@bolloon/bolloon-agent 0.6.4 → 0.6.5

package/dist/agents/opportunity-inbox.js

@@ -0,0 +1,147 @@
+/**
+ * opportunity-inbox.ts — 机会信箱 (2026-10-05, leo: 别人主动投来的机会)
+ *
+ * 设计: 外部 agent 用 DIAP Ed25519 身份签名投递机会声明到本机信箱,
+ *   验签通过才入库 (~/.bolloon/world/inbox/<id>.json) 并进入世界流。
+ *   来源可验: 每条机会带 provider DID + 验签状态, 不再是「本机自产」的虚拟感。
+ *
+ * 协议: bolloon-opportunity-inbox/1
+ *   POST payload = { title, summary, refs[], provider: {did}, issuedAt }
+ *   signature  = ed25519Sign(privateKey, canonicalize(payload))
+ *   验证 = ed25519Verify(providerPublicKey, canonicalize(payload), signature)
+ *
+ * 未来: 群复制 (OrbitDB 公共群 announce) 是信箱的另一条投递通道, 需要第二节点 (诚实边界)。
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as crypto from 'node:crypto';
+import { worldDir } from './intent-store.js';
+import { canonicalize, ed25519Verify } from './x402/paid-info-protocol.js';
+export const INBOX_PROTOCOL = 'bolloon-opportunity-inbox/1';
+const inboxDir = () => path.join(worldDir(), 'inbox');
+function safeId(s) {
+    return s.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);
+}
+/** 把投递载荷按签名标准序列化 (必须与签名时完全一致) */
+export function canonicalPayload(p) {
+    return canonicalize({
+        protocol: p.protocol,
+        title: p.title,
+        summary: p.summary,
+        refs: p.refs,
+        provider: p.provider,
+        issuedAt: p.issuedAt,
+    });
+}
+/** 投递方 DID 的 Ed25519 公钥解析 (did:key 格式 → 32 字节 hex) */
+export async function resolveDidPublicKey(did) {
+    try {
+        // did:key:z6Mk... — multibase base58btc 编码: [multicodec 0xed01(2B) + 32B 公钥] = 34 字节
+        const m = String(did || '').match(/^did:key:z([1-9A-HJ-NP-Za-km-z]+)$/);
+        if (!m)
+            return null;
+        const decoded = Buffer.from(importB58(m[1]));
+        if (decoded.length === 34 && decoded[0] === 0xed && decoded[1] === 0x01) {
+            return decoded.subarray(2).toString('hex'); // 剥 multicodec, 取 32 字节公钥
+        }
+        if (decoded.length === 32)
+            return decoded.toString('hex'); // 裸 32 字节兜底
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** base58btc 解码 (multibase 'z' 前缀 = base58btc) — 只依赖 Node crypto 的 b58 简易实现 */
+function importB58(s) {
+    const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+    const base = BigInt(58);
+    let num = BigInt(0);
+    for (const ch of s) {
+        const idx = ALPHABET.indexOf(ch);
+        if (idx < 0)
+            throw new Error('bad base58 char');
+        num = num * base + BigInt(idx);
+    }
+    const bytes = [];
+    while (num > 0n) {
+        bytes.unshift(Number(num & 0xffn));
+        num >>= 8n;
+    }
+    // 前导 '1' → 前导 0x00
+    let leading = 0;
+    for (const ch of s) {
+        if (ch === '1')
+            leading++;
+        else
+            break;
+    }
+    return Uint8Array.from([...new Array(leading).fill(0), ...bytes]);
+}
+/** 投递机会到信箱 (验签通过才入库) */
+export async function deliverOpportunity(payload, signatureB64) {
+    if (payload.protocol !== INBOX_PROTOCOL)
+        return { ok: false, error: `协议不匹配: ${payload.protocol}` };
+    const title = String(payload.title || '').trim();
+    if (!title)
+        return { ok: false, error: '缺 title' };
+    const did = String(payload.provider?.did || '').trim();
+    if (!did)
+        return { ok: false, error: '缺 provider.did' };
+    // 1. 验签 (能解析公钥才可能 verified)
+    const pub = await resolveDidPublicKey(did);
+    let verification;
+    if (!pub) {
+        verification = 'unverified'; // 公钥解析不了 → 不入库 (不可信来源不污染世界流)
+        return { ok: false, error: '无法解析 provider DID 公钥 (拒绝不可信来源)' };
+    }
+    const okSig = await ed25519Verify(pub, canonicalPayload(payload), signatureB64);
+    if (!okSig) {
+        verification = 'signature-invalid';
+        return { ok: false, error: '签名无效 (拒绝伪造投递)' };
+    }
+    verification = 'verified';
+    // 2. 入库 (一机会一文件)
+    const id = `inbox_${safeId(crypto.createHash('sha256').update(canonicalPayload(payload)).digest('hex').slice(0, 16))}`;
+    const opp = {
+        protocol: payload.protocol,
+        id,
+        title,
+        summary: String(payload.summary || '').trim(),
+        refs: Array.isArray(payload.refs) ? payload.refs.map(String).filter(Boolean) : [],
+        provider: { did, name: payload.provider?.name },
+        issuedAt: payload.issuedAt,
+        verification,
+        receivedAt: Date.now(),
+    };
+    try {
+        await fs.mkdir(inboxDir(), { recursive: true });
+        await fs.writeFile(path.join(inboxDir(), `${id}.json`), JSON.stringify(opp, null, 2) + '\n', { mode: 0o600 });
+    }
+    catch (err) {
+        return { ok: false, error: `入库失败: ${err instanceof Error ? err.message : err}` };
+    }
+    return { ok: true, opportunity: opp };
+}
+/** 列出信箱机会 (verified 优先, 最近在前) */
+export async function listInboxOpportunities() {
+    try {
+        const files = await fs.readdir(inboxDir());
+        const out = [];
+        for (const f of files) {
+            if (!f.endsWith('.json'))
+                continue;
+            try {
+                const raw = await fs.readFile(path.join(inboxDir(), f), 'utf-8');
+                const p = JSON.parse(raw);
+                if (p && p.id)
+                    out.push(p);
+            }
+            catch { /* 坏文件跳过 */ }
+        }
+        return out.sort((a, b) => b.receivedAt - a.receivedAt);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/agents/opportunity-match.js

