@bolloon/bolloon-agent 0.1.34 → 0.1.36

package/dist/agents/pre-tool-validator.js

@@ -0,0 +1,194 @@
+/**
+ * Pre-Tool Validator — 4 步链式校验
+ *
+ * 严格对齐 Claude Code 论文 PreToolUse 4 步:
+ *   1. modeGate(tool, mode)         — bypassPermissions → 直接放行(除 shell)
+ *   2. blacklistGate(tool, args)    — 6 模式黑名单 (recursive rm, force push, dd 等)
+ *   3. shellGuardGate(tool, args)   — **完整** shell-guard (checkCommand + checkWritePath), 永远生效
+ *   4. schemaGate(tool, args)       — 第一版 stub: always allow (后续接入 tool-gate.ts)
+ *
+ * 每步独立 try/catch, 失败 = 跳过该步, 不阻塞 (与现有 lifecycle-hooks 风格一致)
+ *
+ * 失败静默: 任何 step 异常 → console.warn + 继续下一 step, 不抛错
+ */
+import { isShellTool } from './permission-mode.js';
+import { checkCommand, checkWritePath } from './shell-guard.js';
+const DANGEROUS_PATTERNS = [
+    { re: /\brm\s+(-[a-z]*f[a-z]*\s+)?-[a-z]*r[a-z]*\s+\//, reason: '禁止递归删除根目录' },
+    { re: /\bgit\s+push\s+.*--force\b/, reason: '禁止 force push' },
+    { re: /\brm\s+-rf\s+~\//, reason: '禁止递归删除 home' },
+    { re: /\bdd\s+if=.*\s+of=\/dev\//, reason: '禁止 dd 覆盖块设备' },
+    { re: /\bcurl\s+.*\|\s*(ba)?sh\b/, reason: '禁止 curl|sh 直执行' },
+    { re: />\s*\/dev\/sd[a-z]/, reason: '禁止写裸设备' },
+];
+/**
+ * Step 1: modeGate
+ * - bypassPermissions + 非 shell → 直接放行 (但保留 shellGuardRetained 标记)
+ * - 其他 → 继续
+ */
+function modeGate(tool, mode) {
+    try {
+        if (mode === 'bypassPermissions' && !isShellTool(tool)) {
+            return { allowed: true, mode, rejectedBy: undefined, shellGuardRetained: false };
+        }
+        return null; // 不在这一步决定
+    }
+    catch (err) {
+        console.warn('[pre-tool] modeGate failed (silent):', err);
+        return null;
+    }
+}
+/**
+ * Step 2: blacklistGate
+ * 6 模式黑名单 (现有 lifecycle-hooks.ts 行为)
+ */
+function blacklistGate(tool, args, mode) {
+    try {
+        if (!isShellTool(tool))
+            return null;
+        const cmd = String(args.command || args.cmd || '');
+        if (!cmd)
+            return null;
+        for (const { re, reason } of DANGEROUS_PATTERNS) {
+            if (re.test(cmd)) {
+                return { allowed: false, reason, rejectedBy: 'blacklist', mode };
+            }
+        }
+        return null;
+    }
+    catch (err) {
+        console.warn('[pre-tool] blacklistGate failed (silent):', err);
+        return null;
+    }
+}
+/**
+ * Step 3: shellGuardGate
+ * 永远跑 (绕过 mode), 是 bolloon 自身的安全底线
+ *
+ * 接完整 shell-guard.ts (checkCommand + checkWritePath):
+ *   - checkCommand 走命令白名单 + 参数黑名单 (允许列表默认 git/node/npm/npx/tsx/tsc/vitest 等)
+ *   - checkWritePath 走路径黑名单 (硬编码: pi-sdk.ts, shell-guard.ts, .env, .git/, .bolloon/, package.json, dist/ 等)
+ *
+ * 失败静默: 任何异常 → 跳过这步, 不阻塞
+ */
+function shellGuardGate(tool, args, mode) {
+    try {
+        if (!isShellTool(tool))
+            return null;
+        // 1. 命令检查 (含白名单 + arg 黑名单)
+        const cmd = String(args.command || args.cmd || '');
+        let bin = '';
+        if (cmd) {
+            // shell-guard 期望 (cmd, args[]) 形式
+            // 简单 split: 第一个 token 是 cmd, 之后是 args
+            const parts = cmd.split(/\s+/).filter(Boolean);
+            bin = parts[0] || '';
+            const rest = parts.slice(1);
+            if (bin) {
+                const cmdResult = checkCommand(bin, rest);
+                if (!cmdResult.allowed) {
+                    return {
+                        allowed: false,
+                        reason: cmdResult.reason,
+                        rejectedBy: 'shell-guard',
+                        mode,
+                        shellGuardRetained: true,
+                    };
+                }
+            }
+        }
