mu-agent-bridge 1.0.28 → 1.0.30

package/dist/src-ts/plugins/aun/index.js

@@ -3,16 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AunPlugin = void 0;
 const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
 const node_module_1 = require("node:module");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_url_1 = require("node:url");
 const messages_1 = require("./messages");
-const evolcore_1 = require("./evolcore");
 const manifest = {
-    id: "aun", version: "1.0.15", type: "channel", displayName: "AUN 通道",
+    id: "aun", version: "1.0.21", type: "channel", displayName: "AUN 通道",
     entry: "dist/src-ts/plugins/aun/index.js", apiVersion: "1", process: "in-process",
-    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health"],
+    capabilities: ["channel", "channel.identity.create", "channel.receive", "channel.send", "health", "cli"],
     configSchema: "config.schema.json",
     managementPage: "/abweb/channels/aun",
 };
@@ -31,6 +31,24 @@ async function loadSdk() {
     throw new Error("未找到 @agentunion/fastaun，请确认 AUN 插件依赖已安装");
 }
 const aidPattern = /^[a-z0-9][a-z0-9_-]{2,63}\.[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
+const aunRootFingerprint = "DD:09:E9:FD:31:6C:42:DC:7D:F3:5C:98:9C:2C:76:3A:A1:88:D8:4C:9C:C9:FC:D4:2E:A3:10:A2:62:1E:C5:45";
+const cliCommands = [
+    { name: "status", summary: "查看 AUN 通道状态", usage: "mab aun status" },
+    { name: "list", summary: "查看已连接 AID 和 Agent 关联", usage: "mab aun list" },
+    { name: "agents", summary: "列出当前已就绪的 Agent 插件", usage: "mab aun agents" },
+    { name: "create", summary: "创建并连接 AID，可选关联 Agent", usage: "mab aun create <aid> --owner <owner-aid> [--agent <plugin-id>]", examples: ["mab aun create new.agentid.cn --owner owner.agentid.cn --agent qwenwork"] },
+    { name: "bind", summary: "将 AID 关联到 Agent", usage: "mab aun bind <aid> <plugin-id>", examples: ["mab aun bind new.agentid.cn qwenwork"] },
+    { name: "unbind", summary: "解除 Agent 与 AID 的关联", usage: "mab aun unbind <plugin-id>", examples: ["mab aun unbind qwenwork"] },
+];
+class AunCommandError extends Error {
+    statusCode;
+    data;
+    constructor(message, statusCode = 400, data) {
+        super(message);
+        this.statusCode = statusCode;
+        this.data = data;
+    }
+}
 class AunPlugin {
     options;
     manifest = manifest;
@@ -57,10 +75,9 @@ class AunPlugin {
     }
     identity = {
         list: async () => {
-            const connected = [...this.clients.keys()];
             return {
-                evolcore: connected.filter((aid) => !this.identities.has(aid) && !this.legacyCreatedAids.has(aid)).sort(),
-                muAgentBridge: connected.filter((aid) => this.identities.has(aid) || this.legacyCreatedAids.has(aid)).sort(),
+                evolcore: [],
+                muAgentBridge: [...this.clients.keys()].sort(),
                 localMuAgentBridge: [...this.identities].filter((aid) => !this.clients.has(aid)).sort(),
             };
         },
@@ -72,11 +89,13 @@ class AunPlugin {
             this.creating = true;
             try {
                 if (!this.identities.has(aid)) {
-                    // 创建身份沿用 EvolCore 的 legacy 注册流程。Owner AID 是本地归属配置，
-                    // 只有明确执行 Owner 关系绑定时才进入 aid_register_* 双签流程。
-                    const result = await this.store.register(aid);
-                    if (!result.ok)
-                        throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    // Owner AID 是本地归属配置；身份签发沿用 EvolCore 的兼容注册流程。
+                    if (!this.listStoreAids().includes(aid)) {
+                        await this.prepareTrustRoots(aid);
+                        const result = await this.store.register(aid);
+                        if (!result.ok)
+                            throw new Error(redact(result.error?.message ?? result.error?.code ?? "AID 注册失败"));
+                    }
                     const loaded = this.store.load(aid);
                     if (!loaded.ok || !loaded.data)
                         throw new Error(loaded.error?.message ?? "注册后未能加载本地身份");
@@ -85,17 +104,16 @@ class AunPlugin {
                     this.config.owner_aid = owner;
                     this.config.aun_path = this.path();
