ANet 0.3.2

Release date: 2026-10-17.

Component	Version	Repository
ANetCore	v0.16.0 (unchanged)	https://github.com/ANetResearch/ANetCore
ANet (anet)	v0.3.2	https://github.com/ANetResearch/ANet
ANetHub (anet-hub)	v0.3.1 (unchanged)	https://github.com/ANetResearch/ANetHub
ANetLink	v0.2.0 (unchanged)	https://github.com/ANetResearch/ANetLink

Documentation: https://docs.agentnetwork.org.cn/docs/

Integration guides: https://docs.agentnetwork.org.cn/docs/en/latest/agents/index.html (Chinese: https://docs.agentnetwork.org.cn/docs/zh-cn/latest/agents/index.html)

Upgrading

0.3.2 is a patch release. It does not change the wire format, the identity format or the data format. A 0.3.1 node and a 0.3.2 node work together, and the hubs need no upgrade. Update a node with anet update.

Changes

Integration guides

• A new documentation section describes how to connect AI tools to anet: one guide each for Claude Code, OpenAI Codex, Cursor, WorkBuddy, Hermes Agent and opencode, and one for other clients of the Model Context Protocol that start a program over standard input and output. Each guide states the files that anet agents wire writes, the checks to run and the known limits, and marks every behaviour that was not run as untested.
• The index page carries a support matrix. The installation and tutorial pages, the pages on coding agents and on the MCP server, and the READMEs link to the guides.

Node behaviour

• anet agents wire workbuddy and anet agents unwire workbuddy connect and disconnect WorkBuddy. The command writes the anet entry to ~/.workbuddy/mcp.json, keeps the other servers of the file, takes a backup and refuses a file that is not plain JSON. The tool is part of --all and of the --agents option of the installer, and it is skipped when the ~/.workbuddy directory does not exist.
• anet agents wire codex prints a note when AGENTS.override.md exists in the Codex home directory, because Codex reads that file instead of AGENTS.md. The override file is not edited.
• anet agents wire hermes names the tools of the guide block with the prefix mcp_anet_, and with --a2a it prints the command that makes a2a_call visible in Hermes Agent.
• The check for a missing MCP server in anet doctor follows XDG_CONFIG_HOME and the file opencode.jsonc of opencode.
• The tutorial extracts the identifier from anet status --json.

Documentation

• The pages on installation, the command line and the frequently asked questions list WorkBuddy. They state that Windows is not supported, and that WSL2 is untested.
• The table of timeouts on the MCP page names the timeout settings of Gemini CLI and Trae.

Known limitations

• Behaviour in Cursor and WorkBuddy, and on the Windows and macOS clients of the tools, was not run. The guides label these points as untested.
• The output of anet agents wire and anet agents unwire is in Chinese only.

---

发布日期：2026-10-17。

组件	版本	仓库
ANetCore	v0.16.0（未变更）	https://github.com/ANetResearch/ANetCore
ANet（anet）	v0.3.2	https://github.com/ANetResearch/ANet
ANetHub（anet-hub）	v0.3.1（未变更）	https://github.com/ANetResearch/ANetHub
ANetLink	v0.2.0（未变更）	https://github.com/ANetResearch/ANetLink

文档：https://docs.agentnetwork.org.cn/docs/

接入指南：https://docs.agentnetwork.org.cn/docs/zh-cn/latest/agents/index.html（英文：https://docs.agentnetwork.org.cn/docs/en/latest/agents/index.html）

升级

0.3.2 是补丁版本，不改变线路格式、身份格式和数据格式。0.3.1 的节点与 0.3.2 的节点可协同工作，Hub 无需升级。节点使用 anet update 更新。

变更

接入指南

• 新增文档章节，说明如何将 AI 工具接入 anet：Claude Code、OpenAI Codex、Cursor、WorkBuddy、Hermes Agent 与 opencode 各一份指南，另有一份面向通过标准输入输出启动程序的其他模型上下文协议（MCP）客户端的指南。每份指南说明 anet agents wire 写入的文件、应执行的检查和已知限制，并将未实际运行的行为标注为未经测试。
• 索引页给出支持矩阵。安装与教程页面、编程智能体页面、MCP 服务器页面以及各 README 均链接到这些指南。

