@bolloon/bolloon-agent 0.1.35 → 0.1.36

package/scripts/validate-system-prompt.ts

@@ -0,0 +1,142 @@
+#!/usr/bin/env tsx
+/**
+ * validate-system-prompt.ts — 护栏: system-prompt 改动验证
+ *
+ * 跑在 pre-commit + reviewer 后:
+ *   1. 每个 layer .md 不超 maxChars
+ *   2. version 字段 (HTML 注释 <!-- id@version -->) 存在
+ *   3. hibsml 标签没漏 (如果出现 → 警告)
+ *
+ * 用法:
+ *   tsx scripts/validate-system-prompt.ts
+ *   tsx scripts/validate-system-prompt.ts --layer core/refusal.md
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+
+const REPO = process.cwd();
+const LAYERS_DIR = path.join(REPO, 'src/llm/system-prompt/layers');
+
+// 跟 registry 保持一致 (手维护同步; 后续可让 registry 暴露)
+// P-Action 4 (2026-06-15): 跟 registry.ts STATIC_LAYERS maxChars 同步, 停用 layer 设 0
+const MAX_CHARS: Record<string, number> = {
+  'core/identity': 800,
+  'core/knowledge': 600,
+  'core/tools.thin': 400,
+  'core/hibs_reminders': 0,   // 停用 (was 800)
+  'core/refusal': 800,
+  'core/tone': 500,
+  'core/wellbeing': 600,
+  'core/evenhandedness': 300,
+  'core/memory_system': 200,
+  'core/artifacts_storage': 0, // 停用 (was 2500)
+  'core/network_filesystem': 0, // 停用 (was 900)
+  'role/expert': 500,
+  'role/architect': 0,         // 停用 (was 500)
+  'role/implementer': 0,       // 停用 (was 500)
+  'role/security': 0,          // 停用 (was 500)
+  'channel/local': 500,
+  'channel/p2p-visitor': 700,
+  'channel/p2p-agent': 700,
+  'tool/bash': 600,
+  'tool/web_search': 600,
+  'tool/mcp_apps': 0,          // 停用 (was 1800)
+  'tool/hibs_api': 0,          // 停用 (was 4500)
+  'tool/image_search': 0,      // 停用 (was 2500)
+  'tool/artifacts': 0,         // 停用 (was 2500)
+  'tool/manifest': 500,
+};
+
+type IssueType = 'oversize' | 'no-version' | 'leftover-hibsml';
+type IssueSeverity = 'error' | 'warning';
+
+interface Issue {
+  layer: string;
+  type: IssueType;
+  severity: IssueSeverity;
+  detail: string;
+}
+
+/**
+ * P-Action 4 (2026-06-15): oversize 降级为 warning.
+ * 原因: P-Action 4 收紧 registry maxChars 后, 多个历史 layer .md 实际长度超过新上限.
+ *   这些 .md 是"原样"对齐 Claude.ai 完整版的, 内容不动 (用户约束: 不改 prompt).
+ *   runtime 时 assembleSystemPrompt 会按 maxChars 截断, 行为已受控.
+ *   因此 validate 阶段不再 fail build, 只 log warning.
+ * 保留为 error 的: no-version (可追溯性), leftover-hibsml (安全).
+ */
+const SEVERITY: Record<IssueType, IssueSeverity> = {
+  oversize: 'warning',
+  'no-version': 'error',
+  'leftover-hibsml': 'error',
+};
+
+async function check(file: string): Promise<Issue[]> {
+  const issues: Issue[] = [];
+  const rel = path.relative(LAYERS_DIR, file);
+  const max = MAX_CHARS[rel.replace(/\.md$/, '')];
+  const content = await fs.readFile(file, 'utf-8');
+  if (max && content.length > max) {
+    issues.push({ layer: rel, type: 'oversize', severity: SEVERITY.oversize, detail: `${content.length} > ${max}` });
+  }
+  if (!/<!--\s*[\w.-]+@[\d.]+\s*-->/.test(content)) {
+    issues.push({ layer: rel, type: 'no-version', severity: SEVERITY['no-version'], detail: '缺 <!-- id@version --> 标记' });
+  }
+  if (/\{hibsml:(?!thinking_mode)[\w_]+\}/.test(content) || /\{\/hibsml:/.test(content)) {
+    issues.push({ layer: rel, type: 'leftover-hibsml', severity: SEVERITY['leftover-hibsml'], detail: '检测到未脱除的 hibsml 标签' });
+  }
+  return issues;
+}
+
+async function walk(dir: string): Promise<string[]> {
+  const out: string[] = [];
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) out.push(...await walk(full));
+    else if (e.name.endsWith('.md')) out.push(full);
+  }
+  return out;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  let files: string[];
+  if (args.includes('--layer')) {
+    const idx = args.indexOf('--layer');
+    const target = path.join(LAYERS_DIR, args[idx + 1]);
+    files = [target];
+  } else {
+    files = await walk(LAYERS_DIR);
+  }
+  const allIssues: Issue[] = [];
+  for (const f of files) {
+    const issues = await check(f);
+    allIssues.push(...issues);
+  }
+  if (allIssues.length === 0) {
+    console.log(`✅ ${files.length} 个 layer 全部通过 (字符上限, 版本标记, hibsml 脱除)`);
+    return;
+  }
+  const errors = allIssues.filter((i) => i.severity === 'error');
+  const warnings = allIssues.filter((i) => i.severity === 'warning');
+
+  if (warnings.length > 0) {
+    console.warn(`⚠️  ${warnings.length} 个 warning (P-Action 4 后 oversize 不再 fail build):`);
+    for (const i of warnings) {
+      console.warn(`  [${i.type}] ${i.layer}: ${i.detail}`);
+    }
+  }
+
+  if (errors.length === 0) {
+    console.log(`✅ ${files.length} 个 layer 通过 (${warnings.length} 个 warning, 0 个 error)`);
+    return;
+  }
+  console.error(`❌ ${errors.length} 个 error:`);
+  for (const i of errors) {
+    console.error(`  [${i.type}] ${i.layer}: ${i.detail}`);
+  }
+  process.exit(1);
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });

