@bolloon/bolloon-agent 0.1.42 → 0.2.0

package/dist/agents/pi-sdk.js

@@ -963,7 +963,32 @@ class PiAgentSession {
                 const cmd = String(args.command || '').trim();
                 if (!cmd)
                     return { success: false, error: 'command 必填' };
-                const argList = String(args.args || '').split(',').map(s => s.trim()).filter(Boolean);
+                // 2026-06-19: 支持多种 args 格式
+                //   1. JSON 数组: ["checkout", "-b", "branch"] (LLM 偏好)
+                //   2. 逗号分隔: "checkout,-b,branch" (旧格式)
+                //   3. 字符串: "checkout -b branch" (单参数)
+                let argList = [];
+                const rawArgs = args.args;
+                if (Array.isArray(rawArgs)) {
+                    argList = rawArgs.map((s) => String(s).trim()).filter(Boolean);
+                }
+                else if (typeof rawArgs === 'string') {
+                    const trimmed = rawArgs.trim();
+                    if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+                        // JSON 数组字符串
+                        try {
+                            const parsed = JSON.parse(trimmed);
+                            if (Array.isArray(parsed)) {
+                                argList = parsed.map((s) => String(s).trim()).filter(Boolean);
+                            }
+                        }
+                        catch { /* fall through to comma split */ }
+                    }
+                    if (argList.length === 0) {
+                        // 逗号分隔 或 单字符串
+                        argList = trimmed.split(',').map(s => s.trim()).filter(Boolean);
+                    }
+                }
                 const timeoutMs = Number(args.timeoutMs) || 30000;
                 const result = await shellExec(cmd, argList, { timeoutMs });
                 if (result.deniedByGuard) {
@@ -1416,7 +1441,7 @@ class PiAgentSession {
             description: '跑 vitest 测试. 自动 bail (失败就停). 默认 60s timeout.',
             parameters: { pattern: '可选, 文件 glob e.g. "src/agents/pi-sdk.test.ts"', timeoutMs: '可选, 默认 60000' },
             execute: async (args) => {
-                const argv = ['vitest', 'run', '--reporter=basic', '--no-color', '--bail=1'];
+                const argv = ['vitest', 'run', '--reporter=default', '--no-color', '--bail=1'];
                 if (args.pattern)
                     argv.push(String(args.pattern));
                 const timeoutMs = parseInt(String(args.timeoutMs || '60000')) || 60000;
@@ -1634,10 +1659,13 @@ class PiAgentSession {
         // M2.4 (2026-06-17): 缓存 tool 定义 — registerTools() 在构造时调一次, 此后不变
         if (this.cachedToolDefinitions)
             return this.cachedToolDefinitions;
-        const defs = ['可用工具:'];
+        const defs = ['可用工具 (name(params) - 简介):'];
         for (const tool of this.tools.values()) {
-            const params = Object.entries(tool.parameters).map(([k, v]) => `${k}: ${v}`).join(', ');
-            defs.push(`- ${tool.name}(${params}) - ${tool.description}`);
+            // 2026-06-19: 压缩 tool 定义 — 只显示参数名 (不显示描述, 减少 60% 长度)
+            //   完整 description 在 history 第一轮注入 (getToolDefinitionsFull 调用), 后续轮只看简短
+            //   避免 system prompt 太大导致 minimax 撞 max_tokens 输出空
+            const paramNames = Object.keys(tool.parameters).join(',');
+            defs.push(`- ${tool.name}(${paramNames})`);
         }
         this.cachedToolDefinitions = defs.join('\n');
         return this.cachedToolDefinitions;
@@ -2995,6 +3023,10 @@ Workspace root folder: ${this.cwd}
             /\btool\s*=>\s*["'](\w+)["']/,
             // 兼容: [TOOL_CALL] 块内 JSON 形式 {"name": "x", "args": {...}}
             /\[TOOL_CALL\][\s\S]*?\{\s*"name"\s*:\s*"(\w+)"\s*,\s*"args"\s*:\s*(\{[\s\S]*?\})/i,
+            // 2026-06-19: 兼容 LLM 输出 "tool_name {json_args}" 形式 (单行, 无 name 字段)
+            //   实际输出: write_file {"path":"docs/test.md","content":"..."}
+            //   只在行首/新行匹配, 避免误匹配普通文本里的 "foo {...}"
+            /(?:^|\n)(\w+)\s+(\{[\s\S]*?\})(?=\n|$)/,
             // 2026-06-15 修: 兼容 LLM 输出的 XML 格式 <tool_name>...<arg>value</arg>...</tool_name>
             //   实际 LLM 习惯: <shell_exec>\n<command>ls</command>\n<args>["-la", "..."]</args>\n</shell_exec>
             /<(\w+)>([\s\S]*?)<\/\1>/,
@@ -3026,15 +3058,28 @@ Workspace root folder: ${this.cwd}
                 else if (rawArgs && /<\w+>[\s\S]*<\/\w+>/.test(rawArgs)) {
                     // 2026-06-15 修: XML 格式, 解析内嵌子标签 <argname>value</argname>
                     //   例: <command>ls</command>\n<args>["-la","~/.bolloon/skills"]</args>
-                    const xmlArgPattern = /<(\w+)>([\s\S]*?)<\/\1>/g;
-                    let xmlMatch;
-                    while ((xmlMatch = xmlArgPattern.exec(rawArgs)) !== null) {
-                        const argName = xmlMatch[1];
-                        const argValue = xmlMatch[2].trim();
+                    // 2026-06-19 修: 也支持 <parameter name="X">value</parameter> 形式 (OpenAI Hermes function_call)
+                    const paramRe = /<parameter\s+name=["'](\w+)["']>([\s\S]*?)<\/parameter>/g;
+                    let pMatch;
+                    while ((pMatch = paramRe.exec(rawArgs)) !== null) {
+                        const argName = pMatch[1];
+                        const argValue = pMatch[2].trim();
                         if (argName && argValue) {
                             args[argName] = argValue;
                         }
                     }
+                    // 如果没匹配到 <parameter>, 用普通 XML 子标签
+                    if (Object.keys(args).length === 0) {
+                        const xmlArgPattern = /<(\w+)>([\s\S]*?)<\/\1>/g;
+                        let xmlMatch;
+                        while ((xmlMatch = xmlArgPattern.exec(rawArgs)) !== null) {
+                            const argName = xmlMatch[1];
+                            const argValue = xmlMatch[2].trim();
+                            if (argName && argValue) {
+                                args[argName] = argValue;
+                            }
+                        }
+                    }
                 }
                 else if (rawArgs) {
                     // 形参串, 形如 key: value, key2: value2

