@bolloon/bolloon-agent 0.4.29 → 0.4.31

package/dist/web/mobile.js

@@ -3031,3 +3031,142 @@
   document.addEventListener('DOMContentLoaded', init);
   if (document.readyState !== 'loading') init();
 })();
+
+// ============ 联系方式与持久授权 (2026-09-19) ============
+// 独立 IIFE: 不改动既有逻辑, 只用 window.BolloonCore.contacts (编译进 mobile-core.js)。
+// 分工: 手机 = 输入/OTP/确认/展示待发内容/批准/签名授权; 桌面 = 落盘/执行/等待回复/证据。
+(function () {
+  const $ = (sel) => document.querySelector(sel);
+  const C = () => (window.BolloonCore && window.BolloonCore.contacts) || null;
+  const esc = (v) => String(v == null ? '' : v).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+  function openSheet() { const el = $('#contacts-sheet'); if (el) el.hidden = false; }
+  function closeSheet() { const el = $('#contacts-sheet'); if (el) el.hidden = true; }
+  function setText(id, text) { const el = $(id); if (el) el.textContent = text; }
+
+  let _lastChallenge = null;
+
+  async function refresh() {
+    const c = C();
+    setText('#contacts-effective', '加载中...');
+    if (!c) { setText('#contacts-effective', '内核未就绪 (mobile-core 没加载)'); return; }
+    setText('#contacts-signing', c.deviceSigning()
+      ? '本机可做设备签名 (Ed25519) — 授权由这台手机签名后桌面才认'
+      : '⚠ 本机 WebView 不支持 Ed25519 设备签名 — 无法在手机上授权, 请在桌面端授权');
+    // 桌面回来先补同步排队中的授权
+    try { const fl = await c.flushQueue(); if (fl && fl.sent) setText('#contacts-signing', `已补同步 ${fl.sent} 条手机授权到桌面`); } catch (e) {}
+
+    let card = null;
+    try { card = await c.card(); } catch (e) { card = null; }
+    if (!card) { setText('#contacts-effective', '读取失败'); return; }
+    setText('#contacts-effective',
+      `当前授权: ${card.effective}` + (card.deviceSigning ? '' : ' · 本机不能签名'));
+    setText('#contacts-willnot', '不会获得权限: ' + (card.willNotGet || []).join(' · '));
+
+    // 联系方式 (只有脱敏值)
+    const list = $('#contacts-list');
+    if (list) {
+      list.innerHTML = (card.contacts && card.contacts.length)
+        ? card.contacts.map((x) => `<div class="sheet-text">${esc(x.displayValue)} <span style="color:var(--text-secondary)">[${esc(x.kind)}] ${esc(x.state)} · ${esc(x.label)}</span></div>`).join('')
+        : '<div class="sheet-text" style="color:var(--text-secondary)">还没有绑定 — 在下面输入手机号或邮箱</div>';
+    }
+
+    // 待批准 (展示待发内容 → 批准/拒绝)
+    const ap = $('#contacts-approvals');
+    if (ap) {
+      ap.innerHTML = (card.approvals && card.approvals.length)
+        ? `<div class="sheet-title" style="margin-top:10px">待你批准 (${card.approvals.length})</div>` + card.approvals.map((a) => `
+          <div style="border:1px solid var(--border);border-radius:10px;padding:8px;margin-top:6px">
+            <div class="sheet-text" style="font-weight:600">${esc(a.contactName)} · ${esc(a.channel)}${a.reallySent ? '' : ' · 本地落盘(未真实外发)'}</div>
+            <div class="sheet-text" style="font-size:12px">${a.subject ? esc(a.subject) + ' — ' : ''}${esc(a.bodyPreview)}</div>
+            <div class="sheet-text" style="font-size:11px;color:var(--text-secondary)">原因: ${esc(a.reason)}</div>
+            <div style="display:flex;gap:8px;margin-top:6px">
+              <button class="sheet-choice" data-approve="${esc(a.consentId)}" style="flex:1">批准并发送</button>
+              <button class="sheet-choice sheet-cancel" data-reject="${esc(a.consentId)}" style="flex:1">拒绝</button>
+            </div>
+          </div>`).join('')
+        : '<div class="sheet-text" style="color:var(--text-secondary);margin-top:10px">没有待批准的联系</div>';
+      ap.querySelectorAll('[data-approve]').forEach((b) => b.addEventListener('click', async () => {
+        const id = b.getAttribute('data-approve');
+        const r = await C().decide(id, 'approve');