@@ -134,7 +134,52 @@ function candidateOf(entry, intentId, score, reason, matchTags) {
  *   · 无意图: 流入最近 open 公告 (新鲜度优先) —— 打开即有内容
  *   · 有意图: 匹配(`match`)优先浮上来, 其余世界变化按新鲜度垫底 (世界不停)
  *   · 已忽略的同源公告不流入 (随交互越来越准)
+ *   · 机会信箱 (外部 agent 投递, 验签通过) 恒优先 —— 真实可信来源
  */
+async function mergeInboxOnTop(all) {
+    const { listInboxOpportunities } = await import('./opportunity-inbox.js');
+    const inboxOpps = await listInboxOpportunities();
+    const inboxCards = inboxOpps
+        .filter((o) => o.verification === 'verified') // 只放行验签通过的
+        .map((o) => ({
+        id: o.id,
+        intentId: null,
+        source: 'inbox',
+        sourceId: o.id,
+        score: 0.9,
+        reason: 'inbox',
+        title: o.title,
+        summary: o.summary,
+        budget: null,
+        matchTags: [],
+        createdAt: o.receivedAt,
+        inbox: { providerDid: o.provider.did, providerName: o.provider.name, verification: o.verification, refs: o.refs },
+    }));
+    for (const c of inboxCards.slice(0, 10)) {
+        void noteObservation({ ts: Date.now(), kind: 'opportunity-seen', sourceId: c.sourceId, title: c.title, score: c.score, reason: 'inbox' });
+    }
+    // 2026-10-05: AI 主动上网搜到的机会 (真 URL, 可点开核实) — 排信箱后、本地源前
+    const { listSearchOpportunities } = await import('./opportunity-web-search.js');
+    const searchOpps = await listSearchOpportunities();
+    const searchCards = searchOpps.map((o) => ({
+        id: o.id,
+        intentId: null,
+        source: 'search',
+        sourceId: o.id,
+        score: 0.8,
+        reason: 'search',
+        title: o.title,
+        summary: o.summary,
+        budget: null,
+        matchTags: [],
+        createdAt: o.searchedAt,
+        search: { url: o.url, source: o.source, query: o.query },
+    }));
+    for (const c of searchCards.slice(0, 10)) {
+        void noteObservation({ ts: Date.now(), kind: 'opportunity-seen', sourceId: c.sourceId, title: c.title, score: c.score, reason: 'search' });
+    }
+    return [...inboxCards, ...searchCards, ...all]; // 信箱 > 搜索 > 本地
+}
 export async function scanOpportunities(opts = {}) {
     const limit = opts.limit ?? 50;
     const minScore = opts.minScore ?? 0.2;
@@ -184,7 +229,7 @@ export async function scanOpportunities(opts = {}) {
             for (const c of all.filter((x) => x.reason === 'match').slice(0, 10)) {
                 void noteObservation({ ts: Date.now(), kind: 'opportunity-seen', sourceId: c.sourceId, title: c.title, score: c.score, reason: 'match' });
             }
-            return { ok: true, results: all.slice(0, limit) };
+            return { ok: true, results: (await mergeInboxOnTop(all)).slice(0, limit) };
         }
         // 默认世界流: 新鲜度优先
         const sorted = [...openEntries].sort((a, b) => (b.createdAt ?? 0) - (a.createdAt ?? 0));
@@ -198,7 +243,7 @@ export async function scanOpportunities(opts = {}) {
         for (const c of out.slice(0, 10)) {
             void noteObservation({ ts: Date.now(), kind: 'world-change', sourceId: c.sourceId, title: c.title, score: c.score, reason: 'world' });
         }
-        return { ok: true, results: out.slice(0, limit) };
+        return { ok: true, results: (await mergeInboxOnTop(out)).slice(0, limit) };
     }
     // 有意图: 匹配打分, match 优先; 世界变化不消失
     const matches = [];
@@ -229,11 +274,7 @@ export async function scanOpportunities(opts = {}) {
             return rank(a.reason) - rank(b.reason);
         return b.score - a.score;
     });
-    // 世界观察: 高分匹配 = AI 主动看到的机会 (自动记 memory)
-    for (const c of all.filter((x) => x.reason === 'match').slice(0, 10)) {
-        void noteObservation({ ts: Date.now(), kind: 'opportunity-seen', sourceId: c.sourceId, title: c.title, score: c.score, reason: 'match' });
-    }
-    return { ok: true, results: all.slice(0, limit) };
+    return { ok: true, results: (await mergeInboxOnTop(all)).slice(0, limit) };
 }
 /** 对单个意图即时匹配 (list --intent 用; 不走反馈过滤) */
 export async function matchOneIntentText(text, tags, budget, opts = {}) {

