@bolloon/bolloon-agent 0.4.4 → 0.4.6

package/dist/pi-ecosystem-mcp/index.js

@@ -14,6 +14,8 @@ import * as path from 'path';
 import { spawn } from 'child_process';
 import { EventEmitter } from 'events';
 import * as readline from 'readline';
+/** streamable HTTP 传输的浏览器 UA — Cloudflare MCP 等端点有 1010 风控, node fetch 默认 UA 会被拒 */
+const MCP_BROWSER_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36';
 // MCP adapter state
 let tools = new Map();
 let servers = new Map();
@@ -45,7 +47,23 @@ export async function discoverMcpServers() {
             if (serversConfig && typeof serversConfig === 'object') {
                 for (const [name, config] of Object.entries(serversConfig)) {
                     const serverConfig = config;
-                    if (!serverConfig || typeof serverConfig.command !== 'string')
+                    if (!serverConfig || typeof serverConfig !== 'object')
+                        continue;
+                    // 2026-08-12: 支持 HTTP transport (type: "http" + url + headers), 如 Cloudflare MCP
+                    const isHttp = serverConfig.type === 'http' || (typeof serverConfig.url === 'string' && typeof serverConfig.command !== 'string');
+                    if (isHttp) {
+                        if (typeof serverConfig.url !== 'string' || !serverConfig.url)
+                            continue;
+                        configs.push({
+                            name,
+                            type: 'http',
+                            url: serverConfig.url,
+                            command: '',
+                            headers: serverConfig.headers,
+                        });
+                        continue;
+                    }
+                    if (typeof serverConfig.command !== 'string')
                         continue;
                     configs.push({
                         name,
@@ -60,10 +78,10 @@ export async function discoverMcpServers() {
             // File doesn't exist, skip
         }
     }
-    // 去重 (同 name 同 command)
+    // 去重 (同 name 同 command/url)
     const seen = new Set();
     return configs.filter((c) => {
-        const key = `${c.name}::${c.command}`;
+        const key = `${c.name}::${c.type === 'http' ? c.url : c.command}`;
         if (seen.has(key))
             return false;
         seen.add(key);
@@ -100,8 +118,10 @@ export async function connectAndDiscover(serverName) {
         const started = await startServer(serverName);
         if (!started)
             return [];
-        // 等 server 就绪
-        await new Promise((r) => setTimeout(r, 400));
+        // http 传输无进程, 无需等待就绪; stdio 等 server 启动
+        if (server.config.type !== 'http') {
+            await new Promise((r) => setTimeout(r, 400));
+        }
     }
     await sendMcpRequest(serverName, 'initialize', {
         protocolVersion: '2024-11-05',
@@ -230,6 +250,10 @@ async function sendMcpRequest(serverName, method, params) {
     if (!server) {
         throw new Error(`Server not registered: ${serverName}`);
     }
+    // 2026-08-12: http 传输走 fetch JSON-RPC (streamable HTTP)
+    if (server.config.type === 'http') {
+        return sendHttpMcpRequest(serverName, method, params);
+    }
     // 确保 server 进程在跑
     if (!server.running || !server.process || !server.process.stdin?.writable) {
         const started = await startServer(serverName);
@@ -260,6 +284,118 @@ async function sendMcpRequest(serverName, method, params) {
         child.stdin.write(line + '\n');
     });
 }
+/**
+ * Send MCP request to a remote server via streamable HTTP (2026-08-12).
