@agentunion/fastaun-browser 0.5.6 → 0.5.9

package/_packed_docs/group-message-rpc-alignment-gaps.md

@@ -0,0 +1,741 @@
+# Group 消息收发 RPC 方法 Python vs Go 对齐审查报告
+
+**审查时间**：2026-08-16  
+**审查范围**：send, pull, ack, recall, history, thought.put, thought.get  
+**审查文件**：
+- Python: `D:\modelunion\kite\extensions\services\group\entry.py`
+- Go: `D:\modelunion\kite\extensions\services\group\go\cmd\group-go\main.go`
+  - RPC层: `internal/rpc/service_handlers.go`
+  - 服务层: `internal/service/{send_message,pull_messages,ack_messages,recall_messages,thoughts}.go`
+
+---
+
+## 1. send（发送群消息）
+
+### Python 实现（entry.py:6020-6084）
+```python
+async def _rpc_send(params: dict) -> dict:
+    # V1/V2 版本隔离检查
+    request_types = (str(params.get("type") or ""), str(params.get("message_type") or ""))
+    payload_type = str((params.get("payload") or {}).get("type") or "")
+    is_encrypted = any(value in ("e2ee.group_encrypted", "e2ee.encrypted") 
+                       for value in (*request_types, payload_type))
+    
+    if is_encrypted:
+        group_record = await _service._get_group_by_id_compat(group_id)
+        e2ee_ver = getattr(group_record, "e2ee_version", "v1")
+        if e2ee_ver == "v2":
+            raise ValueError("group uses e2ee_v2, please use group.v2.send")
+        if e2ee_ver == "v1":
+            raise ValueError("group is V1; encrypted messages no longer allowed")
+    
+    # 离线推送目标快照（先查询）
+    push_snapshot = await _group_message_push_snapshot(group_id)
+    offline_push_targets = _group_offline_push_targets(
+        push_snapshot.get("active_aids"),
+        sender_aid=sender_aid,
+        banned_aids=push_snapshot.get("banned_aids"),
+    )
+    service_params["_offline_push_targets"] = offline_push_targets
+    
+    result = await _service.send_message(service_params)
+    
+    # 如果实时分发未尝试，补发标准事件
+    msg_dispatch = result.get("message_dispatch", {})
+    if not msg_dispatch.get("attempted"):
+        event_data = {
+            "module_id": MODULE_NAME,
+            "group_id": result["group_id"],
+            "group_aid": result.get("group_aid", ""),
+            "seq": message["seq"],
+            "message_id": message["message_id"],
+            "sender_aid": message["sender_aid"],
+            "sender_device_id": ...,
+            "type": message["message_type"],
+            "dispatch": result.get("dispatch", {}),
+            "message_dispatch": msg_dispatch,
+        }
+        if _inline_realtime_connections_by_aid:
+            event_data["_group_inline_plain_source_v1"] = message
+        if mention_mode:
+            event_data["mention_mode"] = mention_mode
+        await _publish_group_event("group.message_created", event_data)
+    
+    return result
+```
+
+### Go 实现（service_handlers.go:1238-1306）
+```go
+"send": func(ctx HandlerContext) (any, error) {
+    // V1/V2 版本隔离在 Dispatcher.Handle (handler_dispatcher.go:240-263) 层检查
+    // 仅检查 v2.send，不检查普通 send
+    
+    result, err := svc.SendMessage(ctx.Context, svc.SendMessageInput{
+        Params:                       ctx.Params,
+        Repo:                         options.SendMessageRepo,
+        AllowedTypes:                 options.SendAllowedTypes,
+        AllowedTypesConfigured:       options.SendAllowedTypesConfigured,
+        MaxMessageSizeBytes:          options.SendMaxMessageSizeBytes,
+        MaxMessageSizeConfigured:     options.SendMaxMessageSizeConfigured,
+        PendingCount:                 options.SendPendingCount,
+        BackpressureThreshold:        options.SendBackpressureThreshold,
+        BackpressureConfigured:       options.SendBackpressureConfigured,