package/dist/agents/opportunity-web-search.js

@@ -0,0 +1,183 @@
+/**
+ * opportunity-web-search.ts — AI 主动上网搜机会 (2026-10-05, leo: 系统要主动搜索展示)
+ *
+ * 设计: 世界观察器 (world-watcher) 每轮 tick 时, 若有 active intent / 用户画像,
+ *   自动用 DuckDuckGo 搜索「<意图> + 合作/机会/招募/开放」类关键词, 把真搜索结果
+ *   结构化落盘 `~/.bolloon/world/search/<id>.json`, 并进世界流 (reason=search, 带来源 URL)。
+ *
+ * 真实可信: 每条 = 真 URL + 真摘要 (来自搜索返回), 可点开核实, 不是本机编造。
+ * 无 TAVILY_API_KEY 时走 DuckDuckGo HTML 端点 (免费无需 key, 与本仓 fetch_url 同源 curl 模式)。
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as crypto from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { worldDir } from './intent-store.js';
+const pExecFile = promisify(execFile);
+const searchDir = () => path.join(worldDir(), 'search');
+function safeId(s) {
+    return s.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);
+}
+/** DuckDuckGo HTML 搜索 → 结构化结果 (标题/URL/摘要) */
+async function searchDuckDuckGo(query, limit = 8) {
+    try {
+        const UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36';
+        const { stdout } = await pExecFile('curl', [
+            '-sL', '--max-time', '20', '-A', UA,
+            '-H', 'Accept-Language: zh-CN,zh;q=0.9,en;q=0.8',
+            `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`,
+        ], { maxBuffer: 2 * 1024 * 1024, timeout: 25_000 });
+        if (!stdout)
+            return [];
+        // 解析 result__a (标题+URL) + result__snippet (摘要)
+        const out = [];
+        const itemRe = /<a[^>]*class="result__a"[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>[\s\S]*?<a[^>]*class="result__snippet"[^>]*>(.*?)<\/a>/g;
+        let m;
+        let guard = 0;
+        while ((m = itemRe.exec(stdout)) !== null && guard++ < 30) {
+            const rawHref = m[1];
+            // DDG 的 href 是重定向包装 (//duckduckgo.com/l/?uddg=<encoded>)
+            let url = rawHref;
+            const uddg = rawHref.match(/uddg=([^&]+)/);
+            if (uddg) {
+                try {
+                    url = decodeURIComponent(uddg[1]);
+                }
+                catch {
+                    url = rawHref;
+                }
+            }
+            if (!/^https?:\/\//i.test(url))
+                continue;
+            const title = m[2].replace(/<[^>]+>/g, '').trim();
+            const summary = m[3].replace(/<[^>]+>/g, '').replace(/&[a-z]+;/g, ' ').replace(/\s+/g, ' ').trim();
+            if (title)
+                out.push({ title, url, summary: summary.slice(0, 200) });
+            if (out.length >= limit)
+                break;
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/** Tavily 搜索 (配置了 TAVILY_API_KEY 时用, 更完整) */
+async function searchTavily(query, limit = 8) {
+    const key = process.env.TAVILY_API_KEY || '';
+    if (!key)
+        return [];
+    try {
+        const UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36';
+        const { stdout } = await pExecFile('curl', [
+            '-s', '--max-time', '20', '-A', UA,
+            '-X', 'POST', 'https://api.tavily.com/search',
+            '-H', 'Content-Type: application/json',
+            '-d', JSON.stringify({ api_key: key, query, max_results: limit, include_answer: false }),
+        ], { maxBuffer: 2 * 1024 * 1024, timeout: 25_000 });
+        const d = JSON.parse(stdout);
+        return (d.results || []).slice(0, limit).map((x) => ({
+            title: String(x.title || '').trim(),
+            url: String(x.url || '').trim(),
