@bolloon/bolloon-agent 0.3.8 → 0.3.9

package/dist/agents/pi-sdk-tools.js

@@ -8,6 +8,7 @@ import { checkWritePath } from './shell-guard.js';
 import { p2pDocumentTools } from './p2p-document-tools.js';
 import { runSelfImproveLoop } from './pi-sdk-session-factory.js';
 import { getMinimax } from '../constraints/index.js';
+import { delegateToEngine } from '../external-engines/delegate.js';
 /**
  * Tools 模块 — 从 pi-sdk.ts 抽出的 registerTools() / _registerWalletTools() / _setupInboxListener()
  * / wrapToolsWithIdempotency() (2026-07-06).
@@ -267,6 +268,37 @@ export function registerBuiltinTools(ctx) {
             return { success: true, output: `📞 RPC 任务已发送给 ${peerId.substring(0, 16)}...\n   requestId=${requestId}` };
         }
     });
+    // delegate_to_engine — 把编码任务委派给本机已安装的其他 AI 编码智能体 CLI
+    // (codex / claude-code / opencode / openclaw / hermes). 它们必须已安装且可达 PATH.
+    // 实验 API 引擎 (experiment:xxx) 是供应商不是 CLI, 不支持委派, 工具会提示改用 import.
+    ctx.tools.set('delegate_to_engine', {
+        name: 'delegate_to_engine',
+        description: '把编码任务委派给本机已安装的其他 AI 编码智能体 (子智能体) 执行: codex / claude-code / opencode / openclaw / hermes. 引擎需已安装且在 PATH 上. 返回其执行输出. 注意: 各工具 CLI 的非交互参数随版本变化, 若报错请检查该工具版本对应 flag.',
+        parameters: {
+            engine: "引擎 id: codex / claude-code / opencode / openclaw / hermes (实验 API 不支持委派)",
+            prompt: '派发的任务描述 (作为单参数传给该引擎 CLI)',
+            model: '可选, 强制指定模型 (如 deepseek/deepseek-v4-flash), 需引擎支持',
+            cwd: '可选, 工作目录, 默认当前目录'
+        },
+        execute: async (args) => {
+            const engine = String(args.engine || '').trim();
+            const prompt = String(args.prompt || '').trim();
+            if (!engine)
+                return { success: false, error: 'engine 必填' };
+            if (!prompt)
+                return { success: false, error: 'prompt 必填' };
+            const cwd = args.cwd ? String(args.cwd).trim() : undefined;
+            const model = args.model ? String(args.model).trim() : undefined;
+            const result = await delegateToEngine(engine, prompt, { cwd: cwd || undefined, ...(model ? { model } : {}) });
+            if (!result.success) {
+                return { success: false, error: result.error, output: result.output };
+            }
+            return {
+                success: true,
+                output: `🤖 ${engine} 执行结果 (exitCode=${result.exitCode}):\n${result.output || '(无输出)'}`
+            };
+        }
+    });
     ctx.tools.set('get_identity', {
         name: 'get_identity',
         description: '获取当前智能体身份信息',
@@ -1217,12 +1249,26 @@ export function registerWalletTools(ctx) {
     });
     ctx.tools.set('polymarket_get_orders', {
         name: 'polymarket_get_orders',
-        description: '查询 Polymarket 订单.',
-        parameters: { marketId: '可选 按市场 ID 过滤' },
+        description: '查询 Polymarket 开放订单. 需要钱包私钥 privateKey 做 API key 鉴权.',
+        parameters: {
+            privateKey: '钱包私钥 0x... (必填)',
+            marketId: '可选 按市场 ID 过滤',
+            apiKey: '可选, 已存在的 API key',
+            apiSecret: '可选, API secret',
+            apiPassphrase: '可选, API passphrase',
+            funder: '可选, 资金地址',
+        },
         execute: async (args) => {
             try {
                 const { getOrders } = await import('../constraint-runtime/dist/tools/PolymarketSDK/getOrders.js').catch(() => import('../constraint-runtime/src/tools/PolymarketSDK/getOrders.js'));
-                const orders = await getOrders(args.marketId ? { marketId: String(args.marketId) } : {});
+                const orders = await getOrders({
+                    privateKey: String(args.privateKey),
+                    marketId: args.marketId ? String(args.marketId) : undefined,
+                    apiKey: args.apiKey ? String(args.apiKey) : undefined,
+                    apiSecret: args.apiSecret ? String(args.apiSecret) : undefined,
+                    apiPassphrase: args.apiPassphrase ? String(args.apiPassphrase) : undefined,
+                    funder: args.funder ? String(args.funder) : undefined,
+                });
                 return { success: true, output: `📋 订单列表: ${JSON.stringify(orders, null, 2).substring(0, 1500)}` };
             }
             catch (e) {