+        alert(r && r.ok ? '已批准并发送' : '批准失败: ' + ((r && r.error) || '未知'));
+        refresh();
+      }));
+      ap.querySelectorAll('[data-reject]').forEach((b) => b.addEventListener('click', async () => {
+        const id = b.getAttribute('data-reject');
+        const r = await C().decide(id, 'reject', { reason: '手机端拒绝' });
+        alert(r && r.ok ? '已拒绝' : '拒绝失败: ' + ((r && r.error) || '未知'));
+        refresh();
+      }));
+    }
+
+    // 三个授权选项
+    const ch = $('#contacts-choices');
+    if (ch && !ch.dataset.bound) {
+      ch.dataset.bound = '1';
+      ch.innerHTML = (card.choices || []).map((x) => `<button class="sheet-choice" data-choice="${esc(x.id)}">${esc(x.label)}</button>`).join('');
+      ch.querySelectorAll('[data-choice]').forEach((b) => b.addEventListener('click', async () => {
+        const choice = b.getAttribute('data-choice');
+        const warn = choice === 'full_contact_access'
+          ? '完全授权联系方式能力: 手机号/邮箱能力交给 Agent, 普通与敏感内容不再逐次确认 (密钥/支付/合同承诺仍然拒绝)。确认吗?'
+          : choice === 'persistent' ? '长期使用: 以后 Agent 联系已验证的人不再打断你 (仍受频率/任务/证据/撤销约束)。确认吗?'
+            : '仅本次任务: 只授权当前任务使用。确认吗?';
+        if (window.confirm && !window.confirm(warn)) return;
+        const r = await C().authorize(choice);
+        if (r && r.ok) alert('已授权: 桌面已验签接受\n' + (r.note || ''));
+        else if (r && r.queued) alert('桌面暂时不在线\n授权已保存在手机本地队列, 桌面一上线自动同步\n(' + (r.error || '') + ')');
+        else alert('授权失败: ' + ((r && r.error) || '未知'));
+        refresh();
+      }));
+    }
+  }
+
+  function bindEvents() {
+    const item = $('#item-contacts');
+    if (item) item.addEventListener('click', () => { openSheet(); refresh(); });
+    const close = $('#contacts-close');
+    if (close) close.addEventListener('click', closeSheet);
+
+    const bind = $('#contacts-bind');
+    if (bind) bind.addEventListener('click', async () => {
+      const v = ($('#contacts-value') || {}).value || '';
+      if (!v.trim()) { alert('先输入手机号或邮箱'); return; }
+      const isEmail = /@/.test(v);
+      const r = await C().bind(isEmail ? 'email' : 'phone', v.trim(), isEmail ? undefined : 'CN');
+      if (!r || !r.ok) { alert('绑定失败: ' + ((r && r.error) || '未知')); return; }
+      _lastChallenge = r.data;
+      alert('已登记 ' + r.data.displayValue + '\n通道: ' + (r.data.channelLabel || '') +
+        (r.data.otpForLocalSink ? '\n本地落盘验证码: ' + r.data.otpForLocalSink : '\n验证码已通过通道发出, 收到后填在下面'));
+      refresh();
+    });
+
+    const verify = $('#contacts-verify');
+    if (verify) verify.addEventListener('click', async () => {
+      const code = ($('#contacts-code') || {}).value || '';
+      if (!_lastChallenge) { alert('先绑定一个手机号或邮箱'); return; }
+      const r = await C().verify(_lastChallenge.contactId, _lastChallenge.challengeId, code.trim());
+      if (!r || !r.ok) { alert('验证失败: ' + ((r && r.error) || '未知')); return; }
+      alert('验证通过: ' + r.data.displayValue + '\n下一步: 选择下面的授权等级 (验证 ≠ 自动长期授权)');
+      refresh();
+    });
+
+    const revoke = $('#contacts-revoke-all');
+    if (revoke) revoke.addEventListener('click', async () => {
+      if (window.confirm && !window.confirm('撤销全部联系方式授权? 之后 Agent 不能再自动联系任何人 (历史证据保留)')) return;
+      const card = await C().card();
+      const grants = (card && card.grants) || [];
+      if (!grants.length) { alert('当前没有生效中的授权'); return; }
+      let done = 0, err = '';
+      for (const g of grants) {
+        if (g.status !== 'active') continue;
+        const r = await C().revoke(g.grantId, '手机端收回');
+        if (r && r.ok) done++; else err = (r && r.error) || '未知';
+      }
+      alert(done ? `已撤销 ${done} 条授权` : ('撤销未完成: ' + err));
+      refresh();
+    });
+  }
+
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', bindEvents);