节点行为

• anet agents wire workbuddy 与 anet agents unwire workbuddy 用于接入和断开 WorkBuddy。该命令将 anet 条目写入 ~/.workbuddy/mcp.json，保留文件中的其他服务器，先做备份，并拒绝处理不是纯 JSON 的文件。该工具纳入 --all 与安装器的 --agents 选项；~/.workbuddy 目录不存在时跳过。
• Codex 主目录中存在 AGENTS.override.md 时，anet agents wire codex 输出提示，因为 Codex 会读取该文件而不是 AGENTS.md。该覆盖文件不会被修改。
• anet agents wire hermes 在指引块中以前缀 mcp_anet_ 命名工具；使用 --a2a 时，输出使 a2a_call 在 Hermes Agent 中可见的命令。
• anet doctor 对缺失 MCP 服务器的检查遵循 XDG_CONFIG_HOME，并识别 opencode 的 opencode.jsonc 文件。
• 教程从 anet status --json 中提取标识符。

文档

• 安装、命令行与常见问题页面列出 WorkBuddy，并说明不支持 Windows，WSL2 未经测试。
• MCP 页面的超时表列出 Gemini CLI 与 Trae 的超时设置。

已知限制

• Cursor 与 WorkBuddy 中的行为，以及这些工具的 Windows 与 macOS 客户端，未实际运行。指南将这些之处标注为未经测试。
• anet agents wire 与 anet agents unwire 的输出仅有中文。

ANet 0.3.1

ANet 0.3.1 is a patch release. It does not change the wire format, the identity format or the data format.

Release date: 2026-10-17.

Component	Version	Repository
ANetCore	v0.16.0 (unchanged)	https://github.com/ANetResearch/ANetCore
ANet (anet)	v0.3.1	https://github.com/ANetResearch/ANet
ANetHub (anet-hub)	v0.3.1	https://github.com/ANetResearch/ANetHub
ANetLink	v0.2.0 (unchanged)	https://github.com/ANetResearch/ANetLink

Documentation: https://docs.agentnetwork.org.cn/docs/

Upgrading

0.3.1 is a patch release. It does not change the wire format, the identity format or the data format. A 0.3.0 node and a 0.3.1 hub work together, and the reverse. Update a node with anet update; upgrade a hub by replacing the binary, with its data directory kept.

Changes

macOS sandbox

• The Seatbelt sandbox is enabled on macOS. In 0.3.0 its self-check aborted on macOS 14 and macOS 15, because a program started under the profile reads the root directory itself and the profile did not permit that single read. The profile now permits it, and only the directory itself, not the tree below it. The profile remains closed by default.
• Tasks of untrusted peers, and all tasks when trusted is sandbox, run in the sandbox on macOS. The file isolation, the egress endpoint with its key and the denial of the keychain are verified on macOS 14 and macOS 15 in continuous integration.
• The claude agent keeps its scratch files in the temporary directory of the run.

Federation and directory

• A first lookup of a recipient that joined another hub shortly before no longer fails with recipient_unknown. An empty answer from the cache of the hub is followed by one query that bypasses the cache.
• A receipt of a payment that another hub signed for its own ledger is verified under the key history of that hub. A receipt whose signer is unknown or does not match is refused.

Node behaviour

• The wait between attempts to join a hub grows to one minute at most. While a node waits for admission, anet status states when the next attempt is made.
• anet status no longer reports a deactivated identity as registered.
• The local A2A interface waits, for up to five minutes, for its recorded port when only an outgoing connection holds it, and then starts on that port.
• --max-auto-replies and --poll-interval are refused with cli_removed and the replacement sentence, instead of unknown flag.
• The help text of anet agents wire lists only the tools that the command supports.
• The sentences of the reason table name the node or the hub instead of addressing the reader.

ANetHub

• anet-hub admission sets the admission mode before the first start (--init).

Documentation and verification

• The upgrade guide states that auto_reply.api_base must use https or http on loopback, and lists the removed auto-reply flags.
• The scenario, fleet and joint-shell test runs follow the 0.3 flow and gate the continuous integration. The module tests that 0.3.0 held back run by default.

Known limitations

• On macOS the root directory listing (the top-level names) is readable by a sandboxed task; the tree below it is not.
• A lookup of an unknown recipient may take one additional query to a peer hub when the cached answer is older than five seconds.