@@ -1232,19 +1278,40 @@ export function registerWalletTools(ctx) {
     });
     ctx.tools.set('polymarket_create_order', {
         name: 'polymarket_create_order',
-        description: '在 Polymarket 下单 (BUY/SELL).',
-        parameters: { marketId: '市场 ID (必填)', side: 'BUY 或 SELL (必填)', price: '价格 0-1 (必填)', size: '数量 USDC (必填)' },
+        description: '在 Polymarket 下单 (BUY/SELL). 需要钱包私钥 privateKey 做 EIP-712 订单签名与 API key 派生.',
+        parameters: {
+            privateKey: '下单钱包私钥 0x... (必填)',
+            marketId: '市场 ID (必填)',
+            side: 'BUY 或 SELL (必填)',
+            price: '价格 0-1 (必填, 需符合 tickSize)',
+            size: '数量 USDC (必填)',
+            outcome: '可选, Yes/No 或索引 0/1, 默认第一个 (通常 Yes)',
+            tokenId: '可选, 显式条件代币 tokenID (优先于 outcome)',
+            orderType: '可选, GTC (默认) 或 GTD',
+            apiKey: '可选, 已存在的 API key (需配合 apiSecret/apiPassphrase)',
+            apiSecret: '可选, API secret',
+            apiPassphrase: '可选, API passphrase',
+            funder: '可选, 资金地址 (默认=私钥地址)',
+        },
         execute: async (args) => {
             try {
                 const { createOrder } = await import('../constraint-runtime/dist/tools/PolymarketSDK/createOrder.js').catch(() => import('../constraint-runtime/src/tools/PolymarketSDK/createOrder.js'));
                 const r = await createOrder({
+                    privateKey: String(args.privateKey),
                     marketId: String(args.marketId),
                     side: String(args.side).toUpperCase() === 'SELL' ? 'SELL' : 'BUY',
                     price: Number(args.price),
                     size: Number(args.size),
+                    outcome: args.outcome !== undefined ? args.outcome : undefined,
+                    tokenId: args.tokenId ? String(args.tokenId) : undefined,
+                    orderType: args.orderType ? String(args.orderType) : undefined,
+                    apiKey: args.apiKey ? String(args.apiKey) : undefined,
+                    apiSecret: args.apiSecret ? String(args.apiSecret) : undefined,
+                    apiPassphrase: args.apiPassphrase ? String(args.apiPassphrase) : undefined,
+                    funder: args.funder ? String(args.funder) : undefined,
                 });
                 if (r.success)
-                    return { success: true, output: `✅ 订单: ${r.message}` };
+                    return { success: true, output: `✅ 订单已提交: orderId=${r.orderId} status=${r.status}` };
                 return { success: false, error: r.message, output: r.message };
             }
             catch (e) {
@@ -1254,12 +1321,26 @@ export function registerWalletTools(ctx) {
     });
     ctx.tools.set('polymarket_cancel_order', {
         name: 'polymarket_cancel_order',
-        description: '取消 Polymarket 订单.',
-        parameters: { orderId: '订单 ID (必填)' },
+        description: '取消 Polymarket 订单. 需要钱包私钥 privateKey 做 API key 鉴权.',
+        parameters: {
+            privateKey: '钱包私钥 0x... (必填)',
+            orderId: '订单 ID (必填)',
+            apiKey: '可选, 已存在的 API key',
+            apiSecret: '可选, API secret',
+            apiPassphrase: '可选, API passphrase',
+            funder: '可选, 资金地址',
+        },
         execute: async (args) => {
             try {
                 const { cancelOrder } = await import('../constraint-runtime/dist/tools/PolymarketSDK/cancelOrder.js').catch(() => import('../constraint-runtime/src/tools/PolymarketSDK/cancelOrder.js'));
-                const r = await cancelOrder({ orderId: String(args.orderId) });
+                const r = await cancelOrder({
+                    privateKey: String(args.privateKey),
+                    orderId: String(args.orderId),
+                    apiKey: args.apiKey ? String(args.apiKey) : undefined,
+                    apiSecret: args.apiSecret ? String(args.apiSecret) : undefined,
+                    apiPassphrase: args.apiPassphrase ? String(args.apiPassphrase) : undefined,
+                    funder: args.funder ? String(args.funder) : undefined,
+                });
                 if (r.success)
                     return { success: true, output: `✅ 取消订单: ${r.message}` };
                 return { success: false, error: r.message, output: r.message };

