@bolloon/bolloon-agent 0.6.4 → 0.6.6

package/dist/web/routes-contacts.js

@@ -413,8 +413,101 @@ export function registerContactRoutes(app, opts = {}) {
             res.status(500).json({ ok: false, error: String(err?.message || err) });
         }
     });
+    // ── 手机号目录 (2026-10-11, phone-account-lookup-design 落点 A) ────────────
+    // 隐私: 请求/响应全程只过「盲化哈希」, 明文手机号只在请求体出现一次 (发布/查询),
+    //       永不出现在响应里 (与 contacts 既有红线一致)。
+    const dirHome = () => opts.home || undefined;
+    /** 发布手机号 → DID 指针 (opt-in; 用户显式调用) */
+    app.post('/api/contacts/directory/publish', async (req, res) => {
+        try {
+            const { publishEntry, isPlausiblePhone } = await import('../agents/contacts/human-directory.js');
+            const phone = String(req.body?.phone || '');
+            const did = String(req.body?.did || ownerDidFromDisk());
+            if (!isPlausiblePhone(phone))
+                return res.status(400).json({ ok: false, error: '手机号格式不正确' });
+            const e = await publishEntry(phone, did, {
+                displayName: req.body?.displayName ? String(req.body.displayName) : undefined,
+                publicKeyHex: req.body?.publicKeyHex ? String(req.body.publicKeyHex) : undefined,
+                homeDir: dirHome(),
+            });
+            res.json({ ok: true, phoneHash: e.phoneHash.slice(0, 8) + '…', did: e.did, publicKeyHex: e.publicKeyHex || null, publishedAt: e.publishedAt });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 撤销目录条目 (软删) */
+    app.post('/api/contacts/directory/retract', async (req, res) => {
+        try {
+            const { retractEntry } = await import('../agents/contacts/human-directory.js');
+            const did = String(req.body?.did || ownerDidFromDisk());
+            const ok = await retractEntry(did, dirHome());
+            res.json({ ok, revoked: ok });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 按手机号查账号 (在本机目录内找; 响应只回 DID/昵称, 绝不回手机号) */
+    app.post('/api/contacts/directory/lookup', async (req, res) => {
+        try {
+            const { lookupPhone, isPlausiblePhone } = await import('../agents/contacts/human-directory.js');
+            const phone = String(req.body?.phone || '');
+            if (!isPlausiblePhone(phone))
+                return res.status(400).json({ ok: false, error: '手机号格式不正确' });
+            const r = await lookupPhone(phone, dirHome());
+            if (!r.found)
+                return res.json({ ok: true, found: false, note: '未找到 (未注册或未公开)' });
+            res.json({ ok: true, found: true, did: r.did, publicKeyHex: r.publicKeyHex || null, displayName: r.displayName || null });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 按手机号直接发好友请求 (P1, 2026-10-15): directory lookup → publicKeyHex → 既有 /api/friend-request */
+    app.post('/api/contacts/directory/add-friend', async (req, res) => {
+        try {
+            const { lookupPhone, isPlausiblePhone } = await import('../agents/contacts/human-directory.js');
+            const phone = String(req.body?.phone || '');
+            if (!isPlausiblePhone(phone))
+                return res.status(400).json({ ok: false, error: '手机号格式不正确' });
+            const r = await lookupPhone(phone, dirHome());
+            if (!r.found)
+                return res.json({ ok: true, found: false, note: '未找到 (未注册或未公开)' });
+            if (!r.publicKeyHex)
+                return res.status(422).json({ ok: false, found: true, error: `对方已注册目录但未公开 P2P 公钥 (${r.did?.slice(0, 20)}…), 无法直接加好友` });
+            // 委托给既有好友请求链路 (本机端口; 与 pi-sdk accept 工具同口径)
+            const port = process.env.PORT || '54188';
+            const fr = await fetch(`http://127.0.0.1:${port}/api/friend-request`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    targetPublicKey: r.publicKeyHex,
+                    name: req.body?.name ? String(req.body.name) : r.displayName || undefined,
+                    message: req.body?.message ? String(req.body.message) : `来自手机号目录: 想加你为好友`,
+                    note: `via-phone-directory`,
+                }),
+            });
+            const data = await fr.json();
+            res.status(fr.status).json({ ok: data.ok !== false, found: true, did: r.did, friend: data });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
+    /** 列出已发布条目 (本机审计; 只回脱敏哈希) */
+    app.get('/api/contacts/directory/list', async (_req, res) => {
+        try {
+            const { readDirectory, summarizeEntries } = await import('../agents/contacts/human-directory.js');
+            const entries = await readDirectory(dirHome());
+            res.json({ ok: true, entries: summarizeEntries(entries) });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: String(err?.message || err) });
+        }
+    });
     // ── 隐藏守卫自检 (验收/测试直接用) ──────────────────────────────────────────
     app.get('/api/contacts/_selfcheck', (_req, res) => {
-        res.json({ ok: true, plaintextGuard: looksLikePlaintextSecret({ contacts: [{ value: '+8613812345678' }] }) });
+        res.json({ ok: true, plaintextGuard: looksLikePlaintextSecret({ contacts: [{ value: '+861****5678' }] }) });
     });
 }