+ * - POST JSON-RPC 到 url, 携带 Authorization 等配置 headers
+ * - 默认带浏览器 UA (Cloudflare MCP 1010 风控, node fetch 默认 UA 被拒)
+ * - 响应支持 application/json 与 text/event-stream (SSE) 两种格式
+ * - 服务器返回 Mcp-Session-Id 时记录, 后续请求自动携带
+ * - 通知 (notifications/*) fire-and-forget: 不等待响应体 (Cloudflare 返回 202)
+ */
+async function sendHttpMcpRequest(serverName, method, params) {
+    const server = servers.get(serverName);
+    if (!server)
+        throw new Error(`Server not registered: ${serverName}`);
+    if (!server.config.url)
+        throw new Error(`MCP http server 缺 url: ${serverName}`);
+    const id = mcpRequestSeq++;
+    const isNotification = method.startsWith('notifications/');
+    const payload = isNotification
+        ? { jsonrpc: '2.0', method, params: params ?? {} }
+        : { jsonrpc: '2.0', id, method, params: params ?? {} };
+    const headers = {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        ...(server.config.headers ?? {}),
+    };
+    // 1010 风控: 默认浏览器 UA, 用户 headers 可覆盖
+    if (!headers['User-Agent'])
+        headers['User-Agent'] = MCP_BROWSER_UA;
+    if (server.sessionId)
+        headers['Mcp-Session-Id'] = server.sessionId;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), MCP_REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(server.config.url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(payload),
+            signal: ctrl.signal,
+        });
+        if (isNotification) {
+            // fire-and-forget: 不等 body (Cloudflare 返回 202 空体)
+            res.body?.cancel().catch(() => { });
+            return undefined;
+        }
+        const sessionId = res.headers.get('Mcp-Session-Id');
+        if (sessionId)
+            server.sessionId = sessionId;
+        const msg = await readHttpBodyUntilResponse(res);
+        if (msg.error) {
+            throw new Error(`MCP error ${msg.error.code}: ${msg.error.message}`);
+        }
+        return msg.result;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * 读取 HTTP 响应直到拿到完整 JSON-RPC 响应 (2026-08-12 修复).
+ * 坑: streamable HTTP 服务器 (如 mcp.cloudflare.com/mcp) 对 tools/call 返回 SSE 后
+ * **不关闭连接** — res.text() 会永远等 EOF 挂起 (initialize/tools/list 响应收尾, 掩盖了问题).
+ * 方案: 流式读 body, 按 SSE 事件块 (空行分隔) 解析, 找到 id 匹配的响应就 cancel 流返回.
+ * 非 SSE (application/json) 响应直接 text().
+ */
+async function readHttpBodyUntilResponse(res) {
+    const ct = res.headers.get('content-type') || '';
+    if (!ct.includes('text/event-stream')) {
+        const raw = await res.text();
+        return JSON.parse(raw);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = '';
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buf += decoder.decode(value, { stream: true });
+            const msg = extractSseResponse(buf);
+            if (msg)
+                return msg;
+        }
+        const msg = extractSseResponse(buf);
+        if (msg)
+            return msg;
+        throw new Error(`SSE 响应无有效 JSON-RPC data 块: ${buf.slice(0, 200)}`);
+    }
+    finally {
+        // 拿到响应后立即关闭流 — 不等服务器断开连接
+        reader.cancel().catch(() => { });
+    }
+}
+/** 从累积的 SSE 文本提取完整 JSON-RPC 响应 (按空行分隔事件块, data: 行拼 JSON) */
+function extractSseResponse(buf) {
+    const blocks = buf.split(/\n\n/);
+    for (const block of blocks) {
+        let data = '';
+        for (const line of block.split(/\r?\n/)) {
+            if (line.startsWith('data:'))
+                data += line.slice(5).trim();
+        }
+        if (!data)
+            continue;
+        try {
+            return JSON.parse(data);
+        }
+        catch {
+            // 块不完整 (截断) — 等更多数据
+        }
+    }
+    return null;
+}
 /** 挂上 stdout 行读取器 (按 id 分发响应) */
 function attachStdoutReader(serverName, child) {
     const server = servers.get(serverName);
@@ -306,6 +442,11 @@ export async function startServer(serverName) {
     if (server.running && server.process) {
         return true;
     }
+    // 2026-08-12: http 传输无子进程 — 虚拟 running, 请求走 sendHttpMcpRequest
+    if (server.config.type === 'http') {
+        server.running = true;
+        return true;
+    }
     try {
         const child = spawn(server.config.command, server.config.args || [], {
             env: { ...process.env, ...server.config.env },

package/dist/security/tool-gate.js

@@ -64,6 +64,8 @@ const TOOL_WHITELIST = new Set([
     'cid_save', 'cid_load', 'cid_update', 'cid_version', 'cid_list', 'cid_share',
     'context_save_snapshot', 'context_restore',
     'ui_save_component', 'ui_load_component',
+    // 2026-08-12: Kanban 看板工具 (Hermes kanban_db → OrbitDB, src/orbitdb/kanban-store.ts)
+    'kanban_create', 'kanban_list', 'kanban_get', 'kanban_claim', 'kanban_complete', 'kanban_status',
     // 2026-08-07: Bolloon 自身配置读写 (bolloon-config.json, agent 有修改自身配置权限)
     'bolloon_config_get', 'bolloon_config_set',
 ]);

package/dist/web/edge-auth-client.js

@@ -0,0 +1,120 @@
+// 边缘认证客户端 — 把 WebUI 登录配置托管到 Cloudflare 边缘 (Workers + KV)
+// 2026-08-12: 优先请求边缘 Worker, worker 不可达时降级到本地 accounts.json fallback.