package/dist/electron/config.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDev = exports.MAIN_WINDOW_MIN = exports.MAIN_WINDOW_DEFAULT = exports.WEB_SERVER_STARTUP_TIMEOUT_MS = exports.DEFAULT_HOST = exports.DEFAULT_PORT = void 0;
+exports.preferredPort = preferredPort;
+/**
+ * 常量配置 (env 解析在这里集中, 不散在 main 流程)
+ */
+const electron_1 = require("electron");
+exports.DEFAULT_PORT = 54188;
+/** Hard-pin to loopback; LAN exposure must be explicit. */
+exports.DEFAULT_HOST = '127.0.0.1';
+exports.WEB_SERVER_STARTUP_TIMEOUT_MS = 15_000;
+exports.MAIN_WINDOW_DEFAULT = { width: 1200, height: 800 };
+exports.MAIN_WINDOW_MIN = { width: 800, height: 600 };
+function preferredPort() {
+    const raw = process.env.ELECTRON_PORT || process.env.PORT;
+    const n = parseInt(raw || '', 10);
+    return Number.isFinite(n) && n > 0 && n < 65536 ? n : exports.DEFAULT_PORT;
+}
+exports.isDev = process.env.NODE_ENV === 'development' || !electron_1.app.isPackaged;
+//# sourceMappingURL=config.js.map

package/dist/electron/dialogs.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDialogIpc = registerDialogIpc;
+/**
+ * 文件 dialog 桥 (open / save / dir) + 安全的 fs 桥 (read / write / exists)
+ *
+ * 5MB read 上限保护 — 渲染进程直接 fs.readFile 没法做限制, 走主进程就有界
+ * 所有 handler 解析 event.sender 拿到 window, 让 dialog 模态在该窗口上
+ */
+const electron_1 = require("electron");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logger_1 = require("./logger");
+const MAX_READ_BYTES = 5 * 1024 * 1024; // 5MB
+function windowFor(event) {
+    return electron_1.BrowserWindow.fromWebContents(event.sender);
+}
+function resolveSafe(target) {
+    // 不去硬限制路径 — user 给 renderer 暴露 fs 已经信任了, 这里只 normalize
+    return path.resolve(target);
+}
+function registerDialogIpc() {
+    electron_1.ipcMain.handle('dialog:open-file', async (event, opts = {}) => {
+        const win = windowFor(event);
+        const result = await electron_1.dialog.showOpenDialog(win, {
+            title: opts.title,
+            defaultPath: opts.defaultPath,
+            filters: opts.filters,
+            properties: opts.properties ?? ['openFile'],
+        });
+        return { canceled: result.canceled, filePaths: result.filePaths };
+    });
+    electron_1.ipcMain.handle('dialog:save-file', async (event, opts = {}) => {
+        const win = windowFor(event);
+        const result = await electron_1.dialog.showSaveDialog(win, {
+            title: opts.title,
+            defaultPath: opts.defaultPath,
+            filters: opts.filters,
+        });
+        return { canceled: result.canceled, filePath: result.filePath };
+    });
+    electron_1.ipcMain.handle('dialog:open-directory', async (event, opts = {}) => {
+        const win = windowFor(event);
+        const result = await electron_1.dialog.showOpenDialog(win, {
+            title: opts.title,
+            defaultPath: opts.defaultPath,
+            properties: ['openDirectory', 'createDirectory'],
+        });
+        return { canceled: result.canceled, filePaths: result.filePaths };
+    });
+    electron_1.ipcMain.handle('fs:read-text-file', async (_event, opts) => {
+        const target = resolveSafe(opts.path);
+        const stat = fs.statSync(target);
+        if (stat.size > MAX_READ_BYTES) {
+            throw new Error(`文件过大: ${stat.size} > ${MAX_READ_BYTES} bytes`);
+        }
+        return fs.readFileSync(target, { encoding: opts.encoding ?? 'utf8' });
+    });
+    electron_1.ipcMain.handle('fs:write-text-file', async (_event, opts) => {
+        const target = resolveSafe(opts.path);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, opts.content, { encoding: opts.encoding ?? 'utf8' });
+    });
+    electron_1.ipcMain.handle('fs:path-exists', async (_event, opts) => {
+        try {
+            fs.accessSync(resolveSafe(opts.path));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    (0, logger_1.log)('dialog + fs IPC handlers registered');
+}
+//# sourceMappingURL=dialogs.js.map