                     await this.persist();
-                    this.context?.logger.info("AUN 身份已创建", { aid, owner });
+                    this.context?.logger.info("AUN 身份已创建", { aid });
                 }
-                if (!this.clients.has(aid))
-                    await this.connectAid(aid);
-                return { aid, status: "已创建", connection: this.clients.has(aid) ? "ready" : "degraded" };
+                const connectionError = !this.clients.has(aid) ? await this.connectAid(aid) : undefined;
+                return { aid, status: "已创建", connection: this.clients.has(aid) ? "ready" : "degraded", ...(connectionError ? { connectionError } : {}) };
             }
             finally {
                 this.creating = false;
             }
         },
-        bind: async (pluginId, aid, port) => {
+        bind: async (pluginId, aid, _port) => {
             if (pluginId === "aun" || pluginId === "abweb")
                 throw new Error("只能关联 Agent 插件");
             const previous = this.bindings;
@@ -121,15 +139,21 @@ class AunPlugin {
                         this.bindings[aid] = pluginId;
                     }
                     else {
-                        const connected = await this.identity.list();
-                        if (![...connected.evolcore, ...connected.muAgentBridge].includes(aid))
+                        // 本地身份由插件直接接管，不再通过 ec 配置路由。
+                        const loaded = this.store.load(aid);
+                        if (!loaded.ok || !loaded.data)
+                            throw new Error("AID 不在本地密钥库中，无法关联");
+                        this.identities.add(aid);
+                        if (!this.clients.has(aid))
+                            await this.connectAid(aid);
+                        if (!this.clients.has(aid))
                             throw new Error("AID 当前未连接");
-                        await (0, evolcore_1.configureAidForPlugin)(pluginId, aid, port);
                         for (const [identity, target] of Object.entries(this.bindings))
                             if (target === pluginId) {
                                 delete this.bindings[identity];
                                 delete this.bindingTimes[identity];
                             }
+                        this.bindings[aid] = pluginId;
                     }
                 }
                 else {
@@ -198,6 +222,8 @@ class AunPlugin {
             ["GET", "/api/plugins/aun/identities", this.listIdentities],
             ["POST", "/api/plugins/aun/bind", this.bindAgent],
             ["POST", "/api/plugins/aun/settings", this.saveSettings],
+            ["GET", "/api/plugins/aun/commands", this.listCommands],
+            ["POST", "/api/plugins/aun/commands", this.runCommand],
             ...(["", "/app.js", "/style.css"].map((suffix) => ["GET", `/abweb/channels/aun${suffix}`, this.servePage])),
         ]) {
             const dispose = context.http.register({ method, path, handler });
@@ -215,13 +241,16 @@ class AunPlugin {
             this.identities.add(this.aid);
         for (const aid of this.identities)
             await this.connectAid(aid);
-        // AUN 插件直接连接本地密钥库中的所有 AID，不依赖 ec 进程或 CLI。
-        for (const aid of this.listStoreAids())
+        // 密钥库中的其余 AID 也自动连接：不再依赖 ec 或 EvolCore 进程
+        for (const aid of this.listStoreAids()) {
+            this.identities.add(aid);
             if (!this.clients.has(aid))
                 await this.connectAid(aid);
+        }
     }
     async connectAid(aid) {
         try {
+            await this.prepareTrustRoots(aid);
             const loaded = this.store.load(aid);
             if (!loaded.ok || !loaded.data)
                 throw new Error(loaded.error?.message ?? "本地密钥库中不存在该 AID");
@@ -244,7 +273,8 @@ class AunPlugin {
         catch (error) {
             this.status = "degraded";
             this.healthMessage = safeError(error);
-            this.context?.logger.warn("AUN 通道连接失败", { error: this.healthMessage });
+            this.context?.logger.warn("AUN 通道连接失败", { aid, error: this.healthMessage });
+            return this.healthMessage;
         }
     }
     async deactivate(_reason) {
@@ -272,9 +302,49 @@ class AunPlugin {