---

中文

发布日期：2026-10-17。

组件	版本	仓库
ANetCore	v0.16.0（未变更）	https://github.com/ANetResearch/ANetCore
ANet（anet）	v0.3.1	https://github.com/ANetResearch/ANet
ANetHub（anet-hub）	v0.3.1	https://github.com/ANetResearch/ANetHub
ANetLink	v0.2.0（未变更）	https://github.com/ANetResearch/ANetLink

文档：https://docs.agentnetwork.org.cn/docs/

升级

0.3.1 是补丁版本，不改变线路格式、身份格式和数据格式。0.3.0 的节点可与 0.3.1 的 Hub 协同工作，反之亦然。节点使用 anet update 更新；Hub 替换二进制文件并保留数据目录即可升级。

变更

macOS 沙箱

• macOS 上的 Seatbelt 沙箱已启用。在 0.3.0 中，其自检在 macOS 14 与 macOS 15 上中止：在该 profile 下启动的程序会读取根目录本身，而 profile 未允许这一次读取。现在 profile 允许该读取，且仅限目录本身，不包括其下的目录树。profile 仍然默认拒绝。
• 不受信任对端的任务，以及 trusted 为 sandbox 时的所有任务，在 macOS 上于沙箱中运行。文件隔离、带密钥的出口端点以及对钥匙串的拒绝，已在持续集成中于 macOS 14 与 macOS 15 上验证。
• claude Agent 将其临时文件保存在本次运行的临时目录中。

联邦与目录

• 对不久前加入另一个 Hub 的接收方进行首次查找时，不再以 recipient_unknown 失败。Hub 缓存给出空答复后，随即进行一次绕过缓存的查询。
• 另一个 Hub 为其自身账本签发的支付回执，按该 Hub 的密钥历史验证。签发方未知或不匹配的回执将被拒绝。

节点行为

• 加入 Hub 的两次尝试之间的等待时间最长增长到一分钟。节点等待准入期间，anet status 会标明下一次尝试的时间。
• anet status 不再将已停用的身份报告为已注册。
• 当本地 A2A 接口记录的端口仅被某个出站连接占用时，接口最多等待五分钟，随后在该端口上启动。
• --max-auto-replies 与 --poll-interval 现以 cli_removed 及替代说明被拒绝，而不再提示 unknown flag。
• anet agents wire 的帮助文本只列出该命令支持的工具。
• 原因表中的语句改为以节点或 Hub 为主语，不再称呼读者。

ANetHub

• anet-hub admission 可在首次启动之前设置准入模式（--init）。

文档与验证

• 升级指南说明 auto_reply.api_base 必须使用 https 或回环地址上的 http，并列出已移除的自动回复参数。
• 场景、集群和联合 shell 测试按 0.3 流程运行，并作为持续集成的阻塞项。0.3.0 中暂缓的模块测试现默认运行。

已知限制

• 在 macOS 上，沙箱中的任务可以读取根目录的列表（顶层名称），但不能读取其下的目录树。
• 当缓存的答复早于五秒时，对未知接收方的查找可能多一次对对端 Hub 的查询。

ANet 0.3.0

ANet 0.3.0 release notes

Release date: 2026-10-16.

Component	Version	Repository
ANetCore	v0.16.0	https://github.com/ANetResearch/ANetCore
ANet (anet)	v0.3.0	https://github.com/ANetResearch/ANet
ANetHub (anet-hub)	v0.3.0	https://github.com/ANetResearch/ANetHub
ANetLink	v0.2.0	https://github.com/ANetResearch/ANetLink

Documentation: https://docs.agentnetwork.org.cn/docs/

Upgrading

0.3.0 changes the wire format, the identity format and the data format. A 0.2 node and a 0.3 hub, and a 0.3 node and a 0.2 hub, refuse each other. Nothing is migrated: deploy 0.3.0 as a fresh installation and create new identities. See the upgrade guide on the documentation site.

Platform notes

• The macOS Seatbelt sandbox is not part of 0.3.0. On macOS, a task that would run in the sandbox is turned away with sandbox_unavailable (local reason platform_unsupported.pending) and is never run without it. The Linux sandbox, and the direct and API paths, are unaffected.
• The release assets are signed. The installer and anet update verify the signed manifest release.json before they replace anything.

Changes

Summary

• The hub learns less. A message under a delivery credential carries no sender identity, queries for the directory do not name the agent that is looked up, and the ledger and reviews expose less to the operator.
• The sender learns more. A message is confirmed by the node of the recipient, and a refusal reaches the sender within seconds with its reason.
• Keys are replaced by the day. Ciphertext that was processed cannot usually be opened from a stolen copy of a disk after one day.
• Identities can be recovered. Keys are rotated with a recovery passphrase, and a stolen key cannot rotate or deactivate an identity.
• Local execution is isolated. The agent that answers tasks of untrusted peers runs in a sandbox without network access.
• Prices are not public. They are signed in an extended card and handed to the caller.
• Every user-visible sentence comes from one table with a reason code, and the command line, MCP and the local A2A interface give the same sentence for the same event.

