@bolloon/bolloon-agent 0.4.24 → 0.4.26

package/dist/ios/agent-delegate-server.js

@@ -17,9 +17,10 @@
  */
 import express from 'express';
 import { buildAgentDelegateRequest, buildAgentResponse, buildManifestPayload, parseFrame, setLocalManifest, getLocalManifest, getRemoteManifests, cacheRemoteManifest, pickAgent, } from '../agents/agent-manifest-protocol.js';
-export function createAgentDelegateApp(transport) {
+export function createAgentDelegateApp(transport, options = {}) {
     const app = express();
     app.use(express.json({ limit: '2mb' }));
+    const executeTimeoutMs = options.executeTimeoutMs ?? 60_000;
     // ---- 本地 manifest ----
     app.get('/api/agent/local-manifest', (_req, res) => {
         res.json(getLocalManifest());
@@ -81,7 +82,10 @@ export function createAgentDelegateApp(transport) {
             }
             res.json({
                 ok: true,
-                targetAgent: targetAgent || { id: f.payload.delegatedTo, capabilities: [capability], status: 'active', name: f.payload.delegatedTo },
+                // 2026-09-15: 没缓存到对端 manifest 就如实给 null —— 旧版会编一个
+                // 「capabilities:[capability], name:<id>」的假目标, 让人以为已经知道对端是谁。
+                targetAgent: targetAgent || null,
+                targetAgentKnown: !!targetAgent,
                 response: f.payload,
             });
         }
@@ -104,18 +108,60 @@ export function createAgentDelegateApp(transport) {
             return null; // 不需要回包
         }
         if (f.type === 'agent_delegate') {
-            // 路由到本地匹配 agent
             const req = f.payload;
+            const capability = String(req?.capability || '');
+            // 2026-09-15: 严格按文档 §6 / §9 —— 只认 capabilities 含该能力且 active 的 agent。
+            //   旧实现 `|| local.agents[0]` 会把不匹配的指令塞给任意一个本地 agent,
+            //   与「pick 404 = 没有匹配能力」的语义自相矛盾。
             const local = getLocalManifest();
-            const target = local.agents.find((a) => a.capabilities.includes(req.capability) && a.status === 'active') || local.agents[0];
-            if (!target)
-                return buildAgentResponse({ ok: false, delegatedTo: 'none', summary: 'no local agent available' });
-            return buildAgentResponse({
-                ok: true,
-                delegatedTo: target.id,
-                resultCid: `mock-${Date.now()}`,
-                summary: `[${target.name}] 已处理任务: ${req.instruction?.substring(0, 30)}`,
-            });
+            const target = local.agents.find((a) => a.capabilities.includes(capability) && a.status === 'active');
+            if (!target) {
+                return buildAgentResponse({
+                    ok: false,
+                    delegatedTo: 'none',
+                    summary: `no local agent available for capability '${capability}'`,
+                    error: 'no-capability-match',
+                });
+            }
+            // 匹配到了, 但本节点没接执行器 → 如实说"干不了", 不假签收
+            if (!options.execute) {
+                return buildAgentResponse({
+                    ok: false,
+                    delegatedTo: target.id,
+                    summary: `matched agent '${target.name}' but this node has no executor wired`,
+                    error: 'no-executor',
+                });
+            }
+            try {
+                const raced = await Promise.race([
+                    options.execute({
+                        capability,
+                        instruction: String(req?.instruction || ''),
+                        docPath: req?.docPath ? String(req.docPath) : undefined,
+                        docContent: req?.docContent ? String(req.docContent) : undefined,
+                        fromAgentId: req?.fromAgentId ? String(req.fromAgentId) : undefined,
+                        fromPublicKey,
+                        targetAgentId: target.id,
+                        targetAgentName: target.name,
+                    }),
+                    new Promise((resolve) => setTimeout(() => resolve({ ok: false, summary: `executor timed out after ${executeTimeoutMs}ms`, error: 'executor-timeout' }), executeTimeoutMs)),
+                ]);
+                return buildAgentResponse({
+                    ok: !!raced.ok,
+                    delegatedTo: target.id,
+                    resultCid: raced.resultCid,
+                    summary: String(raced.summary || '').slice(0, 4000),
+                    error: raced.error,
+                });
+            }
+            catch (e) {
+                return buildAgentResponse({
+                    ok: false,
+                    delegatedTo: target.id,
+                    summary: `executor threw: ${String(e?.message || e).slice(0, 300)}`,
+                    error: 'executor-error',
+                });
+            }
         }
         return null;
     });

package/dist/ios/index.html

@@ -43,7 +43,7 @@
   </header>
 
   <!-- 主页面: 双频滑动卡片 -->
-  <main class="page-container" id="page-main" data-tab="main">
+  <main class="page-container" id="page-main" data-tab="main" hidden>
     <!-- 水平滑动卡片轨道 -->
     <div class="card-carousel" id="card-carousel">
       <div class="card-track" id="card-track">
@@ -139,6 +139,26 @@
 <button class="create-session-btn" id="btn-create-session" hidden>＋ 创建新会话</button>
 
