@bolloon/bolloon-agent 0.3.45 → 0.3.46

package/dist/agents/agent-identity.js

@@ -17,6 +17,19 @@ import * as path from 'path';
 import * as os from 'os';
 import { KeyManager } from '@diap/sdk';
 const AGENT_KEYS_DIR = path.join(os.homedir(), '.bolloon', 'agent-keys');
+/** 读取用户唯一 DID (与 server loadOrCreateUserIdentity 同源, 归属字段用) */
+export function getUserOwnerDid() {
+    try {
+        const f = path.join(os.homedir(), '.bolloon', 'identity', 'user.json');
+        if (fs.existsSync(f)) {
+            const j = JSON.parse(fs.readFileSync(f, 'utf-8'));
+            if (j.did)
+                return j.did;
+        }
+    }
+    catch { /* 无 user.json → 无归属 */ }
+    return '';
+}
 /**
  * 加载或创建 agent 的持久化 diap 身份
  * - 文件存在 → 从私钥重建 keyPair
@@ -44,6 +57,7 @@ export function loadOrCreateAgentIdentity(agentId) {
                         did: kp.did,
                         createdAt: j.createdAt || 'unknown',
                         reused: true,
+                        ownerDid: j.ownerDid || getUserOwnerDid(),
                     };
                 }
             }
@@ -70,6 +84,8 @@ export function loadOrCreateAgentIdentity(agentId) {
         lastUsedAt: createdAt,
         agentId,
         version: '1.0',
+        // 2026-08-09: 归属用户唯一 DID — DIAP 智能体身份全部归到用户身份下
+        ownerDid: getUserOwnerDid(),
     };
     fs.writeFileSync(fp, JSON.stringify(data, null, 2), { mode: 0o600 });
     try {
@@ -83,6 +99,7 @@ export function loadOrCreateAgentIdentity(agentId) {
         did: kp.did,
         createdAt,
         reused: false,
+        ownerDid: data.ownerDid,
     };
 }
 /**

package/dist/agents/loop-review.js

@@ -46,11 +46,27 @@ export function decideAfterReview(state, maxReviews = DEFAULT_MAX_REVIEWS) {
 export function buildReviewHint(state, maxReviews = DEFAULT_MAX_REVIEWS) {
     const intent = (state.userIntent || '').trim() || '(无)';
     const tools = state.completedTools.length ? state.completedTools.join(', ') : '(尚未执行工具)';
-    return (`[目标对齐 review ${state.reviewsDone + 1}/${maxReviews}]\n` +
-        `用户需求: ${intent.slice(0, 300)}\n` +
-        `本轮已完成工具: ${tools}\n` +
-        `请对照需求自查: 是否还有未完成/可深挖的子目标? 若有 → 继续调用工具推进; ` +
-        `若已满足用户原始需求 → 直接输出 <final gen> 结束. 不要再重复已完成的动作.`);
+    // 2026-08-09: 行动日志 — 逐条列出已完成动作 + 结果摘要, 让 LLM 对照目标核查
+    //   (旧版只有工具名, LLM 容易潦草自查; 带结果才能判断"这一步到底做完了没")
+    let actionLines = '';
+    if (state.actionLog && state.actionLog.length > 0) {
+        actionLines = '\n本轮已执行动作 (逐条):\n' + state.actionLog
+            .map((a, i) => {
+            const args = a.argsPreview ? `(${a.argsPreview.slice(0, 80)})` : '';
+            const res = a.success
+                ? `✓ ${(a.resultPreview || 'ok').slice(0, 120)}`
+                : `✗ ${(a.resultPreview || 'failed').slice(0, 120)}`;
+            return `  ${i + 1}. ${a.tool}${args} → ${res}`;
+        })
+            .join('\n');
+    }
+    return (`[目标对齐 review ${state.reviewsDone + 1}/${maxReviews}]` +
+        `\n用户需求: ${intent.slice(0, 300)}` +
+        actionLines +
+        `\n已完成工具: ${tools}` +
+        `\n请对照需求逐条自查: 上面每一条动作是否真正完成了对应的子目标? 还有未完成/可深挖的子目标 → 继续调用工具推进 (注意: 同一动作已完成就不要重复执行, 直接基于已有结果推进下一步); ` +
+        `若已满足用户原始需求 → 直接输出 <final gen> 结束.` +
+        `\n[重要] 如果你要结束, 请先逐条对照「用户需求」确认每一项都已完成, 不要因为做了一部分就潦草收尾.`);
 }
 /** 布尔门: 是否该继续 review (测试/消融快速断言) */
 export function shouldReviewAgain(state, maxReviews = DEFAULT_MAX_REVIEWS) {