+        RateLimiter:                  options.SendRateLimiter,
+        ResolveDispatch:              resolveDispatch,
+        ResolveDispatchPlan:          resolveDispatchPlan,
+        DispatchMessage:              dispatchMessage,
+        NormalizeAttachmentContext:   options.NormalizeSendStorageRef,
+        ViewStorage:                  options.SendViewStorage,
+        ResolveOfflinePushTargets:    options.OfflinePushTargetResolver,
+        ProduceOfflinePushCandidates: options.OfflinePushCandidateProducer,
+    })
+    if err != nil {
+        return nil, err
+    }
+    // 实时分发未尝试时补发标准事件
+    if !sendMessageDispatchAttempted(result) && options.SendMessageEventPublisher != nil {
+        if err := publishSendFallbackEvent(ctx.Context, ctx.Params, result, options); err != nil {
+            return nil, err
+        }
+    }
+    return result, nil
+}
+```
+
+**服务层** (send_message.go:83-100):
+```go
+func SendMessage(ctx context.Context, input SendMessageInput) (map[string]any, error) {
+    actor, err := requireActorAID(input.Params)
+    groupID := groupIDFromParams(input.Params)
+    group, err := requireFreshSendGroup(ctx, input.Repo, groupID)
+    messageType := normalizeSendMessageType(input.Params["type"])
+    payload := input.Params["payload"]
+    
+    // 权限校验
+    member, err := input.Repo.RequireMember(ctx, group.GroupID, actor)
+    banned, err := input.Repo.IsBanned(ctx, group.GroupID, actor)
+    if banned {
+        return nil, errors.New("banned members cannot send messages")
+    }
+    
+    // 发言权限检查
+    settingsReader, _ := input.Repo.(sendSettingsReader)
+    if settingsReader != nil {
+        rows, _ := settingsReader.GetSettings(ctx, group.GroupID, 
+            []string{"members.allow_member_speak"})
+        allowSpeak := extractAllowMemberSpeak(rows)
+        if member.Role == "member" && !allowSpeak {
+            return nil, errors.New("members are not allowed to speak in this group")
+        }
+    }
+    
+    // 离线推送目标解析在 AppendMessage 后进行
+    ...
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **V1/V2隔离检查** | ✅ 在 `_rpc_send` 入口检查 `type/message_type/payload.type` 三个字段 | ⚠️ 仅在 v2.send 入口检查 envelope，普通 send 无 V1/V2 隔离 | **P0** |
+| **禁言检查** | ✅ `IsBanned()` | ✅ `IsBanned()` | 一致 |
+| **发言权限** | ✅ `settings.allow_member_speak` | ✅ `members.allow_member_speak` | 一致 |
+| **离线推送目标** | ✅ 发送前快照（含 banned 过滤） | ✅ 发送后快照 | 一致（时机略不同） |
+| **消息扇出** | ✅ 在 service 层通过 `SendDispatchInput` | ✅ 在 service 层通过 `SendDispatchInput` | 一致 |
+| **event发布** | ✅ `group.message_created`（dispatch未尝试时） | ✅ `publishSendFallbackEvent`（dispatch未尝试时） | 一致 |
+| **inline推送载荷** | ✅ `_group_inline_plain_source_v1` | ✅ `_group_inline_plain_source_v1` | 一致 |
+
+### 修复清单
+
+#### P0-1: Go send 缺少 V1/V2 E2EE 隔离检查
+- **位置**: `internal/rpc/service_handlers.go:1238` (send handler)
+- **问题**: 普通 `send` 方法未检查加密消息的 e2ee_version，允许向 V1 群发送加密消息
+- **Python 行为**: 
+  - 检查 `type/message_type/payload.type` 是否为 `e2ee.group_encrypted` 或 `e2ee.encrypted`
+  - 如果 `e2ee_version == "v2"` → 拒绝，要求用 `group.v2.send`
+  - 如果 `e2ee_version == "v1"` → 拒绝，V1 E2EE 已下线
+- **修复方案**:
+  ```go
+  "send": func(ctx HandlerContext) (any, error) {
+      // 在 SendMessage 调用前添加版本隔离检查
+      if isEncryptedMessage(ctx.Params) {
+          groupID := groupIDFromParams(ctx.Params)
+          group, _ := options.SendMessageRepo.RequireGroup(ctx.Context, groupID)
+          if group.E2EEVersion == "v2" {
+              return nil, errors.New("group uses e2ee_v2, please use group.v2.send")
+          }
+          if group.E2EEVersion == "v1" {
+              return nil, errors.New("group is V1; encrypted messages no longer allowed")
+          }
+      }
+      ...
