab"], { timeout: 15_000 });
+        }
+        catch { /* 任务不存在或已停止 */ }
+    }
+    try {
+        await (0, promises_1.rm)((0, node_path_1.resolve)(stateDirectory(), "daemon-address.json"), { force: true });
+    }
+    catch { /* 忽略清理失败 */ }
+}
+async function startDaemon() {
+    if (process.platform === "win32") {
+        try {
+            await execFileAsync("schtasks.exe", ["/Run", "/TN", "mab"], { timeout: 15_000 });
+            return;
+        }
+        catch { /* 计划任务不存在时回退到直接启动 */ }
+    }
+    const child = (0, node_child_process_1.spawn)(process.execPath, [(0, node_path_1.resolve)(__dirname, "cli.js"), "start"], { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+}
+async function stop() {
+    await stopDaemon();
+    console.log("旧 daemon 已停止");
+    return 0;
+}
+async function restart() {
+    await stopDaemon();
+    await startDaemon();
+    console.log("旧 daemon 已结束，已启动新 daemon");
     return 0;
 }
 async function status() {
@@ -269,14 +323,20 @@ async function main() {
         return pair();
     if (args[0] === "status")
         return status();
+    if (args[0] === "stop")
+        return stop();
+    if (args[0] === "restart")
+        return restart();
     if (args[0] === "update")
         return update();
     const selfTestIndex = args.indexOf("--self-test");
     if (selfTestIndex >= 0)
         return selfTest(args[selfTestIndex + 1] ?? "hi");
-    if (args.includes("--serve") || args.includes("start"))
+    if (args.includes("--serve") || args.includes("start")) {
+        await stopDaemon(false);
         return serve();
-    console.error("用法：mab start | mab status | mab --self-test <任务>");
+    }
+    console.error("用法：mab start | mab stop | mab restart | mab update | mab status | mab --self-test <任务>");
     return 2;
 }
 main().then((code) => { process.exitCode = code; }).catch((error) => {

package/dist/src-ts/control-server.js

@@ -149,6 +149,12 @@ class ControlServer {
                 return this.json(res, 200, await this.options.manager.updatePolicy());
             if (method === "PATCH" && url.pathname === "/api/update-policy")
                 return this.json(res, 200, await this.options.manager.saveUpdatePolicy(await this.body(req)).then(() => ({ ok: true })));
+            if (method === "GET" && url.pathname === "/api/plugin-trust")
+                return this.json(res, 200, await this.options.manager.pluginTrust());
+            if (method === "PATCH" && url.pathname === "/api/plugin-trust") {
+                await this.options.manager.savePluginTrust(await this.body(req));
+                return this.json(res, 200, { ok: true, ...(await this.options.manager.pluginTrust()) });
+            }
             if (method === "POST" && url.pathname === "/api/versions/check")
                 return this.json(res, 200, { versions: await this.options.manager.checkPackageUpdates() });
             if (method === "POST" && url.pathname === "/api/update") {

package/dist/src-ts/plugin-manager.js

@@ -7,6 +7,7 @@ exports.PluginManager = void 0;
 const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
 const node_module_1 = require("node:module");
+const node_crypto_1 = require("node:crypto");
 const node_child_process_1 = require("node:child_process");
 const node_util_1 = require("node:util");
 const node_path_1 = require("node:path");
@@ -25,6 +26,10 @@ class PluginManager {
     httpRoutes = new Map();
     root;
     messages = [];
+    trustConfig = defaultPluginTrustConfig();
+    trustLoaded = false;
+    publisherLookups = new Map();
+    pendingPublisherLookups = new Set();
     versions;
     logs;
     sessions;
@@ -45,6 +50,35 @@ class PluginManager {
     } }
     async saveUpdatePolicy(policy) { if (!isUpdatePolicy(policy))
         throw new agent_1.AgentError("更新策略无效"); await (0, promises_1.mkdir)(this.options.stateDir, { recursive: true }); await (0, promises_1.writeFile)((0, node_path_1.join)(this.options.stateDir, "update-policy.json"), JSON.stringify(policy, null, 2)); this.log("info", `插件更新策略已设置：${policy.mode}`, undefined, "升级策略"); }
+    async pluginTrust() {
+        await this.loadPluginTrust();
+        const entries = this.list().filter((record) => record.packageName).map((record) => ({
+            id: record.id, packageName: record.packageName, publisher: record.publisher,