package/dist/agents/pi-sdk.js

@@ -1129,6 +1129,10 @@ ${this.getToolDefinitions()}
         //   上限=2 次 (用户要求"运行一两次"), 结束后按用户需求为准.
         let loopReviewCount = 0;
         const loopReviewCompletedTools = new Set();
+        // 2026-08-09: 本轮行动日志 — 每轮工具执行都记录 (args + 结果摘要),
+        //   final 前 review 用逐条核查目标; 也注入 system prompt 让 LLM 看到连续进度
+        //   (防"每轮都像重启" — 之前 LLM 看不到自己已完成什么, 容易重复 react)
+        const loopActionLog = [];
         // 发送循环开始的事件
         if (onStream) {
             onStream({ type: 'status', content: '🔄 开始 ReAct 循环...', tool: 'system' });
@@ -1252,11 +1256,26 @@ ${this.getToolDefinitions()}
 `;
             }
             const personaSection = this.cachedPersonaSection;
+            // 2026-08-09: 循环进度段 — 让 LLM 看到本轮已完成的动作 (连续进度, 不重启)
+            //   Hermes 式 Agent Runtime: 循环是状态机, LLM 每次看到的是"第 N 步 + 已完成 X"
+            //   (之前每轮都是全新上下文, LLM 不知道做过什么 → 重复 react / 衔接差)
+            let loopProgressSection = '';
+            if (loopActionLog.length > 0) {
+                const actionLines = loopActionLog
+                    .map((a, i) => {
+                    const args = a.argsPreview ? `(${a.argsPreview.slice(0, 60)})` : '';
+                    const res = a.success ? '✓' : '✗';
+                    return `  ${i + 1}. ${res} ${a.tool}${args}`;
+                })
+                    .join('\n');
+                loopProgressSection = `\n【本轮循环进度】你已完成以下 ${loopActionLog.length} 个动作, 这是连续执行的同一轮任务:\n${actionLines}\n请基于已有结果继续推进, 不要重复执行上面已成功的动作. 全部完成后用 <final gen> 结束.\n`;
+            }
             const systemPrompt = `${this.bootstrapAddition}你是 ${this.identity.name}，基于ReAct (Reasoning + Acting)模式工作。${personaSection}
 当前工作目录: ${this.cwd}
 当前身份: ${this.identity.name} (${this.identity.did})
 ${refineContext}
 ${this.currentIntentHint}
+${loopProgressSection}
 
