@bolloon/bolloon-agent 0.3.39 → 0.3.41

package/dist/bootstrap/bootstrap.js

@@ -10,7 +10,7 @@
  */
 import { runAdaptiveScan, logEvolution } from '../pi-ecosystem-judgment/adaptive-scan.js';
 import { collectBolloonContext } from './context-collector.js';
-import { migrateAllExternalAgents, formatMigrationNotices } from '../migration/external-agent-migrator.js';
+import { migrateAllExternalAgents, defaultDeps, formatMigrationNotices } from '../migration/external-agent-migrator.js';
 /**
  * 入口: web server / CLI 启动时调一次
  */
@@ -20,7 +20,12 @@ export async function bootstrapBolloon(opts = {}) {
     // 0. 外部智能体 (openclaw/hermes) 数据迁移 — 隐式处理, 静默跑, 结果通告用户
     let externalAgentMigrations = [];
     try {
-        externalAgentMigrations = await migrateAllExternalAgents();
+        const depsM = defaultDeps();
+        if (opts.home)
+            depsM.home = opts.home;
+        if (opts.localAppData)
+            depsM.localAppData = opts.localAppData;
+        externalAgentMigrations = await migrateAllExternalAgents(depsM);
         for (const line of formatMigrationNotices(externalAgentMigrations)) {
             console.log(`[bootstrap] ${line}`);
         }

package/dist/migration/external-agent-migrator.js

@@ -9,16 +9,12 @@
  *     这样 Bolloon 能直接加载同一套性格 / 记忆 / 技能, 无缝兼容.
  *   - 隐式处理: 启动时静默跑, 失败不影响主流程; 完成后通告给用户 (见 report).
  *
- * 源 → 目标映射 (OpenClaw workspace 布局):
- *   - workspace/SOUL.md      → persona/<agent>/soul.md
- *   - workspace/IDENTITY.md  → persona/<agent>/identity.md
- *   - workspace/USER.md      → persona/<agent>/user.md
- *   - workspace/AGENTS.md    → persona/<agent>/agent.md
- *   - workspace/TOOLS.md     → persona/<agent>/project.md
- *   - workspace/MEMORY.md    → persona/<agent>/wiki.md
- *   - workspace/skills/<name>/SKILL.md → ~/.bolloon/skills/<name>/ (整目录复制)
- *   - workspace/memory/*.md  → ~/.bolloon/memory/<agent>/sessions/<n>.summary.md
- *   - workspace/*.md (其它)  → ~/.bolloon/context-os/04-Projects/<agent>-docs/
+ * 异构布局 (2026-08-08 v0.3.40):
+ *   - OpenClaw 平铺在 ~/.openclaw/workspace/ (SOUL/IDENTITY/USER/AGENTS/TOOLS/MEMORY.md +
+ *     skills/<name>/ + memory/*.md)
+ *   - Hermes 根在 %LOCALAPPDATA%\hermes (Windows, 兜底 ~/.hermes), persona 分布在
+ *     SOUL.md(根) + memories/{USER,MEMORY}.md, skills 是 skills/<分类>/<技能>/SKILL.md
+ *     两级嵌套 (235 个). 迁移时展平并以 <分类>-<技能> 命名避免重名冲突.
  *
  * 幂等: 每个源落一份 manifest (~/.bolloon/migration/<source>.json),
  *   记录已迁移的文件 hash; 未变化则跳过, 已存在则覆盖源文档 (文档允许演进),
@@ -49,8 +45,13 @@ function realExists(p) {
     return fs.access(p).then(() => true).catch(() => false);
 }
 export function defaultDeps() {
+    const home = os.homedir();
     return {
-        home: os.homedir(),
+        home,
+        platform: os.platform(),
+        localAppData: (typeof process !== 'undefined' && process.env && (process.env.LOCALAPPDATA || process.env.ProgramData))
+            ? (process.env.LOCALAPPDATA || process.env.ProgramData)
+            : path.join(home, 'AppData', 'Local'),
         readFile: realReadFile,
         readdir: realReaddir,
         stat: realStat,
@@ -63,13 +64,47 @@ export function defaultDeps() {
 // ============================================================
 // 纯函数: 目录布局 + hash
 // ============================================================
-/** 各源的根目录 (相对 home) */
+/** 各源默认根目录: openclaw 在 home/.openclaw; hermes 兜底 home/.hermes (真实见 candidates) */
 export function sourceRootPath(source, home) {
     return source === 'openclaw'
         ? path.join(home, '.openclaw')
         : path.join(home, '.hermes');
 }
-/** workspace 路径 (openclaw 用 workspace/, hermes 假设平铺在根) */
+/**
+ * 各源全部候选根路径 (按优先级, 遍历时取第一个存在者).
