@bolloon/bolloon-agent 0.6.0 → 0.6.1

package/dist/ios/mobile.js

@@ -225,6 +225,68 @@
     }
   }
 
+  // ── Efficode 条目 (内置参考实现: 仓内 src/efficode/**, 不靠"从电脑端同步") ──────
+  // 纪律: 这段**不用 innerHTML 拼任何数据** (纯 createElement + textContent) ·
+  //       双语走 data-zh/data-en (切语言时外面那段 applyLang 会一起改文字节点) ·
+  //       role=button + tabindex + aria-label + Enter/Space 可达 · 无外部依赖。
+  const EFFICODE_SPEC_PATH = 'docs/wiki/efficode.md';
+  const EFFICODE_IMPL_PATH = 'src/efficode/** · src/agents/agent-lang.ts';
+  const EFFICODE_GATE = 'scripts/verify-efficode.ts (55/0)';
+  function effiLangNow() {
+    try { return localStorage.getItem('bolloon_lang') === 'en' ? 'en' : 'zh'; } catch (e) { return 'zh'; }
+  }
+  function buildEfficodeEntry() {
+    const el = document.createElement('div');
+    el.className = 'conv-item';
+    el.id = 'item-efficode';
+    el.setAttribute('role', 'button');
+    el.setAttribute('tabindex', '0');
+    el.setAttribute('aria-label', 'Efficode 规范页 (中文): ' + EFFICODE_SPEC_PATH);
+    const avatar = document.createElement('div');
+    avatar.className = 'conv-avatar';
+    avatar.textContent = 'E';
+    const body = document.createElement('div');
+    body.className = 'conv-body';
+    const name = document.createElement('div');
+    name.className = 'conv-name';
+    name.textContent = '/efficode';
+    const desc = document.createElement('div');
+    desc.className = 'conv-preview';
+    desc.setAttribute('data-zh', '智能体间的符号化交流语言 · 参考实现 (签名/声波未实现) — 点开看规范页 docs/wiki/efficode.md');
+    desc.setAttribute('data-en', 'Symbolic agent-to-agent language · reference impl (signing/audio not implemented) — tap for docs/wiki/efficode.md');
+    desc.textContent = effiLangNow() === 'en' ? desc.getAttribute('data-en') : desc.getAttribute('data-zh');
+    body.appendChild(name);
+    body.appendChild(desc);
+    el.appendChild(avatar);
+    el.appendChild(body);
+    const open = () => alert(
+      '/efficode\n\n' +
+      (effiLangNow() === 'en'
+        ? 'Symbolic binary language between agents (Efficient + Code). Reference implementation in this repo; negotiation falls back to natural language unless both sides declare efficode. Signing / ECC session keys / sound-wave mode are NOT implemented.\n\n'
+        : '智能体之间的符号化二进制交流语言 (Efficient + Code)。本仓有参考实现; 只有双方都声明 efficode 才用, 否则明确回落自然语言。签名验证 / ECC 临时会话密钥 / 声波模式尚未实现。\n\n') +
+      '规范页: ' + EFFICODE_SPEC_PATH + '\n' +
+      '实现: ' + EFFICODE_IMPL_PATH + '\n' +
+      '验收门: ' + EFFICODE_GATE
+    );
+    el.addEventListener('click', open);
+    el.addEventListener('keydown', (ev) => {
+      if (ev.key === 'Enter' || ev.key === ' ' || ev.key === 'Spacebar') { ev.preventDefault(); open(); }
+    });
+    return el;
+  }
+
+  /** 把内置 Efficode 条目追加到 Skills 页 (空态 / 有列表都显示 —— 它是仓内参考实现) */
+  function appendEfficodeBlock(body) {
+    if (!body || body.querySelector('#item-efficode')) return;
+    const cap = document.createElement('div');
+    cap.style.cssText = 'font-size:11px;color:var(--text-muted);margin:14px 0 6px';
+    cap.setAttribute('data-zh', '内置 (随客户端发布, 不来自电脑端同步)');
+    cap.setAttribute('data-en', 'Built in (ships with the client, not synced from desktop)');
+    cap.textContent = effiLangNow() === 'en' ? cap.getAttribute('data-en') : cap.getAttribute('data-zh');
+    body.appendChild(cap);
+    body.appendChild(buildEfficodeEntry());
+  }
+
   async function openSkillsPage() {
     if ($('#skills-page')) return;
     const page = mkOverlayPage('skills-page', 'Skills', '<div style="font-size:12px;color:var(--text-muted)">读取中…</div>');
@@ -241,6 +303,7 @@
         body.innerHTML = `<div style="padding:18px 8px;text-align:center;color:var(--text-muted);line-height:1.8">
           还没有技能列表<br><span style="font-size:12px">电脑端 ~/.bolloon/skills/ 下的 skills，会在「从电脑端同步」后出现在这里</span>
           ${err ? `<div style="font-size:11px;margin-top:8px">（读取失败：${escapeHtml(err)}）</div>` : ''}</div>`;
+        appendEfficodeBlock(body);
         return;
       }
       body.innerHTML = skills.map((s, i) => `<div class="conv-item" data-sk="${i}">
@@ -252,6 +315,7 @@
         const s = skills[Number(el.dataset.sk)] || {};
         alert(`/${s.name || ''}\n\n${s.description || '（无说明）'}`);
       }));
+      appendEfficodeBlock(body);
     };
     await render();
     const btn = page.querySelector('#skills-sync');