+            providerOverride: record.publisher ? this.trustConfig.providers[normalizeProvider(record.publisher)] : undefined,
+            pluginOverride: this.trustConfig.plugins[record.id], trusted: Boolean(record.trusted), autoUpdate: Boolean(record.autoUpdate),
+        }));
+        const providerNames = new Set([...Object.keys(this.trustConfig.providers), ...entries.map((entry) => entry.publisher ? normalizeProvider(entry.publisher) : "").filter(Boolean)]);
+        const providers = [...providerNames].sort().map((name) => ({ name, decision: this.trustConfig.providers[name] ?? "inherit", trusted: this.trustConfig.providers[name] === "allow" || (!this.trustConfig.providers[name] && name === "m2lihui") }));
+        return { config: structuredClone(this.trustConfig), providers, entries };
+    }
+    async savePluginTrust(value) {
+        const config = validatePluginTrustConfig(value);
+        await (0, promises_1.mkdir)(this.options.stateDir, { recursive: true });
+        const target = (0, node_path_1.join)(this.options.stateDir, "plugin-trust.json");
+        const temporary = `${target}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+        try {
+            await (0, promises_1.writeFile)(temporary, JSON.stringify(config, null, 2));
+            await (0, promises_1.rename)(temporary, target);
+        }
+        finally {
+            await (0, promises_1.rm)(temporary, { force: true });
+        }
+        this.trustConfig = mergeDefaultPluginTrustConfig(config);
+        this.trustLoaded = true;
+        for (const { record } of this.plugins.values())
+            this.applyPluginTrust(record);
+        this.log("info", "插件自动升级信任设置已保存", { providers: Object.keys(config.providers).length, plugins: Object.keys(config.plugins).length }, "插件信任");
+    }
     async downloadPackage(packageName, version) {
         if (!/^agent-bridge-[a-z0-9-]+$/.test(packageName))
             throw new agent_1.AgentError("仅支持 agent-bridge-* npm 包名");
@@ -79,6 +113,7 @@ class PluginManager {
     }
     async cachedPackage(packageName, version) { const target = (0, node_path_1.join)(this.options.stateDir, "downloads", packageName, version ?? "latest"); return (0, node_fs_1.existsSync)((0, node_path_1.join)(target, "node_modules", packageName)) ? target : undefined; }
     async discover() {
+        await this.loadPluginTrust();
         await (0, promises_1.mkdir)(this.root, { recursive: true });
         await this.discoverNpmPackages();
         await this.discoverManagedPackages();
@@ -99,6 +134,7 @@ class PluginManager {
                     await this.discoverDirectory(dir, `${id.name}/${version.name}`);
             }
         }
+        await this.resolvePendingPublisherLookups();
         return this.list();
     }
     list() { return [...this.plugins.values()].map(({ record }) => ({ ...record, capabilities: [...record.capabilities], dependencyStatus: this.dependencyStatus(record) })); }
@@ -114,6 +150,7 @@ class PluginManager {
     }
     async checkPackageUpdates() {
         await this.versions.load();
+        await this.refreshPluginPublishers();
         const core = JSON.parse(await (0, promises_1.readFile)((0, node_path_1.resolve)(__dirname, "../../package.json"), "utf8"));
         return Promise.all([this.versions.checkPackage("mu-agent-bridge", core.version), ...this.list().map(async (record) => {
                 const info = this.packageInfo(record.id);
@@ -219,6 +256,7 @@ class PluginManager {
                 throw new agent_1.AgentError("npm 包与插件清单不匹配");
             this.validateCandidate(manifest, meta.agentBridge);
             await this.discoverDirectory(directory, name, manifestFile);
+            await this.resolvePendingPublisherLookups();
             const record = this.plugins.get(manifest.id)?.record;
             if (!record)
                 throw new agent_1.AgentError("插件发现失败");
@@ -608,6 +646,7 @@ class PluginManager {
             }
             catch { /* 无效包由安装时报告 */ }
         }
+        await this.resolvePendingPublisherLookups();
     }
     async discoverDirectory(directory, label, manifestFile = (0, node_path_1.join)(directory, "plugin.json")) {
         try {
@@ -615,12 +654,10 @@ class PluginManager {
             if (this.plugins.has(manifest.id))
                 return;
             let packageName;
-            let publisher;