+// Worker 实现见 src/web/workers/auth/.
+/**
+ * 边缘认证客户端.
+ * 每个 auth 操作先打边缘 Worker; 失败/超时自动降级到本地 accounts.json.
+ */
+export class EdgeAuthClient {
+    baseUrl;
+    timeoutMs;
+    fallbackFile;
+    log;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
+        this.timeoutMs = opts.timeoutMs ?? 4000;
+        this.fallbackFile = opts.fallbackFile;
+        this.log = opts.log ?? (() => { });
+    }
+    // ---- 私有: 边缘 HTTP / 本地文件 ----
+    async edgeFetch(path, opts) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+        try {
+            const res = await fetch(`${this.baseUrl}/api/auth${path}`, {
+                method: opts?.method ?? 'GET',
+                headers: { 'Content-Type': 'application/json' },
+                body: opts?.body ? JSON.stringify(opts.body) : undefined,
+                signal: ctrl.signal,
+            });
+            if (!res.ok) {
+                const err = await res.text().catch(() => '');
+                throw new Error(`边缘认证 ${path} HTTP ${res.status} ${err}`);
+            }
+            return await res.json();
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async loadLocal() {
+        try {
+            const { readFile } = await import('fs/promises');
+            const parsed = JSON.parse(await readFile(this.fallbackFile, 'utf-8'));
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    async saveLocal(accs) {
+        const { mkdir, writeFile } = await import('fs/promises');
+        const dir = this.fallbackFile.replace(/[\\/][^\\/]*$/, '');
+        await mkdir(dir, { recursive: true });
+        await writeFile(this.fallbackFile, JSON.stringify(accs, null, 2), { mode: 0o600 });
+    }
+    // ---- 公共 API (与 server.ts 原 loadAccounts/saveAccounts 语义一致) ----
+    /** 返回脱敏视图 (provider/identifier/loggedAt/skeleton), 供 /api/auth/status 直接用 */
+    async loadAccounts() {
+        try {
+            const data = await this.edgeFetch('/status');
+            return Array.isArray(data?.accounts) ? data.accounts : [];
+        }
+        catch (err) {
+            this.log(`[edge-auth] 边缘不可达, 降级本地: ${err?.message ?? err}`);
+            return this.loadLocal().then((accs) => accs.map((a) => ({
+                provider: a.provider,
+                identifier: a.identifier || a.email || a.username || '',
+                loggedAt: a.loggedAt,
+                skeleton: !!a.skeleton,
+            })));
+        }
+    }
+    async login(payload) {
+        try {
+            return await this.edgeFetch('/login', { method: 'POST', body: payload });
+        }
+        catch (err) {
+            this.log(`[edge-auth] 登录降级本地: ${err?.message ?? err}`);
+            const accs = await this.loadLocal();
+            const now = new Date().toISOString();
+            const exists = accs.find((a) => a.provider === payload.provider &&
+                (!payload.identifier || a.identifier === payload.identifier || a.email === payload.identifier));
+            if (exists) {
+                exists.ownerDid = payload.ownerDid;
+                exists.loggedAt = now;
+                exists.skeleton = true;
+            }
+            else {
+                const id = payload.identifier || '';
+                accs.push({
+                    provider: payload.provider,
+                    identifier: id,
+                    email: payload.provider === 'email' ? id : '',
+                    phone: payload.provider === 'phone' ? id : '',