         return (0, node_path_1.resolve)(process.env.AUN_HOME ?? process.env.EVOLCORE_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".evolcore"));
     }
     newStore() {
-        const rootCaPath = typeof this.config.root_ca_path === "string" && this.config.root_ca_path ? this.config.root_ca_path : (0, node_path_1.join)(this.path(), "CA", "root", "root.crt");
+        const rootCaPath = this.rootCaPath();
         return new this.sdk.AIDStore({ aunPath: this.path(), encryptionSeed: typeof this.config.encryption_seed === "string" && this.config.encryption_seed ? this.config.encryption_seed : "evol", verifySsl: typeof this.config.verify_ssl === "boolean" ? this.config.verify_ssl : true, rootCaPath: (0, node_fs_1.existsSync)(rootCaPath) ? rootCaPath : undefined });
     }
+    rootCaPath() {
+        return typeof this.config.root_ca_path === "string" && this.config.root_ca_path
+            ? this.config.root_ca_path
+            : (0, node_path_1.join)(this.context.dataDir, "CA", "root", "root.crt");
+    }
+    async prepareTrustRoots(aid) {
+        const rootCaPath = this.rootCaPath();
+        const customPath = typeof this.config.root_ca_path === "string" && this.config.root_ca_path.trim();
+        if ((0, node_fs_1.existsSync)(rootCaPath)) {
+            if (customPath)
+                return;
+            const existing = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)(rootCaPath, "utf8"));
+            if (existing.fingerprint256 !== aunRootFingerprint)
+                throw new Error("AUN 插件根证书指纹校验失败");
+            return;
+        }
+        if (customPath)
+            throw new Error("配置的 AUN 根证书文件不存在");
+        try {
+            const cert = new node_crypto_1.X509Certificate(await (0, promises_1.readFile)((0, node_path_1.join)(__dirname, "certs", "root.crt"), "utf8"));
+            if (cert.fingerprint256 !== aunRootFingerprint)
+                throw new Error("内置 AUN 根证书指纹校验失败");
+            await (0, promises_1.mkdir)((0, node_path_1.dirname)(rootCaPath), { recursive: true });
+            await (0, promises_1.writeFile)(rootCaPath, cert.toString(), { mode: 0o600, flag: "wx" });
+            const oldStore = this.store;
+            const newStore = this.newStore();
+            this.store = newStore;
+            try {
+                await oldStore?.close();
+            }
+            catch (error) {
+                this.context?.logger.warn("关闭旧 AUN Store 失败", { error: safeError(error) });
+            }
+            this.context?.logger.info("AUN 固定信任根证书已安装", { aid });
+        }
+        catch (error) {
+            this.context?.logger.warn("AUN Gateway 信任根证书初始化失败", { aid, error: safeError(error) });
+            throw new Error(`AUN Gateway 信任根证书初始化失败：${safeError(error)}`);
+        }
+    }
     createAid = async (request, response) => {
         let input;
         try {
@@ -367,6 +437,254 @@ class AunPlugin {
             this.json(response, 400, { error: safeError(error) });
         }
     };
+    listCommands = async (_request, response) => {
+        response.setHeader("cache-control", "no-store");
+        this.json(response, 200, { protocolVersion: 1, plugin: "aun", version: manifest.version, commands: cliCommands });
+    };
+    runCommand = async (request, response) => {
+        try {
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of request) {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+                size += buffer.length;
+                if (size > 65536)
+                    throw new AunCommandError("请求内容过大");
+                chunks.push(buffer);
+            }
+            let input;
+            try {
+                input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            }
+            catch {
+                throw new AunCommandError("命令请求 JSON 格式无效");
+            }
+            if (!input || typeof input !== "object" || input.protocolVersion !== 1 || !Array.isArray(input.argv) || !input.argv.every((arg) => typeof arg === "string")) {
+                throw new AunCommandError("命令请求格式无效");
+            }
+            const result = await this.executeCommand(input.argv);
+            this.commandResult(response, 200, true, result.message, result.data);