package/dist/web/routes-world.js

@@ -2,6 +2,8 @@ import { setIntent, listIntents, getIntent, removeIntent } from '../agents/inten
 import { scanOpportunities, recordFeedback, readObservations } from '../agents/opportunity-match.js';
 import { readProfile, setProfile } from '../agents/world-profile.js';
 import { worldWatcherStatus } from '../agents/world-watcher.js';
+import { deliverOpportunity, listInboxOpportunities, INBOX_PROTOCOL } from '../agents/opportunity-inbox.js';
+import { searchOpportunitiesForTopic, listSearchOpportunities } from '../agents/opportunity-web-search.js';
 function json(res, status, body) {
     res.status(status).json(body);
 }
@@ -10,7 +12,10 @@ function bodyOf(req) {
 }
 /** 限制输入形状: 只收明确字段, 不整个吞前端对象 */
 function intentInputFromBody(body) {
-    const b = bodyOf(body);
+    // 2026-10-06 修 bug: 之前调 bodyOf(body) —— bodyOf 期望 Request 访问 .body,
+    //   传 body 对象本身时 req.body = body.body = undefined ⇒ 永远返回 {} ⇒ 所有字段都丢。
+    //   body 此刻已是 express.json 解析后的对象, 直接校验即可。
+    const b = body && typeof body === 'object' ? body : {};
     const out = {};
     if (typeof b.text === 'string' && b.text.trim())
         out.text = b.text.trim();
@@ -102,4 +107,56 @@ export function registerWorldRoutes(app) {
         const observations = await readObservations(20);
         json(res, 200, { ok: true, watcher: status, recentObservations: observations });
     });
+    // ── 机会信箱 (2026-10-05, leo: 别人主动投来的机会 — 真实可信来源) ───────────
+    // 外部 agent 用 DIAP Ed25519 身份签名投递机会声明; 验签通过才入库并进世界流。
+    // 协议: POST { protocol, title, summary, refs[], provider:{did}, issuedAt } + header X-Signature
+    //   signature = ed25519Sign(provider 私钥, canonicalize(上述 payload)) — 与 x402 同源 canonicalize
+    app.get('/api/world/inbox', async (_req, res) => {
+        const list = await listInboxOpportunities();
+        json(res, 200, { ok: true, count: list.length, opportunities: list });
+    });
+    app.post('/api/world/inbox', async (req, res) => {
+        const b = bodyOf(req);
+        const sig = typeof req.headers['x-signature'] === 'string' ? req.headers['x-signature'] : '';
+        const payload = {
+            protocol: typeof b.protocol === 'string' ? b.protocol : '',
+            title: typeof b.title === 'string' ? b.title : '',
+            summary: typeof b.summary === 'string' ? b.summary : '',
+            refs: Array.isArray(b.refs) ? b.refs.filter((r) => typeof r === 'string') : [],
+            provider: {
+                did: typeof b.provider?.did === 'string' ? b.provider.did : '',
+                name: typeof b.provider?.name === 'string' ? b.provider.name : undefined,
+            },
+            issuedAt: typeof b.issuedAt === 'string' ? b.issuedAt : new Date().toISOString(),
+        };
+        const r = await deliverOpportunity(payload, sig);
+        json(res, r.ok ? 200 : 400, { ok: r.ok, opportunity: r.opportunity, error: r.error });
+    });
+    // 协议说明 (外部 agent 对接用 — 怎么构造 payload / 怎么签名)
+    app.get('/api/world/inbox/protocol', async (_req, res) => {
+        json(res, 200, {
+            ok: true,
+            protocol: INBOX_PROTOCOL,
+            description: '外部 agent 主动投递机会到信箱: POST /api/world/inbox, header X-Signature = Ed25519(provider 私钥, canonicalize(payload))',
+            payloadFields: ['protocol', 'title', 'summary', 'refs[]', 'provider.did', 'provider.name?', 'issuedAt'],
+            signature: 'ed25519Sign(providerPrivateKey, canonicalize({protocol,title,summary,refs,provider,issuedAt}))',
+            verification: '本机解析 provider.did → Ed25519 公钥 → 验签; 通过才入库 (verified) 并进世界流, 否则拒绝',
+        });
+    });
+    // ── AI 主动搜索 (2026-10-05, leo: 系统要主动上网搜机会, 非只被动响应) ─────────
+    // POST /api/world/search [{topic}] → 按 topic 搜机会落 world/search/ 并进世界流
+    app.post('/api/world/search', async (req, res) => {
+        const b = bodyOf(req);
+        const topic = typeof b.topic === 'string' && b.topic.trim() ? b.topic.trim()
+            : (typeof b.text === 'string' && b.text.trim() ? b.text.trim() : '');
+        if (!topic)
+            return json(res, 400, { ok: false, error: '缺 topic (要搜什么机会)' });
+        const r = await searchOpportunitiesForTopic(topic, { limit: 6 });
+        json(res, r.ok ? 200 : 400, { ok: r.ok, topic, added: r.added, total: r.total, opportunities: r.results, error: r.error });
+    });
+    // GET /api/world/search → 已搜到的机会 (最近在前)
+    app.get('/api/world/search', async (_req, res) => {
+        const list = await listSearchOpportunities();
+        json(res, 200, { ok: true, count: list.length, opportunities: list });
+    });
 }