+  else bindEvents();
+})();

package/dist/web/routes-contacts.js

@@ -0,0 +1,420 @@
+/**
+ * routes-contacts.ts — 联系方式 / 授权 / 配对 的桌面端 API (2026-09-19, Phase 5/6)
+ *
+ * 全部返回**脱敏**数据: 完整手机号/邮箱永不出现在响应里。
+ * 与手机端的分工 (leo 冻结):
+ *   手机负责 输入 + OTP 确认 + 生物识别授权 + 展示待发内容 + 批准高风险联系
+ *   桌面负责 长期 Goal/Run、执行、恢复、持久化状态、证据
+ * 同步只传: identityId / contactId / verificationStatus / capability / consentScope / provider /
+ *          secretRef 的关联状态 —— **不传**明文、不传密钥。
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { ContactChain } from '../agents/contacts/chain.js';
+const PAIRING_TTL_MS = 5 * 60_000;
+/** 明显的明文联系方式/密钥 —— 同步载荷里出现就直接拒绝 (防止"顺手同步了明文") */
+export function looksLikePlaintextSecret(value) {
+    const walk = (v, pathStr) => {
+        if (v == null)
+            return null;
+        if (typeof v === 'string') {
+            const s = v.trim();
+            if (/\b(sk-[A-Za-z0-9]{12,}|AKIA[0-9A-Z]{12,}|ghp_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{20,})\b/.test(s))
+                return `${pathStr}: 疑似密钥明文`;
+            if (/\b(password|passwd|smtp_pass|api_secret|refresh_token|client_secret)\b/i.test(pathStr) && s.length > 0)
+                return `${pathStr}: 疑似秘密字段`;
+            // 明文邮箱/手机号: 只有在 key 明确表示"值"时才拦 (displayValue 是脱敏的, 不会匹配)
+            if (/[^@\s]+@[^@\s]+\.[^@\s]+/.test(s) && !/^\*|@\*/.test(s) && s.includes('*') === false)
+                return `${pathStr}: 疑似邮箱明文`;
+            if (/^\+?\d{8,15}$/.test(s.replace(/[^\d+]/g, '')) && /value|phone|number|to$/i.test(pathStr))
+                return `${pathStr}: 疑似手机号明文`;
+            return null;
+        }
+        if (Array.isArray(v)) {
+            for (let i = 0; i < v.length; i++) {
+                const r = walk(v[i], `${pathStr}[${i}]`);
+                if (r)
+                    return r;
+            }
+            return null;
+        }
+        if (typeof v === 'object') {
+            for (const [k, vv] of Object.entries(v)) {
+                const r = walk(vv, pathStr ? `${pathStr}.${k}` : k);
+                if (r)
+                    return r;
+            }
+            return null;
+        }
+        return null;
+    };
+    return walk(value, '');
+}
+export function registerContactRoutes(app, opts = {}) {
+    const pairs = opts.pairs || new Map();
+    const ownerDidFromDisk = () => {
+        try {
+            const f = path.join(process.env.HOME || os.homedir(), '.bolloon', 'identity', 'user.json');
+            const j = JSON.parse(fs.readFileSync(f, 'utf8'));
+            if (j?.did)
+                return String(j.did);
+        }
+        catch { /* 还没有用户身份 → 用本地占位 */ }
+        return globalThis.__bolloonUserDid || 'did:bolln:local';
+    };
+    const chainFor = (ownerDid) => opts.chain || new ContactChain({
+        home: opts.home,
+        ownerDid: ownerDid || opts.ownerDid || ownerDidFromDisk(),
+        displayName: '本机用户',
+    });
+    const chainOf = (req) => chainFor(String(req?.body?.ownerDid || opts.ownerDid || ''));
+    // ── 列表 (脱敏) ────────────────────────────────────────────────────────────
+    app.get('/api/contacts', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            res.json({
+                ok: true,
+                contacts: await c.listAuthorized(),
+                channels: c.channels(),
+                approvals: (await c.consents.list('pending')).map((a) => ({
+                    consentId: a.consentId, contactId: a.contactId, contactName: a.contactName, channel: a.channel,
+                    provider: a.provider, reallySent: a.reallySent, subject: a.subject, bodyPreview: a.bodyPreview,