package/dist/constraint-runtime/src/tools/PolymarketSDK/cancelOrder.js

@@ -1,6 +1,21 @@
+import { buildClobClient } from './clobShared';
 export async function cancelOrder(params) {
-    return {
-        success: false,
-        message: 'Polymarket order cancellation requires CLOB client with authentication. Use the Polymarket web interface to cancel orders.',
-    };
+    if (!params.privateKey) {
+        return { success: false, message: '取消订单需要提供钱包私钥 privateKey' };
+    }
+    if (!params.orderId) {
+        return { success: false, message: 'orderId 必填' };
+    }
+    try {
+        const { client } = await buildClobClient({
+            privateKey: params.privateKey,
+            creds: { apiKey: params.apiKey, apiSecret: params.apiSecret, apiPassphrase: params.apiPassphrase },
+            funder: params.funder,
+        });
+        const resp = await client.cancelOrder({ orderID: params.orderId });
+        return { success: true, message: '已提交取消', raw: resp };
+    }
+    catch (e) {
+        return { success: false, message: `取消失败: ${e?.message || e}` };
+    }
 }

package/dist/constraint-runtime/src/tools/PolymarketSDK/clobShared.js

@@ -0,0 +1,104 @@
+/**
+ * Polymarket CLOB 下单/查单/撤单 共享依赖
+ *
+ * 真实实现基于 @polymarket/clob-client (ClobClient):
+ *   - 签名用 viem WalletClient (privateKeyToAccount + polygon + http transport)
+ *   - 下单前需 ApiKeyCreds (key/secret/passphrase), 由 createOrDeriveApiKey() 从签名派生
+ *   - tokenID / tickSize / negRisk 来自 Gamma 市场元数据 (https://gamma-api.polymarket.com/markets/:id)
+ *
+ * chainId = 137 (Polygon), host = https://clob.polymarket.com
+ */
+import { ClobClient, OrderType, Side } from '@polymarket/clob-client';
+import { createWalletClient, http } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { polygon } from 'viem/chains';
+export const CLOB_HOST = 'https://clob.polymarket.com';
+export const CHAIN_ID = 137;
+export function normalizePrivateKey(pk) {
+    const s = pk.startsWith('0x') ? pk : `0x${pk}`;
+    return s;
+}
+function safeParseArray(v) {
+    if (Array.isArray(v))
+        return v;
+    if (typeof v === 'string') {
+        try {
+            const parsed = JSON.parse(v);
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    return [];
+}
+/**
+ * 从 Gamma 取市场元数据: clobTokenIds / outcomes / tickSize / negRisk.
+ * 优先用 Gamma 路径端点 (带 tickSize/negRisk), 失败回退 polymarket-sdk listMarkets({id}).
+ */
+export async function fetchMarketMeta(marketId) {
+    try {
+        const res = await fetch(`https://gamma-api.polymarket.com/markets/${encodeURIComponent(marketId)}`);
+        if (res.ok) {
+            const m = await res.json();
+            return {
+                clobTokenIds: safeParseArray(m.clobTokenIds),
+                outcomes: safeParseArray(m.outcomes),
+                tickSize: typeof m.tickSize === 'string' ? m.tickSize : '0.01',
+                negRisk: !!m.negRisk,
+            };
+        }
+    }
+    catch {
+        // fall through to sdk
+    }
+    const { listMarkets } = await import('polymarket-sdk').catch(() => ({ listMarkets: async () => [] }));
+    const ms = await listMarkets({ id: marketId });
+    const m = ms?.[0];
+    if (!m)
+        throw new Error(`未找到市场: ${marketId}`);
+    return {
+        clobTokenIds: safeParseArray(m.clobTokenIds),
+        outcomes: safeParseArray(m.outcomes),
+        tickSize: '0.01',