package/dist/ios/routes-mobile-tasks.js

@@ -167,7 +167,8 @@ export function registerMobileTaskRoutes(app, opts = {}) {
             if (kind === 'group_create' || kind === 'group_join' || kind === 'group_leave') {
                 const { createGroup, joinGroup, leaveGroup } = await import('../agents/gateway-group.js');
                 if (kind === 'group_create') {
-                    const r = await createGroup(String(request.groupRef || '').trim());
+                    // 手机端建群与 Web 端同一语义 (微信式群聊) ⇒ 显式声明开放写入
+                    const r = await createGroup(String(request.groupRef || '').trim(), { acl: 'open' });
                     if (!r.ok || !r.group)
                         return fail(res, 409, 'GROUP_CREATE_FAILED', `建群失败: ${r.error || '未知原因'}`);
                     return res.json({ ok: true, kind, group: { id: r.group.id, name: r.group.name }, text: `已建群「${r.group.name}」` });

package/dist/ios/routes-tasks.js

@@ -4,6 +4,7 @@
  * 从 src/web/server.ts 抽出 (~160 行).
  * 包含 /api/tasks/* (GET, POST, PATCH, DELETE, execute, execute-next)
  */
+import { deliverThroughActor } from '../kernel/channel-actor.js';
 import { loadTaskQueue, saveTaskQueue } from './server-storage.js';
 import { documentReader } from '../documents/reader.js';
 import { applyCancelRequest, shouldFinalizeAsCancelled } from './task-cancel.js';
@@ -309,7 +310,21 @@ async function executeTask(task, channelId, getAgentForChannel, broadcast) {
             case 'chat':
                 if (task.description) {
                     broadcast({ type: 'status', content: `执行任务: ${task.title}` }, channelId);
-                    result = await agent.prompt(task.description);
+                    // 闭包里 TS 不保留收窄 ⇒ 先收成局部 const
+                    const desc = task.description;
+                    const agentForRun = agent;
+                    // 2026-10-02 (K8): 走 Pi 的**唯一执行入口** `runExecution` (K5 步骤⑦ 已建), 不再由通道自己直呼 prompt
+                    if (typeof agentForRun.runExecution !== 'function') {
+                        // K8 纪律: 拿不到唯一执行入口 ⇒ **响亮失败**, 不静默回落直呼 prompt (否则收口变成纸面的)
+                        throw new Error('K8: 该 session 未提供 runExecution (唯一执行入口) ⇒ 拒绝直呼 prompt');
+                    }
+                    // 注意: 这里**显式传 channelId** —— ExecutionRequest 要求它, 且语义上本就该绑定 task 的通道。
+                    // 与旧写法 (prompt(desc), 隐式走 actor 绑定) 相比这是一处**行为差量**: 绑定从隐式变显式。
+                    // 按纪律记过"待真跑核验", **2026-10-02 已核验通过** (`src/test/k8-routes-tasks-execution.test.ts`,
+                    // 真 express + 真 HTTP + 真任务队列): ① agent 只给 runExecution (无 prompt) 也能跑通 ⇒ 活路径唯一;
+                    // ② **两半 id 一致** (解析 agent 用的 id == 绑 run 用的 id) 是自检不变量; ③ 无门时响亮失败且 prompt 调用 0 次。
+                    // 真变异: 绑成 `channelId + '-mut'` ⇒ 判红; 回落直呼 `prompt` ⇒ 判红; 还原 ⇒ 回绿无残差。
+                    result = await deliverThroughActor(agentForRun, () => agentForRun.runExecution({ input: desc, channelId }));
                 }
                 break;
             case 'read':