+        }
+        catch (error) {
+            const failure = error instanceof AunCommandError ? error : new AunCommandError(safeError(error), 502);
+            this.commandResult(response, failure.statusCode, false, failure.message, failure.data);
+        }
+    };
+    async executeCommand(argv) {
+        const [command, ...args] = argv;
+        if (command === "status" && !args.length)
+            return { message: this.healthMessage, data: await this.health() };
+        if (command === "list" && !args.length) {
+            const groups = await this.identity.list();
+            const aids = [...new Set([...groups.evolcore, ...groups.muAgentBridge, ...(groups.localMuAgentBridge ?? []), ...this.listStoreAids()])].sort();
+            return { message: aids.length ? `AID 列表：\n${aids.join("\n")}` : "暂无本地 AID", data: {
+                    aids,
+                    bindings: this.bindings,
+                    bindingTimes: this.bindingTimes,
+                } };
+        }
+        if (command === "agents" && !args.length) {
+            const agents = await this.agents();
+            return { message: agents.length ? `当前已就绪的 Agent 插件：\n${agents.map((agent) => `${agent.id}（${agent.displayName}）`).join("\n")}` : "暂无已就绪的 Agent 插件", data: agents };
+        }
+        if (command === "create")
+            return this.createCommand(args);
+        if (command === "bind" && args.length === 2) {
+            const [aid, pluginId] = args;
+            if (!aidPattern.test(aid))
+                throw new AunCommandError("AID 格式无效");
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId);
+            const replacedAids = (await this.agentBindings(pluginId)).filter((previousAid) => previousAid !== aid);
+            try {
+                await this.patchAgentAid(pluginId, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`AID 关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { aid, agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return {
+                message: replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${pluginId}` : `AID 已关联到 ${pluginId}`,
+                data: { aid, agent: pluginId, replacedAids },
+            };
+        }
+        if (command === "unbind" && args.length === 1) {
+            const [pluginId] = args;
+            this.validatePluginId(pluginId);
+            await this.requireAgent(pluginId, false);
+            const unboundAids = await this.agentBindings(pluginId);
+            try {
+                await this.patchAgentAid(pluginId, "");
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(pluginId).catch(() => undefined);
+                throw new AunCommandError(`解除关联请求失败，已回读当前状态：${safeError(error)}`, error instanceof AunCommandError ? error.statusCode : 502, { agent: pluginId, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+            return { message: `已解除 ${pluginId} 的 AID 关联`, data: { agent: pluginId, unboundAids } };
+        }
+        if (!["status", "list", "agents", "create", "bind", "unbind"].includes(command ?? ""))
+            throw new AunCommandError(`未知 AUN 命令：${command ?? ""}`);
+        throw new AunCommandError(`AUN 命令参数无效：${command}`);
+    }
+    async createCommand(args) {
+        const aid = args[0] ?? "";
+        if (!aidPattern.test(aid))
+            throw new AunCommandError("AID 格式无效");
+        let owner = "";
+        let agent = "";
+        for (let index = 1; index < args.length; index++) {
+            const option = args[index];
+            const value = args[++index];
+            if (!value || value.startsWith("--"))
+                throw new AunCommandError(`${option} 需要参数`);
+            if (option === "--owner" && !owner)
+                owner = value;
+            else if (option === "--agent" && !agent)
+                agent = value;
+            else
+                throw new AunCommandError(`不支持的创建参数：${option}`);
+        }
+        if (!owner || !aidPattern.test(owner))
+            throw new AunCommandError("需要有效的 --owner AID");
+        if (agent) {
+            this.validatePluginId(agent);
+            await this.requireAgent(agent);
+        }
+        let created;
+        try {