 <!-- 创建智能体: 底部滑入加载 sheet -->
+<!-- 2026-09-16: 首启隐私同意门 — 上架要求: 用户同意前不读取本机数据 / 不连网 / 不申请任何权限 -->
+<div class="sheet" id="privacy-gate" hidden>
+  <div class="sheet-inner">
+    <div class="sheet-title" id="privacy-gate-title">隐私政策与权限说明</div>
+    <div class="sheet-text" id="privacy-gate-body"></div>
+    <a class="privacy-link" href="#" id="privacy-gate-link">阅读完整隐私政策 ›</a>
+    <button class="sheet-choice" id="privacy-agree">同意并继续</button>
+    <button class="sheet-choice sheet-cancel" id="privacy-decline">不同意</button>
+  </div>
+</div>
+
+<!-- 2026-09-16: 应用内隐私政策 (全屏, 离线可用; 权威版 = bolloon.cn/privacy.html) -->
+<div class="chat-page" id="policy-page" hidden>
+  <div class="chat-topbar">
+    <button class="icon-btn" id="policy-back">←</button>
+    <div style="flex:1;font-weight:600">隐私政策</div>
+  </div>
+  <div class="policy-body" id="policy-body"></div>
+</div>
+
 <div class="sheet" id="create-sheet" hidden>
   <div class="sheet-inner">
     <div class="spinner"></div>

package/dist/ios/manifest.json

@@ -2,7 +2,7 @@
   "name": "Bolloon Agent",
   "short_name": "Bolloon",
   "description": "去中心化智能体网络 — 手机端 (P2P / DID / 数字资源)",
-  "id": "com.bolloon.agent.mobile",
+  "id": "com.hibs.bolloon",
   "start_url": "./mobile.html",
   "scope": "./",
   "display": "standalone",