+        negRisk: false,
+    };
+}
+/**
+ * 由 outcome (如 "Yes"/"No" 或索引 0/1) 或显式 tokenId 解析出要交易的 tokenID.
+ * 都不给 → 默认取第一个 clobTokenId (通常是 "Yes").
+ */
+export function resolveTokenId(meta, tokenId, outcome) {
+    if (tokenId)
+        return tokenId;
+    if (!meta.clobTokenIds || meta.clobTokenIds.length === 0)
+        return undefined;
+    if (outcome === undefined || outcome === null)
+        return meta.clobTokenIds[0];
+    if (typeof outcome === 'number')
+        return meta.clobTokenIds[outcome];
+    const idx = meta.outcomes.findIndex((o) => String(o).toLowerCase() === String(outcome).toLowerCase());
+    return idx >= 0 ? meta.clobTokenIds[idx] : undefined;
+}
+/**
+ * 构造已鉴权的 ClobClient.
+ *  - 若提供完整 apiKey/apiSecret/apiPassphrase → 直接用
+ *  - 否则用签名派生 ApiKey (createOrDeriveApiKey, 需联网)
+ * signatureType = 0 (EOA / 浏览器钱包, 对应原始私钥签名)
+ */
+export async function buildClobClient(params) {
+    const account = privateKeyToAccount(normalizePrivateKey(params.privateKey));
+    const signer = createWalletClient({ account, chain: polygon, transport: http() });
+    const address = account.address;
+    let creds;
+    if (params.creds?.apiKey && params.creds?.apiSecret && params.creds?.apiPassphrase) {
+        creds = { key: params.creds.apiKey, secret: params.creds.apiSecret, passphrase: params.creds.apiPassphrase };
+    }
+    if (!creds) {
+        const tmp = new ClobClient(CLOB_HOST, CHAIN_ID, signer);
+        creds = await tmp.createOrDeriveApiKey();
+    }
+    const client = new ClobClient(CLOB_HOST, CHAIN_ID, signer, creds, 0, params.funder ?? address);
+    return { client, address };
+}
+export { OrderType, Side };

package/dist/constraint-runtime/src/tools/PolymarketSDK/createOrder.js

@@ -1,6 +1,36 @@
+import { buildClobClient, fetchMarketMeta, resolveTokenId } from './clobShared';
 export async function createOrder(params) {
-    return {
-        success: false,
-        message: 'Polymarket order creation requires CLOB client with authentication. Use the Polymarket web interface to create orders.',
-    };
+    if (!params.privateKey) {
+        return { success: false, message: '下单需要提供钱包私钥 privateKey (用于 EIP-712 订单签名)' };
+    }
+    if (!params.marketId) {
+        return { success: false, message: 'marketId 必填' };
+    }
+    try {
+        const meta = await fetchMarketMeta(params.marketId);
+        const tokenID = resolveTokenId(meta, params.tokenId, params.outcome);
+        if (!tokenID) {
+            return { success: false, message: '无法解析 tokenID (outcome 不匹配或市场无 clobTokenIds)' };
+        }
+        const { client } = await buildClobClient({
+            privateKey: params.privateKey,
+            creds: { apiKey: params.apiKey, apiSecret: params.apiSecret, apiPassphrase: params.apiPassphrase },
+            funder: params.funder,
+        });
+        const resp = await client.createAndPostOrder({
+            tokenID,
+            price: Number(params.price),
+            size: Number(params.size),
+            side: params.side,
+        }, { tickSize: meta.tickSize, negRisk: meta.negRisk }, (params.orderType ?? 'GTC'));
+        return {
+            success: true,
+            orderId: resp?.orderID ?? resp?.id,
+            status: resp?.status,
+            raw: resp,
+        };
+    }
+    catch (e) {
+        return { success: false, message: `下单失败: ${e?.message || e}` };
+    }
 }