Compatibility

• Hub wire 3. A 0.2 daemon and a 0.3 hub, and a 0.3 daemon and a 0.2 hub, refuse each other with wire_too_old and wire_too_new.
• Sealed envelope version 2, key event log anet.kel/2, identity file anet.identity/2, direct frames v: 3, C1 version 1 between anet and ANetLink. There is no decoding path for the earlier formats.
• Data directories are not migrated. A 0.2 data directory is refused with identity_v02; a hub data directory with hub_identity_v02; a data directory that a newer release wrote with datadir_too_new or hub_data_too_new.
• A removed key in config.json stops the daemon (config_key_removed).
• Identities are created again. Allow lists, reviews and the credit balance of a 0.2 hub do not carry over.

Messaging and privacy

Delivery credentials A first contact is made under a session that the sender opens at the hub. Later messages are sent under a capability that the recipient issued and signed, which carries no sender identity. A recipient can limit its senders per credential and withdraw credentials. See Messaging.

Directory queries The directory is queried by bucket of at most 10 bits of the hash of the AID. The routes that took an AID in the request are removed.

Delivery confirmation The node of the recipient confirms each final decision. The hub keeps the confirmation for 7 days, and the sender asks for it anonymously. Messages are shown as waiting, sent again, or failed with delivery_unconfirmed; a refusal arrives with its reason and wait time, and a task becomes rejected within seconds. Cancels of tasks that are not known yet are kept as tombstones.

Forward secrecy and retention Encryption keys are valid for one UTC day, published 14 days ahead, and deleted after the day. A second layer under an interaction key protects the messages of a task. The content of a task is stored encrypted and its key is deleted after the retention period (30 days by default, 7 days for calls to public capabilities, set with anet retention). The node detects a rollback of its local state.

Previews A provider can send a snapshot of the reply that it is writing, every 5 to 10 seconds (anet preview). A streaming client that activates the extension, and anet task watch, show it. MCP does not show previews.

Capability calls with files A call of a public capability can carry files, and a capability declares the count, size and types that it takes.

Identity

• Key event log version 2 with the events icp, rot and dip. Every rotation commits to the next key. The hub of the agent is its witness and confirms the current key, for at most 6 hours per confirmation.
• The recovery passphrase protects a recovery file. Rotation, emergency rotation, change of hub, recovery on another machine and deactivation are commands of anet identity and run on a terminal.
• An agent can complete the first join without a terminal. The status then states that the recovery passphrase is not set, until anet identity protect is run.
• A hub has an identity with the same commands (anet-hub identity), and can rotate its own keys.

Hubs and payments

• Admission by AID. anet-hub admit <AID> replaces invitation secrets; a sign-up window and a credit grant are options. The public hub registers openly, behind three gates: a proof of work of 22 bits, a daily quota per address range (IPv6 counted per /32) and a probation period of 72 hours. A new account receives no credits at registration; after the probation period it receives 20 credits, within daily budgets. A join that waits for admission completes in the background.
• The ledger shows 14 days of detail. The issuance chain publishes the total per epoch, and every account can check that its balance is counted in it. The daemon checks every 6 hours.
• Reviews have pairs of pseudonyms and counts, dates without time of day, and no edges in /graph.
• Settlement across hubs is forwarded with an authenticated signature.
• The hub gateway for plain HTTP x402, voucher redemption and publish_prices are removed. Prices are in the extended card that the provider signs. anet card <aid> and the MCP tool get_agent_card show them. A quote above the signed price is not paid automatically.
• Spending is shown. A payment sentence states the quote, the limit and the result.

Local execution

• Tasks of untrusted peers run in a sandbox without network (Linux with bubblewrap and seccomp; macOS with Seatbelt). The only route is the credential-injecting endpoint of the daemon, which pins the model, limits output tokens and refuses server tools, MCP connectors and stored sessions. The sandboxed agent does not receive the API key.
• An optional list of hosts (sandbox.egress_allow) permits CONNECT connections with exact host names. Every listed host is an outbound channel.
• Budgets limit the runs for untrusted peers per day and per peer.
• Keys, conversations and tickets are not passed on command lines. Unix-socket backends are checked for the user of the listening process.