+  }
+  ```
+
+---
+
+## 2. pull（拉取群消息）
+
+### Python 实现（entry.py:6997-7005）
+```python
+async def _rpc_pull(params: dict) -> dict:
+    tail_params = _tail_window_params(params)
+    if tail_params is not None:
+        reader = getattr(_service, "pull_message_tail", None)
+        if not callable(reader):
+            raise RuntimeError("group message tail is unavailable")
+        _recent_v2_group_cache_record_bypass()
+        return _reverse_group_result_view(await reader(params), params, mode="tail")
+    return await _service.pull_messages(params)
+```
+
+### Go 实现（service_handlers.go:1739-1786）
+```go
+"pull": func(ctx HandlerContext) (any, error) {
+    tailMode, err := validateGroupPullWindow(ctx.Params)
+    if err != nil {
+        return nil, err
+    }
+    
+    var pullTicket any
+    if options.MessagePullStarted != nil {
+        pullTicket = options.MessagePullStarted(ctx.Params)
+    }
+    if options.MessagePullTimedOut != nil {
+        ctx.OnRequestTimeout(func() {
+            options.MessagePullTimedOut(ctx.Params, pullTicket)
+        })
+    }
+    
+    var result map[string]any
+    if tailMode {
+        reverseRepo, ok := options.PullMessagesRepo.(svc.ReverseMessagesRepo)
+        if !ok {
+            err = errors.New("pull_messages repo does not support reverse snapshot")
+            ...
+            return nil, err
+        }
+        result, err = svc.PullMessageTail(ctx.Context, svc.ReverseMessagesInput{
+            Params:           ctx.Params,
+            Repo:             reverseRepo,
+            PendingRows:      options.PullPendingPlainMessages,
+            MaxResponseBytes: options.PullMaxResponseBytes,
+        })
+    } else {
+        result, err = svc.PullMessages(ctx.Context, svc.PullMessagesInput{
+            Params:               ctx.Params,
+            Repo:                 options.PullMessagesRepo,
+            Storage:              options.GetInfoStorage,
+            MaxLimit:             options.PullMaxLimit,
+            MaxResponseBytes:     options.PullMaxResponseBytes,
+            PendingPlainMessages: options.PullPendingPlainMessages,
+        })
+    }
+    
+    if completeErr := registerMessagePullCompletion(ctx, options, ctx.Params, result, err, tailMode, pullTicket, nil); completeErr != nil {
+        return nil, completeErr
+    }
+    return result, err
+}
+```
+
+**服务层** (pull_messages.go):
+```go
+func PullMessages(ctx context.Context, input PullMessagesInput) (map[string]any, error) {
+    actor, err := requireActorAID(input.Params)
+    groupID := groupIDFromParams(input.Params)
+    group, err := input.Repo.RequireGroup(ctx, groupID)
+    member, err := input.Repo.RequireMember(ctx, group.GroupID, actor)
+    
+    // 权限校验：成员资格
+    // cursor 管理：per-member per-device
+    cursor, err := input.Repo.GetOrCreateMessageCursor(ctx, group.GroupID, actor, deviceID, slotID)
+    
+    // 加入时间过滤（只能看到加入后的消息）
+    visibilityFloor := cursor.JoinMsgSeq
+    if floorRepo, ok := input.Repo.(pullMessageVisibilityFloorRepo); ok {
+        floor, _ := floorRepo.MemberMessageVisibilityFloor(ctx, group.GroupID, member)
+        if floor > visibilityFloor {
+            visibilityFloor = floor
+        }
+    }
+    
+    // 分页查询
+    rows, err := input.Repo.PullMessageRows(ctx, group.GroupID, actor, deviceID, afterSeq, limit)