package/dist/ios/mobile-agent.js

@@ -160,11 +160,205 @@ async function applyLlmConfigToBridge() {
     }
     catch { /* 注入失败不阻塞本地执行 */ }
 }
-// ============ 本地执行 (Kotlin AgentRuntime / 内置规则) ============
+// ============ 手机端「读入网说明 → 入网」(2026-09-15) ============
+//
+// 背景: 手机端「一键入网」发出的口令是 `read https://bolloon.cn/bolloon-gateway-join.md`
+// (mobile.js DEFAULT_JOIN_PROMPT), 但手机侧此前只会走到「已收到: "…"」的兜底回复 ——
+// 也就是说这句话在手机上是**空转**的: 既不读文档, 也不入网。
+// 现在手机自己就能走完: 读说明(校验 frontmatter) → 本机 DID → 服务登记
+// (桌面可达则登记进桌面的网络 registry, 否则本机登记并如实说明) → P2P 公告(尽力) → 落盘入网态。
+// 桌面不可达不是失败: 手机是自治节点; 但每一步都如实报 ok/note, 不假装入网。
+/** 入网口令识别 (与 mobile.js 的默认 prompt 同源) */
+export const MOBILE_JOIN_DOC_RE = /read\s+(https?:\/\/\S*bolloon-gateway-join\.md)/i;
+const MOBILE_JOIN_STATE_KEY = 'bolloon_gateway_join';
+export function detectJoinDocUrl(text) {
+    const m = MOBILE_JOIN_DOC_RE.exec(String(text || ''));
+    return m ? m[1] : null;
+}
+/** 极简 SKILL.md frontmatter 解析 (只认 name/version) */
+function parseFm(text) {
+    const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(String(text || ''));
+    if (!m)
+        return {};
+    const out = {};
+    for (const line of m[1].split(/\r?\n/)) {
+        const kv = /^([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(line.trim());
+        if (!kv)
+            continue;
+        const k = kv[1].toLowerCase();
+        if (k === 'name')
+            out.name = kv[2].trim().replace(/^["']|["']$/g, '');
+        if (k === 'version')
+            out.version = kv[2].trim().replace(/^["']|["']$/g, '');
+    }
+    return out;
+}
+export async function getMobileJoinState() {
+    try {
+        const raw = typeof localStorage !== 'undefined' ? localStorage.getItem(MOBILE_JOIN_STATE_KEY) : null;
+        return raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function saveMobileJoinState(s) {
+    try {
+        if (typeof localStorage !== 'undefined')
+            localStorage.setItem(MOBILE_JOIN_STATE_KEY, JSON.stringify(s));
+    }
+    catch { /* 忽略 */ }
+}
+/**
+ * 按入网说明文档入网 (手机端自足执行)。
+ * opts.desktopBaseUrl 可注入 (测试用); 默认读 mobile-gateway 持久化的桌面基址。
+ */
+export async function joinGatewayFromDoc(docUrl, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    const steps = [];
+    const url = String(docUrl || '').trim();
+    if (!/^https?:\/\//i.test(url)) {
+        return { ok: false, docUrl: url, steps, error: `入网说明地址必须是 http(s) URL (收到: ${url.slice(0, 60)})` };
+    }
+    // ① 读入网说明 + 校验
+    let docVersion;
+    try {
+        const r = await f(url, { signal: AbortSignal.timeout(opts.timeoutMs ?? 15000) });
+        if (!r.ok) {
+            steps.push({ step: '读入网说明', ok: false, note: `文档不可达 (HTTP ${r.status})` });
+            return { ok: false, docUrl: url, steps, error: `入网说明不可达 (HTTP ${r.status})` };
+        }
+        const text = await r.text();
+        const fm = parseFm(text);
+        if (fm.name !== 'bolloon-gateway-join' && !/加入网关|bolloon-gateway-join/.test(text)) {
+            steps.push({ step: '读入网说明', ok: false, note: `不是 Bolloon 入网说明 (name=${fm.name || '无'})` });
+            return { ok: false, docUrl: url, steps, error: '该文档不是 Bolloon 网关入网说明, 拒绝据此入网' };
+        }
+        docVersion = fm.version;
+        steps.push({ step: '读入网说明', ok: true, note: `${fm.name || 'bolloon-gateway-join'} v${fm.version || '?'} (${text.length} 字符)` });
+    }
+    catch (e) {
+        steps.push({ step: '读入网说明', ok: false, note: `读取失败: ${String(e?.message || e).slice(0, 120)}` });
+        return { ok: false, docUrl: url, steps, error: `入网说明读取失败: ${String(e?.message || e).slice(0, 120)}` };
+    }
+    // ② 本机 DID (手机端身份层; 可注入, 便于测试/无 IndexedDB 环境)
+    let did = String(opts.did || '');
+    if (did) {
+        steps.push({ step: 'DID 身份', ok: true, note: `${did} (注入身份)` });
+    }
+    else {
+        try {
+            const id = await ensureIdentity();
+            did = id.did;
+            steps.push({ step: 'DID 身份', ok: true, note: `${did} (手机端本机生成)` });
+        }
+        catch (e) {
+            steps.push({ step: 'DID 身份', ok: false, note: String(e?.message || e).slice(0, 120) });
+            return { ok: false, docUrl: url, docVersion, steps, error: '手机端 DID 生成失败' };
+        }
+    }
+    const name = String(opts.name || 'phone-agent');
+    const capabilities = ['chat', 'gateway-join'];
+    // ③ 服务登记: 桌面可达 → 登记进桌面(网络) registry; 否则本机登记并如实说明
+    let desktopBase = String(opts.desktopBaseUrl ?? '');
+    if (opts.desktopBaseUrl === undefined) {
+        try {