 ${toolDefs}
 
@@ -1361,9 +1380,10 @@ ${toolDefs}
             }
             console.log(`[PiAgent] LLM 回复长度: ${reply.length}, 内容预览: "${reply.substring(0, 80)}..."`);
             console.log(`[PiAgent] LLM 完整回复:\n${reply}`);
-            // 通知前端：收到 LLM 回复
+            // 通知前端：收到 LLM 回复 (2026-08-09: 不再截断 100 字符 — 前端流式渲染完整内容,
+            //   配合 Hermes 式回复框: 加载中显示完整文本, 完成后封闭底框)
             if (onStream) {
-                onStream({ type: 'token', content: reply.substring(0, 100) });
+                onStream({ type: 'token', content: reply });
             }
             // 2026-06-19 架构 fix: parseToolCall 优先于 isFinalResponse
             //   之前: 思考块里的 "<final gen>" 触发 isFinalResponse 提前 break, 工具从未真正执行
@@ -1415,9 +1435,10 @@ ${toolDefs}
                     content: reply,
                     toolCalls: toolCalls.length > 1 ? toolCalls : [toolCalls[0]],
                 });
-                // 顺序执行每个工具
-                for (let ti = 0; ti < toolCalls.length; ti++) {
-                    const toolCall = toolCalls[ti];
+                // 2026-08-09: 并发执行本轮所有工具 (Hermes 式 Agent Runtime: 一轮内多工具并行,
+                //   一轮没跑完之前不中断 — 工具执行不检查 abort, 全部完成才 continue 下一轮)
+                //   旧实现顺序 for 循环, 一个工具等一个, 慢; 且多工具时 LLM 要等全部串完才能看到结果.
+                await Promise.all(toolCalls.map(async (toolCall, ti) => {
                     const isMulti = toolCalls.length > 1;
                     // 通知前端
                     if (onStream) {
@@ -1450,7 +1471,7 @@ ${toolDefs}
                         const denyResultMsg = { success: false, error: `拒绝: [${denyResult.source}] ${denyResult.reason}` };
                         this.messageHistory.push({ role: 'tool', content: JSON.stringify(denyResultMsg), toolResult: denyResultMsg });
                         this.logToHarness(toolCall.name, toolCall.args, denyResultMsg);
-                        continue;
+                        return;
                     }
                     if (denyResult.systemAddition) {
                         this.contextHintAddition += '\n' + denyResult.systemAddition;
@@ -1469,7 +1490,7 @@ ${toolDefs}
                         if (onStream)
                             onStream({ type: 'status', content: `💡 Reflection: ${obs.summary}`, tool: 'system' });
                         console.warn(`[PiAgent] 未知工具: ${toolCall.name} (累计 ${totalErrors}/${this.MAX_TOTAL_ERRORS})，跳过并继续`);
-                        continue;
+                        return;
                     }
                     // Bootstrap PreToolUse hook: 调工具前校验 (危险命令拦截)
                     // 失败静默 — hook 自身挂掉 = 放行
@@ -1513,7 +1534,7 @@ ${toolDefs}
                                 this.messageHistory.push({ role: 'system', content: `[注意] 连续 ${consecutiveErrors} 次工具调用被系统拒绝. 请换其他工具或直接回答用户, 末尾加 <final gen>.` });
                                 consecutiveErrors = 0;
                             }
-                            continue;
+                            return;
                         }
                     }
                     catch (err) {
@@ -1550,7 +1571,7 @@ ${toolDefs}
                                 this.messageHistory.push({ role: 'system', content: `[注意] 连续 ${consecutiveErrors} 次工具调用被 Harness 拒绝. 请换其他工具或直接回答.` });
                                 consecutiveErrors = 0;
                             }
-                            continue;
+                            return;
                         }
                     }
                     catch (err) {
@@ -1587,6 +1608,20 @@ ${toolDefs}
                         }
                         this.messageHistory.push({ role: 'tool', content: JSON.stringify(result), toolResult: result, toolCallId: toolCall.id || `call_${Date.now()}_${Math.random().toString(36).slice(2, 8)}` });
                         this.logToHarness(toolCall.name, toolCall.args, result);
+                        // 2026-08-09: 记录到本轮行动日志 (循环进度 + final 前目标核查用)
+                        //   去重: 同一工具同 args 连续成功只记一次 (防 LLM 重复 react 刷屏)
+                        const argsPreview = JSON.stringify(toolCall.args || {}).slice(0, 120);
+                        const isDup = loopActionLog.some((a) => a.tool === toolCall.name && a.argsPreview === argsPreview && a.success === !!result.success);
+                        if (!isDup) {
+                            loopActionLog.push({
+                                tool: toolCall.name,
+                                argsPreview,
+                                resultPreview: result.success
+                                    ? String(result.output || '(无输出)').slice(0, 200)
+                                    : String(result.error || 'failed').slice(0, 200),
+                                success: !!result.success,
+                            });
+                        }
                         if (onStream) {
                             if (result.success) {
                                 onStream({ type: 'status', content: `✅ ${toolCall.name} 执行成功`, tool: toolCall.name });
@@ -1644,7 +1679,7 @@ ${toolDefs}
                                 lastFailedTool = '';
                                 lastFailedToolCount = 0;
                                 consecutiveErrors = 0;
-                                continue;
+                                return;
                             }
                             if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
                                 this.messageHistory.push({ role: 'system', content: `[注意] 前面的工具调用连续失败。请尝试其他工具或换一种方式完成用户请求, 或用 <final gen> 给出最终回答.` });
@@ -1665,7 +1700,7 @@ ${toolDefs}
                             onStream({ type: 'status', content: `💡 Reflection: ${obs.summary}`, tool: 'system' });
                         console.error(`[PiAgent] 工具执行异常 (累计 ${totalErrors}/${this.MAX_TOTAL_ERRORS}): ${execError}`);
                     }
-                } // end for (ti)
+                })); // end Promise.all(toolCalls.map(async ...))
                 // 所有工具执行完毕后, continue while 循环, 让 LLM 看到结果
                 continue;
             }
@@ -1675,9 +1710,9 @@ ${toolDefs}
                     role: 'assistant',
                     content: reply
                 });
-                // 通知前端收到非工具调用回复
+                // 通知前端收到非工具调用回复 (2026-08-09: 完整内容, 不再截断 150)
                 if (onStream) {
-                    onStream({ type: 'token', content: reply.substring(0, 150) });
+                    onStream({ type: 'token', content: reply });
                 }
                 // 2026-06-19 架构 fix: 只有 strip <think> 后才检查 isFinalResponse
                 //   (parseToolCall 已先尝试, 既然没解析出 tool_call, 现在检查 final gen 是否真的在最终回答区)
@@ -1720,6 +1755,7 @@ ${toolDefs}
                         reviewsDone: loopReviewCount,
                         userIntent: this.currentIntentHint,
                         completedTools: Array.from(loopReviewCompletedTools),
+                        actionLog: loopActionLog,
                     }, DEFAULT_MAX_REVIEWS);
                     if (reviewDecision.kind === 'continue-review') {
                         loopReviewCount++;