+    
+    return map[string]any{
+        "messages":    messages,
+        "has_more":    hasMore,
+        "current_seq": currentSeq,
+    }, nil
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **权限校验** | ✅ 成员资格 | ✅ 成员资格 | 一致 |
+| **cursor管理** | ✅ per-member per-device | ✅ per-member per-device | 一致 |
+| **加入时间过滤** | ✅ `join_msg_seq` | ✅ `MemberMessageVisibilityFloor` | 一致 |
+| **recalled过滤** | ✅ 过滤 recalled 消息 | ✅ 过滤 recalled 消息 | 一致 |
+| **分页** | ✅ `after_seq + limit` | ✅ `after_seq + limit` | 一致 |
+| **tail模式** | ✅ `pull_message_tail` | ✅ `PullMessageTail` | 一致 |
+| **inline推送集成** | ✅ `MessagePullStarted/Completed` | ✅ `MessagePullStarted/Completed` | 一致 |
+| **超时处理** | ❌ 无显式超时回调 | ✅ `MessagePullTimedOut` | Go 更完善 |
+
+### 修复清单
+
+#### P2-1: Python pull 缺少超时回调机制
+- **位置**: `entry.py:6997` (_rpc_pull)
+- **问题**: Python 版本未注册超时回调，inline推送状态可能泄漏
+- **Go 行为**: 通过 `ctx.OnRequestTimeout` 注册 `MessagePullTimedOut` 清理资源
+- **修复方案**: 
+  ```python
+  # Python dispatcher 需要实现类似 Go 的 OnRequestTimeout 机制
+  # 或在 inline 推送层增加超时兜底清理
+  ```
+
+---
+
+## 3. ack（确认群消息）
+
+### Python 实现（entry.py:7094-7099）
+```python
+async def _rpc_ack(params: dict) -> dict:
+    result = await _service.ack_messages(params)
+    _on_rpc_request_success(
+        lambda: _maybe_schedule_next_online_unread_after_ack(params, result, kind="message")
+    )
+    return result
+```
+
+### Go 实现（service_handlers.go:1985-2000）
+```go
+"ack": func(ctx HandlerContext) (any, error) {
+    if options.AckMessagesRepo == nil {
+        return nil, errors.New("ack_messages repo is nil")
+    }
+    result, err := svc.LegacyAck(ctx.Context, svc.AckMessagesInput{
+        Params: ctx.Params,
+        Repo:   options.AckMessagesRepo,
+    })
+    if err != nil {
+        return nil, err
+    }
+    if err := registerAckCompletion(ctx, options, ctx.Params, result, "message"); err != nil {
+        return nil, err
+    }
+    return result, nil
+}
+```
+
+**服务层** (ack_messages.go):
+```go
+func AckMessages(ctx context.Context, input AckMessagesInput) (map[string]any, error) {
+    actor, err := requireActorAID(input.Params)
+    groupID := groupIDFromParams(input.Params)
+    
+    group, err := input.Repo.RequireGroup(ctx, groupID)
+    _, err = input.Repo.RequireMember(ctx, group.GroupID, actor)
+    
+    // ack_seq 原子更新
+    ackSeq := rpcInt64(input.Params["after_seq"])
+    deviceID := rpcString(input.Params["device_id"])
+    
+    plan := messages.AckPlan{
+        GroupID:  group.GroupID,
+        AID:      actor,
+        DeviceID: deviceID,
+        AckSeq:   ackSeq,
+    }
+    
+    coalesce, err := input.Repo.EnqueueAckPlan(ctx, plan)
+    
+    return map[string]any{
+        "group_id":  messageGroupIDForRecord(group),
+        "group_aid": group.GroupAID,
+        "ack_seq":   coalesce.EffectiveAckSeq,
+    }, nil
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **权限校验** | ✅ 成员资格 | ✅ 成员资格 | 一致 |
+| **ack_seq更新** | ✅ 原子更新 | ✅ 原子更新（EnqueueAckPlan） | 一致 |
+| **与P2P差异** | ✅ 不通知发送方 | ✅ 不通知发送方 | 一致 |
+| **在线未读调度** | ✅ `_maybe_schedule_next_online_unread_after_ack` | ✅ `registerAckCompletion` → `AckCompleted` → `AfterAck` | 一致 |
+
+### 修复清单
+
+无差异，实现对齐。
+
+---
+
+## 4. recall（撤回群消息）
+
+### Python 实现（entry.py:10632-10667）
+```python