Modules

Optional parts of the daemon are modules with their own build tags and settings. A module can be switched off with without in config.json or anet init --without. A module that is not present or switched off fails closed with a sentence. Every module except the console can also be left out of the binary at build time. The released builds are default and shell. See Modules.

Command line, MCP and local interfaces

• One output convention: human-readable text by default and --json for the commands for people; JSON on standard output and readable lines on standard error for task commands. Exit status 3 marks a task that waits for the caller.
• New commands: anet card, anet task list, anet task watch, anet identity ..., anet preview, anet retention.
• The commands find, delegate and message use the same paths as MCP and the local A2A interface and show the same projection of a task.
• Removed commands answer with cli_removed and the replacement. See Command line reference.
• MCP has 14 tools. The tools have no operation on identity, retention, previews, hubs, payees or auto-reply.
• Status: anet status prints a summary with a line for identity, hub, delivery, inbound, sandbox, payments, privacy and preview.
• Reason codes: one table of codes and sentences in English and Chinese. See Reason codes.

Removed

• The hub gateway /x402/resource, vouchers and the redemption of vouchers.
• Invitation secrets and the options --token and --token-file.
• Public prices, the extension anet-pricing/v1 and profile set --pricing.
• The shared task board of the hub.
• The routes that look up keys, key histories and cards by AID; the lookup of direct addresses.
• The configuration keys listed in removed configuration keys.

Documentation

The documentation is built with Sphinx and published in English and Chinese. The reference for the command line, the reason codes and the wire tables is generated from the source of the programs.

Known limitations

What a hub can see, the bounds of forward secrecy and the cases that identity keys do not cover are stated in Security reference. Several items are planned for later releases and are not part of 0.3.0: anonymous first-contact tokens, se...

anet v0.1.10

两处修复,针对同一个故障:一条含非法 UTF-8 的记录能写进证据账本、却读不出来,节点在下一次重启时崩溃重启到需要物理接触才能恢复。一处堵住坏记录的产生,一处让已经存在的坏尾不再让节点下线。

装在无人值守设备上的节点建议升到这一版。 0.1.9 及更早版本在一次 OOM 或断电之后,有可能开机即崩溃重启,且 systemd 的 Restart 会无限重试。

编码器写得进的,它自己的解码器必须读得出

位置 ANetCore coredet.Marshal(本版依赖升到 ANetCore v0.14.0)。
行为 一个 Go string 可以装任意字节,Marshal 不看就把它写成 CBOR 文本串;Unmarshal 按 RFC 8949 拒绝非法 UTF-8。两个模式的口径不一致,而宽松的那个是编码器 —— 于是失败不落在写入方,落在读回来的人身上,往往是另一个进程、另一天。整个包的编码路径里一处 utf8.Valid 都没有。
影响 写入返回成功、数据落盘,故障推迟到下一次读取。
发现方式 一块 RK3588 板子上的 anet daemon 把一条含 0xa2 字节的命令回显写进证据账本。两天后重启,账本第 65 行读不动,daemon 在 systemd 下每 5 秒崩溃重启一次,只能物理接触归档账本才恢复。

Marshal 现在把刚编出来的字节解一次,解不动就返回错误。它问解码器,而不是重写解码器的规则:Valid() 只检查结构,UTF-8 规则在构值路径上;手写一遍扫描等于给解码器留一份会漂移的副本,而漂移的方向恰好是重新打开这个缺陷。

修在 coredet 而不是各调用点,因为它是全栈唯一的 preimage 编码器 —— 在这里立住"能编码即能解码",对所有调用方一次生效。代价是每次 Marshal 多一次解码。

任意字节有合法去处:[]byte 字段编成 CBOR 字节串,不带 UTF-8 要求。错误信息里写明了这一点。

半截写入与篡改按位置区分

位置 internal/daemon/ledger.go 的 openEvidenceLedger。
行为 任何一行解码失败都返回错误,daemon 直接放弃启动。
影响 一次 OOM 之后节点从网络上消失,且无限重启,只能手工归档账本才能恢复。
发现方式 同上那块板子 —— 转换大模型时 OOM killer 落在 append 中途。

判据改成行的位置,不是错误的类型。文件是追加式的、一条记录一行,所以被杀死的进程只能损坏它正在写的那条,那必然是最后一条:

• 最后一行解码失败 → 判为半截写入。截掉,在链上追加一条 anet.evidence.gap 记录这次丢失,正常启动。
• 中间任何一行解码失败 → 崩溃产生不了这种形态,维持拒绝启动,并点明是第几行。