package/dist/agents/workflow-pivot-loop.js

@@ -260,7 +260,7 @@ export class WorkflowPivotLoop {
                 const llmResponse = await llm.chat(context, headerForThisIter, signal, openAITools);
                 const reply = (llmResponse.reply || '').trim();
                 this.vlog(`[pivot] iter=${this.state.iteration} LLM took=${Date.now() - t0}ms reply=${reply.length} nativeToolCalls=${llmResponse.toolCalls?.length ?? 0} head=${reply.substring(0, 80).replace(/\n/g, ' ')}`);
-                this.emit({ type: 'token', content: reply.substring(0, 100) });
+                this.emit({ type: 'token', content: reply });
                 // 2026-07-06: 把完整 reply 推给前端 — 前端按需更新临时气泡
                 //   之前只 emit token(100B 截断), 前端拿到 100B 看不清. 现在 emit preview 带完整 content.
                 //   折叠 / 清洗交给前端的 message-renderer.addMessage (类型 ai 入口统一 strip).

package/dist/cli-entry.js

@@ -111,11 +111,13 @@ function getMainScript() {
 }
 function getElectronPath() {
     // ESM 兼容: use _require (createRequire) instead of raw require
+    // 2026-08-09: electron 在 devDependencies, 全局安装不装 → require 失败返回 null
+    // (上层 startElectron 收到 null 后降级为 Web 模式, 不再返回裸字符串 'electron' 导致 ENOENT)
     try {
         return _require('electron');
     }
     catch {
-        return 'electron';
+        return null;
     }
 }
 // 解析命令行参数
@@ -466,6 +468,14 @@ async function runNodeScript(scriptPath, additionalArgs) {
 // 启动 Electron
 async function startElectron(additionalArgs) {
     const electronPath = getElectronPath();
+    // 2026-08-09: electron 是 devDependency, 全局安装不包含 → 降级为 Web 模式
+    // (浏览器打开 Web UI, 功能等价, 避免 spawn electron ENOENT 直接退出)
+    if (!electronPath) {
+        log('未检测到 Electron 桌面运行时 (全局安装不含 devDependencies)', YELLOW);
+        log('自动降级为 Web 模式 — 浏览器打开 Web UI...', CYAN);
+        await startWebServer(additionalArgs);
+        return;
+    }
     const distDir = getDistDir();
     // 确定主进程入口
     let mainPath = path.join(distDir, 'electron.js');