+                    username: id || '',
+                    token: '',
+                    ownerDid: payload.ownerDid,
+                    loggedAt: now,
+                    skeleton: true,
+                });
+            }
+            await this.saveLocal(accs);
+            return { ok: true, provider: payload.provider, identifier: payload.identifier, ownerDid: payload.ownerDid, skeleton: true, degraded: true };
+        }
+    }
+    async logout(payload) {
+        try {
+            return await this.edgeFetch('/logout', { method: 'POST', body: payload });
+        }
+        catch (err) {
+            this.log(`[edge-auth] 登出降级本地: ${err?.message ?? err}`);
+            const before = await this.loadLocal();
+            const remaining = before.filter((a) => a.provider !== payload.provider);
+            if (remaining.length === before.length)
+                throw new Error(`未绑定 ${payload.provider} 账号`);
+            await this.saveLocal(remaining);
+            return { ok: true, degraded: true };
+        }
+    }
+}

package/dist/web/server-storage.js

@@ -168,7 +168,27 @@ export function isTaskExecuting() {
 export function getExecutingTaskId() {
     return executionTaskId;
 }
+// ==================== 任务队列 ====================
+// 2026-08-12 (Task6): 任务队列以 OrbitDB 为主存储 (去中心化/跨设备同步), 本地文件作 fallback.
+//   orbit 由 server 启动时 warmTaskOrbitStore() 预热成功后调 markTaskOrbitReady() 置位;
+//   未置位 (测试/离线) 自动回退本地文件.
+let _taskOrbitReady = false;
+/** server 启动 warm 成功后调用, 启用 orbitdb 主存储 (测试可调用 disableTaskOrbitStore 关闭) */
+export function markTaskOrbitReady() { _taskOrbitReady = true; }
+/** 禁用 orbitdb 任务存储 (测试隔离用) */
+export function disableTaskOrbitStore() { _taskOrbitReady = false; }
+function taskOrbitReady() { return _taskOrbitReady; }
 export async function loadTaskQueue() {
+    // OrbitDB 主存储优先
+    if (taskOrbitReady()) {
+        try {
+            const { getTaskOrbitStore } = await import('../orbitdb/task-store.js');
+            const tasks = await getTaskOrbitStore().loadTasks();
+            if (Array.isArray(tasks))
+                return tasks;
+        }
+        catch { /* orbit 读失败 → fallback 本地 */ }
+    }
     try {
         const data = await fs.readFile(TASK_QUEUE_PATH, 'utf-8');
         return JSON.parse(data);
@@ -178,7 +198,16 @@ export async function loadTaskQueue() {
     }
 }
 export async function saveTaskQueue(tasks) {
+    // 本地双写 (备份 + fallback 源)
     await fs.writeFile(TASK_QUEUE_PATH, JSON.stringify(tasks, null, 2));
+    // OrbitDB 主存储同步 (尽力而为)
+    if (taskOrbitReady()) {
+        try {
+            const { getTaskOrbitStore } = await import('../orbitdb/task-store.js');
+            await getTaskOrbitStore().saveTasks(tasks);
+        }
+        catch { /* orbit 写失败静默, 本地已备份 */ }
+    }
 }
 // ==================== 任务认领 CAS (2026-08-11, Hermes kanban 模式) ====================
 // kanban_db.py: "WAL + BEGIN IMMEDIATE + compare-and-swap on tasks.status/claim_lock —

package/dist/web/server.js

@@ -1698,6 +1698,18 @@ export async function createWebServer(port = 3000, options = {}) {
             const rep = await startDidCatalogReplication(identity.did, { intervalMs: 30_000 });
             console.log(`[did-catalog] OrbitDB 自动复制已启动: store=${rep.storeName} address=${String(rep.storeAddress).slice(0, 48)}...`);
             globalThis.__didCatalogReplication = rep;
+            // 2026-08-12 (Task6): 预热任务 OrbitDB 存储 (task 队列去中心化主存储). warm 成功才启用.
