@bolloon/bolloon-agent 0.4.25 → 0.4.27

package/dist/web/server.js

@@ -1679,6 +1679,18 @@ export async function createWebServer(port = 3000, options = {}) {
                 };
                 return { ok: true, runner, kind: 'web' };
             };
+            // 2026-09-16 (M4): 初始化未就绪 → Supervisor 只诊断 (不解析执行器, 不执行任何 Goal)
+            let setupReadyForSupervisor = false;
+            try {
+                const { getSetupGateCached } = await import('../setup/setup-store.js');
+                const g = await getSetupGateCached();
+                setupReadyForSupervisor = g.gate === 'ready';
+                if (!setupReadyForSupervisor)
+                    console.warn(`[supervisor] 初始化未就绪 (${g.gate}, 阶段 ${g.state.stage}) → 只诊断, 不执行 Goal`);
+            }
+            catch {
+                console.warn('[supervisor] 初始化状态不可读 → 只诊断, 不执行 Goal');
+            }
             const sup = getSupervisor({
                 tickIntervalMs: tickMs,
                 leaseTtlMs: leaseMs,
@@ -1688,7 +1700,7 @@ export async function createWebServer(port = 3000, options = {}) {
                     broadcast({ type: 'supervisor', ...e });
                 }
                 catch { /* UI 广播失败不影响调度 */ } },
-                resolver: resolver,
+                resolver: setupReadyForSupervisor ? resolver : undefined,
             });
             // 宿主层: 跨进程单 tick 互斥 + 宿主身份/心跳落盘 + 优雅停止
             const host = await runSupervisorHost({
@@ -2937,6 +2949,299 @@ ${goalDesc}
         }
     });
     // 2026-09-16: 运行记录 (持久化 harness) — 当前 + 历史 agent 运行。跨重载可读。
+    // 2026-09-18: 智能体工具执行轨迹 + 本机 P2P 信息 (与小工具/名片交换用, 结构化)
+    // 2026-09-18 (Phase 4): 交易审计 — 里程碑 / 争议 / 责任 / 事件链 一眼可查
+    app.get('/api/x402/transactions', async (_req, res) => {
+        try {
+            const { listTransactions } = await import('../agents/x402/transaction-store.js');
+            const { aggregateMilestones } = await import('../agents/x402/milestone-settlement.js');
+            const txs = await listTransactions();
+            res.json({
+                count: txs.length,
+                transactions: txs.map((t) => ({
+                    transactionId: t.transactionId, status: t.status, settlementFact: t.settlementFact,
+                    itemId: t.itemId, amount: t.amount, currency: t.currency, network: t.network,
+                    paymentMode: t.paymentMode, chainSettled: t.chainSettled === true, txHash: t.txHash,
+                    milestones: t.milestones?.length ? aggregateMilestones(t.milestones) : null,
+                    disputed: !!t.dispute, disputeResolved: t.dispute?.resolution?.decision || null,
+                    responsibility: t.responsibility?.type || null,
+                    partial: t.settlementFact === 'partially_settled',
+                })),
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    app.get('/api/x402/transactions/:id', async (req, res) => {
+        try {
+            const { readTransaction, replayTransaction } = await import('../agents/x402/transaction-store.js');
+            const { aggregateMilestones, milestoneGoalEligibility } = await import('../agents/x402/milestone-settlement.js');
+            const rec = await readTransaction(req.params.id);
+            if (!rec)
+                return res.status(404).json({ error: '交易不存在' });
+            res.json({
+                transaction: rec,
+                milestones: rec.milestones?.length ? { list: rec.milestones, aggregate: aggregateMilestones(rec.milestones) } : null,
+                dispute: rec.dispute || null,
+                responsibility: rec.responsibility || null,
+                goalEligibility: milestoneGoalEligibility(rec, { executionOk: rec.execution?.ok === true, goalCriteriaHit: rec.goalCriteriaMet === true }),
+                replay: await replayTransaction(req.params.id),
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    app.get('/api/trace', async (req, res) => {
+        try {
+            const { listRuns } = await import('../agents/run-store.js');
+            const { runToTraceJson } = await import('../agents/trace-export.js');
+            const runs = await listRuns({ limit: Number(req.query.limit) || 20 });