package/dist/web/client.js

@@ -3791,6 +3791,13 @@ ${data.error || "channel not found"}`, "error");
       if (nameEl) nameEl.textContent = identity.name || "\u533F\u540D";
       if (didEl) didEl.textContent = identity.didShort ? `did:key:${identity.didShort}` : "";
       if (letterEl) letterEl.textContent = letter;
+      const avatarEl = document.getElementById("user-avatar");
+      if (avatarEl) {
+        avatarEl.style.cursor = "pointer";
+        avatarEl.onclick = () => {
+          openAuthModal();
+        };
+      }
       if (nameEl) {
         nameEl.onclick = () => {
           const current = nameEl.textContent || "";
@@ -3841,6 +3848,140 @@ ${data.error || "channel not found"}`, "error");
     } catch (e) {
     }
   }
+  function getEl(id) {
+    return document.getElementById(id);
+  }
+  function showAuthMsg(text, isError = false) {
+    const msg = getEl("auth-msg");
+    if (!msg) return;
+    msg.textContent = text;
+    msg.style.display = "block";
+    msg.style.color = isError ? "#ef4444" : "#22c55e";
+  }
+  async function refreshAuthAccounts() {
+    try {
+      const res = await fetch("/api/auth/status");
+      if (!res.ok) return;
+      const data = await res.json();
+      const statusLine = getEl("auth-status-line");
+      if (statusLine) {
+        statusLine.innerHTML = `\u5F53\u524D\u7528\u6237 DID: <code style="font-size:11px;">${escapeHtml2(data.did || "")}</code><br><span style="color:var(--text-muted);">\u6240\u6709\u767B\u5F55\u8D26\u53F7\u4E0E DIAP \u667A\u80FD\u4F53\u8EAB\u4EFD\u5747\u5F52\u5C5E\u6B64 DID\u3002</span>`;
+      }
+      const listEl = getEl("auth-accounts-list");
+      if (listEl) {
+        const accs = data.accounts || [];
+        if (accs.length === 0) {
+          listEl.innerHTML = '<div class="form-info" style="margin-top:4px;color:var(--text-muted);">\u5C1A\u672A\u7ED1\u5B9A\u4EFB\u4F55\u8D26\u53F7</div>';
+        } else {
+          listEl.innerHTML = '<div class="form-info" style="margin-bottom:4px;"><b>\u5DF2\u7ED1\u5B9A\u8D26\u53F7</b></div>' + accs.map((a) => `<div style="display:flex;justify-content:space-between;align-items:center;padding:4px 8px;border:1px solid var(--border);border-radius:6px;margin-bottom:4px;font-size:12px;">
+            <span>${escapeHtml2(a.provider)}${a.identifier ? " \xB7 " + escapeHtml2(a.identifier) : ""}${a.skeleton ? ' <span style="color:#f59e0b;">(\u9AA8\u67B6)</span>' : ""}</span>
+            <button class="btn-secondary btn-sm auth-unbind-btn" data-provider="${escapeHtml2(a.provider)}" style="padding:1px 8px;font-size:11px;">\u89E3\u7ED1</button>
+          </div>`).join("");
+          listEl.querySelectorAll(".auth-unbind-btn").forEach((btn) => {
+            btn.addEventListener("click", async () => {
+              const provider = btn.dataset.provider || "";
+              try {
+                const r = await fetch("/api/auth/logout", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ provider }) });
+                if (r.ok) {
+                  showAuthMsg(`\u2713 \u5DF2\u89E3\u7ED1 ${provider}`);
+                  refreshAuthAccounts();
+                } else {
+                  showAuthMsg(`\u89E3\u7ED1\u5931\u8D25: ${(await r.json()).error || ""}`, true);
+                }
+              } catch {
+                showAuthMsg("\u89E3\u7ED1\u5931\u8D25", true);
+              }
+            });
+          });
+        }
+      }
+    } catch {
+    }
+  }
+  async function openAuthModal() {
+    const modal = getEl("auth-modal");
+    if (!modal) return;
+    modal.style.display = "flex";
+    const msg = getEl("auth-msg");
+    if (msg) msg.style.display = "none";
+    const emailEl = getEl("auth-email");
+    const phoneEl = getEl("auth-phone");
+    if (emailEl) emailEl.value = "";
+    if (phoneEl) phoneEl.value = "";
+    await refreshAuthAccounts();
+  }
+  function closeAuthModal() {
+    const modal = getEl("auth-modal");
+    if (modal) modal.style.display = "none";
+  }
+  async function authLogin(provider, identifier) {
+    try {
+      const res = await fetch("/api/auth/login", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider, identifier })
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        showAuthMsg(data.error || "\u767B\u5F55\u5931\u8D25", true);
+        return;
+      }
+      showAuthMsg(`\u2713 ${data.message || "\u5DF2\u7ED1\u5B9A"}`);
+      await refreshAuthAccounts();
+      loadUserIdentity();
+    } catch {
+      showAuthMsg("\u767B\u5F55\u8BF7\u6C42\u5931\u8D25", true);
+    }
+  }
+  function bindAuthModalEvents() {
+    const closeBtn = getEl("auth-modal-close");
+    if (closeBtn) closeBtn.onclick = closeAuthModal;
+    document.querySelectorAll(".auth-oauth-btn").forEach((btn) => {
+      btn.addEventListener("click", () => {
+        const provider = btn.dataset.provider || "";
+        authLogin(provider);
+      });
+    });
+    const emailBtn = getEl("auth-email-btn");
+    if (emailBtn) emailBtn.onclick = () => {
+      const emailEl = getEl("auth-email");
+      const val = emailEl?.value?.trim() || "";
+      if (!val) {
+        showAuthMsg("\u8BF7\u586B\u5199\u90AE\u7BB1", true);
+        return;
+      }
+      authLogin("email", val);
+    };
+    const phoneBtn = getEl("auth-phone-btn");
+    if (phoneBtn) phoneBtn.onclick = () => {
+      const phoneEl = getEl("auth-phone");
+      const val = phoneEl?.value?.trim() || "";
+      if (!val) {
+        showAuthMsg("\u8BF7\u586B\u5199\u624B\u673A\u53F7", true);
+        return;
+      }
+      authLogin("phone", val);
+    };
+    const emailInput = getEl("auth-email");
+    if (emailInput) emailInput.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") getEl("auth-email-btn")?.click();
+    });
+    const phoneInput = getEl("auth-phone");
+    if (phoneInput) phoneInput.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") getEl("auth-phone-btn")?.click();
+    });
+    const modal = getEl("auth-modal");
+    if (modal) modal.addEventListener("click", (e) => {
+      if (e.target === modal) closeAuthModal();
+    });
+  }
+  if (typeof document !== "undefined") {
+    if (document.readyState === "loading") {
+      document.addEventListener("DOMContentLoaded", bindAuthModalEvents);
+    } else {
+      bindAuthModalEvents();
+    }
+  }
   async function init() {
     const themeData = await loadTheme();
     currentAgentId = themeData.agentId || `agent_${generateId().substring(0, 8)}`;