             let coreConstraint;
             try {
                 const packageJson = JSON.parse(await (0, promises_1.readFile)((0, node_path_1.join)(directory, "package.json"), "utf8"));
                 packageName = packageJson.name;
-                publisher = packageJson._npmUser?.name ?? packageJson.maintainers?.[0]?.name;
                 coreConstraint = packageJson.agentBridge?.requires?.["mu-agent-bridge"];
                 const declared = packageJson.agentBridge?.requires?.plugins;
                 if (declared && JSON.stringify(declared) !== JSON.stringify(manifest.dependencies ?? {}))
@@ -632,14 +669,78 @@ class PluginManager {
             }
             const coreVersion = require((0, node_path_1.resolve)(__dirname, "../../package.json")).version;
             const error = coreConstraint && !(0, version_manager_1.satisfiesVersion)(coreVersion, coreConstraint) ? `核心版本 ${coreVersion} 不满足插件要求 ${coreConstraint}` : undefined;
-            const trustedNames = new Set((process.env.AGENT_BRIDGE_TRUSTED_PACKAGES ?? "").split(",").map((name) => name.trim()).filter(Boolean));
-            const trusted = Boolean(packageName && trustedNames.has(packageName));
-            this.plugins.set(manifest.id, { record: { id: manifest.id, version: manifest.version, type: manifest.type ?? "other", displayName: manifest.displayName ?? manifest.id, status: error ? "failed" : "discovered", capabilities: manifest.capabilities, manifest, path: directory, ...(packageName ? { packageName, publisher, trusted, autoUpdate: trusted } : {}), ...(coreConstraint ? { coreConstraint } : {}), ...(error ? { error } : {}) } });
+            const record = { id: manifest.id, version: manifest.version, type: manifest.type ?? "other", displayName: manifest.displayName ?? manifest.id, status: error ? "failed" : "discovered", capabilities: manifest.capabilities, manifest, path: directory, ...(packageName ? { packageName } : {}), ...(coreConstraint ? { coreConstraint } : {}), ...(error ? { error } : {}) };
+            this.applyPluginTrust(record);
+            this.plugins.set(manifest.id, { record });
+            if (packageName && /^agent-bridge-[a-z0-9-]+$/.test(packageName)) {
+                const pending = this.lookupPublisher(packageName, manifest.version).then((name) => {
+                    if (!name)
+                        return;
+                    record.publisher = name;
+                    this.applyPluginTrust(record);
+                }).catch((lookupError) => {
+                    this.log("warn", `无法查询插件 npm 提供者：${manifest.id}`, { packageName, error: lookupError instanceof Error ? lookupError.message : String(lookupError) }, "插件信任");
+                }).finally(() => this.pendingPublisherLookups.delete(pending));
+                this.pendingPublisherLookups.add(pending);
+            }
         }
         catch (error) {
             throw new agent_1.AgentError(`invalid plugin ${label}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
         }
     }
+    async loadPluginTrust() {
+        if (this.trustLoaded)
+            return;
+        try {
+            const value = JSON.parse(await (0, promises_1.readFile)((0, node_path_1.join)(this.options.stateDir, "plugin-trust.json"), "utf8"));
+            this.trustConfig = mergeDefaultPluginTrustConfig(validatePluginTrustConfig(value));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                this.log("warn", "插件信任配置无效，已使用默认设置", { error: error instanceof Error ? error.message : String(error) }, "插件信任");
+            this.trustConfig = defaultPluginTrustConfig();
+        }
+        this.trustLoaded = true;
+    }
+    applyPluginTrust(record) {
+        if (!record.packageName)
+            return;
+        const provider = record.publisher ? normalizeProvider(record.publisher) : undefined;
+        const legacyTrusted = (process.env.AGENT_BRIDGE_TRUSTED_PACKAGES ?? "").split(",").map((name) => name.trim()).includes(record.packageName);
+        const decision = this.trustConfig.plugins[record.id]
+            ?? (provider ? this.trustConfig.providers[provider] : undefined)
+            ?? (legacyTrusted ? "allow" : undefined)
+            ?? "deny";
+        record.trusted = decision === "allow";
+        record.autoUpdate = decision === "allow";
+    }
+    async lookupPublisher(packageName, version) {