+            res.json({ runs: runs.map((r) => runToTraceJson(r)) });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    app.get('/api/trace/:runId', async (req, res) => {
+        try {
+            const { readRun } = await import('../agents/run-store.js');
+            const { runToTraceText, runToTraceJson } = await import('../agents/trace-export.js');
+            const run = await readRun(req.params.runId);
+            if (!run)
+                return res.status(404).json({ error: 'run 不存在' });
+            if (String(req.query.format || 'json') === 'text') {
+                res.type('text/plain; charset=utf-8').send(runToTraceText(run));
+                return;
+            }
+            res.json(runToTraceJson(run));
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    app.get('/api/p2p/info', async (_req, res) => {
+        try {
+            const { getLocalP2pInfo, formatP2pInfoJson } = await import('../agents/p2p-info.js');
+            const info = await getLocalP2pInfo();
+            res.type('application/json').send(formatP2pInfoJson(info));
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    // 2026-09-16 (2-F/2-H): 判据 (criteria) + 长期执行面板 API —— CLI/Web 读同一份 Goal 事实
+    app.get('/api/goals/:id/criteria', async (req, res) => {
+        try {
+            const { longTermStatus } = await import('../agents/goal-criteria.js');
+            const { readGoal } = await import('../agents/goal-store.js');
+            const g = await readGoal(req.params.id);
+            if (!g)
+                return res.status(404).json({ error: 'goal 不存在' });
+            const st = await longTermStatus(req.params.id);
+            res.json({ goalId: g.goalId, objective: g.objective, status: g.status, successCriteria: g.successCriteria, completedCriteria: g.completedCriteria, criteriaSource: g.criteriaSource, criteriaConfirmed: g.criteriaConfirmed === true, criteriaVersion: g.criteriaVersion, proposedCriteria: g.proposedCriteria || null, unresolvedItems: g.unresolvedItems, evidence: (g.evidence || []).slice(-10), longTerm: st });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    app.post('/api/goals/:id/criteria', async (req, res) => {
+        try {
+            const { confirmCriteria, proposeForGoal } = await import('../agents/goal-criteria.js');
+            const { readGoal } = await import('../agents/goal-store.js');
+            const g = await readGoal(req.params.id);
+            if (!g)
+                return res.status(404).json({ error: 'goal 不存在' });
+            const criteria = Array.isArray(req.body?.criteria) ? req.body.criteria.map((c) => String(c)) : undefined;
+            if (req.body?.propose === true) {
+                const p = await proposeForGoal(req.params.id);
+                return res.json({ ok: p.ok, proposed: p.criteria, needsHuman: !!p.needsHuman, reason: p.reason || null });
+            }
+            // 默认: 确认 (可同时改内容)
+            const r = await confirmCriteria(req.params.id, { criteria, by: 'web' });
+            res.status(r.ok ? 200 : 409).json({ ok: r.ok, reason: r.reason || null, criteria: r.goal?.successCriteria, criteriaVersion: r.goal?.criteriaVersion });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200) });
+        }
+    });
+    // 长期执行面板 (纯静态页, 直接打已有 API; 未 ready 时 chat 路由本来就 503)
+    app.get('/goals', (_req, res) => {
+        res.type('html').send(`<!doctype html><meta charset="utf-8"><title>Bolloon 长期执行</title>
+<style>body{font-family:system-ui,-apple-system,"PingFang SC",sans-serif;max-width:1000px;margin:32px auto;padding:0 16px;line-height:1.55;color:#181818}
+h1{font-size:20px}h2{font-size:15px;margin-top:22px}table{border-collapse:collapse;width:100%;font-size:13px}th,td{border-bottom:1px solid #eee;padding:6px 8px;text-align:left;vertical-align:top}
+.ok{color:#0a7d32}.bad{color:#b00020}.dim{color:#666}button{font-size:12px;padding:4px 8px;margin-right:4px}code{background:#f6f6f6;padding:1px 4px;border-radius:4px}</style>
+<h1>长期执行面板</h1>
+<p class="dim">数据 = <code>/api/goals</code> · <code>/api/runs</code> · <code>/api/goals/:id/criteria</code> · <code>/api/supervisor</code> (与 CLI 同一份事实)</p>
+<div id="sup"></div>