+ *
+ * 覆盖三大平台的实际安装位置:
+ *   OpenClaw: 主目录 ~/.openclaw (三平台一致), 兜底 ~/.config/openclaw
+ *   Hermes :
+ *     - win32   %LOCALAPPDATA%\hermes  → ~/.hermes
+ *     - darwin  ~/Library/Application Support/hermes  → ~/.hermes
+ *     - linux   ~/.local/share/hermes  → ~/.config/hermes  → ~/.hermes
+ */
+export function sourceRootCandidates(source, deps) {
+    const home = deps.home;
+    const platform = deps.platform || 'linux';
+    if (source === 'openclaw') {
+        return [
+            path.join(home, '.openclaw'),
+            path.join(home, '.config', 'openclaw'),
+        ];
+    }
+    const candidates = [];
+    if (platform === 'win32') {
+        if (deps.localAppData)
+            candidates.push(path.join(deps.localAppData, 'hermes'));
+    }
+    else if (platform === 'darwin') {
+        candidates.push(path.join(home, 'Library', 'Application Support', 'hermes'));
+    }
+    else {
+        candidates.push(path.join(home, '.local', 'share', 'hermes'));
+        candidates.push(path.join(home, '.config', 'hermes'));
+    }
+    candidates.push(path.join(home, '.hermes'));
+    return candidates;
+}
+/** workspace 路径 (openclaw 用 workspace/, hermes 平铺在根) */
 export function workspacePath(source, sourceRoot) {
     return source === 'openclaw'
         ? path.join(sourceRoot, 'workspace')
@@ -79,6 +114,36 @@ export function workspacePath(source, sourceRoot) {
 export function sha1(content) {
     return crypto.createHash('sha1').update(content).digest('hex');
 }
+/**
+ * 内容级脱敏: 抹掉明敏凭据, 防止迁移产物把真实的 Bearer token / API key /
+ * MT5 会话标识 / 长随机串 带进 Bolloon 落盘. 迁移只搬运"知识", 不搬运"秘密".
+ *
+ * 处理模式:
+ *   - Authorization / Bearer <token>
+ *   - token: / api_key: / access_token: / secret: 等 key 声明后的随机串
+ *   - 形如 sk-... / ghp_... / AKIA... 的 platform token
+ *   - 一行冒号后跟 20+ 位 base64/hex 随机串 ("MT5 data: D0E8...", "token: Ab...")
+ *
+ * 保留中文句子与结构说明, 只替换被判定为凭据的 token 片段.
+ */
+export function redactSecrets(text) {
+    const REDACTED = '***REDACTED***';
+    let out = text;
+    // 0. Bearer <JWT/base64> / Authorization: Bearer ... — 最优先, 连同包头一起抹
+    out = out.replace(/\bBearer\s+[A-Za-z0-9_./\-=+]{12,}/gi, REDACTED);
+    out = out.replace(/\bAuthorization\s*[:=]\s*(?:Bearer\s+)?[A-Za-z0-9_./\-=+]{12,}/gi, REDACTED);
+    // 1. explicit key=value 声明 (token/apiKey/access_token/key/secret/password)
+    out = out.replace(/\b(token|api[_-]?key|access[_-]?token|secret|password)\b\s*[:=]\s*["']?[A-Za-z0-9_./+\-]{8,}["']?/gi, (_m, k) => `${k}: ${REDACTED}`);
+    // 2. platform 前缀 token (sk- / sk-proj- / sk-ant- / ghp_ / AKIA / xoxb-)
+    out = out.replace(/\b(sk-[A-Za-z0-9_]{8,}|sk-proj-[A-Za-z0-9_-]{8,}|sk-ant-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[bp]-[A-Za-z0-9-]{8,})\b/g, REDACTED);
+    // 3. "标签: <20+位随机串>" 结构 — 冒号后跟长的 alnum token (MT5 data: D0E8...).
+    //    保守: 只匹配不含 `/`(避开 URL/路径) 且不含域名点 的纯 token 骨架.
+    out = out.replace(/([A-Za-z][A-Za-z0-9 _-]{0,20})\s*[:：]\s*([A-Za-z0-9_+\-]{20,})\b(?![A-Za-z0-9])/g, (_m, name) => `${name}: ${REDACTED}`);
+    // 4. 宽松: 独立长串 24+ (base64) — 前后为空白/标点/行首行尾, 避开 URL 与中文段.