+        const cacheKey = `${packageName}@${version}`;
+        const cached = this.publisherLookups.get(cacheKey);
+        if (cached)
+            return cached;
+        const lookup = (this.options.publisherResolver ?? resolveNpmPublisher)(packageName, version).then((name) => name?.trim() || undefined).catch((error) => {
+            this.publisherLookups.delete(cacheKey);
+            throw error;
+        });
+        this.publisherLookups.set(cacheKey, lookup);
+        return lookup;
+    }
+    async resolvePendingPublisherLookups() { await Promise.all([...this.pendingPublisherLookups]); }
+    async refreshPluginPublishers() {
+        const pending = [];
+        for (const { record } of this.plugins.values()) {
+            if (!record.packageName || !/^agent-bridge-[a-z0-9-]+$/.test(record.packageName))
+                continue;
+            pending.push(this.lookupPublisher(record.packageName, record.version).then((publisher) => {
+                if (publisher && publisher !== record.publisher) {
+                    record.publisher = publisher;
+                    this.applyPluginTrust(record);
+                }
+            }).catch(() => undefined));
+        }
+        await Promise.all(pending);
+    }
     checkCompatibility(record) {
         const coreVersion = require((0, node_path_1.resolve)(__dirname, "../../package.json")).version;
         if (record.coreConstraint && !(0, version_manager_1.satisfiesVersion)(coreVersion, record.coreConstraint))
@@ -702,3 +803,41 @@ class PluginManager {
 }
 exports.PluginManager = PluginManager;
 function isUpdatePolicy(value) { return Boolean(value && typeof value === "object" && ["auto-install", "download-only", "manual"].includes(value.mode)); }
+function defaultPluginTrustConfig() { return { providers: { m2lihui: "allow" }, plugins: {} }; }
+function mergeDefaultPluginTrustConfig(value) { return { providers: { m2lihui: "allow", ...value.providers }, plugins: { ...value.plugins } }; }
+function normalizeProvider(value) { return value.trim().toLowerCase(); }
+function validatePluginTrustConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new agent_1.AgentError("插件信任配置必须是对象");
+    const source = value;
+    if (Object.keys(value).some((key) => key !== "providers" && key !== "plugins"))
+        throw new agent_1.AgentError("插件信任配置包含未知字段");
+    const readDecisions = (input, label, normalize) => {
+        if (input === undefined)
+            return {};
+        if (!input || typeof input !== "object" || Array.isArray(input))
+            throw new agent_1.AgentError(`${label}设置必须是对象`);
+        const entries = Object.entries(input);
+        if (entries.length > 500)
+            throw new agent_1.AgentError(`${label}设置数量超出限制`);
+        const result = {};
+        for (const [rawName, decision] of entries) {
+            const name = normalize ? normalizeProvider(rawName) : rawName;
+            if (!/^[a-z0-9][a-z0-9._-]{0,127}$/i.test(name))
+                throw new agent_1.AgentError(`${label}名称无效：${rawName}`);
+            if (decision !== "allow" && decision !== "deny")
+                throw new agent_1.AgentError(`${label}信任值只能是 allow 或 deny`);
+            result[name] = decision;
+        }
+        return result;
+    };
+    return { providers: readDecisions(source.providers, "提供者", true), plugins: readDecisions(source.plugins, "插件", false) };
+}
+async function resolveNpmPublisher(packageName, version) {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, { signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`npm 查询失败：HTTP ${response.status}`);
+    const metadata = await response.json();
+    const publisher = metadata.versions?.[version]?._npmUser?.name ?? metadata.maintainers?.[0]?.name;
+    return typeof publisher === "string" ? publisher : undefined;
+}

package/dist/src-ts/plugins/abweb/public/app.js

@@ -16,6 +16,9 @@
     const versionsNode = node("#versions");
     const policyNode = node("#update-policy");
     const policyStatusNode = node("#update-policy-status");
+    const trustProvidersNode = node("#trust-providers");
+    const trustPluginsNode = node("#trust-plugins");
+    const trustStatusNode = node("#plugin-trust-status");
     const loginExpiry = Number(localStorage.getItem("mab-login-expires-at") ?? 0);
     if (loginExpiry <= Date.now()) {