+            try {
+                const { warmTaskOrbitStore, taskStoreName } = await import('../orbitdb/task-store.js');
+                const { markTaskOrbitReady } = await import('./server-storage.js');
+                const ok = await warmTaskOrbitStore(identity.did);
+                if (ok)
+                    markTaskOrbitReady();
+                console.log(`[task-store] OrbitDB 任务存储 ${ok ? '已启用' : '未启用 (回退本地)'} (store=${taskStoreName(identity.did)})`);
+            }
+            catch (e) {
+                console.warn('[task-store] 任务 OrbitDB 预热失败 (非致命):', e?.message?.slice(0, 120));
+            }
         }
         catch (e) {
             console.warn('[did-catalog] OrbitDB 复制启动失败 (非致命, 稍后可用 API 重试):', e?.message?.slice(0, 120));
@@ -1733,7 +1745,11 @@ export async function createWebServer(port = 3000, options = {}) {
                 if (!cid || knownIds.has(cid))
                     continue;
                 // 有 session 文件才算可恢复 (说明确实创建过)
-                const hasSession = existsSync(`${sessionsDir}/${cid}:default.json`) || existsSync(`${sessionsDir}/${cid}.json`);
+                // 2026-08-12 fix: SessionStore 保存到 cache/<channelId>__default.json (冒号被 filenameEscape 成 __),
+                //   之前用 `${sessionsDir}/${cid}:default.json` (未 escape + 硬拼冒号) 查不到 → 会话已存在也被判为
+                //   "无 session" 永不恢复, 即 session/channel 路径与创建智能体 channel 的路径不一致 (bug 修复)
+                const { getSessionCacheFile } = await import('../bootstrap/memory-compressor.js');
+                const hasSession = existsSync(getSessionCacheFile(cid, 'default')) || existsSync(`${sessionsDir}/${cid}.json`);
                 if (!hasSession)
                     continue;
                 const restored = {
@@ -2845,39 +2861,32 @@ ${goalDesc}
     });
     // ========== 登录框架 (2026-08-09) — GitHub/Google/邮箱/手机号, 仅骨架 ==========
     // 所有登录方式最终都归属到用户 DID (右下角唯一身份).
+    // 2026-08-12: 登录配置托管到 Cloudflare 边缘 (Workers+KV), 本地 accounts.json 仅作降级 fallback.
     // 真实 OAuth / 验证码后续接入, 这里先做: 记录账号 + 绑定用户 DID + 提供状态查询.