+<h2>目标 (Goals)</h2><table id="goals"><thead><tr><th>goalId</th><th>状态</th><th>判据</th><th>下一动作</th><th>Runs</th><th>操作</th></tr></thead><tbody></tbody></table>
+<h2>运行 (Runs, 最近 20)</h2><table id="runs"><thead><tr><th>runId</th><th>goalId</th><th>状态</th><th>步数</th><th>恢复</th><th>操作</th></tr></thead><tbody></tbody></table>
+<pre id="log" class="dim"></pre>
+<script>
+const log = (m) => { document.getElementById('log').textContent = typeof m === 'string' ? m : JSON.stringify(m, null, 1); };
+async function j(u){ const r = await fetch(u); return await r.json(); }
+async function view(id){
+  const c = await j('/api/goals/'+id+'/criteria');
+  log(c);
+}
+async function act(id, what){
+  if (what === 'confirm') { const r = await fetch('/api/goals/'+id+'/criteria',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({})}); log(await r.json()); }
+  else if (what === 'propose') { const r = await fetch('/api/goals/'+id+'/criteria',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({propose:true})}); log(await r.json()); }
+  else if (what === 'wake') { const r = await fetch('/api/goals/'+id+'/wake',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({force:true})}); log(await r.json()); }
+  else if (what === 'resume') { const r = await fetch('/api/runs/'+id+'/resume',{method:'POST'}); log(await r.json()); }
+  else if (what === 'pause') { const r = await fetch('/api/runs/'+id+'/pause',{method:'POST'}); log(await r.json()); }
+  else if (what === 'abort') { const r = await fetch('/api/runs/'+id+'/abort',{method:'POST'}); log(await r.json()); }
+  refresh();
+}
+async function refresh(){
+  try {
+    const sup = await j('/api/supervisor');
+    document.getElementById('sup').innerHTML = '<b>Supervisor</b> owner='+(sup.state?.owner||'-')+' worker='+(sup.state?.workerId||'-')+' ticks='+(sup.ticks||0)+
+      ' <span class="dim">lease='+(sup.leaseTtlMs||'-')+'ms tick='+(sup.tickIntervalMs||'-')+'ms</span>';
+  } catch(e){ document.getElementById('sup').textContent = 'supervisor 不可用: '+e; }
+  const gs = await j('/api/goals');
+  const gtb = document.querySelector('#goals tbody'); gtb.innerHTML = '';
+  for (const g of (gs.goals || [])) {
+    let crit = g.successCriteria?.length ? (g.completedCriteria?.length||0)+'/'+g.successCriteria.length : '<span class="bad">无判据</span>';
+    const src = g.criteriaSource ? ' <span class="dim">('+g.criteriaSource+(g.criteriaConfirmed?'✓':'?')+')</span>' : '';
+    const tr = document.createElement('tr');
+    tr.innerHTML = '<td><code>'+g.goalId+'</code></td><td>'+g.status+'</td><td>'+crit+src+'</td><td class="dim">'+
+      ((g.continuation&&(g.continuation.nextAction||g.continuation.wakeReason))||'-')+'</td><td>'+((g.runs||[]).length)+'</td>'+
+      '<td><button onclick="view(\''+g.goalId+'\')">详情</button><button onclick="act(\''+g.goalId+'\',\'confirm\')">确认判据</button><button onclick="act(\''+g.goalId+'\',\'propose\')">提候选</button><button onclick="act(\''+g.goalId+'\',\'wake\')">唤醒</button></td>';
+    gtb.appendChild(tr);
+  }
+  const rs = await j('/api/runs');
+  const rtb = document.querySelector('#runs tbody'); rtb.innerHTML = '';
+  for (const r of (rs.runs || []).slice(-20).reverse()) {
+    const tr = document.createElement('tr');
+    tr.innerHTML = '<td><code>'+String(r.runId).slice(0,14)+'</code></td><td class="dim">'+(r.goalId||'-')+'</td><td>'+r.status+'</td><td>'+((r.steps||[]).length)+'</td><td>'+((r.recovery||[]).length)+'</td>'+
+      '<td><button onclick="act(\''+r.runId+'\',\'resume\')">resume</button><button onclick="act(\''+r.runId+'\',\'pause\')">pause</button><button onclick="act(\''+r.runId+'\',\'abort\')">abort</button></td>';
+    rtb.appendChild(tr);
+  }
+}
+refresh(); setInterval(refresh, 5000);
+</script>`);
+    });
+    // 2026-09-16 (Phase 4): Onboard API —— 与 CLI 共用同一条执行器 (src/setup/onboard.ts)
+    //   页面只负责"提交本步输入", 阶段判定/校验/真实验证/原子提交/门禁全在服务端同一份事实里。
+    const setupState = async () => {
+        const { evaluateSetup } = await import('../setup/setup-store.js');
+        const { nextStepInfo } = await import('../setup/onboard.js');
+        const ev = await evaluateSetup();
+        const next = ev.gate === 'ready' ? null : await nextStepInfo(ev.state).catch(() => null);