这不是链校验。Import 仍然对所有解出来的记录验签名与前向链接,被改写的历史照样被拒;放宽的只是"最后一行读不动"这一种形态。

代价不对等是这么改的理由:篡改是罕见的攻击,半截写入是 OOM、断电、SIGKILL 之后的常态,把后者当成前者的代价是节点下线到有人去现场。

丢失记在链上而不是只进日志 —— 校验这条链的第三方看不到本地日志,缺口若只进日志,在证据面上等于没发生。写不成 gap 记录本身是致命错误。

Append 之后 Sync()

证据链的意义是"调用方被告知存在的记录,要能挺过下一秒的断电"。它同时收窄了半截写入的窗口:没有它,上面那种尾部残留不是边界情况,而是任何一次硬停止的常态结果。

校验

两个变体的可插拔判据在四个平台上都核对过(go tool nm):默认版 module/shell 符号数 0,anet-shell-* 25。二进制用 -w 而非 -s -w 构建,保留符号表 —— -s 会让这条检查在无符号表的文件上返回 0,看起来通过、实际什么也没证明。

anet-<os>-<arch>          默认版,不含 module/shell,不能在宿主机执行命令
anet-shell-<os>-<arch>    -tags shell 构建,可执行运营者在配置里列出的命令

checksums.txt 是解压后裸二进制的 sha256,install.sh 在 gunzip 之后核对。

安装

curl -fsSL https://agentnetwork.org.cn/install.sh | sh

默认装默认版到 ~/.local/bin。需要 shell 变体或装到 /usr/local/bin 见 install.sh --help。

anet v0.1.9

面向"用一台机器远程控制另一台"的三处修复。0.1.8 装在被控端时,超过一分钟的命令会被静默杀掉;这一版之前请不要用它跑长任务。

能力调用的时长由 provider 决定

位置 internal/daemon/capability.go 的 capabilityInvokeTimeout(60 秒)。
行为 module/shell 把 timeout_s 校验到自己的上限,daemon 在上层无条件 60 秒截断。两层各有一个超时,只有短的那个可见。
影响 运营者配 20 分钟,命令在 1 分钟被杀,唯一的迹象是一条没有解释的 FAILED —— 被截断的命令也会"回来",只看状态区分不出来。
发现方式 需要在一块 RK3588 上跑至少一小时的任务。

新增可选接口 provider.LongRunning(照已有的 provider.Priced 惯例),provider 按能力 id 报出自己需要多久;不实现的仍走 60 秒默认。module/shell 实现它,自身上限从 30 分钟提到 24 小时。

不做成无限:超时是唯一能回收卡死进程组的东西,它把"永远卡着且看不见"变成"FAILED,N 秒后被杀,这是它当时的输出"。

长任务移出轮询循环

这是上一条的前提。pollOnce 是同步分发的,能力调用就在收信循环里跑 —— 所以 60 秒不是随手写的数,它在挡"一个长任务把整个收信循环冻住"。只调大常数,等于把"跑不了长任务"换成"跑长任务时节点彻底失联"。

声明了长时长的调用现在在自己的 goroutine 里跑,消息立刻 ack。ack 提前是有意的 at-most-once 取舍:未 ack 的消息会被重投,而重跑一条烧写固件或执行迁移的命令,比丢掉"它开始过"这条记录更糟。

随之处理的两件事:并发上限 4(异步化让并发第一次成为可能,不设限就是换一种耗尽方式,超限明确回 UNAVAILABLE 而不排队);关停要等在飞的调用排空(原本 Close 直接把交互存储置 nil,异步调用正在写结果时会 panic —— 新测试第一次跑就抓到了)。

--cap 与 --capability 不再互斥

find 只收 --cap、delegate 只收 --capability,各自拒绝对方的写法,于是"按能力找到节点再调用它"这个两步中途要换个词。现在两条命令都收两种。近似拼写仍然被拒 —— 修的是"两个名字",不是"停止检查"。

测试

scripts/joint-shell.sh 新增第 8 节:一条真的 sleep 75 的远程命令,跨 hub 与两个 daemon 实测 76 秒跑完,并断言用时确实超过 70 秒。同时验长命令在跑时另一个调用照常应答。22/22。

其余四条联调回归:joint.sh 20 · joint-fleet.sh 23 · joint-invite.sh 15 · scenario.sh 60。五条 mutation 全部被杀,其中两条(改回同步、去掉并发上限)让测试直接挂到超时 —— 正是修复所防的冻结。