+async def _rpc_recall(params: dict) -> dict:
+    result = await _service.recall_group_messages(params)
+    recalled_items = result.get("recalled_details", [])
+    if recalled_items:
+        group_id = str(result.get("group_id") or params.get("group_id") or "").strip()
+        message_group_id = str(result.get("group_aid") or _rpc_response_canonical_group_id(group_id)).strip()
+        _recent_v2_group_cache_clear_group(message_group_id or group_id)
+        actor_aid = (params.get("_auth") or {}).get("aid", "")
+        reason = str(params.get("reason") or "")
+        
+        for item in recalled_items:
+            try:
+                original_seq = int(item.get("original_seq") or 0)
+                # 按 original_seq 过滤：在原消息之后才加入的成员不应收到撤回通知
+                visible_aids = await _group_recall_visible_member_aids(group_id, original_seq)
+                await _publish_group_event("group.message_recalled", {
+                    "module_id": MODULE_NAME,
+                    "group_id": message_group_id,
+                    "group_aid": message_group_id,
+                    "seq": item.get("notice_seq"),
+                    "message_id": item.get("notice_message_id"),
+                    "message_ids": [item["message_id"]],
+                    "target_message_seqs": [original_seq],
+                    "member_aids": visible_aids,
+                    "sender_aid": actor_aid,
+                    "recalled_by": actor_aid,
+                    "recalled_at": int(item.get("recalled_at") or time.time() * 1000),
+                    "reason": reason,
+                    "event_seq": item.get("event_seq"),
+                })
+            except Exception as exc:
+                print(f"[{MODULE_NAME}] group.recall push failed: {exc}")
+    return result
+```
+
+### Go 实现（service_handlers.go:1722-1738）
+```go
+"recall": func(ctx HandlerContext) (any, error) {
+    if options.RecallMessagesRepo == nil {
+        return nil, errors.New("recall_group_messages repo is nil")
+    }
+    return svc.RecallGroupMessages(ctx.Context, svc.RecallGroupMessagesInput{
+        Params:              ctx.Params,
+        Repo:                options.RecallMessagesRepo,
+        EventTargetRepo:     options.RecallEventTargetRepo,
+        PublishEvent:        options.RecallEventPublisher,
+        EventModuleID:       options.RecallEventModuleID,
+        NowMS:               options.RecallNowMS,
+        RecallWindowSeconds: options.RecallWindowSeconds,
+        MaxBatch:            options.RecallMaxBatch,
+        WaitPending:         options.RecallWaitPending,
+        RecentV2Cache:       options.PullRecentV2Cache,
+    })
+}
+```
+
+**服务层** (recall_messages.go):
+```go
+func RecallGroupMessages(ctx context.Context, input RecallGroupMessagesInput) (map[string]any, error) {
+    actor, err := requireActorAID(input.Params)
+    wireGroupID, err := requireGroupIDFromParams(input.Params)
+    group, err := input.Repo.RequireGroup(ctx, wireGroupID)
+    
+    // 权限校验
+    _, err := input.Repo.RequireMember(ctx, group.GroupID, actor)
+    banned, err := input.Repo.IsBanned(ctx, group.GroupID, actor)
+    if banned {
+        return nil, errors.New("banned members cannot recall messages")
+    }
+    
+    // 批量撤回（最大100条）
+    messageIDs, rawCount, err := normalizeRecallMessageIDs(rawIDs)