         localStorage.removeItem("mab-login-token");
@@ -25,6 +28,8 @@
     let plugins = [];
     let selectedChannelId = "";
     let pluginVersions = {};
+    let pluginTrustConfig = { providers: {}, plugins: {} };
+    let pluginTrustDirty = false;
     let logPage = 1;
     let logHasNext = false;
     let loading = false;
@@ -117,8 +122,8 @@
         loading = true;
         try {
             error("");
-            const [health, plugins, messages, versions, policy, sessions] = await Promise.all([
-                request("/api/health"), request("/api/plugins"), request("/api/messages"), request("/api/versions"), request("/api/update-policy"), request("/api/sessions"),
+            const [health, plugins, messages, versions, policy, sessions, trust] = await Promise.all([
+                request("/api/health"), request("/api/plugins"), request("/api/messages"), request("/api/versions"), request("/api/update-policy"), request("/api/sessions"), request("/api/plugin-trust"),
             ]);
             policyNode.value = policy.mode;
             policyStatusNode.textContent = `当前：${policyNode.options[policyNode.selectedIndex]?.text ?? policy.mode}`;
@@ -127,6 +132,7 @@
             node("#health").textContent = `服务运行中 · ${health.plugins} 个插件`;
             node("#access-panel").hidden = true;
             const installed = plugins.plugins ?? [];
+            renderPluginTrust(trust);
             renderPlugins(installed);
             renderChannels(installed);
             renderMessages(messages.messages ?? []);
@@ -199,6 +205,71 @@
         if (!entries.length)
             versionsNode.textContent = "尚未检查版本";
     }
+    function renderPluginTrust(data) {
+        if (pluginTrustDirty)
+            return;
+        pluginTrustConfig = structuredClone(data.config ?? { providers: {}, plugins: {} });
+        trustProvidersNode.replaceChildren();
+        for (const provider of data.providers ?? []) {
+            const row = document.createElement("tr");
+            const name = document.createElement("td");
+            name.textContent = provider.name;
+            const current = document.createElement("td");
+            current.textContent = provider.trusted ? "可信" : "不可信";
+            const action = document.createElement("td");
+            const select = document.createElement("select");
+            select.setAttribute("aria-label", `${provider.name} 提供者信任策略`);
+            for (const [value, label] of [["inherit", "使用默认"], ["allow", "信任并自动升级"], ["deny", "取消信任"]]) {
+                const option = document.createElement("option");
+                option.value = value;
+                option.textContent = label;
+                select.append(option);
+            }
+            select.value = provider.decision;
+            select.onchange = () => { pluginTrustDirty = true; if (select.value === "inherit")
+                delete pluginTrustConfig.providers[provider.name];
+            else
+                pluginTrustConfig.providers[provider.name] = select.value; };
+            action.append(select);
+            row.append(name, current, action);
+            trustProvidersNode.append(row);
+        }
+        trustPluginsNode.replaceChildren();
+        for (const entry of data.entries ?? []) {
+            const row = document.createElement("tr");
+            for (const value of [entry.id, entry.packageName ?? "非 npm 插件", entry.publisher ?? "未知提供者", entry.autoUpdate ? "允许" : "禁止"]) {
+                const cell = document.createElement("td");
+                cell.textContent = value;
+                row.append(cell);
+            }
+            const action = document.createElement("td");
+            const select = document.createElement("select");
+            select.setAttribute("aria-label", `${entry.id} 插件自动升级策略`);
+            for (const [value, label] of [["inherit", "继承提供者"], ["allow", "允许自动升级"], ["deny", "禁止自动升级"]]) {
+                const option = document.createElement("option");
+                option.value = value;
+                option.textContent = label;
+                select.append(option);
+            }
+            select.value = entry.pluginOverride ?? "inherit";
+            select.onchange = () => { pluginTrustDirty = true; if (select.value === "inherit")
+                delete pluginTrustConfig.plugins[entry.id];