下载

两个变体 × 四个平台。远程执行命令需要 anet-shell-*(含 shell 模块);默认版不含,可在下载到的产物上自行复核:

gunzip -c anet-linux-arm64.gz > anet && chmod +x anet
go tool nm anet | grep -c module/shell      # 默认版必须是 0

一行安装:

curl -fsSL https://agentnetwork.org.cn/install.sh | sh
curl -fsSL https://agentnetwork.org.cn/install.sh | sh -s -- --shell --system

anet v0.1.8

本版的重心是把 anet daemon 与 anet hub 做稳,以及把各类编码 agent 工具接进来做多机群控。

编码 agent 接入

anet install --agent <cursor|claude|codex|opencode|openclaw|hermes> 把 anet 的用法写进该工具会读的指引文件;anet autoreply set --backend exec --agent <同上> 让节点在收到委派时拉起本机的编码 agent 作答。两条合起来就是群控:一台机器上的 agent 工具派活,多台机器上的节点各自执行。

• 新增 opencode。headless 调用 opencode run,指引写到 ~/.config/opencode/AGENTS.md。它与 codex 都读 AGENTS.md,但落在各自目录,装一个不会连带装另一个。
• 支持列表不再手抄。帮助文本从注册表推导,加一个 agent 不必再记住改三处。
• anet mcp 把这张网络作为 MCP server 交给 Claude Code / Cursor,九个工具:agents_find task_delegate task_results task_inbox task_message task_end evidence_read credit_balance node_status。

修掉的缺陷

exec agent 后端的超时不生效。 配 2 秒超时、对着一个卡住的 agent,实际要等 60 秒。原因是 CommandContext 的看门狗只对它直接启动的进程发信号,而编码 agent CLI 是个启动器,它的子进程仍持有 stdout 管道。影响:一个卡住的 agent 会占住 autoreply 循环直到子进程自己死光,期间该节点对其它任务全部失聪 —— 多机群控里等于一台静默下线。现改为独立进程组 + 杀整组 + 兜底等待。

控制端口分配存在竞态。 分配靠"绑定后立即关闭"来测试可用性,检查与真正 bind 之间没有东西占住端口。同时启动两个身份,都拿到 39811,后一个起不来。现改为靠 bind 分配并持有;若配置的端口被占且是自动分配的,换一个空闲端口、先写回 config.json 再使用。运营者手写的端口不搬家。

x402 审计对最直接的一种改写不报警。 auditIssuance 把 ael.Ledger.Append 的返回值当作"这条已挂上链",而 ael 为乱序导入设计,seq 有缺口时进 staging 仍返回成功。于是 hub 删掉发放链中间条目后 audit-hub 照报 verified:true。现改为显式校验验签、prev_id 链接、seq 连续与创世条目。

价格不变式此前三侧无一方执行。 网关报价与取货地址不复验卡片签名(hub 可改价、可把买家导向别处);provider 兑付不比对自己公布的价格(少付抓不到);买方会为一份未验签的报价付款 —— VerifyResult 在结果不带密钥历史时立即返回 ErrUnverifiable,发生在校验收据签名、provider 绑定与 deliverable 哈希之前,而 /relay/send 按设计不鉴权。三侧现已分别堵上。

目录放大面。 一次匿名注册可写 20 万条能力,4.2MB 请求体撑出 55.5MB 库与 4.0MB 的匿名响应。本地与联邦两个入口都已加上限。

运营面内置生产拓扑。 anet-hub-admin 二进制里编译进了生产主机名与 ssh_user: root,一次带 token 的只读请求就会 SSH 进生产机,且这份拓扑随二进制分发。改为从 <--data>/officials.json 读,缺省为空。

另有 hub 侧生命周期、联邦、准入、见证共二十余条,详见提交记录。

测试

五条联调合计 137 项全绿:joint.sh 20(daemon↔ANetLink↔ANetMock↔hub 四仓跨进程)· joint-fleet.sh 23(群控,新增,连跑三次稳定)· joint-shell.sh 19 · joint-invite.sh 15 · scenario.sh 60(单机多节点 + 双 hub 联邦与结算)。新断言逐条做了 mutation 验证。

下载

两个变体 × 四个平台。默认版不含远程执行能力;anet-shell-* 含 shell 模块(在本机执行命令)。判据可在下载到的产物上自行复核:

gunzip -c anet-linux-amd64.gz > anet && chmod +x anet
go tool nm anet | grep -c module/shell      # 默认版必须是 0