+    maxBatch := input.MaxBatch
+    if maxBatch <= 0 {
+        maxBatch = 100
+    }
+    if rawCount > maxBatch {
+        return nil, fmt.Errorf("too many message_ids: %d, max %d", rawCount, maxBatch)
+    }
+    
+    // 时间窗口检查（默认2分钟）
+    createdAtMap, err := input.Repo.MessageCreatedAtMS(ctx, group.GroupID, messageIDs)
+    windowMS := int64(input.RecallWindowSeconds) * 1000
+    if windowMS <= 0 {
+        windowMS = 120000
+    }
+    
+    // 权限检查：只能撤回自己的消息，admin/owner可撤回任何消息
+    notices, events, err := input.Repo.RecallGroupMessages(ctx, group.GroupID, messageIDs, actor, nowMS, reason)
+    
+    // 事件发布：按 original_seq 过滤可见成员
+    for _, notice := range notices {
+        visibleAIDs := recallVisibleMemberAIDs(allMembers, notice.OriginalSeq)
+        input.PublishEvent(ctx, "group.message_recalled", eventPayload)
+    }
+    
+    return result, nil
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **权限校验** | ✅ 成员资格 + 禁言 | ✅ 成员资格 + 禁言 | 一致 |
+| **撤回权限** | ✅ 只能撤回自己的，admin/owner可撤回任何 | ✅ 只能撤回自己的，admin/owner可撤回任何 | 一致 |
+| **时间窗口** | ✅ 默认120秒 | ✅ 默认120秒 | 一致 |
+| **批量撤回** | ✅ 最大100条 | ✅ 最大100条 | 一致 |
+| **visible_aids过滤** | ✅ 按 original_seq 过滤 | ✅ 按 original_seq 过滤 | 一致 |
+| **event发布** | ✅ `group.message_recalled` | ✅ `group.message_recalled` | 一致 |
+| **recalled_at时间源** | ✅ 复用 store 事务内时间 | ✅ 复用 store 事务内时间 | 一致 |
+| **缓存失效** | ✅ `_recent_v2_group_cache_clear_group` | ✅ `RecentV2Cache.ClearGroup` | 一致 |
+
+### 修复清单
+
+无差异，实现对齐。
+
+---
+
+## 5. history（历史消息查询）
+
+### Python 实现（entry.py:7008-7013）
+```python
+async def _rpc_history(params: dict) -> dict:
+    _history_window_params(params)
+    reader = getattr(_service, "pull_message_history", None)
+    if not callable(reader):
+        raise RuntimeError("group history is unavailable")
+    return _reverse_group_result_view(await reader(params), params, mode="history")
+```
+
+### Go 实现（service_handlers.go:1844-1861）
+```go
+"history": func(ctx HandlerContext) (any, error) {
+    if err := validateGroupHistoryWindow(ctx.Params); err != nil {
+        return nil, err
+    }
+    if options.PullMessagesRepo == nil {
+        return nil, errors.New("pull_messages repo is nil")
+    }
+    reverseRepo, ok := options.PullMessagesRepo.(svc.ReverseMessagesRepo)
+    if !ok {
+        return nil, errors.New("pull_messages repo does not support reverse snapshot")
+    }
+    return svc.PullMessageHistory(ctx.Context, svc.ReverseMessagesInput{
+        Params:           ctx.Params,
+        Repo:             reverseRepo,
+        PendingRows:      options.PullPendingPlainMessages,
+        MaxResponseBytes: options.PullMaxResponseBytes,
+    })
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **向前翻页** | ✅ `before_seq` | ✅ `before_seq` | 一致 |
+| **权限校验** | ✅ 成员资格 | ✅ 成员资格 | 一致 |
+| **加入时间过滤** | ✅ 只能看到加入后的消息 | ✅ 只能看到加入后的消息 | 一致 |
+
+### 修复清单
+
+无差异，实现对齐。
+
+---
+
+## 6. thought.put/get（草稿管理）
+
+### Python 实现（entry.py:7016-7089）
+```python
+async def _rpc_thought_put(params: dict) -> dict:
+    # V1 群拒绝加密 thought
+    payload = params.get("payload")
+    payload_type = ""
+    if isinstance(payload, dict):
+        payload_type = str(payload.get("type") or "").strip()
+    if payload_type in ("e2ee.group_encrypted", "e2ee.encrypted"):
+        group_id = _group_identifier_param(params)