+            else
+                pluginTrustConfig.plugins[entry.id] = select.value; };
+            action.append(select);
+            row.append(action);
+            trustPluginsNode.append(row);
+        }
+        trustStatusNode.textContent = "";
+        if (!(data.entries ?? []).length) {
+            const row = document.createElement("tr");
+            const cell = document.createElement("td");
+            cell.colSpan = 5;
+            cell.textContent = "暂无可管理的 npm 插件";
+            row.append(cell);
+            trustPluginsNode.append(row);
+        }
+    }
     function renderPlugins(items) {
         plugins = items;
         pluginsNode.replaceChildren();
@@ -328,6 +399,7 @@
     node("#refresh").onclick = () => void load();
     node("#check-versions").onclick = () => void request("/api/versions/check", "POST", {}).then(() => load()).catch((cause) => error(String(cause)));
     node("#save-update-policy").onclick = () => void request("/api/update-policy", "PATCH", { mode: policyNode.value }).then(() => load()).catch((cause) => error(String(cause)));
+    node("#save-plugin-trust").onclick = () => { const button = node("#save-plugin-trust"); button.disabled = true; trustStatusNode.textContent = "正在保存…"; void request("/api/plugin-trust", "PATCH", pluginTrustConfig).then(() => { pluginTrustDirty = false; trustStatusNode.textContent = "信任设置已保存"; return load(false); }).catch((cause) => { trustStatusNode.textContent = String(cause); }).finally(() => { button.disabled = false; }); };
     node("#update-core").onclick = () => { if (confirm("确认升级后台并自动重启？"))
         void request("/api/update", "POST", {}).then(() => { error("后台正在升级，页面将在几秒后恢复"); }).catch((cause) => error(String(cause))); };
     node("#pair-button").onclick = () => {

package/dist/src-ts/plugins/abweb/public/index.html

@@ -13,6 +13,7 @@
     <nav class="tabs" role="tablist" aria-label="管理视图"><button id="settings-tab" type="button" role="tab" aria-selected="true" aria-controls="settings-panel">插件设置</button><button id="messages-tab" type="button" role="tab" aria-selected="false" aria-controls="messages-panel">通信记录</button><button id="logs-tab" type="button" role="tab" aria-selected="false" aria-controls="logs-panel">运行日志</button></nav>
     <div id="settings-panel" role="tabpanel" aria-labelledby="settings-tab">
     <section><div class="section-heading"><h2>版本管理</h2><div><button id="check-versions" type="button">检查更新</button><button id="update-core" type="button">升级后台</button></div></div><label for="update-policy">插件更新策略</label><select id="update-policy"><option value="auto-install">自动下载并安装</option><option value="download-only">自动下载，手动安装</option><option value="manual">手动下载和安装</option></select><button id="save-update-policy" type="button">保存策略</button><span id="update-policy-status" class="muted"></span><div id="versions" class="muted"></div></section>
+    <section id="plugin-trust"><div class="section-heading"><h2>自动升级信任</h2><button id="save-plugin-trust" type="button">保存信任设置</button></div><p class="muted">默认信任 m2lihui；未知提供者默认禁止自动升级。插件设置优先于提供者设置。</p><h3>提供者</h3><div class="table-scroll"><table class="trust-table"><thead><tr><th scope="col">npm 提供者</th><th scope="col">当前信任</th><th scope="col">策略</th></tr></thead><tbody id="trust-providers"></tbody></table></div><h3>插件</h3><div class="table-scroll"><table class="trust-table"><thead><tr><th scope="col">插件</th><th scope="col">npm 包</th><th scope="col">提供者</th><th scope="col">自动升级</th><th scope="col">单插件设置</th></tr></thead><tbody id="trust-plugins"></tbody></table></div><span id="plugin-trust-status" class="muted" role="status"></span></section>
     <section><details id="installed-plugins" open><summary><h2>已安装插件</h2></summary><div class="table-scroll"><table class="plugin-table"><thead><tr><th scope="col">名称</th><th scope="col">类型</th><th scope="col">版本</th><th scope="col">状态</th><th scope="col">操作</th></tr></thead><tbody id="plugins"></tbody></table></div><div class="plugin-catalog"><div class="section-heading"><h3>npm 插件目录</h3><button id="search-packages" type="button">刷新目录</button></div><input id="package-search" placeholder="搜索插件名称或功能" aria-label="搜索 npm 插件"><div id="catalog" class="catalog" aria-live="polite"></div></div><form id="install-local-form"><input id="plugin-path" required placeholder="Windows 上的插件目录路径" aria-label="本地插件目录"><button type="submit">安装本地插件</button></form></details></section>