package/dist/web/index.html

@@ -414,6 +414,54 @@
     </main>
   </div>
 
+  <!-- ========== 登录 Modal (2026-08-09) — GitHub/Google/邮箱/手机号, 仅骨架 ========== -->
+  <div id="auth-modal" class="modal" style="display:none;">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h2>登录 · 账号绑定</h2>
+        <button id="auth-modal-close" class="modal-close">&times;</button>
+      </div>
+      <div class="modal-body">
+        <div id="auth-status-line" class="form-info" style="margin-bottom:12px;font-size:12px;"></div>
+
+        <!-- OAuth 骨架按钮 -->
+        <div class="form-group">
+          <label>第三方账号</label>
+          <div style="display:flex;gap:8px;flex-wrap:wrap;">
+            <button type="button" class="btn-secondary auth-oauth-btn" data-provider="github" style="flex:1;min-width:120px;">GitHub</button>
+            <button type="button" class="btn-secondary auth-oauth-btn" data-provider="google" style="flex:1;min-width:120px;">Google</button>
+          </div>
+          <small class="form-hint" id="auth-oauth-hint">骨架: 点击后记录账号归属当前 DID, 真实 OAuth 授权页后续接入。</small>
+        </div>
+
+        <!-- 邮箱登录骨架 -->
+        <div class="form-group">
+          <label for="auth-email">邮箱登录</label>
+          <div style="display:flex;gap:8px;">
+            <input type="email" id="auth-email" placeholder="you@example.com" style="flex:1;">
+            <button type="button" class="btn-secondary" id="auth-email-btn">绑定</button>
+          </div>
+          <small class="form-hint">骨架: 记录邮箱归属当前 DID, 验证码发送后续接入。</small>
+        </div>
+
+        <!-- 手机号登录骨架 -->
+        <div class="form-group">
+          <label for="auth-phone">手机号登录</label>
+          <div style="display:flex;gap:8px;">
+            <input type="tel" id="auth-phone" placeholder="+86 138... " style="flex:1;">
+            <button type="button" class="btn-secondary" id="auth-phone-btn">绑定</button>
+          </div>
+          <small class="form-hint">骨架: 记录手机号归属当前 DID, 短信验证码后续接入。</small>
+        </div>
+
+        <!-- 已绑定列表 -->
+        <div id="auth-accounts-list" style="margin-top:8px;"></div>
+
+        <div id="auth-msg" class="form-info" style="display:none;margin-top:8px;"></div>
+      </div>
+    </div>
+  </div>
+
   <script type="module" src="./components/wallet-viem.mjs"></script>
   <script type="module" src="./components/p2p/index.js"></script>
   <script type="module" src="./ui/step-timeline.js"></script>