package/dist/web/server.js

@@ -920,6 +920,7 @@ async function handleV3P2PMessage(parsed, conn, comm) {
                             output: event.output,
                             error: event.error,
                             args: event.args,
+                            durationMs: event.durationMs, // 2026-10-12: 命令执行时间读秒
                             fromPublicKey: v3P2PRef?.getPublicKey() || ''
                         }
                     });
@@ -4941,7 +4942,7 @@ fetchState();
             //   (与邮箱串行一致), web 不再自己持 abortController。取到 agent 后立刻开户 (见下面 getAgentForChannel 之后)。
             let abortSignal;
             // 2026-07-04: pivot loop safety net — 防止 LLM hang (minimax M3
-            //   偶尔反复 think 不输出 <final gen>, pivot 连 5 次无进展时会 hang 在
+            //   偶尔反复 think 不输出结果, pivot 连 5 次无进展时会 hang 在
             //   quality 评估). setTimeout 让 LLM 客户端收 signal 主动 break.
             // 2026-07-06: 30s 太短 — minimax M3 单次 LLM 约 10s, pivot 默认 moderate profile 30 iter
             //   留 ~300s. 之前 30s 自动 abort 时, 一次"你好"调用就被截断, 用户看到 ❌ 循环异常 + 空内容.
@@ -5169,7 +5170,7 @@ fetchState();
                 // 2026-06-10: 注入 skills 列表 (本机 ~/.bolloon/skills/ 下所有 skills)
                 // 让 LLM 知道有哪些 skill 可用, 在回复中提示用户
                 try {
-                    const { loadSkillsFromPaths, defaultSkillPaths, describeSkill } = await import('../agents/skill-loader.js');
+                    const { loadSkillsFromPaths, defaultSkillPaths } = await import('../agents/skill-loader.js');
                     const paths = defaultSkillPaths();
                     const skills = await loadSkillsFromPaths(paths);
                     if (skills.length > 0) {
@@ -6901,6 +6902,7 @@ fetchState();
                         output: event.output,
                         error: event.error,
                         args: event.args,
+                        durationMs: event.durationMs, // 2026-10-12: 命令执行时间读秒
                     }, channelId);
                 }
                 else if (event.type === 'error') {

package/dist/web/style.css

@@ -4,6 +4,12 @@
   box-sizing: border-box;
 }
 
+/* 2026-10-05 (leo): hidden 属性必须真隐藏 —— 之前 .messages{display:flex} 覆盖了
+   UA 的 [hidden]{display:none}, 导致世界栏下面一直显示聊天记录 (污染)。 */
+[hidden] {
+  display: none !important;
+}
+
 :root {
   --bg: #1a1a18;
   --bg-sidebar: #222220;
@@ -120,13 +126,20 @@ body {
   flex-shrink: 0;
   transition: var(--transition);
   transform: translateX(0);
-  position: relative;
+  /* 2026-10-06: 改为 fixed 覆盖 — sidebar 收起时绝对定位脱离流, relative 会被挤成 0 宽,
+      恢复条必须固定在屏幕左侧才能被看到/点到 */
+  position: fixed;
+  left: 0;
+  top: 0;
+  height: 100%;
   z-index: 99;
 }
 