+        // 2. 写路径检查 — 从 2 个来源抽:
+        //    a) 结构化字段 (args.path / args.target / args.file)
+        //    b) 命令字符串里的 token (老测试传 args.command='cat pi-sdk.ts' 时也能拦)
+        const pathCandidates = [];
+        const structured = String(args.path || args.target || args.file || args.targetPath || args.destination || '');
+        if (structured)
+            pathCandidates.push(structured);
+        if (cmd) {
+            // 简单 tokenize: 按空白切, 取不含 shell 元字符的 token
+            const tokens = cmd.split(/\s+/).filter((t) => t && !/^[|>;&`$()<]/.test(t));
+            for (const t of tokens) {
+                if (t !== bin)
+                    pathCandidates.push(t); // 跳过命令本身
+            }
+        }
+        // 纯文件名 denylist (兜底 — checkWritePath 的 regex 要求 /src/xxx/ 锚定, 纯文件名拦不到)
+        // 只对**写/删/改**类命令生效 (rm, cp, mv, sed -i, echo >); 读类命令 (cat, head, tail, ls) 跳过
+        const READ_BINS = new Set(['cat', 'head', 'tail', 'wc', 'ls', 'echo', 'pwd', 'date', 'mkdir', 'touch', 'find', 'grep', 'git', 'node', 'npm', 'npx', 'tsx', 'tsc', 'vitest']);
+        const FILENAME_DENYLIST = [
+            'pi-sdk.ts', 'shell-guard.ts', 'shell-tool.ts',
+            '.env', 'package.json', 'tsconfig.json',
+        ];
+        const isReadOperation = READ_BINS.has(bin);
+        for (const candidate of pathCandidates) {
+            // 2a. checkWritePath 只对写操作调用 (读类命令绕开, 避免 cat pi-sdk.ts 误拦)
+            if (!isReadOperation) {
+                const pathResult = checkWritePath(candidate);
+                if (!pathResult.allowed) {
+                    return {
+                        allowed: false,
+                        reason: pathResult.reason,
+                        rejectedBy: 'shell-guard',
+                        mode,
+                        shellGuardRetained: true,
+                    };
+                }
+            }
+            // 2b. 纯文件名兜底 — 只对写操作生效
+            if (!isReadOperation) {
+                const baseName = candidate.split('/').pop() || '';
+                if (FILENAME_DENYLIST.includes(baseName)) {
+                    return {
+                        allowed: false,
+                        reason: `shell-guard: 禁止 ${bin} 操作 ${candidate} (命中文件名硬编码黑名单)`,
+                        rejectedBy: 'shell-guard',
+                        mode,
+                        shellGuardRetained: true,
+                    };
+                }
+            }
+        }
+        return null; // 通过
+    }
+    catch (err) {
+        console.warn('[pre-tool] shellGuardGate failed (silent):', err);
+        return null;
+    }
+}
+/**
+ * Step 4: schemaGate
+ * 第一版 stub: always allow
+ */
+function schemaGate(_tool, _args, mode) {
+    return null; // 不在这一步决定
+}
+/**
+ * 主入口: 4 步链式, 任何一步拒绝 → 返回, 否则最终放行
+ */
+export function validatePreToolUse(tool, args, mode) {
+    const steps = [
+        () => modeGate(tool, mode),
+        () => blacklistGate(tool, args, mode),
+        () => shellGuardGate(tool, args, mode),
+        () => schemaGate(tool, args, mode),
+    ];
+    for (const step of steps) {
+        const result = step();
+        if (result && !result.allowed)
+            return result;
+    }
+    // 全部通过 → 放行
+    // bypassPermissions + shell 走到这里 = shellGuardGate 已经放过, 但要标记 shellGuardRetained
+    return {
+        allowed: true,
+        mode,
+        rejectedBy: undefined,
+        shellGuardRetained: isShellTool(tool),
+    };
+}
+// ============================================================
+// 测试钩子
+// ============================================================
+export function _resetValidatorForTest() {
+    // validator 是 pure, 保留 API 一致
+}