package/dist/web/server.js

@@ -1873,6 +1873,13 @@ export async function createWebServer(port = 3000, options = {}) {
         // 尝试发布 DID 到 IPFS
         try {
             const auth = await AgentAuthManager.newWithRemoteIpfs('http://127.0.0.1:5001', 'http://127.0.0.1:8080');
+            // 2026-08-09: 归属用户 DID — 智能体身份归属用户唯一身份 (DID 文档带 controller+alsoKnownAs)
+            try {
+                const owner = await loadOrCreateUserIdentity();
+                if (owner?.did)
+                    auth.setOwnerDid(owner.did);
+            }
+            catch { /* 归属设置失败不阻塞 */ }
             await auth.registerAgent({ name, services: [] }, kp, '');
             console.log('P2P DID 已发布到 IPFS');
         }
@@ -2793,6 +2800,117 @@ ${goalDesc}
             res.status(500).json({ error: err.message });
         }
     });
+    // ========== 登录框架 (2026-08-09) — GitHub/Google/邮箱/手机号, 仅骨架 ==========
+    // 所有登录方式最终都归属到用户 DID (右下角唯一身份).
+    // 真实 OAuth / 验证码后续接入, 这里先做: 记录账号 + 绑定用户 DID + 提供状态查询.
+    const ACCOUNTS_FILE = `${process.env.HOME || '/tmp'}/.bolloon/accounts.json`;
+    async function loadAccounts() {
+        try {
+            const { readFile } = await import('fs/promises');
+            const parsed = JSON.parse(await readFile(ACCOUNTS_FILE, 'utf-8'));
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    async function saveAccounts(accs) {
+        const { mkdir, writeFile } = await import('fs/promises');
+        await mkdir(`${process.env.HOME || '/tmp'}/.bolloon`, { recursive: true });
+        await writeFile(ACCOUNTS_FILE, JSON.stringify(accs, null, 2), { mode: 0o600 });
+    }
+    // GET /api/auth/status — 当前用户 DID + 已绑定账号列表
+    app.get('/api/auth/status', async (_req, res) => {
+        try {
+            const identity = await loadOrCreateUserIdentity();
+            const accs = await loadAccounts();
+            res.json({
+                did: identity.did,
+                didShort: identity.didShort,
+                name: identity.name,
+                // 只返回脱敏视图 (不含 token)
+                accounts: accs.map((a) => ({
+                    provider: a.provider,
+                    identifier: a.identifier || a.email || a.username || '',
+                    loggedAt: a.loggedAt,
+                    skeleton: !!a.skeleton,
+                })),
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    // POST /api/auth/login — 登录骨架 (记录账号 + 绑定用户 DID)
+    // body: { provider: 'github'|'google'|'email'|'phone', identifier?: string }
+    app.post('/api/auth/login', async (req, res) => {
+        try {
+            const { provider, identifier } = req.body || {};
+            const prov = String(provider || '').trim().toLowerCase();
+            const VALID = ['github', 'google', 'email', 'phone'];
+            if (!VALID.includes(prov)) {
+                return res.status(400).json({ error: `provider 必须是 ${VALID.join('/')}` });
+            }
+            // 邮箱/手机号必填 identifier
+            if ((prov === 'email' || prov === 'phone') && !String(identifier || '').trim()) {
+                return res.status(400).json({ error: `${prov === 'email' ? '邮箱' : '手机号'}必填` });
+            }
+            const identity = await loadOrCreateUserIdentity();
+            const accs = await loadAccounts();
+            const idStr = String(identifier || '').trim();
+            const existing = accs.find((a) => a.provider === prov && (!idStr || a.identifier === idStr || a.email === idStr));
+            const now = new Date().toISOString();
+            if (existing) {
+                // 已绑定 → 更新归属 DID + 时间
+                existing.ownerDid = identity.did;
+                existing.loggedAt = now;
+                existing.skeleton = true;
+            }
+            else {
+                accs.push({
+                    provider: prov,
+                    identifier: idStr || '',
+                    email: prov === 'email' ? idStr : '',
+                    phone: prov === 'phone' ? idStr : '',
+                    username: idStr || '',
+                    token: '', // 真实 OAuth 后填
+                    ownerDid: identity.did, // 归属用户唯一 DID
+                    loggedAt: now,
+                    skeleton: true, // 骨架标记: 未做真实 OAuth/验证码
+                });
+            }
+            await saveAccounts(accs);
+            console.log(`[auth] 登录骨架: ${prov}${idStr ? ' ' + idStr : ''} → 归属 DID ${identity.did.substring(0, 20)}...`);
+            res.json({
+                ok: true,
+                provider: prov,
+                identifier: idStr,
+                ownerDid: identity.did,
+                skeleton: true,
+                message: `${prov} 登录骨架已记录 (归属用户 DID), 真实 OAuth/验证码后续接入`,
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    // POST /api/auth/logout — 解除某个 provider 的绑定 (骨架)
+    app.post('/api/auth/logout', async (req, res) => {
+        try {
+            const { provider } = req.body || {};
+            const prov = String(provider || '').trim().toLowerCase();
+            const accs = await loadAccounts();
+            const before = accs.length;
+            const remaining = accs.filter((a) => a.provider !== prov);
+            if (remaining.length === before)
+                return res.status(404).json({ error: `未绑定 ${prov} 账号` });
+            await saveAccounts(remaining);
+            res.json({ ok: true, provider: prov });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
     // 2026-08-08: DID 目录 (Postgres 式) — 以用户 DID 为主键, 绑定 memory/persona/skills/on_policy/context_os 等表
     app.get('/api/did-catalog/:table', async (req, res) => {
         try {
@@ -4176,6 +4294,13 @@ ${goalDesc}
             const pkBytes = Buffer.from(channel.publicKey, 'hex');
             const kp = { privateKey: new Uint8Array(32), publicKey: pkBytes, did: channel.did };
             const auth = await AgentAuthManager.newWithRemoteIpfs('http://127.0.0.1:5001', 'http://127.0.0.1:8080');
+            // 2026-08-09: 归属用户 DID — 子智能体身份归属用户唯一身份
+            try {
+                const owner = await loadOrCreateUserIdentity();
+                if (owner?.did)
+                    auth.setOwnerDid(owner.did);
+            }
+            catch { /* 归属设置失败不阻塞 */ }
             const result = await auth.registerAgent({ name: channel.name, services: [] }, kp, '');
             channel.cid = result.cid || channel.cid;
             // 关键: 不再保存整份 didDocument, 只留 cid/ipnsName 两个引用字段