package/src/agents/p2p-chat-tools.ts

@@ -1,7 +1,7 @@
 /**
  * p2p-chat-tools — 异步 chat 通道 + 持久化 inbox + 判断力外包 (draft)
  *
- * 解决痛点: 两个节点的智能体代替各自人类主人做异步判断
+ * 解决痛点: 两个节点的智能体代替各自人类用户做异步判断
  *
  * 流程:
  *   1. A 节点 (人类在线) 通过 sendChat(peerDID, text) 发消息 → iroh 'agent_chat'
@@ -9,7 +9,7 @@
  *        - onMessage('agent_chat') → 落 ~/.bolloon/inbox/<peerDID>.jsonl
  *        - 状态 = 'received' (未处理)
  *   3. B 节点 wake-up (processPendingInbox) → 扫描 status='received' 的消息
- *        - 调 LLM 生成 draft (注入主人历史判断 + ValueProfile)
+ *        - 调 LLM 生成 draft (注入用户历史判断 + ValueProfile)
  *        - 写 status='drafted', draft 落盘
  *        - 通过 'agent_chat' 消息类型回送 draft (前缀 [DRAFT] 表明是代回)
  *   4. A 节点收到 draft → 写到 A 的 outbox (inbox 中 from=B 的那条)
@@ -258,7 +258,7 @@ async function buildValueHint(text: string): Promise<string> {
       .slice(-10)
       .flatMap((j) => j.reasons || [])
       .slice(0, 20);
-    return `\n[主人历史判断 (style 参考, 不可外泄)]\n关注维度: ${profileHint}\n关键理由示例: ${reasons.join(' | ').slice(0, 400) || '(无)'}\n`;
+    return `\n[用户历史判断 (style 参考, 不可外泄)]\n关注维度: ${profileHint}\n关键理由示例: ${reasons.join(' | ').slice(0, 400) || '(无)'}\n`;
   } catch (e) {
     return '';
   }
@@ -275,7 +275,7 @@ export async function generateDraft(
   if (entry.status !== 'received') return entry;
 
   const valueHint = await buildValueHint(entry.text);
-  const promptForDraft = `你是主人的代理. 对方发来这条消息: "${entry.text.slice(0, 1500)}"\n${valueHint}\n请基于主人的历史判断, 用 1-2 句话代主人拟一个回复草案. 草案要保留主人的语气和立场, 开头标注 [DRAFT]. 直接给草案文本, 不要解释.`;
+  const promptForDraft = `你是用户的代理. 对方发来这条消息: "${entry.text.slice(0, 1500)}"\n${valueHint}\n请基于用户的历史判断, 用 1-2 句话代用户拟一个回复草案. 草案要保留用户的语气和立场, 开头标注 [DRAFT]. 直接给草案文本, 不要解释.`;
 
   let draftText = '';
   let confidence = 0.5;
@@ -290,7 +290,7 @@ export async function generateDraft(
       body: JSON.stringify({
         model: openaiModel,
         messages: [
-          { role: 'system', content: '你是主人的代理. 你的输出会被主人审阅后才发出. 请谨慎.' },
+          { role: 'system', content: '你是用户的代理. 你的输出会被用户审阅后才发出. 请谨慎.' },
           { role: 'user', content: promptForDraft },
         ],
         temperature: 0.4,
@@ -310,7 +310,7 @@ export async function generateDraft(
   }
 
   if (!draftText) {
-    draftText = `[DRAFT] 已收到. (本地 draft 引擎未配置 LLM, 主人上线后请手写回复)`;
+    draftText = `[DRAFT] 已收到. (本地 draft 引擎未配置 LLM, 用户上线后请手写回复)`;
     confidence = 0.1;
   }
 