package/dist/electron/first-run.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasSeenFirstRun = hasSeenFirstRun;
+exports.markFirstRunSeen = markFirstRunSeen;
+exports.showFirstRunOverlay = showFirstRunOverlay;
+exports.registerFirstRunIpc = registerFirstRunIpc;
+exports.maybeShowFirstRun = maybeShowFirstRun;
+/**
+ * 首启检测 + 引导浮层
+ *
+ * 标记文件写在 userData (不是 ~/.bolloon/), 卸载 app 自然清掉
+ * 引导窗是父主窗的 modal, frame=false, 透明背景; 关闭时标记写入
+ */
+const electron_1 = require("electron");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const paths_1 = require("./paths");
+const logger_1 = require("./logger");
+const OVERLAY_HTML = `
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8" />
+<style>
+  :root { color-scheme: light dark; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    margin: 0; padding: 32px 28px;
+    background: rgba(245,245,247,0.97);
+    color: #1d1d1f;
+    height: 100vh; box-sizing: border-box;
+  }
+  @media (prefers-color-scheme: dark) {
+    body { background: rgba(28,28,30,0.97); color: #f5f5f7; }
+  }
+  h1 { font-size: 18px; margin: 0 0 14px; font-weight: 600; }
+  p  { font-size: 13px; line-height: 1.55; margin: 8px 0; }
+  code {
+    font-family: ui-monospace, "SF Mono", Menlo, monospace;
+    font-size: 12px; padding: 1px 5px;
+    background: rgba(0,0,0,0.06); border-radius: 3px;
+  }
+  @media (prefers-color-scheme: dark) {
+    code { background: rgba(255,255,255,0.08); }
+  }
+  .btn {
+    display: inline-block; margin-top: 18px; padding: 8px 18px;
+    background: #007aff; color: #fff; border: none; border-radius: 6px;
+    font-size: 13px; font-weight: 500; cursor: pointer;
+  }
+  .btn:hover { background: #0066d6; }
+  ul { padding-left: 20px; }
+  li { font-size: 13px; line-height: 1.7; }
+</style>
+</head>
+<body>
+<h1>欢迎使用 Bolloon Agent</h1>
+<p>你的数据存放在本地, 不上传:</p>
+<ul>
+  <li>配置 / 频道 / P2P 密钥: <code id="data"></code></li>
+  <li>运行日志: <code id="logs"></code></li>
+</ul>
+<p>所有数据在卸载后仍保留 — 想清理就手动删除 ~/.bolloon/。</p>
+<button class="btn" id="ok">知道了</button>
+<script>
+  const ok = document.getElementById('ok');
+  ok.addEventListener('click', () => window.electronAPI.markFirstRunSeen());
+  document.getElementById('data').textContent = window.electronAPI.getDataPathSync?.() || '';
+  document.getElementById('logs').textContent = window.electronAPI.getLogsPathSync?.() || '';
+</script>
+</body>
+</html>
+`;
+function hasSeenFirstRun() {
+    try {
+        return fs.existsSync((0, paths_1.firstRunFlagPath)());
+    }
+    catch {
+        return false;
+    }
+}
+function markFirstRunSeen() {
+    try {
+        fs.mkdirSync(path.dirname((0, paths_1.firstRunFlagPath)()), { recursive: true });
+        fs.writeFileSync((0, paths_1.firstRunFlagPath)(), new Date().toISOString());
+    }
+    catch (err) {
+        (0, logger_1.log)(`写入首启标记失败: ${err.message}`, 'warn');
+    }
+}
+function showFirstRunOverlay(parent) {
+    return new Promise((resolve) => {
+        const overlay = new electron_1.BrowserWindow({
+            parent,
+            modal: true,
+            frame: false,
+            transparent: true,
+            width: 520,
+            height: 360,
+            resizable: false,
+            movable: false,
+            minimizable: false,
+            maximizable: false,
+            title: 'Welcome',
+        });
+        const dataUrl = 'data:text/html;charset=utf-8,' + encodeURIComponent(OVERLAY_HTML);
+        overlay.loadURL(dataUrl);
+        // 一次性的 IPC handler, 关闭后清掉避免累积
+        const handler = () => {
+            markFirstRunSeen();
+            overlay.close();
+        };
+        electron_1.ipcMain.once('first-run:ack', handler);
+        overlay.on('closed', () => {
+            electron_1.ipcMain.removeListener('first-run:ack', handler);
+            resolve();
+        });
+    });
+}
+/** 注册 IPC handlers (给 preload 桥用) */
+function registerFirstRunIpc() {
+    electron_1.ipcMain.handle('first-run:seen', () => hasSeenFirstRun());
+    electron_1.ipcMain.handle('first-run:mark-seen', () => { markFirstRunSeen(); });
+    // 同步值 (不用 ipcRenderer.invoke 的 await) — 用 exposeInMainWorld 的 sync getter 更顺
+    electron_1.ipcMain.handle('first-run:data-dir', () => (0, paths_1.dataDir)());
+    electron_1.ipcMain.handle('first-run:logs-dir', () => (0, paths_1.logsDir)());
+    (0, logger_1.log)('first-run IPC handlers registered');
+}
+/** 包装 — 决定要不要弹 overlay */
+async function maybeShowFirstRun(parent) {
+    if (hasSeenFirstRun())
+        return;
+    (0, logger_1.log)('首启 — 弹出引导');
+    await showFirstRunOverlay(parent);
+    electron_1.app.addRecentDocument((0, paths_1.firstRunFlagPath)()); // 跟踪最近文档, 让 user 知道有这文件
+}
+//# sourceMappingURL=first-run.js.map