+        if group_id and _service:
+            group_record = await _service._get_group_by_id_compat(group_id)
+            e2ee_ver = getattr(group_record, "e2ee_version", "v1") if group_record else "v1"
+            if e2ee_ver == "v1":
+                raise ValueError(f"group {group_id} is V1; encrypted thoughts are no longer allowed in V1 groups")
+    return await _service.put_thought(params)
+
+async def _rpc_thought_get(params: dict) -> dict:
+    result = await _service.get_thought(params)
+    # 按客户端 group 版本过滤 items
+    if isinstance(result, dict) and result.get("found") and isinstance(result.get("thoughts"), list):
+        _auth = params.get("_auth", {}) if isinstance(params, dict) else {}
+        client_ver = _client_group_version(_auth.get("capabilities") if isinstance(_auth, dict) else None)
+        result["thoughts"] = _filter_thoughts_by_client_version(result["thoughts"], client_ver)
+    return result
+
+def _client_group_version(capabilities: dict | None) -> str:
+    """从能力声明判 Group 版本。返回 "v1" 或 "v2"。
+    仅 supported_group_e2ee == ["group_e2ee_v2"]（不含 "group_e2ee"）才视为 V2 客户端。
+    """
+    if not isinstance(capabilities, dict):
+        return "v1"
+    supported = capabilities.get("supported_group_e2ee")
+    if not isinstance(supported, list):
+        return "v1"
+    has_v2 = "group_e2ee_v2" in supported
+    has_v1 = "group_e2ee" in supported
+    return "v2" if (has_v2 and not has_v1) else "v1"
+
+def _filter_thoughts_by_client_version(items: list, client_group_version: str) -> list:
+    """按客户端 group 版本过滤 thought items。"""
+    enforce = os.environ.get("AUN_ENFORCE_THOUGHT_VERSION_FILTER", "1").strip().lower()
+    if enforce in ("0", "false", "off"):
+        return items
+    filtered = []
+    for item in items:
+        if not isinstance(item, dict):
+            continue
+        item_ver = _thought_payload_version(item.get("payload"))
+        if item_ver == "plaintext":
+            filtered.append(item)
+        elif client_group_version == "v2" and item_ver == "v2":
+            filtered.append(item)
+        elif client_group_version == "v1" and item_ver == "v1":
+            filtered.append(item)
+    return filtered
+```
+
+### Go 实现（service_handlers.go:808-833）
+```go
+"thought.put": func(ctx HandlerContext) (any, error) {
+    if options.ThoughtRepo == nil {
+        return nil, errors.New("thought repo is nil")
+    }
+    if options.ThoughtStore == nil {
+        return nil, errors.New("thought store is nil")
+    }
+    return svc.PutThought(ctx.Context, svc.ThoughtInput{
+        Params: ctx.Params,
+        Repo:   options.ThoughtRepo,
+        Store:  options.ThoughtStore,
+    })
+},
+"thought.get": func(ctx HandlerContext) (any, error) {
+    if options.ThoughtRepo == nil {
+        return nil, errors.New("thought repo is nil")
+    }
+    if options.ThoughtStore == nil {
+        return nil, errors.New("thought store is nil")
+    }
+    return svc.GetThought(ctx.Context, svc.ThoughtInput{
+        Params: ctx.Params,
+        Repo:   options.ThoughtRepo,
+        Store:  options.ThoughtStore,
+    })
+}
+```
+
+### 差异分析
+
+| 维度 | Python | Go | 影响等级 |
+|------|--------|----|----|
+| **V1群加密thought拒绝** | ✅ 检查 `payload.type` | ❌ 无检查 | **P0** |
+| **客户端版本过滤** | ✅ 按 `capabilities.supported_group_e2ee` 过滤返回 | ❌ 无过滤 | **P1** |