package/dist/agents/workflow-pivot-loop.js

@@ -208,6 +208,19 @@ export class WorkflowPivotLoop {
                             type: 'error',
                             content: `❌ 未知工具: ${toolCall.name}`
                         });
+                        // 2026-06-15: step-timeline — 未知工具也开/关一个 step 节点
+                        this.emit({
+                            type: 'step_start',
+                            content: `未知工具 ${toolCall.name}`,
+                            tool: toolCall.name,
+                            args: toolCall.args || {},
+                        });
+                        this.emit({
+                            type: 'step_error',
+                            content: `未知工具 ${toolCall.name}`,
+                            tool: toolCall.name,
+                            error: 'Unknown tool',
+                        });
                         this.messageHistory.push({
                             role: 'tool',
                             content: JSON.stringify({ success: false, error: `Unknown tool: ${toolCall.name}` })
@@ -219,8 +232,26 @@ export class WorkflowPivotLoop {
                         content: `🔧 执行: ${toolCall.name}`,
                         tool: toolCall.name
                     });
+                    // 2026-06-15: step-timeline — 开节点
+                    this.emit({
+                        type: 'step_start',
+                        content: `调用 ${toolCall.name}`,
+                        tool: toolCall.name,
+                        args: toolCall.args || {},
+                    });
                     try {
                         const result = await tool.execute(toolCall.args ?? {});
+                        // 2026-06-15: step-timeline — 关闭节点 (success / error)
+                        this.emit({
+                            type: result.success ? 'step_done' : 'step_error',
+                            content: result.success
+                                ? `${toolCall.name} 成功`
+                                : `${toolCall.name} 失败: ${result.error}`,
+                            tool: toolCall.name,
+                            success: result.success,
+                            output: result.output,
+                            error: result.error,
+                        });
                         this.emit({
                             type: result.success ? 'status' : 'error',
                             content: result.success
@@ -305,9 +336,49 @@ export class WorkflowPivotLoop {
      */
     extractPendingToolUses(content) {
         const pending = [];
+        // Pattern 0: <tool_use>{...JSON...}</tool_use> (Anthropic 风格 + minimax 也用)
+        // 这次 LLM 输出: <tool_use>\n{"name": "read_document", "arguments": {"path": "/Users/.../README.md"}}\n</tool_use>
+        const toolUseRe = /<tool_use>\s*(\{[\s\S]*?\})\s*<\/tool_use>/g;
+        let match;
+        while ((match = toolUseRe.exec(content)) !== null) {
+            try {
+                const obj = JSON.parse(match[1]);
+                if (obj && obj.name && this.tools.has(obj.name)) {
+                    const args = this.normalizeArgs(obj.arguments || {});
+                    pending.push({ name: obj.name, args, description: '', parameters: {} });
+                }
+            }
+            catch (e) {
+                // JSON 解析失败, 继续下一 match
+            }
+        }
+        // Pattern 0b: <function_calls><invoke name="X"><parameter name="k">v</parameter>...</invoke></function_calls>
+        //   这次 minimax LLM 用这种 Anthropic 风格 XML
+        const fnCallsRe = /<function_calls>([\s\S]*?)<\/function_calls>/g;
+        while ((match = fnCallsRe.exec(content)) !== null) {