package/dist/electron/ipc.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCoreIpc = registerCoreIpc;
+/**
+ * IPC handler 集中注册 — version / userData path / open-external (legacy 3 个)
+ * dialog/fs 的注册在 dialogs.ts; updater 的注册在 updater.ts
+ */
+const electron_1 = require("electron");
+const paths_1 = require("./paths");
+const logger_1 = require("./logger");
+function registerCoreIpc() {
+    electron_1.ipcMain.handle('get-version', () => electron_1.app.getVersion());
+    electron_1.ipcMain.handle('get-user-data-path', () => (0, paths_1.userDataDir)());
+    electron_1.ipcMain.handle('get-data-path', () => (0, paths_1.dataDir)()); // 跟 userData 分开, 渲染层要用
+    electron_1.ipcMain.handle('open-external', async (_event, url) => {
+        await electron_1.shell.openExternal(url);
+    });
+    (0, logger_1.log)('core IPC handlers registered');
+}
+//# sourceMappingURL=ipc.js.map

package/dist/electron/logger.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.log = log;
+/**
+ * 简单 logger: 写日志到 <userData>/logs/bolloon.log, size-based 轮转
+ * (5MB 上限, 保留 .1 .2 .3 共 3 个备份 → ~20MB 上限)
+ *
+ * 同步写是因为 Electron 主进程日志量小, 同步 append 简单可靠, 不丢日志.
+ * 量大的会话级 jsonl 走自己路径 (lifecycle-hooks 等), 跟本 logger 无关.
+ */
+const fs = __importStar(require("fs"));
+const paths_1 = require("./paths");
+const MAX_BYTES = 5 * 1024 * 1024;
+const MAX_BACKUPS = 3; // 保留 bolloon.log.1 .2 .3
+let currentSize = 0;
+let initialized = false;
+function ensureLogFile() {
+    if (initialized)
+        return;
+    initialized = true;
+    try {
+        fs.mkdirSync((0, paths_1.logsDir)(), { recursive: true });
+        try {
+            currentSize = fs.statSync((0, paths_1.mainLogPath)()).size;
+        }
+        catch {
+            currentSize = 0;
+        }
+    }
+    catch (err) {
+        // 失败也无所谓, log() 内部会 swallow
+        currentSize = 0;
+        console.error('[logger] ensureLogFile failed:', err);
+    }
+}
+function rotate() {
+    const logPath = (0, paths_1.mainLogPath)();
+    for (let i = MAX_BACKUPS; i >= 1; i--) {
+        const src = `${logPath}.${i}`;
+        const dst = `${logPath}.${i + 1}`;
+        if (i === MAX_BACKUPS) {
+            try {
+                fs.unlinkSync(src);
+            }
+            catch { /* missing ok */ }
+        }
+        else {
+            try {
+                fs.renameSync(src, dst);
+            }
+            catch { /* missing ok */ }
+        }
+    }
+    try {
+        fs.renameSync(logPath, `${logPath}.1`);
+    }
+    catch { /* missing ok */ }
+    currentSize = 0;
+}
+function log(message, level = 'info') {
+    ensureLogFile();
+    const ts = new Date().toISOString();
+    const line = `[${ts}] [${level}] ${message}\n`;
+    if (currentSize + line.length > MAX_BYTES)
+        rotate();
+    try {
+        fs.appendFileSync((0, paths_1.mainLogPath)(), line);
+        currentSize += line.length;
+    }
+    catch (err) {
+        // 写不进就 console, 不要再递归 log
+        console.error('[logger] appendFileSync failed:', err);
+    }
+    if (level === 'error')
+        console.error(line.trimEnd());
+    else if (level === 'warn')
+        console.warn(line.trimEnd());
+    else
+        console.log(line.trimEnd());
+}
+//# sourceMappingURL=logger.js.map