package/dist/ios/routes-x402-info.js

@@ -20,6 +20,7 @@ import * as os from 'os';
 import { listInfo, getStoredInfo, publishInfo, removeInfo, buildPaymentRequired, checkAndSettlePayment, buyInfo, } from '../agents/x402/paid-info-store.js';
 import { buildSignedEnvelope, verifyEnvelope, summarizeVerify } from '../agents/x402/paid-info-protocol.js';
 import { makeDidResolver } from '../agents/x402/paid-info-tools.js';
+import { handleDirectPayment, directHealth, directPaymentPath, directPaymentEnabled } from '../agents/x402/direct-payment.js';
 /** 本机 DIAP 身份 (签发信封用) — 缺失时明确报错, 不静默造一个 */
 async function loadProviderKeypair() {
     try {
@@ -122,7 +123,7 @@ export function registerX402InfoRoutes(app) {
                 content: stored.content,
                 keypair: kp,
                 payment: {
-                    mode: pay.mode === 'facilitator' ? 'facilitator' : 'local-dev',
+                    mode: pay.mode === 'facilitator' ? 'facilitator' : pay.mode === 'direct' ? 'direct' : 'local-dev',
                     receipt: String(pay.receipt || ''),
                     txHash: pay.txHash,
                     network: pay.network || stored.item.price.network,
@@ -139,6 +140,32 @@ export function registerX402InfoRoutes(app) {
             res.status(500).json({ error: e?.message });
         }
     });
+    // ---- 去中心化直付 (mode = 'direct'): 买方自己发 USDC, 把 txHash 交回来 ----
+    //   POST /api/x402/info/:id/payment   body: { "txHash": "0x…" }
+    //   服务器**只读链**: receipt.status=1 + USDC Transfer → payTo + value >= accepts.amount
+    //   + 两条不同 RPC 交叉一致 + 确认数够 → 落待办 + 给取件 token (202); 未过 → 402 (accepts 逐字)
+    app.post('/api/x402/info/:id/payment', async (req, res) => {
+        try {
+            const id = String(req.params.id);
+            const stored = await getStoredInfo(id);
+            if (!stored)
+                return res.status(404).json({ error: '信息不存在' });
+            const baseUrl = `${req.protocol || 'http'}://${req.headers?.host || `127.0.0.1:${process.env.PORT || 54188}`}`;
+            const out = await handleDirectPayment({
+                item: stored.item,
+                bodyText: typeof req.body === 'string' ? req.body : JSON.stringify(req.body ?? {}),
+                resourceUrl: `${baseUrl}${directPaymentPath(stored.item.id)}`,
+            });
+            return res.status(out.status).set(out.headers).send(out.body);
+        }
+        catch (e) {
+            res.status(500).json({ error: e?.message });
+        }
+    });
+    // ---- 直付模式自述 (health 用: 开关与口径必须能从机器读到) ----
+    app.get('/api/x402/direct', async (_req, res) => {
+        res.json({ enabled: directPaymentEnabled(), paymentPath: directPaymentPath(':id'), ...directHealth() });
+    });
     // ---- 买方辅助: 代付 + 验真 ----
     app.post('/api/x402/info/buy', async (req, res) => {
         try {