package/dist/web/style.css

@@ -1446,6 +1446,38 @@ body {
   gap: 8px;
 }
 
+/* 2026-08-09: Hermes 式流式回复框 — 加载中底部开放 (虚线底边 + 脉动),
+   回复完成后 finalizeTimelineAsMessage → addMessage 生成完整封闭气泡 (.bubble-ai).
+   加载框即"未封闭"状态: 顶部/左右边框实线, 底部虚线示意还在写. */
+.message-streaming {
+  background: var(--ai-bg);
+  color: var(--ai-text);
+  border: 1px solid var(--border);
+  border-top-left-radius: var(--radius);
+  border-top-right-radius: var(--radius);
+  border-bottom-left-radius: 4px;
+  border-bottom-right-radius: 4px;
+  padding: 14px 18px;
+  line-height: 1.7;
+  white-space: pre-line;
+  word-break: break-word;
+  font-size: 15px;
+  /* 底部开放: 虚线 + 强调色, 视觉上"还没写完" */
+  border-bottom: 2px dashed var(--accent);
+  animation: streamBoxPulse 1.4s ease-in-out infinite;
+}
+
+@keyframes streamBoxPulse {
+  0%, 100% { border-bottom-color: var(--accent); }
+  50% { border-bottom-color: var(--accent-dark); }
+}
+
+/* 完成态: 底部封闭成实线 (由 addMessage 生成 .bubble-ai, 这里兜底旧 streaming 元素) */
+.message-streaming.closed {
+  border-bottom: 1px solid var(--border);
+  animation: none;
+}
+
 .streaming-content::before {
   content: '';
   width: 6px;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.3.45",
+  "version": "0.3.46",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",
@@ -59,7 +59,7 @@
     "@capacitor/ios": "^8.4.2",
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
-    "@diap/sdk": "^0.2.2",
+    "@diap/sdk": "^0.2.4",
     "@libp2p/autonat": "^3.0.25",
     "@libp2p/circuit-relay-v2": "^4.2.9",
     "@libp2p/dcutr": "^3.0.20",