+    //    保守: 不含 `/` 与 `.`, 防误伤 URL/域名/路径.
+    out = out.replace(/(^|[\s(（[:：\]）])[A-Za-z0-9_+=]{22,}(?=[\s)）\].,，。；;:：§]|$)/gm, (_m, prefix) => `${prefix}${REDACTED}`);
+    return out;
+}
 /** bolloon 目标根 (默认 ~/.bolloon, 可注入 override) */
 function bolloonRoot(home) {
     return path.join(home, '.bolloon');
@@ -86,15 +151,16 @@ function bolloonRoot(home) {
 // ============================================================
 // 单文件迁移 helper
 // ============================================================
-async function copyIfNeeded(deps, from, to, manifest) {
+async function copyIfNeeded(deps, from, to, manifest, redact = false) {
     const content = await deps.readFile(from);
     if (content === undefined)
         return false;
-    const hash = sha1(content);
+    const contentOut = redact ? redactSecrets(content) : content;
+    const hash = sha1(contentOut);
     if (manifest.get(to) === hash)
         return false; // 未变化, 跳过
     await deps.mkdir(path.dirname(to));
-    await deps.writeFile(to, content);
+    await deps.writeFile(to, contentOut);
     manifest.set(to, hash);
     return true;
 }
@@ -122,14 +188,28 @@ async function copyDirIfNeeded(deps, srcDir, destDir, manifest) {
 // ============================================================
 // 主迁移
 // ============================================================
-/** 探测某个源是否安装 (根目录存在) */
+/** 探测某源是否安装: 返回选中的根目录 or null. */
 export async function detectSource(deps, source) {
-    const root = sourceRootPath(source, deps.home);
-    const st = await deps.stat(root);
-    if (st?.isDirectory)
-        return root;
+    for (const root of sourceRootCandidates(source, deps)) {
+        const st = await deps.stat(root);
+        if (st?.isDirectory)
+            return root;
+    }
     return null;
 }
+const OPENCLAW_PERSONA = [
+    { src: 'SOUL.md', toName: 'soul.md' },
+    { src: 'IDENTITY.md', toName: 'identity.md' },
+    { src: 'USER.md', toName: 'user.md' },
+    { src: 'AGENTS.md', toName: 'agent.md' },
+    { src: 'TOOLS.md', toName: 'project.md' },
+    { src: 'MEMORY.md', toName: 'wiki.md' },
+];
+const HERMES_PERSONA = [
+    { src: 'SOUL.md', toName: 'soul.md' },
+    { src: 'memories/USER.md', toName: 'user.md' },
+    { src: 'memories/MEMORY.md', toName: 'wiki.md' },
+];
 /**
  * 迁移单个源的全部数据到 Bolloon.
  * 返回 report; 源不存在 → migrated=false 且不抛错 (静默).
@@ -154,6 +234,7 @@ export async function migrateExternalAgent(source, deps = defaultDeps()) {
             report.migrated = false;
             return report; // 未安装, 静默
         }
+        report.sourceRoot = root;
         const ws = workspacePath(source, root);
         const wsStat = await deps.stat(ws);
         if (!wsStat?.isDirectory) {
@@ -185,43 +266,67 @@ export async function migrateExternalAgent(source, deps = defaultDeps()) {
             catch { /* 损坏忽略, 从头迁 */ }
         }
         await deps.mkdir(path.join(bRoot, 'migration'));
-        // 1. persona 6 文件映射
-        const personaMap = [
-            ['SOUL.md', 'soul.md'],
-            ['IDENTITY.md', 'identity.md'],
-            ['USER.md', 'user.md'],
-            ['AGENTS.md', 'agent.md'],
-            ['TOOLS.md', 'project.md'],
-            ['MEMORY.md', 'wiki.md'],
-        ];
-        for (const [fromName, toName] of personaMap) {
-            const from = path.join(ws, fromName);
+        // 1. persona (per-source spec) — 含敏感 token, 内容级脱敏后写入
+        const personaSpec = source === 'openclaw' ? OPENCLAW_PERSONA : HERMES_PERSONA;
+        for (const { src, toName } of personaSpec) {
+            const from = path.join(ws, src);
             const to = path.join(personaDir, toName);
-            if (await copyIfNeeded(deps, from, to, manifest)) {
+            if (await copyIfNeeded(deps, from, to, manifest, true)) {
                 report.persona.push(toName);
                 report.entries.push({ from, to, kind: 'persona' });
             }
         }
-        // 2. skills: workspace/skills/*/ → ~/.bolloon/skills/<name>/
+        // 2. skills → ~/.bolloon/skills/<name>/
         const skillsSrc = path.join(ws, 'skills');
         const skillDirs = await deps.readdir(skillsSrc);
         if (skillDirs) {
-            for (const dirName of skillDirs) {
-                const srcDir = path.join(skillsSrc, dirName);
-                const st = await deps.stat(srcDir);
-                if (!st?.isDirectory)
+            // OpenClaw: skills/<name>/SKILL.md 一层, 直接落盘 <name>.