+            const g = await import('./mobile-gateway.js');
+            desktopBase = String(g.getDesktopBaseUrl() || '');
+        }
+        catch {
+            desktopBase = '';
+        }
+    }
+    desktopBase = desktopBase.replace(/\/+$/, '');
+    let registeredOn = 'local';
+    if (desktopBase) {
+        try {
+            const r = await f(`${desktopBase}/api/registry/register`, {
+                method: 'POST', headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    agentId: did, name, wallet: '',
+                    service: { name: 'chat', description: '手机端智能体 (自足节点)', price: { amount: '0', currency: 'USDC', per: 'task' }, endpoint: '' },
+                    capabilities,
+                }),
+                signal: AbortSignal.timeout(opts.timeoutMs ?? 15000),
+            });
+            if (r.ok) {
+                registeredOn = 'desktop';
+                steps.push({ step: '服务登记', ok: true, note: `已登记进电脑端网络 registry (${desktopBase}) —— 网络内其他智能体可按能力发现我` });
+            }
+            else {
+                steps.push({ step: '服务登记', ok: false, note: `电脑端 registry 拒绝 (HTTP ${r.status}); 已改为本机登记` });
+            }
+        }
+        catch (e) {
+            steps.push({ step: '服务登记', ok: false, note: `电脑端不可达 (${String(e?.message || e).slice(0, 80)}); 已改为本机登记` });
+        }
+    }
+    else {
+        steps.push({ step: '服务登记', ok: true, note: '未配置电脑端基址 → 只在本机登记 (手机是自治节点; 设置里填电脑端地址可登记进网络 registry)' });
+    }
+    // ④ P2P 公告 (尽力): 让已连接的对端知道本机服务; 没连上不是入网失败
+    try {
+        const p2p = await import('./mobile-p2p.js');
+        let peers = 0;
+        try {
+            peers = (p2p.getConnectedPeers?.() || []).length;
+        }
+        catch {
+            peers = 0;
+        }
+        if (peers > 0 && typeof p2p.sendMobileP2PMessage === 'function') {
+            const okAnnounce = await p2p.sendMobileP2PMessage('*', 'registry.register', JSON.stringify({ agent_id: did, name, capabilities }), did);
+            steps.push({ step: 'P2P 公告', ok: !!okAnnounce, note: okAnnounce ? `已向 ${peers} 个对端广播本机声明` : `广播失败 (对端 ${peers} 个)` });
+        }
+        else {
+            steps.push({ step: 'P2P 公告', ok: false, note: '当前无已连接对端 (浏览器/未连电脑端时正常) — 本机声明已就绪, 连上即生效' });
+        }
+    }
+    catch (e) {
+        steps.push({ step: 'P2P 公告', ok: false, note: `P2P 层不可用: ${String(e?.message || e).slice(0, 80)}` });
+    }
+    // ⑤ 落盘入网态 (幂等: 同 url 再次入网覆盖时间戳)
+    saveMobileJoinState({ url, did, name, capabilities, docVersion, registeredOn, desktopBaseUrl: desktopBase || undefined, joinedAt: new Date().toISOString() });
+    const state = await getMobileJoinState();
+    steps.push({ step: '落盘入网态', ok: !!state?.did, note: `localStorage:${MOBILE_JOIN_STATE_KEY}` });
+    return { ok: true, docUrl: url, docVersion, did, steps };
+}
+/** 把入网结果渲染成给用户看的回复 (与桌面工具的 steps 汇报风格一致) */
+export function formatMobileJoinResult(r) {
+    if (!r.ok) {
+        return `❌ 入网失败: ${r.error || '未知原因'}\n\n${r.steps.map((s) => `${s.ok ? '✓' : '✗'} ${s.step}: ${s.note}`).join('\n')}`;
+    }
+    const s = r.steps.find((x) => x.step === '服务登记');
+    return [
+        '✅ 已加入全球智能体网络 (手机端自足执行)',
+        '',
+        `DID: ${r.did}`,
+        `入网说明: v${r.docVersion || '?'} (${r.docUrl})`,
+        s ? `登记: ${s.note}` : '',
+        '',
+        ...r.steps.map((x) => `${x.ok ? '✓' : '✗'} ${x.step}: ${x.note}`),
+        '',
+        '用「网络 → Agent 网络」可查看成员; 设置里填电脑端地址可把本机登记进网络 registry。',
+    ].filter((l) => l !== '').join('\n');
+}
+// ============ 本地执行 (Kotlin AgentRuntime / 离线兜底) ============
 /** 手机端本地 agent 执行 (优先 Kotlin, 离线内置规则) */
 export async function runLocalAgent(goal) {
     const win = typeof window !== 'undefined' ? window : null;
     const cap = win?.Capacitor;
+    // 2026-09-15: 「读入网说明 → 入网」在手机端本地自足执行 (先于 Kotlin 桥: 原生工具集里没有入网能力,
+    //   交给它只会得到空转回复)。这样浏览器 / WebView / 真机三种环境行为一致。
+    const joinDocUrl = detectJoinDocUrl(goal);
+    if (joinDocUrl) {
+        _lastWorklog = [`🧩 识别为入网口令: ${joinDocUrl}`];
+        const r = await joinGatewayFromDoc(joinDocUrl).catch((e) => ({
+            ok: false, docUrl: joinDocUrl, steps: [{ step: '入网', ok: false, note: String(e?.message || e).slice(0, 120) }], error: String(e?.message || e),
+        }));
+        _lastWorklog = [..._lastWorklog, ...r.steps.map((s) => `${s.ok ? '✓' : '✗'} ${s.step}: ${s.note}`)];
+        return formatMobileJoinResult(r);
+    }
     const bridge = cap && cap.Plugins && cap.Plugins.RokidBridge;
     if (bridge && cap.isNativePlatform?.()) {
         try {