     <section><div class="section-heading"><h2>Channel 设置</h2></div><nav id="channel-tabs" class="tabs channel-tabs" role="tablist" aria-label="Channel 设置"></nav><div id="channel-panel" role="tabpanel" aria-live="polite"></div></section>
     </div>

package/dist/src-ts/plugins/abweb/public/style.css

@@ -29,6 +29,9 @@ form { margin-top: 14px; flex-wrap: wrap; }
 .plugin-table .controls { white-space: nowrap; }
 .plugin-table .controls button { margin: 0 5px 5px 0; }
 .plugin-id { display: block; margin-top: 4px; }
+.trust-table { min-width: 620px; }
+.trust-table th:nth-child(1) { width: 190px; }
+#plugin-trust h3 { font-size: 14px; margin: 16px 0 5px; }
 .plugin-catalog { border-top: 1px solid #e0e5e2; margin-top: 18px; padding-top: 14px; }
 .plugin-catalog h3 { font-size: 14px; margin: 0; }
 .plugin-catalog input { width: min(100%, 420px); margin: 10px 0; }

package/dist/src-ts/plugins/chatgpt/cdp-client.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChatgptCdpClient = exports.userBubbleSelector = exports.turnSelector = exports.editorSelector = void 0;
 const node_child_process_1 = require("node:child_process");
+const session_store_1 = require("./session-store");
 exports.editorSelector = '[data-codex-composer="true"][contenteditable="true"]';
 exports.turnSelector = '[data-chatgpt-conversation-turn="true"]';
 exports.userBubbleSelector = "[data-user-message-bubble]";
@@ -11,6 +12,7 @@ const contentUnitSelector = "[data-content-search-unit-key]";
 const sendButtonSelector = 'button[aria-label="Send"], button[aria-label="发送"]';
 const stopButtonSelector = 'button[aria-label="Stop"], button[aria-label="停止"]';
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const sidebarSelector = "[data-app-action-sidebar-thread-id]";
 class ChatgptCdpClient {
     socket;
     tunnel;
@@ -29,6 +31,51 @@ class ChatgptCdpClient {
         this.ssh = options.ssh;
     }
     connected() { return Boolean(this.socket); }
+    async listSessions() {
+        const entries = await this.evaluate(`(() => {
+      return [...document.querySelectorAll(${JSON.stringify(sidebarSelector)})].map(item => ({
+        id: item.getAttribute('data-app-action-sidebar-thread-id'),
+        host: item.getAttribute('data-app-action-sidebar-thread-host-id'),
+        title: item.getAttribute('data-app-action-sidebar-thread-title')
+      }));
+    })()`);
+        if (!Array.isArray(entries))
+            throw new Error("ChatGPT 侧栏会话列表格式无效");
+        return entries.filter(session_store_1.validSession);
+    }
+    async activeSession() {
+        const entry = await this.evaluate(`(() => {
+      const item = document.querySelector('[data-app-action-sidebar-thread-selected="true"]');
+      return item ? {
+        id: item.getAttribute('data-app-action-sidebar-thread-id'),
+        host: item.getAttribute('data-app-action-sidebar-thread-host-id'),
+        title: item.getAttribute('data-app-action-sidebar-thread-title')
+      } : null;
+    })()`);
+        return (0, session_store_1.validSession)(entry) ? entry : undefined;
+    }
+    async switchSession(session) {
+        const locate = `[...document.querySelectorAll(${JSON.stringify(sidebarSelector)})].find(item =>
+      item.getAttribute('data-app-action-sidebar-thread-id') === ${JSON.stringify(session.id)}
+      && item.getAttribute('data-app-action-sidebar-thread-host-id') === ${JSON.stringify(session.host)})`;
+        const clicked = await this.evaluate(`(() => {
+      const editor = document.querySelector(${JSON.stringify(exports.editorSelector)});
+      if (editor?.innerText.trim() || document.querySelector(${JSON.stringify(stopButtonSelector)})) {
+        throw new Error('当前会话有未发送内容或正在生成回复，不能切换');
+      }
+      const item = ${locate};
+      if (!item) return false;
+      item.click();
+      return true;
+    })()`);
+        if (!clicked)
+            throw new Error("ChatGPT 侧栏中找不到目标会话");
+        await this.waitFor(`(() => {
+      const item = ${locate};
+      return item?.getAttribute('data-app-action-sidebar-thread-selected') === 'true'
+        && Boolean(document.querySelector(${JSON.stringify(exports.editorSelector)}));
+    })()`, "ChatGPT 会话切换未确认，未发送消息");
+    }
     async connect() {
         if (this.socket)
             return;