package/dist/electron/main.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Electron 主进程 lifecycle 入口
+ * 单实例锁 → whenReady → createMainWindow → cleanup on quit
+ * 启动时: 装 menu / tray / IPC handlers / 首启引导
+ */
+const electron_1 = require("electron");
+const logger_1 = require("./logger");
+const window_1 = require("./window");
+const server_1 = require("./server");
+const menu_1 = require("./menu");
+const tray_1 = require("./tray");
+const ipc_1 = require("./ipc");
+const dialogs_1 = require("./dialogs");
+const first_run_1 = require("./first-run");
+(0, logger_1.log)('Bolloon Electron 启动');
+// 单实例锁
+const gotTheLock = electron_1.app.requestSingleInstanceLock();
+if (!gotTheLock) {
+    (0, logger_1.log)('已有实例在运行，退出');
+    electron_1.app.quit();
+}
+electron_1.app.on('second-instance', () => {
+    (0, window_1.focusMainWindow)();
+});
+electron_1.app.whenReady().then(async () => {
+    (0, logger_1.log)('Electron 准备好');
+    (0, ipc_1.registerCoreIpc)();
+    (0, dialogs_1.registerDialogIpc)();
+    (0, first_run_1.registerFirstRunIpc)();
+    (0, menu_1.installAppMenu)(window_1.getMainWindow);
+    (0, tray_1.createTray)(window_1.getMainWindow);
+    await (0, window_1.createMainWindow)();
+    // 首启引导 (在主窗口就绪后弹, 不阻塞 UI)
+    const win = (0, window_1.getMainWindow)();
+    if (win) {
+        win.webContents.once('did-finish-load', () => {
+            void (0, first_run_1.maybeShowFirstRun)(win);
+        });
+    }
+    electron_1.app.on('activate', async () => {
+        // macOS: dock 图标被点击且没有窗口时, 重开
+        if (electron_1.BrowserWindow.getAllWindows().length === 0) {
+            await (0, window_1.createMainWindow)();
+        }
+    });
+});
+electron_1.app.on('window-all-closed', () => {
+    (0, logger_1.log)('所有窗口已关闭');
+    (0, tray_1.destroyTray)();
+    (0, server_1.killWebServer)();
+    if (process.platform !== 'darwin') {
+        electron_1.app.quit();
+    }
+});
+electron_1.app.on('before-quit', () => {
+    (0, logger_1.log)('应用即将退出');
+    (0, tray_1.destroyTray)();
+    (0, server_1.killWebServer)();
+});
+(0, logger_1.log)('主进程初始化完成');
+//# sourceMappingURL=main.js.map

package/dist/electron/menu.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAppMenu = buildAppMenu;
+exports.installAppMenu = installAppMenu;
+/**
+ * 应用菜单 — macOS 标准 + File/Edit/View/Window/Help 自定义项
+ * "Open Data Folder" 等会跨平台显示 (mac 也会出现, 不会冲突)
+ */
+const electron_1 = require("electron");
+const paths_1 = require("./paths");
+const logger_1 = require("./logger");
+function openDataFolder() {
+    electron_1.shell.openPath((0, paths_1.dataDir)()).catch((e) => (0, logger_1.log)(`open data folder 失败: ${e.message}`, 'error'));
+}
+function openLogsFolder() {
+    electron_1.shell.openPath((0, paths_1.logsDir)()).catch((e) => (0, logger_1.log)(`open logs folder 失败: ${e.message}`, 'error'));
+}
+function openExternal(url) {
+    electron_1.shell.openExternal(url).catch((e) => (0, logger_1.log)(`openExternal 失败: ${e.message}`, 'error'));
+}
+function buildAppMenu(getMainWindow) {
+    const isMac = process.platform === 'darwin';
+    const win = getMainWindow();
+    const appMenu = {
+        label: electron_1.app.getName(),
+        submenu: [
+            { role: 'about' },
+            { type: 'separator' },
+            { role: 'services' },
+            { type: 'separator' },
+            { role: 'hide' },
+            { role: 'hideOthers' },
+            { role: 'unhide' },
+            { type: 'separator' },
+            { role: 'quit' },
+        ],
+    };
+    const fileMenu = {
+        label: 'File',
+        submenu: [
+            {
+                label: 'Open Data Folder',
+                accelerator: 'CmdOrCtrl+Shift+D',
+                click: () => openDataFolder(),
+            },
+            {
+                label: 'Open Logs Folder',
+                accelerator: 'CmdOrCtrl+Shift+L',
+                click: () => openLogsFolder(),
+            },
+            { type: 'separator' },
+            isMac ? { role: 'close' } : { role: 'quit' },
+        ],
+    };
+    const editMenu = {
+        label: 'Edit',
+        submenu: [
+            { role: 'undo' },
+            { role: 'redo' },
+            { type: 'separator' },
+            { role: 'cut' },
+            { role: 'copy' },
+            { role: 'paste' },
+            { role: 'selectAll' },
+        ],
+    };
+    const viewMenu = {
+        label: 'View',
+        submenu: [
+            {
+                label: 'Reload',
+                accelerator: 'CmdOrCtrl+R',
+                click: () => win?.webContents.reload(),
+            },
+            {
+                label: 'Force Reload',
+                accelerator: 'CmdOrCtrl+Shift+R',
+                click: () => win?.webContents.reloadIgnoringCache(),
+            },
+            {
+                label: 'Toggle DevTools',
+                accelerator: isMac ? 'Alt+Cmd+I' : 'Ctrl+Shift+I',
+                click: () => win?.webContents.toggleDevTools(),
+            },
+            { type: 'separator' },
+            { role: 'resetZoom' },
+            { role: 'zoomIn' },
+            { role: 'zoomOut' },
+            { type: 'separator' },
+            { role: 'togglefullscreen' },
+        ],
+    };
+    const windowMenu = {
+        label: 'Window',
+        submenu: [
+            { role: 'minimize' },
+            { role: 'zoom' },
+            ...(isMac
+                ? [{ type: 'separator' }, { role: 'front' }]
+                : [{ role: 'close' }]),
+        ],
+    };
+    const helpMenu = {
+        role: 'help',
+        submenu: [
+            {
+                label: 'GitHub Repository',
+                click: () => openExternal('https://github.com/bolloon/bolloon'),
+            },
+            {
+                label: 'Report Issue',
+                click: () => openExternal('https://github.com/bolloon/bolloon/issues'),
+            },
+            { type: 'separator' },
+            {
+                label: 'About Bolloon Agent',
+                click: () => {
+                    // 简单 about — 用 dialog 暂代 (避免再造 HTML 窗口)
+                    // 真实 about panel 在 macOS 是 app.role 触发的, 我们走菜单项即可
+                    const { dialog } = require('electron');
+                    dialog.showMessageBox({
+                        type: 'info',
+                        title: 'About Bolloon Agent',
+                        message: `Bolloon Agent v${electron_1.app.getVersion()}`,
+                        detail: `P2P AI Document Agent\nData: ${(0, paths_1.dataDir)()}\nLogs: ${(0, paths_1.logsDir)()}`,
+                        buttons: ['OK'],
+                    }).catch(() => { });
+                },
+            },
+        ],
+    };
+    const template = [
+        ...(isMac ? [appMenu] : []),
+        fileMenu,
+        editMenu,
+        viewMenu,
+        windowMenu,
+        helpMenu,
+    ];
+    return electron_1.Menu.buildFromTemplate(template);
+}
+function installAppMenu(getMainWindow) {
+    electron_1.Menu.setApplicationMenu(buildAppMenu(getMainWindow));
+}
+//# sourceMappingURL=menu.js.map