+                    goalId: a.goalId, reason: a.reason, createdAt: a.createdAt, expiresAt: a.expiresAt,
+                })),
+                waiting: (await c.store.readLedger({ limit: 200 })).filter((l) => l.activity === 'contact.sent').slice(-10),
+            });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 绑定 (Phase 2/3): 输入 → 规范化 → 隐私说明 → 发验证码 → pending ─────────
+    app.post('/api/contacts/bind', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const kind = String(req.body?.kind || '');
+            if (kind !== 'phone' && kind !== 'email')
+                return res.status(400).json({ ok: false, error: 'kind 必须是 phone 或 email' });
+            const r = await c.bind({
+                kind,
+                value: String(req.body?.value || ''),
+                region: req.body?.region ? String(req.body.region) : undefined,
+                provider: req.body?.provider ? String(req.body.provider) : undefined,
+                secretRef: req.body?.secretRef ? String(req.body.secretRef) : undefined,
+                aliases: Array.isArray(req.body?.aliases) ? req.body.aliases.map(String) : undefined,
+                note: req.body?.note ? String(req.body.note) : undefined,
+                source: req.body?.source === 'agent_card' ? 'agent_card' : 'user_input',
+            });
+            if (!r.ok)
+                return res.status(400).json({ ok: false, error: r.error });
+            res.json({
+                ok: true,
+                contactId: r.contact.contactId,
+                displayValue: r.contact.displayValue,
+                verificationStatus: r.contact.verificationStatus,
+                channelLabel: r.channelLabel,
+                challengeId: r.challengeId,
+                // 只有本地落盘通道才回显验证码 (真外发通道不回显, 也不会出现在响应里)
+                otpForLocalSink: r.otpForLocalSink,
+                privacy: '完整手机号/邮箱不会进入 prompt / Run / Git; 外部只看到 已验证/可联系/不可联系/需要重新授权',
+            });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/verify', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.verify({ contactId: String(req.body?.contactId || ''), challengeId: String(req.body?.challengeId || ''), code: String(req.body?.code || '') });
+            if (!r.ok)
+                return res.status(400).json({ ok: false, error: r.error });
+            res.json({ ok: true, contactId: r.contact.contactId, displayValue: r.contact.displayValue, verificationStatus: r.contact.verificationStatus, capabilities: r.contact.capabilities });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/:id/revoke', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.revoke({ contactId: String(req.params.id), by: String(req.body?.by || 'user'), reason: req.body?.reason ? String(req.body.reason) : undefined });
+            if (!r.ok)
+                return res.status(404).json({ ok: false, error: r.error });
+            res.json({ ok: true, evidenceRef: r.evidenceRef, affectedGoals: r.affectedGoals });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 任务级授权 (把联系方式绑定到某个长期任务) ───────────────────────────────
+    app.post('/api/contacts/:id/authorize', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.authorizeForTask({ contactId: String(req.params.id), goalId: String(req.body?.goalId || ''), by: String(req.body?.by || 'user') });
+            if (!r.ok)
+                return res.status(400).json({ ok: false, error: r.error });
+            res.json({ ok: true, contactId: r.contact.contactId, consentScope: r.contact.consentScope });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 预览 (不发送) ──────────────────────────────────────────────────────────