+            summary: String(x.content || '').replace(/\s+/g, ' ').slice(0, 200),
+        })).filter((x) => x.title && /^https?:/.test(x.url));
+    }
+    catch {
+        return [];
+    }
+}
+/** 搜索查询构造: 意图/画像 + 机会类词 (真搜索, 关键词可配) */
+const OPPORTUNITY_HINTS = ['合作', '机会', '招募', 'open call', 'partnership', 'looking for', 'call for'];
+function buildQueries(topic) {
+    const base = String(topic || '').trim().slice(0, 60);
+    if (!base)
+        return [];
+    return OPPORTUNITY_HINTS.map((h) => `${base} ${h}`);
+}
+/**
+ * 主动搜索一轮: 按 topic (意图/画像文本) 搜机会, 结构化落盘。
+ * 返回本轮新增条数 (已有同 URL 的不重复落盘 — 幂等)。
+ */
+export async function searchOpportunitiesForTopic(topic, opts = {}) {
+    const limit = opts.limit ?? 6;
+    const queries = buildQueries(topic);
+    if (!queries.length)
+        return { ok: false, added: 0, total: 0, results: [], error: '空 topic' };
+    // 合并引擎结果 (Tavily 优先, 无 key 走 DDG)
+    const engine = process.env.TAVILY_API_KEY ? searchTavily : searchDuckDuckGo;
+    const raw = [];
+    for (const q of queries.slice(0, 3)) {
+        const hits = await engine(q, limit);
+        for (const h of hits)
+            raw.push({ ...h, query: q });
+    }
+    // 已有 URL 集合 (幂等)
+    const seen = new Set();
+    try {
+        const files = await fs.readdir(searchDir());
+        for (const f of files) {
+            if (!f.endsWith('.json'))
+                continue;
+            try {
+                const p = JSON.parse(await fs.readFile(path.join(searchDir(), f), 'utf-8'));
+                if (p && p.url)
+                    seen.add(String(p.url));
+            }
+            catch { /* 坏文件跳过 */ }
+        }
+    }
+    catch { /* 目录不存在 = 首次 */ }
+    const now = Date.now();
+    const results = [];
+    let added = 0;
+    try {
+        await fs.mkdir(searchDir(), { recursive: true });
+    }
+    catch { /* 落盘失败不阻断 */ }
+    for (const r of raw) {
+        if (seen.has(r.url))
+            continue; // 已有, 不重复
+        const id = `search_${safeId(crypto.createHash('sha256').update(r.url).digest('hex').slice(0, 14))}`;
+        const opp = {
+            id,
+            query: r.query,
+            title: r.title.slice(0, 80),
+            url: r.url,
+            summary: r.summary,
+            source: process.env.TAVILY_API_KEY ? 'tavily' : 'duckduckgo',
+            searchedAt: now,
+        };
+        try {
+            await fs.writeFile(path.join(searchDir(), `${id}.json`), JSON.stringify(opp, null, 2) + '\n', { mode: 0o600 });
+            seen.add(r.url);
+            results.push(opp);
+            added += 1;
+        }
+        catch { /* 单条失败跳过 */ }
+        if (added >= limit)
+            break;
+    }
+    return { ok: true, added, total: results.length, results };
+}
+/** 列出已搜索到的机会 (最近在前) */
+export async function listSearchOpportunities() {
+    try {
+        const files = await fs.readdir(searchDir());
+        const out = [];
+        for (const f of files) {
+            if (!f.endsWith('.json'))
+                continue;
+            try {
+                const p = JSON.parse(await fs.readFile(path.join(searchDir(), f), 'utf-8'));
+                if (p && p.id && p.url)
+                    out.push(p);
+            }
+            catch { /* 坏文件跳过 */ }
+        }
+        return out.sort((a, b) => b.searchedAt - a.searchedAt);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/agents/world-watcher.js