+            created = await this.identity.create(aid, owner);
+        }
+        catch (error) {
+            const exists = this.identities.has(aid) || this.listStoreAids().includes(aid);
+            if (exists)
+                throw new AunCommandError("AID 可能已创建，但后续连接或保存失败；请先执行 mab aun list 确认，不要重试创建", 502, { created: true, aid });
+            throw new AunCommandError(`AID 创建失败：${safeError(error).replaceAll(owner, "[已隐藏]")}`, 502);
+        }
+        const data = { created: true, aid, connection: created.connection ?? "ready" };
+        if (created.connection !== "ready")
+            throw new AunCommandError("AID 已创建，但连接失败；请先执行 mab aun list 确认，不要重试创建", 502, { ...data, connectionError: created.connectionError });
+        let replacedAids = [];
+        if (agent) {
+            try {
+                replacedAids = (await this.agentBindings(agent)).filter((previousAid) => previousAid !== aid);
+                await this.patchAgentAid(agent, aid);
+            }
+            catch (error) {
+                const bindingState = await this.bindingState(agent).catch(() => undefined);
+                throw new AunCommandError(`AID 已创建，但 Agent 关联失败，已回读当前状态：${safeError(error)}`, 502, { ...data, agent, ...(bindingState ? { bindingState } : { bindingState: "unknown" }) });
+            }
+        }
+        return {
+            message: agent ? (replacedAids.length ? `AID ${replacedAids.join("、")} 已替换为 ${aid} 并关联到 ${agent}` : `AID 已创建并关联到 ${agent}`) : "AID 已创建并连接",
+            data: { ...data, ...(agent ? { agent, replacedAids } : {}) },
+        };
+    }
+    async agents(readyOnly = true) {
+        const payload = await this.controlRequest("/api/plugins");
+        if (!Array.isArray(payload.plugins))
+            throw new AunCommandError("控制 API 插件列表格式无效", 502);
+        return payload.plugins.filter((plugin) => !!plugin && typeof plugin === "object" && !Array.isArray(plugin))
+            .filter((plugin) => plugin.type === "agent" && (!readyOnly || plugin.status === "ready") && typeof plugin.id === "string" && /^[a-z][a-z0-9-]{1,63}$/.test(plugin.id))
+            .map((plugin) => ({ id: plugin.id, displayName: typeof plugin.displayName === "string" ? plugin.displayName : plugin.id }))
+            .sort((left, right) => left.id.localeCompare(right.id));
+    }
+    async requireAgent(pluginId, readyOnly = true) {
+        if (!(await this.agents(readyOnly)).some((agent) => agent.id === pluginId))
+            throw new AunCommandError(readyOnly ? "目标 Agent 不存在或尚未就绪" : "目标插件不存在或不是 Agent 插件");
+    }
+    validatePluginId(pluginId) {
+        if (!/^[a-z][a-z0-9-]{1,63}$/.test(pluginId) || pluginId === "aun" || pluginId === "abweb")
+            throw new AunCommandError("Agent 插件 ID 无效");
+    }
+    async patchAgentAid(pluginId, aid) {
+        await this.controlRequest(`/api/plugins/${encodeURIComponent(pluginId)}/aid`, "PATCH", { aid });
+    }
+    async agentBindings(pluginId) {
+        const aun = await this.controlPayload("/api/plugins/aun/identities");
+        if (!aun.bindings || typeof aun.bindings !== "object" || Array.isArray(aun.bindings))
+            throw new AunCommandError("AUN 身份列表格式无效", 502);
+        const bindings = aun.bindings;
+        return Object.entries(bindings).filter(([, target]) => target === pluginId).map(([aid]) => aid).sort();
+    }
+    async bindingState(pluginId) {
+        const [aun, agent] = await Promise.all([
+            this.agentBindings(pluginId),
+            this.controlPayload(`/api/plugins/${encodeURIComponent(pluginId)}/config`),
+        ]);
+        return {
+            aunAids: aun,
+            agentAid: typeof agent.aid === "string" ? agent.aid : "",
+        };
+    }
+    async controlRequest(path, method = "GET", body) {
+        const result = await this.controlPayload(path, method, body);
+        if (result.ok !== true)
+            throw new AunCommandError("本机控制 API 响应未确认操作成功", 502);
+        return result;
+    }
+    async controlPayload(path, method = "GET", body) {
+        const base = this.controlUrl();
+        let response;
+        try {
+            response = await fetch(new URL(path, base), {
+                method,