+    app.post('/api/contacts/preview', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.preview({ contactId: String(req.body?.contactId || ''), goalId: req.body?.goalId ? String(req.body.goalId) : undefined, subject: req.body?.subject ? String(req.body.subject) : undefined, body: String(req.body?.body || '') });
+            res.json({ ok: true, allowed: r.decision.allowed, requiresApproval: r.decision.requiresApproval, blockKind: r.decision.blockKind, reallySent: r.decision.reallySent, preview: r.text });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 发送 (走 policy; 需要批准就返回 awaiting_approval) ───────────────────────
+    app.post('/api/contacts/send', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.send({
+                contactId: String(req.body?.contactId || ''),
+                goalId: req.body?.goalId ? String(req.body.goalId) : undefined,
+                runId: req.body?.runId ? String(req.body.runId) : undefined,
+                subject: req.body?.subject ? String(req.body.subject) : undefined,
+                body: String(req.body?.body || ''),
+                requestId: req.body?.requestId ? String(req.body.requestId) : undefined,
+                replyExpected: req.body?.replyExpected !== false,
+            });
+            const code = r.status === 'denied' ? 409 : r.status === 'failed' ? 502 : 200;
+            res.status(code).json({ ok: r.status === 'sent' || r.status === 'awaiting_reply', ...r });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 批准 / 拒绝 (人工授权) ─────────────────────────────────────────────────
+    app.post('/api/contacts/approvals/:id/approve', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.approveAndSend(String(req.params.id), { by: String(req.body?.by || 'user'), via: 'web', body: req.body?.body ? String(req.body.body) : undefined });
+            const code = r.ok ? 200 : (String(r.error || '').includes('not_found') ? 404 : 400);
+            res.status(code).json({ ok: r.ok, error: r.error, status: r.status, requestId: r.requestId });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/approvals/:id/reject', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.consents.reject(String(req.params.id), { by: String(req.body?.by || 'user'), reason: req.body?.reason ? String(req.body.reason) : undefined });
+            const code = r.ok ? 200 : (String(r.error || '').includes('not_found') ? 404 : 400);
+            const cons = r.consent;
+            if (cons) {
+                await c.store.appendLedger({
+                    ts: new Date().toISOString(), activity: 'contact.rejected', contactId: cons.contactId, goalId: cons.goalId,
+                    detail: `人工拒绝 (by ${String(req.body?.by || 'user')}${req.body?.reason ? `, ${req.body.reason}` : ''}) · consent=${cons.consentId}`,
+                });
+            }
+            res.status(code).json({ ok: r.ok, error: r.error });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 回复入口 (通道回调 / 手机转投): 来源校验不过就不唤醒、不入证据 ──────────────
+    app.post('/api/contacts/reply', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.reply({
+                requestId: req.body?.requestId ? String(req.body.requestId) : undefined,
+                threadToken: req.body?.threadToken ? String(req.body.threadToken) : undefined,
+                from: String(req.body?.from || ''),
+                body: String(req.body?.body || ''),
+                eventId: req.body?.eventId ? String(req.body.eventId) : undefined,
+            });
+            const code = r.ok ? 200 : (r.reason === 'source_untrusted' ? 403 : 404);
+            res.status(code).json({ ok: r.ok, woke: r.woke, goalId: r.goalId, reason: r.reason, evidenceRef: r.evidenceRef });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 手机—桌面配对 (Phase 5): 只同步 capability, 不同步明文/密钥 ───────────────