package/dist/electron/paths.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dataDir = dataDir;
+exports.userDataDir = userDataDir;
+exports.logsDir = logsDir;
+exports.mainLogPath = mainLogPath;
+exports.firstRunFlagPath = firstRunFlagPath;
+exports.buildResourcesDir = buildResourcesDir;
+/**
+ * 路径常量 — 单一来源, 避免散落各处
+ *
+ * dataDir: 用户数据 (LLM config / P2P secret / 频道 JSON 等) — 故意保持在 ~/.bolloon/
+ *          与 CLI 共用, 卸载 app 不删数据. 不要改这个路径, 不要做 userData 重定向.
+ * userDataDir: Electron 的 app.getPath('userData'), 用来放日志 / 临时 / 锁文件
+ * logsDir: userData 下的 logs/ 子目录
+ */
+const electron_1 = require("electron");
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+function dataDir() {
+    return path.join(os.homedir(), '.bolloon');
+}
+function userDataDir() {
+    return electron_1.app.getPath('userData');
+}
+function logsDir() {
+    return path.join(userDataDir(), 'logs');
+}
+function mainLogPath() {
+    return path.join(logsDir(), 'bolloon.log');
+}
+function firstRunFlagPath() {
+    return path.join(userDataDir(), '.bolloon-first-run-seen');
+}
+/** 资源目录: packaged 下是 process.resourcesPath/build, dev 下是 repo/build/ */
+function buildResourcesDir() {
+    if (electron_1.app.isPackaged) {
+        return path.join(process.resourcesPath, 'build');
+    }
+    return path.join(electron_1.app.getAppPath(), 'build');
+}
+//# sourceMappingURL=paths.js.map