+            const block = match[1];
+            // 抓 <invoke name="X">...</invoke>
+            const invokeRe = /<invoke\s+name="(\w+)"\s*>([\s\S]*?)<\/invoke>/g;
+            let im;
+            while ((im = invokeRe.exec(block)) !== null) {
+                const name = im[1];
+                if (!this.tools.has(name))
+                    continue;
+                // 抓 <parameter name="k">v</parameter> 列表
+                const args = {};
+                const paramRe = /<parameter\s+name="(\w+)"\s*>([\s\S]*?)<\/parameter>/g;
+                let pm;
+                while ((pm = paramRe.exec(im[2])) !== null) {
+                    args[pm[1]] = pm[2].trim().replace(/^["']|['"]$/g, '');
+                }
+                // 避免重复添加
+                if (!pending.some(p => p.name === name)) {
+                    pending.push({ name, args, description: '', parameters: {} });
+                }
+            }
+        }
         // Pattern 1: Chinese format "调用工具: tool_name(args)"
         const pattern1 = /调用工具[：:]\s*(\w+)\s*\(([^)]*)\)/g;
-        let match;
         while ((match = pattern1.exec(content)) !== null) {
             const name = match[1];
             const argsStr = match[2];
@@ -357,22 +428,52 @@ export class WorkflowPivotLoop {
             return args;
         const pairs = argsStr.split(',').map(s => s.trim()).filter(Boolean);
         for (const pair of pairs) {
-            const colonIdx = pair.indexOf(':');
-            if (colonIdx > 0) {
-                const key = pair.substring(0, colonIdx).trim();
-                const value = pair.substring(colonIdx + 1).trim().replace(/^['"]|['"]$/g, '');
-                args[key] = value;
+            // 2026-06-15: LLM 实际输出 3 种格式 — 全支持
+            //   1) JSON 风格: {"key":"value"}     (服务器日志显示, 但 LLM 不会真输出完整 JSON)
+            //   2) key="value" 含双引号         (本次 read_document(path="/Users/..."))
+            //   3) key='value' 含单引号
+            //   4) key:value                    (老 Chinese 格式)
+            //   5) key value                    (positional 兜底)
+            let m = pair.match(/^["']?([\w-]+)["']?\s*=\s*["']([^"']*)["']$/);
+            if (m) {
+                args[m[1]] = m[2];
+                continue;
             }
-            else {
-                // No colon, try to parse as positional
-                const parts = pair.split(/\s+/);
-                if (parts.length >= 2) {
-                    args[parts[0]] = parts.slice(1).join(' ');
-                }
+            m = pair.match(/^["']?([\w-]+)["']?\s*[:=]\s*([^,]+)$/);
+            if (m) {
+                args[m[1]] = m[2].trim().replace(/^['"]|['"]$/g, '');
+                continue;
+            }
+            m = pair.match(/^["']?([\w-]+)["']?\s*[:]\s*["']?([^"']*)["']?$/);
+            if (m) {
+                args[m[1]] = m[2].trim();
+                continue;
+            }
+            // positional 兜底
+            const parts = pair.split(/\s+/);
+            if (parts.length >= 2) {
+                args[parts[0]] = parts.slice(1).join(' ');
             }
         }
         return args;
     }
+    /**
+     * 把 tool_use JSON 里的 arguments (已经是对象) 转成 Record<string, string>
+     *   JSON parser 直接给对象, 但 tool.execute 期望 Record<string, string>
+     *   非字符串值 JSON.stringify 一下
+     */
+    normalizeArgs(args) {
+        const out = {};
+        for (const [k, v] of Object.entries(args || {})) {
+            if (v == null)
+                continue;
+            if (typeof v === 'string')
+                out[k] = v;
+            else
+                out[k] = JSON.stringify(v);
+        }
+        return out;
+    }
     /**
      * Build context from message history
      */