+                headers: { accept: "application/json", ...(body === undefined ? {} : { "content-type": "application/json" }) },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: AbortSignal.timeout(5000),
+                redirect: "error",
+            });
+        }
+        catch (error) {
+            throw new AunCommandError(`本机控制 API 请求失败：${safeError(error)}`, 502);
+        }
+        let raw;
+        try {
+            raw = await readResponse(response, 65536);
+        }
+        catch (error) {
+            if (error instanceof AunCommandError)
+                throw error;
+            throw new AunCommandError(`本机控制 API 响应读取失败：${safeError(error)}`, 502);
+        }
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            throw new AunCommandError("本机控制 API 返回的 JSON 无效", 502);
+        }
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            throw new AunCommandError("本机控制 API 响应格式无效", 502);
+        const result = payload;
+        if (!response.ok) {
+            const message = typeof result.error === "string" ? result.error : `HTTP ${response.status}`;
+            throw new AunCommandError(`本机控制 API 操作失败：${message}`, response.status >= 400 && response.status < 500 ? response.status : 502);
+        }
+        return result;
+    }
+    controlUrl() {
+        const controlUrl = this.context?.runtime?.controlUrl;
+        if (!controlUrl)
+            throw new AunCommandError("运行时未提供 controlUrl，请更新核心服务", 502);
+        let url;
+        try {
+            url = new URL(controlUrl);
+        }
+        catch {
+            throw new AunCommandError("运行时 controlUrl 无效", 502);
+        }
+        const hostname = url.hostname.replace(/^\[|\]$/g, "");
+        if (url.protocol !== "http:" || !["127.0.0.1", "::1"].includes(hostname) || url.username || url.password || (url.pathname !== "/") || url.search || url.hash) {
+            throw new AunCommandError("运行时 controlUrl 必须指向本机回环地址", 502);
+        }
+        return url;
+    }
+    commandResult(response, status, ok, message, data) {
+        response.statusCode = status;
+        response.setHeader("content-type", "application/json; charset=utf-8");
+        response.setHeader("cache-control", "no-store");
+        response.end(JSON.stringify({ ok, message, ...(data === undefined ? {} : { data }) }));
+    }
     servePage = async (request, response) => {
         const path = new URL(request.url ?? "/", "http://localhost").pathname;
         const file = path.endsWith("/app.js") ? "app.js" : path.endsWith("/style.css") ? "style.css" : "index.html";
@@ -428,6 +746,34 @@ exports.default = AunPlugin;
 function safeError(error) {
     return redact(error instanceof Error ? error.message : String(error)).slice(0, 240);
 }
+async function readResponse(response, limit) {
+    if (!response.body) {
+        const raw = await response.text();
+        if (Buffer.byteLength(raw) > limit)
+            throw new AunCommandError("响应内容过大", 502);
+        return raw;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > limit) {
+                await reader.cancel();
+                throw new AunCommandError("响应内容过大", 502);
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 function redact(message) {
     return message.replace(/(private[_ -]?key|seed|token|certificate)\s*[:=]\s*[^\s,;]+/gi, "$1=[已隐藏]");
 }

package/dist/src-ts/plugins/aun/public/app.js

@@ -15,6 +15,12 @@
     return result;
   }
   function show(message, failed = false) { status.textContent = message; status.className = failed ? "error" : ""; }
+  function notify(title, message, failed = false) {
+    show(message, failed);
+    if (window.parent !== window) window.parent.postMessage({ type: "mab:operation-result", title, message, failed }, window.location.origin);
+    else window.alert(`${title}\n${message}`);
+  }
+  const errorMessage = (error) => error instanceof Error ? error.message : String(error);
   async function load(refreshForm = true) {
     if (loading) return;
     loading = true;
@@ -31,8 +37,15 @@
         configForm.elements.encryption_seed.value = "";
       }
       list.replaceChildren();
-      const entries = [["本工程 · 已连接", identities.groups.muAgentBridge || []], ["EvolCore · 已连接", identities.groups.evolcore || []]]
