npm - @konglx/rotom - Versions diffs - 2.21.0 - Mend

@konglx/rotom 2.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (189) hide show

package/README.md +417 -0
package/bin/mesh-master.sh +439 -0
package/bin/rotom +29 -0
package/bin/rotom-link.sh +136 -0
package/bin/rotom-send-with-status +57 -0
package/bin/rotom-up.sh +428 -0
package/dist/cli/ask.js +62 -0
package/dist/cli/common.js +321 -0
package/dist/cli/config.js +65 -0
package/dist/cli/directory.js +17 -0
package/dist/cli/executor.js +58 -0
package/dist/cli/fed.js +91 -0
package/dist/cli/group.js +273 -0
package/dist/cli/identity.js +62 -0
package/dist/cli/init.js +268 -0
package/dist/cli/issue.js +202 -0
package/dist/cli/join.js +170 -0
package/dist/cli/link.js +47 -0
package/dist/cli/master.js +51 -0
package/dist/cli/memory.js +307 -0
package/dist/cli/note.js +68 -0
package/dist/cli/repo.js +77 -0
package/dist/cli/rotom.js +277 -0
package/dist/cli/routes.js +118 -0
package/dist/cli/run.js +45 -0
package/dist/cli/schedule.js +237 -0
package/dist/cli/skill.js +173 -0
package/dist/cli/team.js +106 -0
package/dist/executor/claude-code-hook.cjs +80 -0
package/dist/executor/cli-executor.js +8 -0
package/dist/executor/executors/claude-code.js +780 -0
package/dist/executor/executors/codex.js +719 -0
package/dist/executor/executors/hermes-cli.js +855 -0
package/dist/executor/executors/openclaw.js +467 -0
package/dist/executor/executors/pi.js +514 -0
package/dist/executor/index.js +269 -0
package/dist/executor/jsonrpc-transport.js +125 -0
package/dist/executor/process-runner.js +101 -0
package/dist/executor/reasoning-status.js +83 -0
package/dist/executor/repo-cache.js +502 -0
package/dist/executor/session-store.js +188 -0
package/dist/executor/worker-chat.js +257 -0
package/dist/executor/worker-connection.js +89 -0
package/dist/executor/worker-issue.js +264 -0
package/dist/executor/worker.js +877 -0
package/dist/link/pending-requests.js +72 -0
package/dist/link/server.js +233 -0
package/dist/link/visibility-store.js +58 -0
package/dist/master/api/agents.js +333 -0
package/dist/master/api/artifacts.js +271 -0
package/dist/master/api/domains.js +64 -0
package/dist/master/api/groups.js +635 -0
package/dist/master/api/guidance-templates.js +147 -0
package/dist/master/api/index.js +89 -0
package/dist/master/api/issues-patrol.js +172 -0
package/dist/master/api/issues.js +663 -0
package/dist/master/api/links-patrol.js +168 -0
package/dist/master/api/links.js +114 -0
package/dist/master/api/memory.js +259 -0
package/dist/master/api/messages.js +157 -0
package/dist/master/api/notes.js +77 -0
package/dist/master/api/schedule-patterns.js +133 -0
package/dist/master/api/schedules.js +272 -0
package/dist/master/api/sessions.js +158 -0
package/dist/master/api/share.js +269 -0
package/dist/master/api/skills.js +190 -0
package/dist/master/api/teams.js +122 -0
package/dist/master/api/uploads.js +245 -0
package/dist/master/auth.js +134 -0
package/dist/master/dashboard/animations/calico-dozing.apng +0 -0
package/dist/master/dashboard/animations/calico-error.apng +0 -0
package/dist/master/dashboard/animations/calico-happy.apng +0 -0
package/dist/master/dashboard/animations/calico-notification.apng +0 -0
package/dist/master/dashboard/animations/calico-sleeping.apng +0 -0
package/dist/master/dashboard/animations/calico-thinking.apng +0 -0
package/dist/master/dashboard/animations/calico-waking.apng +0 -0
package/dist/master/dashboard/assets/ApprovalCard-C38VV6ko.css +1 -0
package/dist/master/dashboard/assets/ApprovalCard-CHPh2dmE.js +17 -0
package/dist/master/dashboard/assets/ArtifactPanel-P_2gAP7v.js +1 -0
package/dist/master/dashboard/assets/ArtifactPanel-aGHySny5.css +1 -0
package/dist/master/dashboard/assets/css.worker-DaIe3gwK.js +84 -0
package/dist/master/dashboard/assets/editor.worker-BCzxt1at.js +12 -0
package/dist/master/dashboard/assets/html.worker-CKrFyw_2.js +461 -0
package/dist/master/dashboard/assets/index-CChrTn81.css +32 -0
package/dist/master/dashboard/assets/index-Dhu4SN1z.js +181 -0
package/dist/master/dashboard/assets/json.worker-B7c_PmGb.js +49 -0
package/dist/master/dashboard/assets/markdown-CeN5IgdF.js +29 -0
package/dist/master/dashboard/assets/monaco-core-DyX1CsEw.css +1 -0
package/dist/master/dashboard/assets/monaco-core-oQiQUisy.js +833 -0
package/dist/master/dashboard/assets/monaco-setup-CiOPQdmo.js +1 -0
package/dist/master/dashboard/assets/react-vendor-C8IxlyCR.js +67 -0
package/dist/master/dashboard/assets/ts.worker-BhkL8olL.js +51334 -0