+        return { gate: ev.gate, stage: ev.state.stage, readiness: ev.state.readiness, readinessWhy: ev.state.readinessWhy,
+            allow: ev.state.allow, completed: ev.state.completed, inputs: ev.state.inputs, checks: ev.state.checks,
+            lastError: ev.state.lastError || null, actions: ev.state.actions, reasons: ev.reasons, nextStep: next };
+    };
+    app.get('/api/setup', async (_req, res) => {
+        try {
+            res.json(await setupState());
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200), gate: 'blocked' });
+        }
+    });
+    // 跑一步 (answers 按顺序喂给执行器; oneShot: 一步失败就返回, 不阻塞)
+    const runSetupStep = async (req, res, mode) => {
+        try {
+            const { runOnboard, ScriptedIO } = await import('../setup/onboard.js');
+            const answers = Array.isArray(req.body?.answers) ? req.body.answers.map((x) => String(x ?? '')) : [];
+            const io = new ScriptedIO(answers);
+            const r = await runOnboard({ mode, io, oneShot: true, targets: req.body?.targets });
+            res.json({ ...(await setupState()), ok: r.ok, failedStage: r.failedStage || null, errorClass: r.errorClass || null,
+                message: r.message || null, steps: r.steps, stepLog: io.log.slice(-40), summary: r.summary });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err).slice(0, 200), gate: 'blocked' });
+        }
+    };
+    app.post('/api/setup/start', async (_req, res) => { try {
+        res.json(await setupState());
+    }
+    catch (err) {
+        res.status(500).json({ error: String(err) });
+    } });
+    app.post('/api/setup/step', async (req, res) => runSetupStep(req, res, 'resume'));
+    app.post('/api/setup/resume', async (req, res) => runSetupStep(req, res, 'resume'));
+    app.post('/api/setup/test', async (req, res) => runSetupStep(req, res, 'test'));
+    app.post('/api/setup/repair', async (req, res) => runSetupStep(req, res, 'repair'));
+    app.post('/api/setup/reconfigure', async (req, res) => runSetupStep(req, res, 'reconfigure'));
+    app.post('/api/setup/commit', async (_req, res) => {
+        try {
+            const { refreshSetupState } = await import('../setup/setup-store.js');
+            const ev = await refreshSetupState({});
+            const { describeSetup } = await import('../setup/setup-store.js');
+            res.json({ ...(await setupState()), ok: ev.gate === 'ready', summary: describeSetup(ev) });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err) });
+        }
+    });
+    app.post('/api/setup/identity', async (req, res) => runSetupStep({ body: { answers: [req.body?.name] } }, res, 'resume'));
+    app.post('/api/setup/provider', async (req, res) => runSetupStep({ body: { answers: [req.body?.provider] } }, res, 'resume'));
+    // 首启页面 (零依赖, 直接打这些 API; 未 ready 时所有对话路由都是 503)
+    app.get('/setup', (_req, res) => {
+        res.type('html').send(`<!doctype html><meta charset="utf-8"><title>Bolloon 初始化</title>
+<style>body{font-family:system-ui,-apple-system,"PingFang SC",sans-serif;max-width:760px;margin:40px auto;padding:0 16px;line-height:1.6}
+h1{font-size:20px}pre{background:#f6f6f6;padding:12px;border-radius:8px;white-space:pre-wrap}
+.ok{color:#0a7d32}.bad{color:#b00020}input,select,button{font-size:15px;padding:8px;margin:4px 0}
+.row{margin:10px 0}small{color:#666}</style>
+<h1>Bolloon 初始化</h1>
+<div id="state">加载中…</div>
+<div class="row" id="form"></div>
+<div class="row"><button onclick="run('step')">提交这一步</button>
+<button onclick="run('test')">重新测试连通性/运行时</button>
+<button onclick="run('repair')">修复/迁移配置</button>
+<button onclick="fetchState()">刷新</button></div>
+<pre id="log"></pre>
+<script>
+async function fetchState(){
+  const r = await fetch('/api/setup'); const s = await r.json();
+  const ready = s.gate==='ready';
+  document.getElementById('state').innerHTML =
+    '<b>阶段</b>: '+s.stage+' &nbsp; <b>门禁</b>: <span class="'+(ready?'ok':'bad')+'">'+s.gate+'</span><br>'+
+    '<b>就绪度</b>: basic '+s.readiness.basic+' · agent '+s.readiness.agent+' · durable '+s.readiness.durable+' · network '+s.readiness.network+'<br>'+
+    '<small>已完成: '+(s.completed.join(' → ')||'(无)')+'</small><br>'+
+    '<small>下一步: '+(s.actions[0]||'')+'</small>'+