+    app.post('/api/contacts/pairing/challenge', async (_req, res) => {
+        const now = Date.now();
+        const pairingId = `pair-${now.toString(36)}-${crypto.randomBytes(3).toString('hex')}`;
+        const p = { pairingId, code: String(crypto.randomInt(0, 1_000_000)).padStart(6, '0'), createdAt: now, expiresAt: now + PAIRING_TTL_MS };
+        pairs.set(pairingId, p);
+        res.json({ ok: true, pairingId, code: p.code, expiresAt: p.expiresAt, note: '手机扫码/深链确认后调 /confirm; 挑战 5 分钟有效且一次性' });
+    });
+    app.post('/api/contacts/pairing/confirm', async (req, res) => {
+        try {
+            const pairingId = String(req.body?.pairingId || '');
+            const p = pairs.get(pairingId);
+            if (!p)
+                return res.status(404).json({ ok: false, error: 'pairing_not_found' });
+            if (p.usedAt)
+                return res.status(409).json({ ok: false, error: 'pairing_already_used' });
+            if (p.expiresAt < Date.now())
+                return res.status(410).json({ ok: false, error: 'pairing_expired' });
+            if (String(req.body?.code || '') !== p.code)
+                return res.status(401).json({ ok: false, error: 'pairing_code_mismatch' });
+            // 明文字段直接拒绝 —— 同步只允许传 capability 视图
+            const incoming = req.body?.contacts;
+            const leak = looksLikePlaintextSecret(incoming);
+            if (leak)
+                return res.status(400).json({ ok: false, error: `同步载荷含明文/秘密, 已拒绝: ${leak}` });
+            p.usedAt = Date.now();
+            p.deviceDid = req.body?.deviceDid ? String(req.body.deviceDid) : undefined;
+            pairs.set(pairingId, p);
+            const accepted = [];
+            const rejected = [];
+            const c = chainOf(req);
+            const allowedKeys = ['contactId', 'kind', 'displayValue', 'verificationStatus', 'capabilities', 'consentScope', 'provider', 'secretRef', 'state'];
+            for (const item of Array.isArray(incoming) ? incoming : []) {
+                const clean = {};
+                for (const k of allowedKeys)
+                    if (item && k in item)
+                        clean[k] = item[k];
+                const known = clean.contactId ? await c.store.getContact(String(clean.contactId)) : null;
+                if (!known)
+                    rejected.push({ contactId: clean.contactId, reason: '桌面端不认识这个 contactId (需要在桌面端绑定/接收能力)' });
+                else
+                    accepted.push({ contactId: known.contactId, displayValue: known.displayValue, verificationStatus: known.verificationStatus, parity: 'capability-only' });
+            }
+            res.json({
+                ok: true, deviceDid: p.deviceDid, accepted, rejected,
+                note: '两端只对齐 contactId/状态/capability; 明文与密钥各自留在本机',
+                evidence: await c.store.appendLedger({
+                    ts: new Date().toISOString(), activity: 'contact.discovered',
+                    detail: `手机—桌面配对完成 (deviceDid=${p.deviceDid || '未提供'}), 接受 ${accepted.length} 项能力, 拒绝 ${rejected.length} 项`,
+                }),
+            });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 持久能力授权 (Phase 3/4/8/10): CLI / Web / 手机 读同一份 Grant 事实 ──────
+    app.get('/api/contacts/grants', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const summary = await c.grantsSummary();
+            res.json({
+                ok: true,
+                ...summary,
+                choices: [
+                    { id: 'task_once', label: '仅本次任务' },
+                    { id: 'persistent', label: '长期使用 (推荐)' },
+                    { id: 'full_contact_access', label: '完全授权联系方式能力' },