package/dist/bollharness/src/scripts/checks/check_doc_freshness.js

@@ -74,7 +74,7 @@ export function run(repoRoot, mode = "full") {
     const findings = [];
     const actualRoutes = countRouteDecorators(repoRoot);
     const routesDoc = path.join(repoRoot, ".boll", "rules", "backend-routes.md");
-    const claudeMd = path.join(repoRoot, "CLAUDE.md");
+    const claudeMd = path.join(repoRoot, "Bolloon.md");
     if (fs.existsSync(routesDoc)) {
         const routesContent = fs.readFileSync(routesDoc, "utf-8");
         const routeClaims = routesContent.match(/-\s+`(?:GET|POST|PUT|PATCH|DELETE|WS)\s+/g) || [];

package/dist/bollharness/src/scripts/checks/check_doc_links.js

@@ -2,7 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 export function run(repoRoot, mode = "full") {
     const findings = [];
-    const docFiles = ["CLAUDE.md", "docs/ROADMAP.md", "README.md"];
+    const docFiles = ["Bolloon.md", "docs/ROADMAP.md", "README.md"];
     const maxAgeDays = 7;
     for (const docFile of docFiles) {
         const fullPath = path.join(repoRoot, docFile);

package/dist/bollharness/src/scripts/context_router.js

@@ -17,7 +17,7 @@ export const CONTEXT_MAP = {
     "scenes/": ["scene-fidelity", "two-language"],
     "website/app/[scene]/": ["scene-fidelity", "two-language"],
     "website/components/scene/": ["scene-fidelity", "two-language"],
-    "CLAUDE.md": ["truth-source-hierarchy"],
+    "Bolloon.md": ["truth-source-hierarchy"],
     "MEMORY.md": ["truth-source-hierarchy"],
     "docs/INDEX.md": ["truth-source-hierarchy"],
     "mcp-server/pyproject.toml": ["version-sources"],

package/dist/bollharness/src/scripts/deploy-guard.js

@@ -109,7 +109,7 @@ function block(reason, host = null) {
   Demo 正式: bash scripts/deploy-demo.sh <name> --channel prod --yes
   Demo 内测: bash scripts/deploy-demo.sh <name> --channel preview --yes
   Edge/Nginx: bash scripts/deploy-edge.sh --yes
-详见 CLAUDE.md Development Commands。`;
+详见 Bolloon.md Development Commands。`;
     }
     else if (BRIDGE_VPS_HOSTS.includes(host ?? "")) {
         guidance = `Bridge VPS 必须走 git pull 更新路径：

package/dist/bollharness/src/scripts/guard_router.js

@@ -8,7 +8,7 @@ export const GUARD_MAP = {
     "docs/issues/": ["check_issue_closure"],
     "backend/product/routes/": ["check_doc_freshness"],
     "docs/ROADMAP.md": ["check_doc_freshness"],
-    "CLAUDE.md": ["check_doc_freshness"],
+    "Bolloon.md": ["check_doc_freshness"],
     "docs/magic/": ["check_doc_freshness"],
     ".boll/rules/backend-routes.md": ["check_doc_freshness"],
     ".boll/settings.json": ["check_hook_installed"],

package/dist/bollharness/src/scripts/hooks/_hook_output.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 process.stdout.write(`\n\n## Bollharness Context\n\n` +
     `bollharness is an AI Agent Session Governance Framework.\n\n` +
-    `For more information, see CLAUDE.md in the project root.\n`);
+    `For more information, see Bolloon.md in the project root.\n`);
 process.exit(0);
 export {};