+    (s.lastError?'<br><small class="bad">上次错误 ['+s.lastError.errorClass+'] '+s.lastError.message+'</small>':'');
+  const f = document.getElementById('form');
+  const n = s.nextStep;
+  if(!n){ f.innerHTML='<b class="ok">✅ 已就绪, 可以进入对话</b>'; window.currentNeeds=null; return; }
+  window.currentNeeds=n.needs;
+  if(n.needs==='provider'){
+    f.innerHTML='<div>'+n.question+'</div><select id="v">'+ (n.choices||[]).map(c=>'<option value="'+c.value+'">'+c.label+(c.hint?' — '+c.hint:'')+'</option>').join('') +'</select>';
+  } else if(n.needs==='credential'){
+    f.innerHTML='<div>'+n.question+'</div><input id="v" type="password" placeholder="API key (不会回显)" autocomplete="off">';
+  } else if(n.needs==='none'){
+    f.innerHTML='<div>'+n.question+' (点上面按钮执行)</div>';
+  } else {
+    f.innerHTML='<div>'+n.question+'</div><input id="v" value="'+(n.defaultValue||'')+'">';
+  }
+}
+async function run(ep){
+  const v=document.getElementById('v'); const n=window.currentNeeds;
+  const answers = (n==='credential'||n==='name'||n==='model'||n==='provider') && v ? [v.value] : [];
+  if(v) v.value='';                       // key 立即从 DOM 里清掉
+  const r = await fetch('/api/setup/'+ep,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({answers})});
+  const j = await r.json();
+  document.getElementById('log').textContent = (j.log||[]).join('\n') + '\n' + (j.summary||'');
+  fetchState();
+}
+fetchState();
+</script>`);
+    });
+    // 2026-09-16 (M1/M3): 初始化状态 —— CLI 与 Web 读同一份事实 (setup-state.json + 各领域 store)
+    app.get('/api/setup', async (_req, res) => {
+        try {
+            const { evaluateSetup, describeSetup, resolveBolloonHome } = await import('../setup/setup-store.js');
+            const ev = await evaluateSetup({ light: false });
+            res.json({ gate: ev.gate, stage: ev.state.stage, readiness: ev.state.readiness, allow: ev.state.allow, completed: ev.state.completed, inputs: ev.state.inputs, lastError: ev.state.lastError, reasons: ev.reasons, nextActions: ev.nextActions, summary: describeSetup(ev), bolloonHome: resolveBolloonHome() });
+        }
+        catch (err) {
+            res.status(500).json({ error: String(err?.message || err).slice(0, 200), gate: 'blocked' });
+        }
+    });
     // 2026-09-16 (2-G.1): Skills Manager —— 与 CLI `/skills` `/skill` 读同一份事实 (skills-registry.json + 技能目录)
     app.get('/api/skills', async (_req, res) => {
         try {
@@ -3037,6 +3342,8 @@ ${goalDesc}
     });
     // 手动踢一个调度周期 (调试/验收用; 不改变任何"事实来源")
     app.post('/api/supervisor/tick', async (_req, res) => {
+        if (!(await setupGate(res)))
+            return;
         try {
             const { getSupervisor } = await import('../agents/execution-supervisor.js');
             const report = await getSupervisor().tickOnce();
@@ -4275,7 +4582,29 @@ ${goalDesc}
             console.log(`[SSE] 客户端断开 channelId=${channelId || '(broadcast)'}, 剩余=${sseClients.size}`);
         });
     });
+    // 2026-09-16 (M4): agent 执行硬门禁 —— 未 ready 时这些路由 503 + 结构化初始化状态 (Web 只显示初始化页)
+    const setupGate = async (res) => {
+        try {
+            const { getSetupGateCached } = await import('../setup/setup-store.js');
+            const { gate, state } = await getSetupGateCached();
+            if (gate === 'ready')
+                return true;
+            res.status(503).json({
+                error: `初始化未就绪 (${gate}, 阶段 ${state.stage}) — 请先完成初始化`,
+                gate, stage: state.stage, readiness: state.readiness,
+                nextActions: state.actions, lastError: state.lastError || null,
+            });
+            return false;
+        }
+        catch (err) {
+            // fail-closed: 连门禁都读不出来 → 不放行
+            res.status(503).json({ error: `初始化状态不可读 (fail-closed): ${String(err?.message || err).slice(0, 160)}`, gate: 'blocked' });
+            return false;
+        }
+    };
     app.post('/message', async (req, res) => {
+        if (!(await setupGate(res)))
+            return;
         const { text, channelId, channelDid, attachments } = req.body;
         if (!text) {
             return res.status(400).json({ error: 'No text provided' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",