package/dist/constraint-runtime/src/tools/PolymarketSDK/getOrders.js

@@ -1,6 +1,19 @@
+import { buildClobClient } from './clobShared';
 export async function getOrders(params = {}) {
-    return {
-        orders: [],
-        message: 'Polymarket order retrieval requires CLOB client with authentication. Use the Polymarket web interface to view orders.',
-    };
+    if (!params.privateKey) {
+        return { orders: [], message: '查询订单需要提供钱包私钥 privateKey' };
+    }
+    try {
+        const { client } = await buildClobClient({
+            privateKey: params.privateKey,
+            creds: { apiKey: params.apiKey, apiSecret: params.apiSecret, apiPassphrase: params.apiPassphrase },
+            funder: params.funder,
+        });
+        const resp = await client.getOpenOrders(params.marketId ? { market: params.marketId } : {});
+        const orders = Array.isArray(resp) ? resp : resp?.orders ?? [];
+        return { orders, message: 'OK' };
+    }
+    catch (e) {
+        return { orders: [], message: `查询失败: ${e?.message || e}` };
+    }
 }

package/dist/external-engines/delegate.js

@@ -0,0 +1,148 @@
+/**
+ * external-engines/delegate.ts — 把编码任务委派给本机已安装的外部编码智能体 CLI
+ *
+ * 与 discovery 配合: discovery 找到 CLI 路径 + 规格, 这里真正 spawn 起来跑任务.
+ *
+ * 安全边界 (参照 shell-tool.ts 的护栏思路):
+ *   - 只委派给"已发现且 installed"的引擎 (cliPath 来自 command -v, 不由用户输入)
+ *   - prompt 作为单一 argv 传入, shell: false, 杜绝命令注入
+ *   - 默认 120s 超时 (BOLLOON_ENGINE_DELEGATE_TIMEOUT_MS 可配), 超时杀进程
+ *   - experiment 引擎是 API 供应商不是 CLI, 不支持委派 (提示改用 import)
+ */
+import { spawn } from 'child_process';
+import { discoverEngines, buildDelegateArgs } from './discovery.js';
+function delegateTimeoutMs() {
+    const env = Number(process.env.BOLLOON_ENGINE_DELEGATE_TIMEOUT_MS);
+    return Number.isFinite(env) && env > 0 ? env : 120_000;
+}
+/**
+ * 把任务派发给指定引擎的 CLI 执行.
+ * @param id 引擎 id: codex / claude-code / opencode / openclaw / hermes
+ * @param prompt 任务描述 (作为单参数传给 CLI)
+ */
+export async function delegateToEngine(id, prompt, opts = {}) {
+    const trimmedId = String(id || '').trim();
+    const trimmedPrompt = String(prompt || '').trim();
+    if (!trimmedId)
+        return { success: false, error: 'engine id 必填', unavailable: true };
+    if (!trimmedPrompt)
+        return { success: false, error: 'prompt 必填', unavailable: false };
+    // 实验引擎是 API 供应商, 不是 CLI, 不能委派
+    if (trimmedId.startsWith('experiment:')) {
+        return {
+            success: false,
+            unavailable: true,
+            error: `引擎 ${trimmedId} 是实验 API 供应商 (无 CLI), 不能委派执行. 请先用 /api/external-engines/import 把它注册为 LLM provider 后由 Bolloon 直接调用.`,
+        };
+    }
+    // 发现引擎, 拿到 cliPath + argv 模板
+    const engines = await discoverEngines();
+    const engine = engines.find((e) => e.id === trimmedId);
+    if (!engine) {
+        return { success: false, unavailable: true, error: `未发现的引擎: ${trimmedId}` };
+    }
+    if (!engine.installed || !engine.cliPath) {
+        return {
+            success: false,
+            unavailable: true,
+            error: `引擎 ${trimmedId} 未安装 (CLI 不在 PATH 上), 无法委派. 可用 /api/external-engines 查看已安装列表.`,
+        };
+    }
+    const argv = buildDelegateArgs(trimmedId, trimmedPrompt, opts.model);
+    if (!argv) {
+        return { success: false, unavailable: true, error: `引擎 ${trimmedId} 没有配置委派参数模板` };
+    }
+    const cwd = opts.cwd || process.cwd();
+    const timeoutMs = opts.timeoutMs || delegateTimeoutMs();