+                ],
+                willNotGet: ['读取全部邮箱', '读取通讯录', '群发消息', '自动支付/转账', '代表你签署合同', '拿到手机号/邮箱明文'],
+                forbiddenAlways: ['凭证 (密钥/密码)', '银行账号', '支付/转账指令', '合同承诺'],
+            });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/grants', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const choice = ['task_once', 'persistent', 'full_contact_access'].includes(String(req.body?.choice)) ? String(req.body.choice) : 'persistent';
+            const r = await c.authorize({
+                choice,
+                grantedBy: String(req.body?.by || 'user'),
+                grantedVia: req.body?.via === 'mobile' ? 'mobile' : req.body?.via === 'onboard' ? 'onboard' : 'web',
+            });
+            res.json({ ok: r.ok, userLabel: r.userLabel, grant: r.grant });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/grants/:id/:action', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const id = String(req.params.id);
+            const action = String(req.params.action);
+            const by = String(req.body?.by || 'user');
+            if (action === 'pause') {
+                const r = await c.pauseGrant(id, { by });
+                return res.status(r.ok ? 200 : 400).json({ ok: r.ok, error: r.error, grant: r.grant });
+            }
+            if (action === 'resume') {
+                const r = await c.resumeGrant(id, { by });
+                return res.status(r.ok ? 200 : 400).json({ ok: r.ok, error: r.error, grant: r.grant });
+            }
+            if (action === 'revoke') {
+                const r = await c.revokeGrant(id, { by, reason: req.body?.reason ? String(req.body.reason) : undefined });
+                return res.status(r.ok ? 200 : 400).json({ ok: r.ok, error: r.error, affectedGoals: r.affectedGoals });
+            }
+            res.status(400).json({ ok: false, error: `未知动作 ${action}` });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    app.post('/api/contacts/grants/revoke-all', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.revokeAllGrants({ by: String(req.body?.by || 'user'), reason: req.body?.reason ? String(req.body.reason) : undefined });
+            res.json({ ok: true, ...r });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 登记手机设备公钥 (配对阶段; 之后只接受它签名的授权) */
+    app.post('/api/contacts/devices', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const deviceId = String(req.body?.deviceId || '');
+            const publicKeyPem = String(req.body?.publicKeyPem || '');
+            if (!deviceId || !/BEGIN PUBLIC KEY/.test(publicKeyPem))
+                return res.status(400).json({ ok: false, error: 'deviceId/publicKeyPem 必填 (PEM 公钥)' });
+            const d = await c.registerDevice(deviceId, publicKeyPem, req.body?.label ? String(req.body.label) : undefined);
+            res.json({ ok: true, device: { deviceId: d.deviceId, label: d.label, registeredAt: d.registeredAt } });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 手机同步签名 Grant (Phase 4): 验签 → 版本冲突 → 撤销优先 */
+    app.post('/api/contacts/grants/sync', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const incoming = req.body?.grant;
+            if (!incoming?.grantId || !incoming?.signature)
+                return res.status(400).json({ ok: false, error: '需要带签名的 grant (grantId + signature)' });
+            const r = await c.syncGrant(incoming);
+            return res.status(r.ok ? 200 : 409).json({ ok: r.ok, code: r.code, reason: r.reason, grantId: r.grant?.grantId, grantVersion: r.grant?.grantVersion });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 手机撤销 → 桌面立即失效 */
+    app.post('/api/contacts/grants/revoke-sync', async (req, res) => {
+        try {