package/dist/ios/server-storage.js

@@ -11,6 +11,8 @@
  * Channel / Session / Task / SessionMessage / SessionSummary type 来自 ./server-types.ts.
  */
 import * as fs from 'fs/promises';
+import * as path from 'path';
+import { channelsPaths, assertTestWriteTarget } from '../agents/agent-identity-store.js';
 import { CHANNELS_PATH, SESSION_CACHE_PATH, TASK_QUEUE_PATH, THEME_PATH, } from './server-types.js';
 import { saveWindow as saveSessionWindow, loadWindow as loadSessionWindow } from '../bootstrap/session-window.js';
 import { parentsSatisfied } from './task-deps.js';
@@ -42,7 +44,7 @@ export async function updateChannels(fn) {
 }
 async function rawLoadChannels() {
     try {
-        const data = await fs.readFile(CHANNELS_PATH, 'utf-8');
+        const data = await fs.readFile(channelsPathNow(), 'utf-8');
         return JSON.parse(data);
     }
     catch (readErr) {
@@ -50,11 +52,11 @@ async function rawLoadChannels() {
         if (readErr?.code !== 'ENOENT') {
             console.warn('[loadChannels] channels.json 解析失败, 尝试从 .tmp 恢复:', readErr?.message?.slice(0, 80));
             try {
-                const tmpData = await fs.readFile(CHANNELS_PATH + '.tmp', 'utf-8');
+                const tmpData = await fs.readFile(channelsPathNow() + '.tmp', 'utf-8');
                 const recovered = JSON.parse(tmpData);
                 console.log(`[loadChannels] 从 .tmp 恢复成功: ${recovered.length} 个 channel`);
                 // 立即把恢复的内容写回主文件
-                await fs.writeFile(CHANNELS_PATH, tmpData, 'utf-8');
+                await fs.writeFile(channelsPathNow(), tmpData, 'utf-8');
                 return recovered;
             }
             catch (tmpErr) {
@@ -64,6 +66,22 @@ async function rawLoadChannels() {
         return [];
     }
 }
+/**
+ * channels.json 的路径**每次调用时**解析 (2026-10-01, 数据事故修复)。
+ *
+ * 事故: `server-types.CHANNELS_PATH` 是 import 时定死的常量 (按那一刻的 HOME 解析),
+ *   于是测试里后设的 process.env.HOME **完全不起作用** ⇒ 测试夹具把用户的真实
+ *   ~/.bolloon/sessions/channels.json 整表覆盖 (4 个智能体只剩 1 条)。
+ *   现在改成按**当前** HOME 解析 (与 CLI 侧 agent-identity-store.channelsPaths 同一口径)。
+ */
+function channelsPathNow() {
+    try {
+        return channelsPaths()[0];
+    }
+    catch {
+        return CHANNELS_PATH;
+    }
+}
 async function rawSaveChannels(channels) {
     const sanitized = channels.map(ch => {
         const { didDocument: _omit, ...rest } = ch;
@@ -75,9 +93,12 @@ async function rawSaveChannels(channels) {
     lastChannelsJson = jsonStr;
     console.log('[saveChannels] 保存频道数据, 数量:', sanitized.length);
     // 2026-07-24: 原子写入 — 先写 .tmp 再 rename, 防止崩溃导致 channels.json 损坏
-    const tmpPath = CHANNELS_PATH + '.tmp';
+    const target = channelsPathNow();
+    // 测试进程只允许写临时目录 —— 真实数据目录一律拒绝 (第二道闸)
+    assertTestWriteTarget(path.dirname(path.dirname(target)), 'channels.json');
+    const tmpPath = target + '.tmp';
     await fs.writeFile(tmpPath, jsonStr, 'utf-8');
-    await fs.rename(tmpPath, CHANNELS_PATH);
+    await fs.rename(tmpPath, target);
     lastChannelsWriteAt = Date.now();
 }
 export async function loadChannels() {