+    return new Promise((resolve) => {
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        // 注意: 不要用 detached:true — 实测会让 opencode 不退出 (探针: detached=true 时 90s 仍不 exit,
+        //   detached=false 时 ~11s 正常 exit+close). opencode run --format json 退出干净, 无残留孙进程.
+        // 监听 'exit' 而非 'close': exit 在进程退出时即触发, 更稳 (close 也正常, 两者都可用).
+        const proc = spawn(engine.cliPath, argv, {
+            cwd,
+            env: { ...process.env },
+            shell: false,
+            windowsHide: true,
+            // stdin 必须 'ignore' (/dev/null): 否则 stdin 是默认管道, opencode run 会阻塞等
+            // stdin EOF 导致永不退出. stdout/stderr 用 pipe 收集输出.
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const killTree = () => {
+            try {
+                proc.kill('SIGKILL');
+            }
+            catch {
+                // 进程可能已退出, 忽略
+            }
+        };
+        const killTimer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                killTree();
+                resolve({
+                    success: false,
+                    output: stdout.slice(-8000),
+                    error: `委派超时 (${timeoutMs}ms), 已终止 ${trimmedId} 进程`,
+                    exitCode: null,
+                });
+            }
+        }, timeoutMs);
+        proc.stdout?.on('data', (d) => {
+            stdout += d.toString();
+            if (stdout.length > 8_000_000) {
+                // 超过 8MB, 截断防止内存爆炸 (仍继续收集尾部不重要)
+                stdout = stdout.slice(-8_000_000);
+            }
+        });
+        proc.stderr?.on('data', (d) => {
+            stderr += d.toString();
+            if (stderr.length > 8_000_000)
+                stderr = stderr.slice(-8_000_000);
+        });
+        proc.on('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(killTimer);
+            killTree();
+            resolve({ success: false, error: `启动 ${trimmedId} 失败: ${err.message}`, exitCode: null, unavailable: true });
+        });
+        // 用 'exit' 而非 'close': exit 在进程退出时即触发, 不被孙子进程持有的管道阻塞.
+        // setImmediate 给最后一批 stdout data 一个 tick 的 flush 机会, 避免截断.
+        proc.on('exit', (code, signal) => {
+            if (settled)
+                return;
+            setImmediate(() => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(killTimer);
+                // opencode run 会留一个 headless server 孙进程继承 stdout 管道, 让 Node 的
+                // 'close' 永不触发 / 事件循环不退出. destroy 掉我们这一侧的流句柄, 释放 event loop
+                // (孙进程的 fd 副本在它自己进程里, 不影响 Node 退出). 结果已在 stdout/stderr 字符串里.
+                try {
+                    proc.stdout?.destroy();
+                }
+                catch { /* noop */ }
+                try {
+                    proc.stderr?.destroy();
+                }
+                catch { /* noop */ }
+                killTree();
+                const combined = (stdout + (stderr ? `\n[stderr]\n${stderr}` : '')).trim();
+                if (code === 0) {
+                    resolve({ success: true, output: combined || '(无输出)', exitCode: code });
+                }
+                else if (signal) {
+                    resolve({ success: false, output: combined || '(无输出)', error: `${trimmedId} 被信号 ${signal} 终止`, exitCode: null });
+                }
+                else {
+                    resolve({ success: false, output: combined || '(无输出)', error: `${trimmedId} 退出码 ${code}`, exitCode: code });
+                }
+            });
+        });
+    });
+}