package/dist/bollharness/src/scripts/hooks/risk-tracker.js

@@ -6,7 +6,7 @@ const RISK_ORDER = { R0: 0, R1: 1, R2: 2, R3: 3, R4: 4 };
 const RISK_ELEVATORS = [
     ["scripts/deploy", "R4"],
     ["backend/product/db/migration", "R4"],
-    ["CLAUDE.md", "R3"],
+    ["Bolloon.md", "R3"],
     [".boll/settings.json", "R3"],
     [".boll/skills/", "R3"],
     [".boll/rules/", "R3"],

package/dist/bollharness-integration/context-router.js

@@ -25,7 +25,7 @@ export const CONTEXT_MAP = {
     'src/bollharness-integration/': ['truth-source-hierarchy', 'artifact-linkage'],
     'docs/': ['truth-source-hierarchy', 'two-language'],
     'docs/decisions/': ['truth-source-hierarchy', 'artifact-linkage'],
-    'CLAUDE.md': ['truth-source-hierarchy', 'bridge-constitution'],
+    'Bolloon.md': ['truth-source-hierarchy', 'bridge-constitution'],
     'README.md': ['truth-source-hierarchy', 'general-dev-principles'],
 };
 /**
@@ -331,7 +331,7 @@ export const CONTEXT_FRAGMENTS = {
     'project-governance': `# Project Governance
 
 ## Truth Sources
-- CLAUDE.md: Project overview and norms
+- Bolloon.md: Project overview and norms
 - docs/: Architecture and decisions
 - code/: Implementation
 - issues/: Tracking and discussions

package/dist/bollharness-integration/guard-checker.js

@@ -36,7 +36,7 @@ export const GUARD_MAP = {
     'src/constraints/': ['check_api_types', 'check_versions'],
     'src/social/': ['check_api_types', 'check_versions'],
     'docs/': ['check_doc_freshness', 'check_doc_links'],
-    'CLAUDE.md': ['check_doc_freshness', 'check_artifact_link'],
+    'Bolloon.md': ['check_doc_freshness', 'check_artifact_link'],
     'README.md': ['check_doc_freshness'],
     'docs/decisions/': ['check_artifact_link', 'check_versions'],
     '.boll/': ['check_hook_installed'],