@@ -15,7 +15,8 @@ export { readProfile, setProfile };
 let watcherTimer = null;
 let watching = false; // 防重叠: 上一轮没跑完就跳过这一轮
 let watcherCount = 0;
-/** 单轮观察: 扫描世界 → 观察日志/校准环自动积累 (分发主体本地版) */
+/** 单轮观察: 扫描世界 → 观察日志/校准环自动积累 (分发主体本地版)。
+ *  2026-10-05 (leo): 有 active intent / 画像时, 自动上网搜机会 (AI 主动搜索, 非被动响应)。 */
 export async function tickWorldWatcher() {
     if (watching)
         return { ok: true, observed: 0, count: watcherCount, error: '上一轮观察未完成, 跳过本轮 (防重叠)' };
@@ -23,12 +24,40 @@ export async function tickWorldWatcher() {
     try {
         const r = await scanOpportunities({ limit: 50 });
         watcherCount += 1;
+        // 2026-10-05: 主动搜索 — 有意图/画像才搜 (无 topic 不烧网络); 失败不影响扫描
+        await autoSearchForIntents();
         return { ok: r.ok, observed: r.results.length, count: watcherCount, error: r.error };
     }
     finally {
         watching = false;
     }
 }
+/** 按 active intent + 画像文本自动搜索机会 (AI 主动上网找, 结果进 world/search/) */
+async function autoSearchForIntents() {
+    try {
+        const { listIntents } = await import('./intent-store.js');
+        const intents = await listIntents();
+        const active = intents.ok ? intents.intents.filter((i) => i.status === 'active') : [];
+        const topics = active.map((i) => i.text);
+        if (!topics.length) {
+            const profile = await readProfile();
+            if (profile && (profile.about || profile.tags.length)) {
+                topics.push(profile.about || profile.tags.join(' '));
+            }
+        }
+        if (!topics.length)
+            return; // 无意图无画像 → 不主动搜
+        // 每轮至多搜 2 个主题 (网络调用有成本; 已有结果幂等不重复)
+        for (const t of topics.slice(0, 2)) {
+            const { searchOpportunitiesForTopic } = await import('./opportunity-web-search.js');
+            const r = await searchOpportunitiesForTopic(t, { limit: 4 });
+            if (r.added > 0) {
+                console.info(`[world-watcher] 主动搜索「${t.slice(0, 30)}」新增 ${r.added} 条机会`);
+            }
+        }
+    }
+    catch { /* 主动搜索失败静默, 下一轮再试 */ }
+}
 /**
  * 启动世界自动观察器 (服务端启动时调用一次即可; 幂等, 重复调用不叠定时器)。
  * 每 intervalMs (默认 10 分钟) 自动扫描一次 —— 机会进入 AI 视野是主动行为, 不是人触发。

package/dist/cli/intent-command.js

@@ -174,7 +174,7 @@ export async function opportunityCommand(flags) {
 }
 function cardRows(opts) {
     const pct = Math.round(opts.score * 100);
-    const tag = opts.reason === 'match' ? '● 与你匹配' : '○ 世界变化';
+    const tag = opts.reason === 'match' ? '● 与你匹配' : (opts.reason === 'inbox' ? '✉ 外部投递' : (opts.reason === 'search' ? '🔎 AI 搜索' : '○ 世界变化'));
     return [
         `  ${pct}% ${tag}  ${opts.title}`,
         `      ${opts.summary}`,

package/dist/ios/bolloon-web.json

@@ -1,10 +1,10 @@
 {
   "schema": "bolloon-mobile-web/1",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "channel": "stable",
   "build": "stable",
-  "commit": "d0d0f60ab5efd7e473c1aac60cd63aa97fc4e331",
-  "builtAt": "2026-10-05T10:43:20.796Z",
+  "commit": "bc1ef6920ae4c4ef7c4d6b6433e81dcf3e17a55d",
+  "builtAt": "2026-10-06T07:02:09.463Z",
   "layer": "web",
   "note": "web 资源层构建戳 (手机端 OTA 的身份第 ③ 级回退; 装机后以 OTA state.json 为准)"
 }