 .sidebar-collapsed.hidden {
   transform: translateX(calc(-1 * var(--sidebar-collapsed)));
-  position: absolute;
+  position: fixed;
+  left: 0;
+  top: 0;
   height: 100%;
 }
 
@@ -1858,6 +1871,40 @@ body {
   font-weight: normal;
   color: var(--text-muted);
 }
+
+/* 2026-10-05 (leo): 世界/聊天切换放进原导航栏 (header) 中间 — 与钱包/配置同栏 */
+.header-tabs {
+  display: flex;
+  gap: 2px;
+  margin-left: 18px;
+  padding: 3px;
+  background: var(--bg-hover);
+  border-radius: 8px;
+  flex-shrink: 0;
+}
+.header-tab {
+  padding: 7px 22px;
+  background: transparent;
+  border: none;
+  border-radius: 6px;
+  color: var(--text-secondary);
+  font-size: 13px;
+  font-weight: 600;
+  cursor: pointer;
+  transition: var(--transition);
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  white-space: nowrap;
+}
+.header-tab:hover {
+  color: var(--text-primary);
+}
+.header-tab.active {
+  background: var(--bg-main);
+  color: var(--accent-hover);
+  box-shadow: 0 1px 3px rgba(0,0,0,0.3);
+}
 .judgment-status-bar {
   display: flex;
   gap: 6px;

package/dist/web/sw.js

@@ -6,7 +6,7 @@
  * 现在: 代码类资源 (html/js/css/json) 一律 **network-first** (拿不到网才回退缓存),
  *   缓存名带版本号, activate 时清掉所有旧缓存; 图标等静态资源仍 cache-first。
  */
-const CACHE = 'bolloon-mobile-v0.6.4';
+const CACHE = 'bolloon-mobile-v0.6.6';
 const SHELL = [
   './mobile.html',
   './mobile.css',

package/dist/web/ui/message-renderer.js

@@ -261,21 +261,10 @@ function segmentChatReply(reply, ctx) {
   if (remaining.trim()) {
     remaining = filterFillerText(remaining);
   }
-  const finalIdx = remaining.indexOf("<final gen>");
-  let beforeFinalText = remaining;
-  if (finalIdx >= 0) {
-    beforeFinalText = remaining.substring(0, finalIdx);
-  }
-  const textContent = beforeFinalText.trim();
+  const textContent = remaining.trim();
   if (textContent) {
     segments.push({ type: "text", content: textContent });
   }
-  if (finalIdx >= 0) {
-    const afterFinal = remaining.substring(finalIdx + "<final gen>".length).trim();
-    if (afterFinal) {
-      segments.push({ type: "final", content: afterFinal });
-    }
-  }
   return segments;
 }
 function extractAndPush(type, text, out, re) {
@@ -530,11 +519,7 @@ function addMessage(content, type, save = true, container, usedJudgmentIds = [],
   div.className = `message message-${type}`;
   let cleanContent = content;
   if (type === "ai") {
-    cleanContent = cleanContent.replace(/<think>[\s\S]*?<\/think>/g, "");
-    const finalGenIdx = cleanContent.indexOf("<final gen>");
-    if (finalGenIdx >= 0) {
-      cleanContent = cleanContent.substring(0, finalGenIdx).trim();
-    }
+    cleanContent = cleanContent.replace(/ thinking[\s\S]*?<\/think>/g, "");
   }
   const knownToolNames = ctx && ctx.knownToolNames || /* @__PURE__ */ new Set();
   const segments = segmentChatReply(cleanContent, { knownToolNames });
@@ -858,7 +843,8 @@ function handleStepEvent(data, ctx = { messagesEl: null, messagesContainers: /*
     args: data.args,
     success: data.success,
     output: data.output,
-    error: data.error
+    error: data.error,
+    durationMs: data.durationMs
   });
 }
 function flushStepEventBuffer(channelId, ctx) {