+            // Hermes: skills/<分类>/<技能>/SKILL.md 两层, 逐 <技能> 递归找 SKILL.md,
+            //   落盘 <分类>-<技能> 展平, 避免跨分类重名.
+            for (const entryName of skillDirs) {
+                if (entryName.startsWith('.'))
                     continue;
-                if (dirName.startsWith('.'))
+                const entry = path.join(skillsSrc, entryName);
+                const st = await deps.stat(entry);
+                if (!st?.isDirectory)
                     continue;
-                const destDir = path.join(skillsRoot, dirName);
-                const copied = await copyDirIfNeeded(deps, srcDir, destDir, manifest);
-                if (copied.length > 0) {
-                    report.skillsCopied.push(dirName);
-                    report.entries.push({ from: srcDir, to: destDir, kind: 'skill' });
+                if (source === 'hermes') {
+                    // 分类下的每个技能目录 → 目标 <分类>-<技能>
+                    const cat = entryName;
+                    const subDirs = await deps.readdir(entry);
+                    if (!subDirs)
+                        continue;
+                    for (const skillName of subDirs) {
+                        if (skillName.startsWith('.'))
+                            continue;
+                        const skillDir = path.join(entry, skillName);
+                        const sst = await deps.stat(skillDir);
+                        if (!sst?.isDirectory)
+                            continue;
+                        // 该分类下菊 不一定有 SKILL.md → 跳过
+                        const hasSkill = await deps.exists(path.join(skillDir, 'SKILL.md'));
+                        if (!hasSkill)
+                            continue;
+                        const targetName = `${cat}-${skillName}`;
+                        const destDir = path.join(skillsRoot, targetName);
+                        const copied = await copyDirIfNeeded(deps, skillDir, destDir, manifest);
+                        if (copied.length > 0) {
+                            report.skillsCopied.push(targetName);
+                            report.entries.push({ from: skillDir, to: destDir, kind: 'skill' });
+                        }
+                    }
+                }
+                else {
+                    const destDir = path.join(skillsRoot, entryName);
+                    const copied = await copyDirIfNeeded(deps, entry, destDir, manifest);
+                    if (copied.length > 0) {
+                        report.skillsCopied.push(entryName);
+                        report.entries.push({ from: entry, to: destDir, kind: 'skill' });
+                    }
                 }
             }
         }
-        // 3. memory: workspace/memory/*.md → memory/<agent>/sessions/
+        // 3. memory: openclaw workspace/memory/*.md → sessions/; hermes 无独立 memory 目录
         const memSrc = path.join(ws, 'memory');
         const memFiles = await deps.readdir(memSrc);
         if (memFiles) {
@@ -231,7 +336,7 @@ export async function migrateExternalAgent(source, deps = defaultDeps()) {
                     continue;
                 const from = path.join(memSrc, f);
                 const to = path.join(memoryRoot, `${idx + 1}-${f}`);
-                if (await copyIfNeeded(deps, from, to, manifest)) {
+                if (await copyIfNeeded(deps, from, to, manifest, true)) {
                     report.memoryCopied.push(f);
                     report.entries.push({ from, to, kind: 'memory' });
                 }
@@ -241,11 +346,11 @@ export async function migrateExternalAgent(source, deps = defaultDeps()) {
         // 4. docs: workspace 根其他 .md → context-os/04-Projects/<source>-docs/
         const wsFiles = await deps.readdir(ws);
         if (wsFiles) {
-            const excluded = new Set(['SOUL.md', 'IDENTITY.md', 'USER.md', 'AGENTS.md', 'TOOLS.md', 'MEMORY.md']);
+            const excluded = personaSpec.map((p) => p.toName);
             for (const f of wsFiles) {
                 if (!f.endsWith('.md'))
                     continue;
-                if (excluded.has(f))
+                if (excluded.includes(f))
                     continue;
                 const from = path.join(ws, f);
                 const st = await deps.stat(from);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.3.39",
+  "version": "0.3.41",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",