+| **存储键格式** | ✅ `draft:group:{group_aid}` | ✅ `draft:group:{group_aid}` | 一致 |
+| **与P2P差异** | ✅ 独立存储空间 | ✅ 独立存储空间 | 一致 |
+
+### 修复清单
+
+#### P0-2: Go thought.put 缺少 V1 群加密 thought 拒绝检查
+- **位置**: `internal/rpc/service_handlers.go:808` (thought.put handler)
+- **问题**: Go 版本允许向 V1 群发送加密 thought，违反 V1 E2EE 下线策略
+- **Python 行为**: 
+  - 检查 `payload.type` 是否为 `e2ee.group_encrypted` 或 `e2ee.encrypted`
+  - 如果 `e2ee_version == "v1"` → 拒绝
+- **修复方案**:
+  ```go
+  "thought.put": func(ctx HandlerContext) (any, error) {
+      // 添加 V1 群加密 thought 拒绝检查
+      payload, _ := ctx.Params["payload"].(map[string]any)
+      if payload != nil {
+          payloadType := strings.TrimSpace(fmt.Sprint(payload["type"]))
+          if payloadType == "e2ee.group_encrypted" || payloadType == "e2ee.encrypted" {
+              groupID := groupIDFromParams(ctx.Params)
+              group, _ := options.ThoughtRepo.RequireGroup(ctx.Context, groupID)
+              if group.E2EEVersion == "v1" {
+                  return nil, errors.New("group is V1; encrypted thoughts no longer allowed")
+              }
+          }
+      }
+      return svc.PutThought(ctx.Context, svc.ThoughtInput{...})
+  }
+  ```
+
+#### P1-1: Go thought.get 缺少客户端版本过滤
+- **位置**: `internal/rpc/service_handlers.go:821` (thought.get handler)
+- **问题**: Go 版本返回所有版本的 thought，可能导致客户端解密失败
+- **Python 行为**:
+  - 从 `_auth.capabilities.supported_group_e2ee` 判断客户端版本
+  - 仅返回匹配版本的 thought（V1客户端只看V1，V2客户端只看V2，plaintext全可见）
+  - 可通过 `AUN_ENFORCE_THOUGHT_VERSION_FILTER=0` 关闭
+- **修复方案**:
+  ```go
+  "thought.get": func(ctx HandlerContext) (any, error) {
+      result, err := svc.GetThought(ctx.Context, svc.ThoughtInput{...})
+      if err != nil {
+          return nil, err
+      }
+      
+      // 按客户端版本过滤
+      if enforce := os.Getenv("AUN_ENFORCE_THOUGHT_VERSION_FILTER"); enforce != "0" && enforce != "false" {
+          auth, _ := ctx.Params["_auth"].(map[string]any)
+          clientVer := clientGroupVersion(auth)
+          result = filterThoughtsByClientVersion(result, clientVer)
+      }
+      return result, nil
+  }
+  ```
+
+---
+
+## 总结
+
+### P0 级问题（影响核心功能/安全）
+
+| ID | 问题 | 位置 | 影响 |
+|----|------|------|------|
+| P0-1 | Go send 缺少 V1/V2 E2EE 隔离检查 | `service_handlers.go:1238` | 允许向 V1 群发送加密消息，违反 V1 E2EE 下线策略 |
+| P0-2 | Go thought.put 缺少 V1 群加密 thought 拒绝检查 | `service_handlers.go:808` | 允许向 V1 群发送加密 thought，违反 V1 E2EE 下线策略 |
+
+### P1 级问题（影响业务逻辑）
+
+| ID | 问题 | 位置 | 影响 |
+|----|------|------|------|
+| P1-1 | Go thought.get 缺少客户端版本过滤 | `service_handlers.go:821` | 返回不兼容版本的 thought，可能导致客户端解密失败 |
+
+### P2 级问题（优化改进）
+
+| ID | 问题 | 位置 | 影响 |
+|----|------|------|------|
+| P2-1 | Python pull 缺少超时回调机制 | `entry.py:6997` | inline推送状态可能泄漏，但影响有限 |
+
+### 对齐良好的部分
+
+- ✅ **权限校验**：成员资格、禁言、发言权限在两端完全一致
+- ✅ **消息扇出**：在线/离线推送策略对齐
+- ✅ **cursor管理**：per-member per-device，加入时间过滤对齐
+- ✅ **recall机制**：时间窗口、批量撤回、visible_aids过滤对齐
+- ✅ **事件发布**：group.message_created / group.message_recalled 对齐
+- ✅ **inline推送集成**：Pull/Ack 的进程内副作用注册机制对齐
+
+### 修复优先级
+
+1. **立即修复** (P0-1, P0-2)：V1/V2 E2EE 隔离检查，涉及协议合规
+2. **近期修复** (P1-1)：thought 客户端版本过滤，影响用户体验
+3. **长期优化** (P2-1)：Python 超时回调机制，可作为框架增强
+
+---
+
+**审查结论**：Go 版本在核心流程（权限、扇出、cursor、recall）上与 Python 对齐良好，但在 V1 E2EE 下线相关的版本隔离检查上存在 2 个 P0 级遗漏，需要立即修复以保证协议合规性。