package/dist/web/ui/step-timeline.js

@@ -1,6 +1,15 @@
 // src/web/ui/step-timeline.ts
 var MAX_VISIBLE_NODES = 20;
 var STORAGE_PREFIX = "bolloon.stepTimeline.expanded.";
+function formatDuration(ms) {
+  if (!Number.isFinite(ms) || ms < 0) return "(耗时未知)";
+  if (ms < 1e3) return `${ms}ms`;
+  const s = ms / 1e3;
+  if (s < 60) return `${s.toFixed(1)}s`;
+  const m = Math.floor(s / 60);
+  const rem = Math.round(s % 60);
+  return `${m}m${rem}s`;
+}
 var stateMap = /* @__PURE__ */ new WeakMap();
 function readExpanded(channelId) {
   if (!channelId) return false;
@@ -121,7 +130,10 @@ function render(timelineEl) {
       }
       node.setAttribute("data-status", step.status);
       const label = node.querySelector(".step-timeline-label");
-      if (label) label.textContent = step.name;
+      if (label) {
+        const dur = step.durationMs !== void 0 && step.status !== "active" ? ` · ${formatDuration(step.durationMs)}` : "";
+        label.textContent = step.name + dur;
+      }
       const argsEl = node.querySelector(".step-timeline-args");
       if (argsEl) {
         const argStr = step.args && Object.keys(step.args).length > 0 ? JSON.stringify(step.args).slice(0, 60) : "";
@@ -265,6 +277,7 @@ function pushStepToTimeline(timelineEl, eventType, data) {
       steps[targetIdx].status = data.success === false ? "error" : "done";
       if (data.output) steps[targetIdx].output = data.output;
       if (data.error) steps[targetIdx].error = data.error;
+      if (data.durationMs !== void 0) steps[targetIdx].durationMs = data.durationMs;
     } else {
       steps[targetIdx].status = "error";
       if (data.error) steps[targetIdx].error = data.error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bolloon/bolloon-agent",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "type": "module",
   "description": "P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品",
   "main": "dist/cli-entry.js",
@@ -59,7 +59,8 @@
     "ios:release": "bash scripts/ios-release.sh"
   },
   "workspaces": [
-    "src/constraint-runtime"
+    "src/constraint-runtime",
+    "src/kernel"
   ],
   "dependencies": {
     "@a2ui/react": "^0.11.0",

package/scripts/build-web.ts

@@ -14,7 +14,7 @@ async function main() {
 
   // 重要: 不能 rm -rf 整个 dist/web/, 否则会删掉 build:main 编译出来的
   // dist/web/server.js. 只清理 web 静态资源, 保留 server.js.
-  for (const f of ['index.html', 'api-config.html', 'explorer.html', 'style.css', 'client.js', 'chain-explorer.js', 'mobile.html', 'mobile.css', 'mobile.js', 'mobile-core.js', 'components']) {
+  for (const f of ['index.html', 'api-config.html', 'explorer.html', 'style.css', 'client.js', 'chain-explorer.js', 'mobile.html', 'mobile.css', 'mobile.js', 'mobile-core.js', 'mobile-persona.js', 'components']) {
     await fs.rm(path.join(DIST_WEB, f), { recursive: true, force: true });
   }
   await fs.mkdir(DIST_WEB, { recursive: true });
@@ -115,6 +115,21 @@ async function main() {
     bundle: true,
   });
 
+  // 2026-10-09: mobile.js 动态 import('./mobile-persona.js')。
+  //   这是手机端可直接运行 Agent 的配置依赖，必须随 dist/web 一起生成，
+  //   否则 WebView 会静默 404，性格页和 Web Agent 都会失效。
+  console.log('[build-web] 编译 mobile-persona.ts...');
+  await esbuild.build({
+    entryPoints: [path.join(ROOT, 'src/web/mobile-persona.ts')],
+    outfile: path.join(DIST_WEB, 'mobile-persona.js'),
+    format: 'esm',
+    target: 'es2022',
+    platform: 'browser',
+    minify: false,
+    bundle: true,
+    charset: 'utf8',
+  });
+
   // 2026-08-12: 编译 A2UI 前端渲染器 (a2ui-client.tsx → a2ui-client.js)
   //   react + @a2ui/react + @a2ui/web_core 全部打包进 bundle (手机端 webview 无 CDN)
   console.log('[build-web] 编译 a2ui-client.tsx...');