package/src/agents/permission-mode.ts

@@ -0,0 +1,127 @@
+/**
+ * Permission Mode — 3 种模式枚举 + 解析
+ *
+ * 设计: 严格对齐 Claude Code 论文 3 种 mode (default / acceptEdits / bypassPermissions)
+ * 论文第 7 种 (plan/dontAsk/bubble) bolloon 暂不引入, 减少 API surface.
+ *
+ * 关键设计: shell-guard **不受** mode 影响
+ *   - 路径黑名单 (.bolloon/, pi-sdk.ts, shell-guard.ts, .env, .git/ 等) 永远生效
+ *   - 命令 allowlist 默认: git/node/npm/npx/tsx/tsc/vitest/cat/head/tail/wc/ls/echo/pwd/date/mkdir/touch 永远生效
+ *   - 即使用户设 bypassPermissions, shell 类工具仍走 shell-guard
+ *
+ * 失败静默: 任何异常 → 返回 'default' (向后兼容)
+ */
+
+export type PermissionMode = 'default' | 'acceptEdits' | 'bypassPermissions';
+
+export const ALL_PERMISSION_MODES: readonly PermissionMode[] = [
+  'default',
+  'acceptEdits',
+  'bypassPermissions',
+] as const;
+
+export interface ResolveOptions {
+  /** BootstrapOptions / onPreToolUse 调用处透传 */
+  permissionMode?: PermissionMode;
+}
+
+/**
+ * 解析当前 permission mode.
+ * 优先级 (由高到低):
+ *   1. opts.permissionMode          (BootstrapOptions 显式传入)
+ *   2. runtime override             (~/.bolloon/sessions/permission-mode.json, UI 设置)
+ *   3. env BOLLOON_PERM_MODE        (环境变量)
+ *   4. 'default'                    (兜底)
+ *
+ * 非法值 → fallback 'default', console.warn
+ * 失败静默: 任何异常 → 'default' (不阻塞主对话)
+ */
+export function resolvePermissionMode(opts?: ResolveOptions): PermissionMode {
+  try {
+    if (opts?.permissionMode && ALL_PERMISSION_MODES.includes(opts.permissionMode)) {
+      return opts.permissionMode;
+    }
+    // runtime override (UI 设置, 存 ~/.bolloon/sessions/permission-mode.json)
+    const override = readRuntimeOverride();
+    if (override) {
+      return override;
+    }
+    const env = process.env.BOLLOON_PERM_MODE;
+    if (env === 'default' || env === 'acceptEdits' || env === 'bypassPermissions') {
+      return env;
+    }
+    if (env && env.length > 0) {
+      console.warn(`[permission-mode] unknown BOLLOON_PERM_MODE="${env}", fallback to "default"`);
+    }
+    return 'default';
+  } catch (err) {
+    console.warn('[permission-mode] resolvePermissionMode failed (silent, using default):', err);
+    return 'default';
+  }
+}
+
+/**
+ * 读 runtime override 文件 (UI 设的 mode).
+ * 失败静默: 任何异常 → null (回到 env/default)
+ */
+function readRuntimeOverride(): PermissionMode | null {
+  try {
+    const fs = require('fs') as typeof import('fs');
+    const os = require('os') as typeof import('os');
+    const path = require('path') as typeof import('path');
+    const file = path.join(
+      process.env.HOME || os.homedir() || '/tmp',
+      '.bolloon', 'sessions', 'permission-mode.json'
+    );
+    if (!fs.existsSync(file)) return null;
+    const raw = fs.readFileSync(file, 'utf-8');
+    const obj = JSON.parse(raw);
+    if (obj && typeof obj.mode === 'string' && ALL_PERMISSION_MODES.includes(obj.mode as any)) {
+      return obj.mode as PermissionMode;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 工具名分类: 是不是"编辑"类 (受 acceptEdits 模式影响)
+ * 简单按前缀, 不做完整注册表
+ */
+export function isEditTool(toolName: string): boolean {
+  const lc = toolName.toLowerCase();
+  return lc.startsWith('edit_') || lc.startsWith('write_') || lc === 'str_replace' || lc === 'create_file' || lc === 'present_files';
+}
+
+/**
+ * 工具名分类: 是不是"shell"类 (永远走 shell-guard, 不受 mode 影响)
+ */
+export function isShellTool(toolName: string): boolean {
+  const lc = toolName.toLowerCase();
+  return lc === 'shell' || lc === 'shell_exec' || lc === 'bash';
+}
+
+/**
+ * 判断当前 mode + tool 的最终是否需要走 blacklist
+ *
+ * 逻辑表:
+ *   - shell 工具: 永远走 blacklist (shell-guard 接管)
+ *   - bypassPermissions 模式: 非 shell 全部放行
+ *   - acceptEdits 模式: edit_* / write_* 类跳过 blacklist
+ *   - default 模式: 全部走 blacklist
+ */
+export function shouldRunBlacklist(toolName: string, mode: PermissionMode): boolean {
+  if (isShellTool(toolName)) return true;  // shell-guard 永远跑
+  if (mode === 'bypassPermissions') return false;
+  if (mode === 'acceptEdits' && isEditTool(toolName)) return false;
+  return true;  // default
+}
+
+// ============================================================
+// 测试钩子
+// ============================================================
+
+export function _resetPermissionModeForTest(): void {
+  // 解析只读 env, 无内部状态, 保留 API 一致
+}