     const ACCOUNTS_FILE = `${process.env.HOME || '/tmp'}/.bolloon/accounts.json`;
-    async function loadAccounts() {
-        try {
-            const { readFile } = await import('fs/promises');
-            const parsed = JSON.parse(await readFile(ACCOUNTS_FILE, 'utf-8'));
-            return Array.isArray(parsed) ? parsed : [];
-        }
-        catch {
-            return [];
-        }
-    }
-    async function saveAccounts(accs) {
-        const { mkdir, writeFile } = await import('fs/promises');
-        await mkdir(`${process.env.HOME || '/tmp'}/.bolloon`, { recursive: true });
-        await writeFile(ACCOUNTS_FILE, JSON.stringify(accs, null, 2), { mode: 0o600 });
-    }
+    const EDGE_AUTH_URL = process.env.BOLLOON_EDGE_AUTH_URL || 'http://127.0.0.1:8788';
+    const { EdgeAuthClient } = await import('./edge-auth-client.js');
+    const edgeAuth = new EdgeAuthClient({
+        baseUrl: EDGE_AUTH_URL,
+        timeoutMs: 4000,
+        fallbackFile: ACCOUNTS_FILE,
+        log: (m) => { try {
+            console.log(m);
+        }
+        catch { /* noop */ } },
+    });
+    async function loadAccounts() { return edgeAuth.loadAccounts(); }
     // GET /api/auth/status — 当前用户 DID + 已绑定账号列表
     app.get('/api/auth/status', async (_req, res) => {
         try {
             const identity = await loadOrCreateUserIdentity();
-            const accs = await loadAccounts();
+            const accounts = await loadAccounts();
             res.json({
                 did: identity.did,
                 didShort: identity.didShort,
                 name: identity.name,
-                // 只返回脱敏视图 (不含 token)
-                accounts: accs.map((a) => ({
-                    provider: a.provider,
-                    identifier: a.identifier || a.email || a.username || '',
-                    loggedAt: a.loggedAt,
-                    skeleton: !!a.skeleton,
-                })),
+                // 只返回脱敏视图 (不含 token), 来源: 边缘 KV (worker 不可达时本地 fallback)
+                accounts,
             });
         }
         catch (err) {
@@ -2899,31 +2908,9 @@ ${goalDesc}
                 return res.status(400).json({ error: `${prov === 'email' ? '邮箱' : '手机号'}必填` });
             }
             const identity = await loadOrCreateUserIdentity();
-            const accs = await loadAccounts();
             const idStr = String(identifier || '').trim();
-            const existing = accs.find((a) => a.provider === prov && (!idStr || a.identifier === idStr || a.email === idStr));
-            const now = new Date().toISOString();
-            if (existing) {
-                // 已绑定 → 更新归属 DID + 时间
-                existing.ownerDid = identity.did;
-                existing.loggedAt = now;
-                existing.skeleton = true;
-            }
-            else {
-                accs.push({
-                    provider: prov,
-                    identifier: idStr || '',
-                    email: prov === 'email' ? idStr : '',
-                    phone: prov === 'phone' ? idStr : '',
-                    username: idStr || '',
-                    token: '', // 真实 OAuth 后填
-                    ownerDid: identity.did, // 归属用户唯一 DID
-                    loggedAt: now,
-                    skeleton: true, // 骨架标记: 未做真实 OAuth/验证码
-                });
-            }
-            await saveAccounts(accs);
-            console.log(`[auth] 登录骨架: ${prov}${idStr ? ' ' + idStr : ''} → 归属 DID ${identity.did.substring(0, 20)}...`);
+            const result = await edgeAuth.login({ provider: prov, identifier: idStr, ownerDid: identity.did });
+            console.log(`[auth] 登录骨架: ${prov}${idStr ? ' ' + idStr : ''} → 归属 DID ${identity.did.substring(0, 20)}...${result.degraded ? ' (本地 fallback)' : ' (边缘)'}`);
             res.json({
                 ok: true,
                 provider: prov,
@@ -2931,6 +2918,7 @@ ${goalDesc}
                 ownerDid: identity.did,
                 skeleton: true,
                 message: `${prov} 登录骨架已记录 (归属用户 DID), 真实 OAuth/验证码后续接入`,
+                storage: result.degraded ? 'local' : 'edge',
             });
         }
         catch (err) {
@@ -2942,13 +2930,8 @@ ${goalDesc}
         try {
             const { provider } = req.body || {};
             const prov = String(provider || '').trim().toLowerCase();
-            const accs = await loadAccounts();
-            const before = accs.length;
-            const remaining = accs.filter((a) => a.provider !== prov);
-            if (remaining.length === before)
-                return res.status(404).json({ error: `未绑定 ${prov} 账号` });
-            await saveAccounts(remaining);
-            res.json({ ok: true, provider: prov });
+            const result = await edgeAuth.logout({ provider: prov });
+            res.json({ ok: true, provider: prov, storage: result.degraded ? 'local' : 'edge' });
         }
         catch (err) {
             res.status(500).json({ error: err.message });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",