package/dist/bootstrap/bootstrap.js

@@ -0,0 +1,117 @@
+/**
+ * Bolloon Bootstrap — 启动入口
+ *
+ * web server 启动时 (或 CLI 模式) 调一次, 完成 3 件事:
+ * 1. 跑类 B 自适应扫描 (暖缓存 + 写 evolution.jsonl 启动事件)
+ * 2. 收集项目 Context (Bolloon.md / git / persona / judgments / skills)
+ * 3. 挂每天 0:00 定时任务
+ *
+ * 失败静默: 任意步骤失败 console.warn, 不抛错 (主流程不被阻塞)
+ */
+import { runAdaptiveScan, logEvolution } from '../pi-ecosystem-judgment/adaptive-scan.js';
+import { collectBolloonContext } from './context-collector.js';
+/**
+ * 入口: web server / CLI 启动时调一次
+ */
+export async function bootstrapBolloon(opts = {}) {
+    const start = Date.now();
+    const errors = [];
+    // 1. 类 B 启动扫描
+    let scanResult = {
+        scannedAt: new Date().toISOString(),
+        judgmentsTotal: 0,
+        usageEntriesScanned: 0,
+        suggestions: [],
+    };
+    try {
+        scanResult = await runAdaptiveScan();
+        const { suggestionHint } = await import('../pi-ecosystem-judgment/adaptive-scan.js');
+        await logEvolution({
+            ts: new Date().toISOString(),
+            action: 'accept', // 用 accept 表示"系统记录" (跟 reject 区分)
+            suggestion: {
+                key: 'bootstrap-startup',
+                kind: 'unused', // 占位
+                judgmentId: '__bootstrap__',
+                decision: 'Bolloon 启动扫描',
+                reason: `本次启动扫描了 ${scanResult.judgmentsTotal} 条原则, ${scanResult.usageEntriesScanned} 条使用记录, 生成 ${scanResult.suggestions.length} 条建议`,
+                action: 'review',
+                hint: suggestionHint('unused', 'review', { usage7d: 0, usage30d: 0, daysSinceLastUse: 0, totalUsage: 0 }),
+                metrics: { usage7d: 0, usage30d: 0, daysSinceLastUse: 0, totalUsage: 0 },
+                scannedAt: scanResult.scannedAt,
+            },
+        });
+        console.log(`[bootstrap] 类 B 启动扫描完成: ${scanResult.suggestions.length} 条建议`);
+    }
+    catch (err) {
+        errors.push(`scan: ${err.message}`);
+        console.warn('[bootstrap] 启动扫描失败 (非致命):', err);
+    }
+    // 2. 收集项目 Context
+    let context = {
+        projectRoot: opts.cwd ?? process.cwd(),
+        projectName: 'unknown',
+        bolloonMd: null,
+        hierarchy: { managed: null, user: null, project: null, local: null, merged: '' },
+        git: null,
+        persona: null,
+        judgmentsSummary: { total: 0, active: 0, superseded: 0, rejected: 0, topValues: [] },
+        skills: [],
+        env: { os: 'unknown', nodeVersion: 'unknown', llmProvider: 'unknown' },
+        pending: { goals: [], todos: [] },
+        collectedAt: new Date().toISOString(),
+    };
+    try {
+        context = await collectBolloonContext({ cwd: opts.cwd ?? process.cwd() });
+        console.log(`[bootstrap] context 收集完成: ${context.judgmentsSummary.total} judgments, ${context.skills.length} skills`);
+    }
+    catch (err) {
+        errors.push(`context: ${err.message}`);
+        console.warn('[bootstrap] context 收集失败 (非致命):', err);
+    }
+    // 3. 挂定时任务 (每天 0:00 跑扫描, server 重启时丢失可接受)
+    try {
+        scheduleAdaptiveScanDaily();
+        console.log('[bootstrap] 定时任务已挂: 每天 0:00 跑类 B 扫描');
+    }
+    catch (err) {
+        errors.push(`schedule: ${err.message}`);
+        console.warn('[bootstrap] 定时任务挂载失败 (非致命):', err);
+    }
+    const durationMs = Date.now() - start;
+    console.log(`[bootstrap] 完成 (${durationMs}ms, ${errors.length} 个错误)`);
+    return { context, scanResult, durationMs, errors };
+}
+// ============================================================
+// 定时任务: 每天 0:00 跑类 B 自适应扫描
+// ============================================================
+let scheduled = false;
+function scheduleAdaptiveScanDaily() {
+    if (scheduled)
+        return;
+    scheduled = true;
+    const now = new Date();
+    const next = new Date(now);
+    next.setHours(24, 0, 0, 0);
+    const msUntilMidnight = next.getTime() - now.getTime();
+    // 第一次: 等到明天 0:00
+    setTimeout(() => {
+        runAdaptiveScan().then((result) => {
+            console.log(`[bootstrap] 定时扫描完成: ${result.suggestions.length} 条建议`);
+        }).catch((err) => {
+            console.warn('[bootstrap] 定时扫描失败:', err);
+        });
+        // 之后: 每 24h
+        setInterval(() => {
+            runAdaptiveScan().then((result) => {
+                console.log(`[bootstrap] 定时扫描完成: ${result.suggestions.length} 条建议`);
+            }).catch((err) => {
+                console.warn('[bootstrap] 定时扫描失败:', err);
+            });
+        }, 24 * 60 * 60 * 1000);
+    }, msUntilMidnight);
+}
+/** 测试辅助: 重置 scheduled 标志 */
+export function _resetScheduleForTest() {
+    scheduled = false;
+}