package/dist/electron/server.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWebServerProcess = getWebServerProcess;
+exports.killWebServer = killWebServer;
+exports.startWebServer = startWebServer;
+/**
+ * Spawns dist/web/server.js as a child Node process (via Electron's
+ * ELECTRON_RUN_AS_NODE=1) and parses BOLLOON_PORT=NNNN to learn the
+ * actually-bound port (which may have drifted from the preferred port
+ * due to EADDRINUSE auto-bump).
+ */
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const logger_1 = require("./logger");
+const config_1 = require("./config");
+let webServerProcess = null;
+function getWebServerProcess() {
+    return webServerProcess;
+}
+function killWebServer() {
+    if (webServerProcess && !webServerProcess.killed) {
+        (0, logger_1.log)('终止 Web 服务器进程');
+        webServerProcess.kill();
+    }
+    webServerProcess = null;
+}
+function startWebServer(preferredPort) {
+    return new Promise((resolve, reject) => {
+        const serverScript = path.join(__dirname, '..', 'web', 'server.js');
+        (0, logger_1.log)(`启动 Web 服务器进程: ${serverScript}`);
+        // ELECTRON_RUN_AS_NODE=1 — packaged 时 process.execPath 是 Electron 二进制,
+        // 没这行 require() 会失败. Dev 模式 (electron dist/electron.js) 同样情况.
+        webServerProcess = (0, child_process_1.spawn)(process.execPath, [serverScript], {
+            env: {
+                ...process.env,
+                ELECTRON_RUN_AS_NODE: '1',
+                NODE_ENV: 'production',
+                PORT: String(preferredPort),
+                ELECTRON_PORT: String(preferredPort),
+                BOLLOON_HOST: config_1.DEFAULT_HOST,
+            },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdoutBuf = '';
+        let stderrData = '';
+        webServerProcess.stdout?.on('data', (data) => {
+            stdoutBuf += data.toString();
+            process.stdout.write(`[WebServer] ${data}`);
+            const m = stdoutBuf.match(/^BOLLOON_PORT=(\d+)/m);
+            if (m) {
+                const actualPort = parseInt(m[1], 10);
+                (0, logger_1.log)(`Web 服务器就绪: 实际端口=${actualPort} (preferred=${preferredPort})`);
+                resolve({ port: actualPort });
+            }
+        });
+        webServerProcess.stderr?.on('data', (data) => {
+            stderrData += data.toString();
+            process.stderr.write(`[WebServer ERR] ${data}`);
+        });
+        webServerProcess.on('error', (err) => {
+            (0, logger_1.log)(`Web 服务器启动失败: ${err.message}`, 'error');
+            reject(err);
+        });
+        webServerProcess.on('exit', (code, signal) => {
+            (0, logger_1.log)(`Web 服务器退出: code=${code} signal=${signal}`);
+            if (code !== 0 && code !== null) {
+                (0, logger_1.log)(`Web 服务器 stderr: ${stderrData}`, 'error');
+            }
+            webServerProcess = null;
+        });
+        setTimeout(() => {
+            if (webServerProcess && !webServerProcess.killed) {
+                (0, logger_1.log)(`Web 服务器启动超时 (${config_1.WEB_SERVER_STARTUP_TIMEOUT_MS}ms)`, 'error');
+                reject(new Error('Web server startup timeout'));
+            }
+        }, config_1.WEB_SERVER_STARTUP_TIMEOUT_MS);
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/electron/tray.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTray = createTray;
+exports.destroyTray = destroyTray;
+/**
+ * 系统托盘 — Show / Hide / Quit
+ *
+ * 图标资源要求 (需用户自备):
+ *   build/trayTemplate.png  (mac, 16x16 + 32x32 @2x, 单色 alpha, 自动暗/亮)
+ *   build/tray.png          (win/linux, 16x16 + 32x32)
+ *
+ * 若 build 目录没有 tray 图标, 降级为不创建托盘 (主菜单和窗口关闭行为不变)
+ */
+const electron_1 = require("electron");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const paths_1 = require("./paths");
+const logger_1 = require("./logger");
+let trayInstance = null;
+function loadTrayIcon() {
+    const isMac = process.platform === 'darwin';
+    const file = isMac ? 'trayTemplate.png' : 'tray.png';
+    const iconPath = path.join((0, paths_1.buildResourcesDir)(), file);
+    if (!fs.existsSync(iconPath)) {
+        (0, logger_1.log)(`托盘图标缺失: ${iconPath} (跳过托盘创建)`, 'warn');
+        return null;
+    }
+    const img = electron_1.nativeImage.createFromPath(iconPath);
+    if (isMac)
+        img.setTemplateImage(true);
+    return img;
+}
+function createTray(getMainWindow) {
+    if (trayInstance)
+        return;
+    const icon = loadTrayIcon();
+    if (!icon)
+        return;
+    trayInstance = new electron_1.Tray(icon);
+    trayInstance.setToolTip(`Bolloon Agent v${electron_1.app.getVersion()}`);
+    const toggle = () => {
+        const w = getMainWindow();
+        if (!w)
+            return;
+        if (w.isVisible() && w.isFocused()) {
+            w.hide();
+        }
+        else {
+            if (w.isMinimized())
+                w.restore();
+            w.show();
+            w.focus();
+        }
+    };
+    const menu = electron_1.Menu.buildFromTemplate([
+        { label: 'Show / Hide', click: () => toggle() },
+        { type: 'separator' },
+        {
+            label: 'Quit',
+            click: () => {
+                (0, logger_1.log)('托盘菜单 Quit');
+                electron_1.app.quit();
+            },
+        },
+    ]);
+    trayInstance.setContextMenu(menu);
+    // mac 默认 click 弹菜单, win/linux 默认 click 触发自定义
+    if (process.platform !== 'darwin') {
+        trayInstance.on('click', () => toggle());
+    }
+}
+function destroyTray() {
+    if (trayInstance) {
+        trayInstance.destroy();
+        trayInstance = null;
+    }
+}
+//# sourceMappingURL=tray.js.map