+            const c = chainOf(req);
+            const r = await c.syncRevocation(String(req.body?.grantId || ''), {
+                by: String(req.body?.by || 'mobile'),
+                reason: req.body?.reason ? String(req.body.reason) : undefined,
+                version: Number(req.body?.version) || undefined,
+                revokedAt: req.body?.revokedAt ? String(req.body.revokedAt) : undefined,
+                signature: req.body?.signature, // 手机签名 (有则验签, 未登记设备一律拒)
+            });
+            res.status(r.ok ? 200 : 400).json({ ok: r.ok, error: r.reason, grant: r.grant });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    // ── 隐藏守卫自检 (验收/测试直接用) ──────────────────────────────────────────
+    app.get('/api/contacts/_selfcheck', (_req, res) => {
+        res.json({ ok: true, plaintextGuard: looksLikePlaintextSecret({ contacts: [{ value: '+8613812345678' }] }) });
+    });
+}

package/dist/web/server.js

@@ -13,6 +13,8 @@ import { registerJudgmentsRoutes } from './routes-judgments.js';
 import { registerLlmConfigRoutes } from './routes-llm-config.js';
 import { registerExternalEngineRoutes } from './routes-external-engines.js';
 import { registerTaskRoutes } from './routes-tasks.js';
+// 2026-09-19: 联系方式 / 人工批准 / 手机—桌面配对 路由
+import { registerContactRoutes } from './routes-contacts.js';
 // 2026-09-13: 微支付信息服务 (x402) 路由
 import { registerX402InfoRoutes } from './routes-x402-info.js';
 import { loadPeerTier, recordInteraction, tierLabel } from '../social/dunbar-tier.js';
@@ -6797,6 +6799,9 @@ fetchState();
     });
     // 2026-07-06: Task Queue API 抽到 ./routes-tasks.ts
     registerTaskRoutes(app, { broadcast, getAgentForChannel });
+    // 2026-09-19: 社交身份 API (DID + 已验证联系方式 + 联系能力 + 权限 + 证据)
+    //   只返回脱敏值; 明文联系方式不进 Run/prompt/Git
+    registerContactRoutes(app, {});
     // 2026-09-13: 微支付信息服务 (x402) — 发布 / 402 收款 / 买方代付 / 验真
     registerX402InfoRoutes(app);
     // 2026-07-06: LLM/Video/Audio 配置路由抽到 ./routes-llm-config.ts
@@ -8216,6 +8221,35 @@ fetchState();
         console.warn('[24h] Failed to load heartbeat modules:', err);
     }
     // 健康检查端点
+    // 2026-09-18: 网络脉冲公开只读投影 (给 bolloon-UI 网关页; 无认证, 短缓存, 只有聚合)
+    //   永远不返回原始事件 / registry / DID / peerId / IP / 钱包 / 任务正文。
+    app.get('/api/public/network/progress', async (req, res) => {
+        try {
+            const np = await import('../agents/network-pulse.js');
+            const snap = await np.getNetworkPulse({});
+            // agent_sites = 本节点**显式发布**的公开指针 (IPNS); 没发布就是空数组, 不猜
+            const body = JSON.stringify({ ...snap, status: np.snapshotStatus(snap), agent_sites: np.readAgentSites() });
+            const { createHash } = await import('crypto');
+            const etag = '"' + createHash('sha256').update(body).digest('hex').slice(0, 32) + '"';
+            res.setHeader('Cache-Control', 'public, max-age=15, stale-while-revalidate=15');
+            res.setHeader('ETag', etag);
+            if (req.headers['if-none-match'] === etag) {
+                res.status(304).end();
+                return;
+            }
+            res.type('application/json').send(body);
+        }
+        catch (e) {
+            // 观察层不可用 → 如实 unavailable (不是 500 空体, 也不是"网络为空")
+            try {
+                const np = await import('../agents/network-pulse.js');
+                res.type('application/json').send(JSON.stringify(await np.getNetworkPulse({ unavailable: true })));
+            }
+            catch {
+                res.status(503).json({ status: 'unavailable', error: 'network pulse unavailable' });
+            }
+        }
+    });
     app.get('/api/health', async (req, res) => {
         try {
             if (!healthMonitor) {