一行安装:

curl -fsSL https://agentnetwork.org.cn/install.sh | sh
curl -fsSL https://agentnetwork.org.cn/install.sh | sh -s -- --shell     # 带 shell 模块

---

发布后的补充(同一 tag,产物未变)

这些是发布之后继续测出来并已修进 main 的,下一版带上;记在这里以免文档与实际脱节。

• hub-register --token 补进了 anet help --all 的摘要行。 邀请码准入是这一版新加的
  功能,而传码的写法只出现在参数不足时的错误提示里。
• /stats 与 /agents 曾对"有多少 agent"给出不同答案。 联邦目录合并进无参列表之后,
  落地页的计数没跟上。已改为分开报 agents 与 federated_agents —— "在我们这里注册的"
  与"别人告诉我们的"是两种断言,合成一个数会让 hub 报出它并不拥有的覆盖面。
  两个生产 hub 已升到含此修复的 anet-hub 0.1.7。
• 运营面的登录限流已在生产生效(连续错误凭据第 21 次起返回 429)。

测试范围

• 单元 + mutation:两仓全绿,race 干净,10 条 tag 双向符号数成立。
• 联调 137 项:joint.sh 20(四仓跨进程,含真实设备栈)· joint-fleet.sh 23(群控,连跑
  三次稳定)· joint-shell.sh 19 · joint-invite.sh 15 · scenario.sh 60(双 hub 联邦与结算)。
• 发行版矩阵 32 项:debian:12 / debian:bookworm-slim / ubuntu:22.04 / ubuntu:24.04 × 两个变体,
  全部从公网一行安装、起 daemon、核对模块清单。
• 实网双 hub:prodtest.sh 打两台真实 hub 与三个节点。

v0.1.7

First published release. Prebuilt binaries for macOS and Linux, amd64 and arm64.

Install

curl -fsSL https://agentnetwork.org.cn/install.sh | sh

Install, start and join a hub in one line:

curl -fsSL https://agentnetwork.org.cn/install.sh | sh -s -- \
  --hub https://hub.agentnetwork.org.cn --name my-node

Two variants per platform

anet-<os>-<arch> is the default build. It cannot execute anything on the
machine it runs on — the module that would do it is not compiled in.

anet-shell-<os>-<arch> is built with -tags shell. It can run the commands
its operator names in the config, for the callers its operator lists.

The difference is checkable on the file you downloaded, not just claimed:

go tool nm anet | grep -c module/shell        # default build → 0
go tool nm anet-shell | grep -c module/shell  # shell build   → 23

Release binaries keep their symbol table for exactly this reason (-w, not
-s -w). A stripped binary answers 0 because it has no symbols at all, which
reads like a passing check while proving nothing.

Install the shell variant with --shell:

curl -fsSL https://agentnetwork.org.cn/install.sh | sh -s -- --shell

New in this release: the shell module

Run operator-approved commands on a machine, from an agent elsewhere on the
network — restart a service, read a log, flash a board, and read back what
happened. Built for the case where you have a fleet of development machines.

It is the only module with an additive build tag: absent unless the build
asks for it. Every other optional subsystem is in by default and subtracted
with no_<name>. The two kinds of mistake do not cost the same — a
subtractive tag that goes wrong ships a module somebody wanted removed; an
additive one that goes wrong ships command execution to everybody who never
asked for it.

Carrying the module is not the same as being open. Three independent gates:

Gate	Default
Build tag	absent — the code is not in the binary
modules.shell config block	absent — no capability is registered
Caller allowlist	empty — every remote call is refused

It does not raise privilege: commands run as whatever user the daemon runs as.
Caller arguments are quoted so they cannot become commands. Timeouts kill the
whole process group. A non-zero exit is reported as FAILED with the exit
code and stderr, never as success with empty output. Every execution and every
refusal is written to the node's evidence chain before the caller is answered.
Revocation is live: the allow-file is re-read on every call, no restart.

Full contract and configuration: docs/SHELL-zh.md.

Verifying a download

curl -fsSLO https://github.com/ANetResearch/ANet/releases/download/v0.1.7/anet-linux-amd64.gz
curl -fsSLO https://github.com/ANetResearch/ANet/releases/download/v0.1.7/checksums.txt
gunzip anet-linux-amd64.gz
sha256sum -c --ignore-missing checksums.txt

The checksums are over the raw binaries, after gunzip.