-        .flatMap(([label, values], group) => values.map((aid) => ({ aid, label, group, bound: identities.bindings?.[aid] || agents.find((agent) => agent.id && agent.configAid === aid)?.id || "", time: Date.parse(identities.bindingTimes?.[aid] || "") || 0 })));
+      const entries = [];
+      const seen = new Set();
+      for (const [group, label, values] of [[0, "本工程 · 已连接", identities.groups.muAgentBridge || []], [1, "EvolCore · 已连接", identities.groups.evolcore || []]]) {
+        for (const aid of values) {
+          if (seen.has(aid)) continue;
+          seen.add(aid);
+          entries.push({ aid, label, group, bound: identities.bindings?.[aid] || agents.find((agent) => agent.id && agent.configAid === aid)?.id || "", time: Date.parse(identities.bindingTimes?.[aid] || "") || 0 });
+        }
+      }
       entries.sort((a, b) => Number(Boolean(b.bound)) - Number(Boolean(a.bound)) || a.group - b.group || b.time - a.time || a.aid.localeCompare(b.aid));
       for (const { aid, label, bound } of entries) {
           const row = document.createElement("tr");
@@ -43,22 +56,29 @@
           cell.append(select); row.append(cell); list.append(row);
       }
       if (!list.children.length) { const row = document.createElement("tr"); const cell = document.createElement("td"); cell.colSpan = 4; cell.textContent = "暂无已连接 AID"; row.append(cell); list.append(row); }
-      show(`${(identities.groups.evolcore || []).length + (identities.groups.muAgentBridge || []).length} 个已连接 AID`);
+      show(`${entries.length} 个已连接 AID`);
     } catch (error) { show(String(error), true); }
     finally { loading = false; }
   }
   async function bind(aid, pluginId) {
     try {
       await request(`/api/plugins/${encodeURIComponent(pluginId)}/aid`, "PATCH", { aid });
-      await load(); show(`${aid} 已关联 ${pluginId}`);
-    } catch (error) { show(`关联失败：${String(error)}`, true); }
+      await load(); notify("关联成功", `${aid} 已关联 ${pluginId}`);
+    } catch (error) { notify("关联失败", errorMessage(error), true); }
   }
   createForm.onsubmit = (event) => { event.preventDefault(); const aid = createForm.elements.aid.value.trim(); const owner = createForm.elements.ownerAid.value.trim();
-    void request("/api/plugins/aun/aid", "POST", { aid, ownerAid: owner }).then((result) => load().then(() => show(result.status === "等待 Owner 确认" ? `${aid} 等待 Owner 确认` : `${aid} 已创建`))).catch((error) => show(String(error), true));
+    show("正在创建 AID 并连接，请稍候……");
+    void request("/api/plugins/aun/aid", "POST", { aid, ownerAid: owner }).then((result) => {
+      const failed = result.connection === "degraded";
+      const message = failed ? `${aid} 已创建，但连接失败：${result.connectionError || "未提供连接失败原因，请查看运行日志"}\n身份已经保存在本地，请勿重复注册。`
+        : result.status === "等待 Owner 确认" ? `${aid} 等待 Owner 确认` : `${aid} 已创建并连接`;
+      notify(failed ? "AID 创建完成，连接失败" : "AID 创建结果", message, failed);
+      return load();
+    }).catch((error) => notify("创建 AID 失败", errorMessage(error), true));
   };
   configForm.onsubmit = (event) => { event.preventDefault(); const changes = { agent_plugin: configForm.elements.agent_plugin.value, allow_from: configForm.elements.allow_from.value, aun_path: configForm.elements.aun_path.value };
     if (configForm.elements.encryption_seed.value) changes.encryption_seed = configForm.elements.encryption_seed.value;
-    void request("/api/plugins/aun/settings", "POST", changes).then(() => request("/api/plugins/aun/reload", "POST")).then(() => load()).then(() => show("配置已保存")).catch((error) => show(String(error), true));
+    void request("/api/plugins/aun/settings", "POST", changes).then(() => request("/api/plugins/aun/reload", "POST")).then(() => load()).then(() => notify("保存成功", "配置已保存")).catch((error) => notify("保存配置失败", errorMessage(error), true));
   };
   find("#refresh").onclick = () => void load();
   void load();

package/dist/src-ts/plugins/aun/public/index.html

@@ -6,7 +6,7 @@
     <header><h1>AUN 身份</h1><button id="refresh" type="button">刷新</button></header>
     <p id="status" role="status"></p>
     <div class="table-scroll"><table><thead><tr><th>AID</th><th>来源</th><th>已关联 Agent</th><th>操作</th></tr></thead><tbody id="identities"></tbody></table></div>