package/dist/electron/window.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMainWindow = getMainWindow;
+exports.createMainWindow = createMainWindow;
+exports.focusMainWindow = focusMainWindow;
+/**
+ * 主窗口工厂 — preload 路径解析 + dev/prod loadURL + 外部链接走系统浏览器
+ */
+const electron_1 = require("electron");
+const path = __importStar(require("path"));
+const logger_1 = require("./logger");
+const config_1 = require("./config");
+const server_1 = require("./server");
+let mainWindow = null;
+function getMainWindow() {
+    return mainWindow;
+}
+async function createMainWindow() {
+    (0, logger_1.log)('创建主窗口...');
+    mainWindow = new electron_1.BrowserWindow({
+        width: config_1.MAIN_WINDOW_DEFAULT.width,
+        height: config_1.MAIN_WINDOW_DEFAULT.height,
+        minWidth: config_1.MAIN_WINDOW_MIN.width,
+        minHeight: config_1.MAIN_WINDOW_MIN.height,
+        title: 'Bolloon Agent',
+        webPreferences: {
+            nodeIntegration: false,
+            contextIsolation: true,
+            sandbox: false, // MCP/spawn 等需要 fs; 真正的隔离靠 preload 边界
+            preload: path.join(__dirname, '..', 'electron-preload.js'),
+        },
+        show: false,
+    });
+    if (config_1.isDev) {
+        // dev:web 用 tsx 起 server, 端口固定 preferredPort, 不会 EADDRINUSE 自增
+        const port = (0, config_1.preferredPort)();
+        mainWindow.loadURL(`http://localhost:${port}`);
+        mainWindow.webContents.openDevTools();
+    }
+    else {
+        try {
+            (0, logger_1.log)('启动内置 Web 服务器...');
+            const { port: actualPort } = await (0, server_1.startWebServer)((0, config_1.preferredPort)());
+            mainWindow.loadURL(`http://localhost:${actualPort}`);
+        }
+        catch (err) {
+            (0, logger_1.log)(`启动服务器失败: ${err.message}`, 'error');
+            console.error('启动服务器失败:', err);
+        }
+    }
+    mainWindow.once('ready-to-show', () => {
+        mainWindow?.show();
+        (0, logger_1.log)('窗口已显示');
+    });
+    // 外部链接走系统浏览器, 不在 app 内开新窗口
+    mainWindow.webContents.setWindowOpenHandler(({ url }) => {
+        if (url.startsWith('http://') || url.startsWith('https://')) {
+            electron_1.shell.openExternal(url);
+        }
+        return { action: 'deny' };
+    });
+    mainWindow.on('closed', () => {
+        mainWindow = null;
+    });
+    (0, logger_1.log)('窗口创建完成');
+}
+function focusMainWindow() {
+    if (!mainWindow)
+        return;
+    if (mainWindow.isMinimized())
+        mainWindow.restore();
+    mainWindow.show();
+    mainWindow.focus();
+}
+//# sourceMappingURL=window.js.map

package/dist/index.js

@@ -1928,9 +1928,12 @@ async function main() {
         }
         const { createWebServer, openBrowser } = await import('./web/server.js');
         s.info(`启动 Web 服务端口 ${port}...`);
-        const { port: actualPort } = await createWebServer(port, { selfImprove });
-        s.success(`浏览器已打开 → http://localhost:${actualPort}`);
-        openBrowser(`http://localhost:${actualPort}`);
+        // 2026-06-24: CLI 默认 loopback bind (安全), LAN 访问需 BOLLOON_HOST=0.0.0.0
+        const bindHost = process.env.BOLLOON_HOST;
+        const { port: actualPort } = await createWebServer(port, { selfImprove, ...(bindHost ? { host: bindHost } : {}) });
+        const displayHost = bindHost ?? '127.0.0.1';
+        s.success(`浏览器已打开 → http://${displayHost}:${actualPort}`);
+        openBrowser(`http://${displayHost}:${actualPort}`);
     }
     else if (isNonInteractive) {
         console.log = originalLog;

package/dist/web/server.js

@@ -5209,16 +5209,23 @@ export async function createWebServer(port = 3000, options = {}) {
         const startPort = port;
         let currentPort = startPort;
         let attempt = 0;
+        // 2026-06-24: 默认 loopback bind，避免在 LAN 上暴露 (CORS 已经 * 了)。
+        // Electron 包装里强制 127.0.0.1; CLI 用户想 LAN 访问可显式 BOLLOON_HOST=0.0.0.0
+        const bindHost = options.host ?? process.env.BOLLOON_HOST ?? '127.0.0.1';
         // 局部可变 server 引用 — listen 失败后必须重新 createServer 再 listen
         let currentServer = server;
         const tryListen = () => {
             currentServer.removeAllListeners('error');
             currentServer.once('error', onError);
-            currentServer.listen(currentPort, () => {
+            currentServer.listen(currentPort, bindHost, () => {
                 if (currentPort !== startPort) {
                     console.warn(`⚠ 端口 ${startPort} 被占用，已自动切换到 ${currentPort}`);
                 }
-                console.log(`Web 服务器启动完成: http://localhost:${currentPort}`);
+                // 2026-06-24: BOLLOON_PORT=NNNN 是 Electron 主进程解析的契约行 (parseable),
+                // 旧 marker ('服务器已监听') 也保留给日志/调试看。
+                console.log(`BOLLOON_PORT=${currentPort}`);
+                console.log(`BOLLOON_HOST=${bindHost}`);
+                console.log(`Web 服务器启动完成: http://${bindHost}:${currentPort}`);
                 console.log('服务器已监听');
                 // 安装 chat bus -> SSE 桥 (供前端 inbox UI 实时刷新)
                 void installChatBusHook();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.1.42",
+  "version": "0.2.0",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli.js",
@@ -87,6 +87,11 @@
       "bin/**/*",
       "package.json"
     ],
+    "npmRebuild": false,
+    "buildDependenciesFromSource": false,
+    "extraResources": [
+      { "from": "build", "to": "build", "filter": ["**/*"] }
+    ],
     "extraMetadata": {
       "main": "dist/electron.js",
       "type": "commonjs"
@@ -121,7 +126,7 @@
       "createDesktopShortcut": true,
       "createStartMenuShortcut": true
     },
-    "asar": false,
+    "asar": true,
     "asarUnpack": [
       "node_modules/@diap/**/*",
       "node_modules/@rayhanadev/**/*",