-    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner AID 用于本地归属和 Agent 关联；创建身份本身沿用 AUN 的普通注册流程</small></label></div><button type="submit">创建</button></form>
+    <form id="create-form"><h2>创建 AID</h2><div class="fields"><label>新 AID<input name="aid" required placeholder="例如：example.agentid.cn"></label><label>Owner AID<input name="ownerAid" required placeholder="例如：owner.agentid.cn（本地归属配置）"><small class="hint">Owner 保存为本地归属配置；不代表 AUN 协议中的 Owner 关系已激活。</small></label></div><button type="submit">创建</button></form>
     <form id="config-form"><h2>通道配置</h2><div class="fields"><label>默认 Agent<select name="agent_plugin"></select></label><label>允许的来源<input name="allow_from"></label><label>AUN 存储路径<input name="aun_path"></label><label>加密种子<input name="encryption_seed" type="password" autocomplete="new-password" placeholder="留空则不修改"></label></div><button type="submit">保存配置</button></form>
   </main>
   <script src="/abweb/channels/aun/app.js"></script>

package/dist/src-ts/plugins/desktop-launch.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findWindowsExecutable = findWindowsExecutable;
+exports.findExecutableInTree = findExecutableInTree;
+exports.launchAndWait = launchAndWait;
+exports.waitFor = waitFor;
+const promises_1 = require("node:fs/promises");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** 在 Windows 常见安装目录中查找桌面程序，避免依赖单一盘符。 */
+async function findWindowsExecutable(fileName, configured) {
+    if (configured?.trim())
+        return (0, node_fs_1.existsSync)((0, node_path_1.resolve)(configured)) ? (0, node_path_1.resolve)(configured) : undefined;
+    if (process.platform !== "win32")
+        return undefined;
+    const pattern = /doubao|豆包|qwen|qwwork|千问/i;
+    const roots = [...new Set([
+            process.env.LOCALAPPDATA && (0, node_path_1.join)(process.env.LOCALAPPDATA, "Programs"),
+            process.env.ProgramFiles,
+            process.env["ProgramFiles(x86)"],
+            ...Array.from({ length: 24 }, (_, index) => `${String.fromCharCode(67 + index)}:\\`),
+        ].filter((value) => typeof value === "string" && (0, node_fs_1.existsSync)(value)))];
+    for (const root of roots) {
+        const found = await findExecutableInTree(root, fileName, pattern, 6);
+        if (found)
+            return found;
+    }
+    return undefined;
+}
+async function findExecutableInTree(directory, fileName, pattern, depth) {
+    return search(directory, fileName, pattern, depth, pattern.test(directory));
+}
+async function search(directory, fileName, pattern, depth, insideProduct) {
+    try {
+        const entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+        for (const entry of entries)
+            if (entry.isFile() && insideProduct && entry.name.toLowerCase() === fileName.toLowerCase())
+                return (0, node_path_1.join)(directory, entry.name);
+        if (depth <= 0)
+            return undefined;
+        for (const entry of entries)
+            if (entry.isDirectory() && !entry.name.startsWith(".") && (insideProduct || pattern.test(entry.name) || /^(?:Program Files(?: \(x86\))?|Programs)$/i.test(entry.name))) {
+                const found = await search((0, node_path_1.join)(directory, entry.name), fileName, pattern, depth - 1, insideProduct || pattern.test(entry.name));
+                if (found)
+                    return found;
+            }
+    }
+    catch { /* 无权限或目录在扫描期间消失时继续查找 */ }
+    return undefined;
+}
+async function launchAndWait(executable, args, connect, timeoutMs, launch = (file, argv) => (0, node_child_process_1.spawn)(file, argv, { detached: true, stdio: "ignore", windowsHide: false })) {
+    const child = launch(executable, args);
+    child.unref();
+    return waitFor(connect, timeoutMs, 250);
+}
+async function waitFor(action, timeoutMs, intervalMs = 500) {
+    const deadline = Date.now() + timeoutMs;
+    let last;
+    while (Date.now() < deadline) {
+        try {
+            return await action();
+        }
+        catch (error) {
+            last = error;
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+    }
+    throw last instanceof Error ? last : new Error("桌面程序启动超时");
+}
+const node_child_process_1 = require("node:child_process");