package/dist/master/dashboard/assets/useMonaco-ILb4vyPh.js +12 -0
package/dist/master/dashboard/assets/vite-preload-CxJPbCTl.js +1 -0
package/dist/master/dashboard/debug-auth.html +197 -0
package/dist/master/dashboard/favicon.ico +0 -0
package/dist/master/dashboard/index.html +20 -0
package/dist/master/dashboard/rotom-avatar.png +0 -0
package/dist/master/db/agent-sessions.js +60 -0
package/dist/master/db/agent-visibility.js +64 -0
package/dist/master/db/agents.js +119 -0
package/dist/master/db/ask-bridges.js +157 -0
package/dist/master/db/build-update.js +59 -0
package/dist/master/db/core.js +82 -0
package/dist/master/db/domains.js +80 -0
package/dist/master/db/groups.js +316 -0
package/dist/master/db/guidance-templates.js +58 -0
package/dist/master/db/index.js +12 -0
package/dist/master/db/internal.js +45 -0
package/dist/master/db/issues-patrol.js +81 -0
package/dist/master/db/issues.js +373 -0
package/dist/master/db/links.js +221 -0
package/dist/master/db/master-node.js +43 -0
package/dist/master/db/memory.js +272 -0
package/dist/master/db/messages.js +210 -0
package/dist/master/db/notes.js +55 -0
package/dist/master/db/schedule-patterns.js +56 -0
package/dist/master/db/schedules.js +135 -0
package/dist/master/db/skills.js +144 -0
package/dist/master/db/team.js +88 -0
package/dist/master/db/types.js +10 -0
package/dist/master/db.js +12 -0
package/dist/master/embedded.js +133 -0
package/dist/master/federation/client.js +283 -0
package/dist/master/federation/identity.js +133 -0
package/dist/master/federation/manager.js +267 -0
package/dist/master/federation/publisher.js +87 -0
package/dist/master/federation/self-publisher.js +69 -0
package/dist/master/federation/server.js +487 -0
package/dist/master/group-paths.js +208 -0
package/dist/master/offline-queue.js +38 -0
package/dist/master/opc-bootstrap.js +245 -0
package/dist/master/patrol-terminal.js +275 -0
package/dist/master/repo-scan.js +188 -0
package/dist/master/router.js +214 -0
package/dist/master/scheduler-handlers.js +510 -0
package/dist/master/scheduler.js +201 -0
package/dist/master/server.js +203 -0
package/dist/master/services/link-collector.js +82 -0
package/dist/master/services/link-patrol-bootstrap.js +50 -0
package/dist/master/services/memory-extract-prompt.js +34 -0
package/dist/master/services/patrol-bootstrap.js +63 -0
package/dist/master/share-tokens.js +56 -0
package/dist/master/terminal-hub.js +300 -0
package/dist/master/uploads.js +108 -0
package/dist/master/util/fs.js +100 -0
package/dist/master/util/paths.js +50 -0
package/dist/master/util/persona.js +10 -0
package/dist/master/ws-hub/connection.js +928 -0
package/dist/master/ws-hub/conversation.js +290 -0
package/dist/master/ws-hub/directory.js +70 -0
package/dist/master/ws-hub/dispatch-enrich.js +34 -0
package/dist/master/ws-hub/hub.js +136 -0
package/dist/master/ws-hub/index.js +9 -0
package/dist/master/ws-hub/internal.js +35 -0
package/dist/master/ws-hub/routing.js +295 -0
package/dist/master/ws-hub/sessions.js +130 -0
package/dist/master/ws-hub.js +11 -0
package/dist/shared/agent-profile.js +44 -0
package/dist/shared/constants.js +55 -0
package/dist/shared/dedup.js +33 -0
package/dist/shared/group-context.js +62 -0
package/dist/shared/json-codec.js +33 -0
package/dist/shared/logger.js +136 -0
package/dist/shared/mention.js +22 -0
package/dist/shared/network.js +40 -0
package/dist/shared/parse.js +18 -0
package/dist/shared/prompt-composer.js +171 -0
package/dist/shared/protocol/client-messages.js +8 -0
package/dist/shared/protocol/enums.js +6 -0
package/dist/shared/protocol/federation.js +62 -0
package/dist/shared/protocol/guards.js +87 -0
package/dist/shared/protocol/server-messages.js +8 -0
package/dist/shared/protocol/types.js +8 -0
package/dist/shared/protocol.js +19 -0
package/dist/shared/readonly-allowlist.js +122 -0
package/dist/shared/rotom-cli-prompt.js +23 -0
package/dist/shared/skill-context.js +19 -0
package/dist/shared/skill-md.js +43 -0
package/dist/shared/slash-commands.js +50 -0
package/dist/shared/time.js +80 -0
package/dist/shared/title.js +46 -0
package/dist/shared/url-extractor.js +99 -0
package/migrations/001-schema.sql +942 -0
package/package.json +68 -0
package/scripts/fix-node-pty-perms.mjs +46 -0
package/skill/rotom-a2a-communicate/SKILL.md +257 -0
package/skill/rotom-bus-host/SKILL.md +78 -0
package/skill/rotom-bus-host/scripts/poll-replies.sh +148 -0

package/dist/shared/readonly-allowlist.js ADDED Viewed

@@ -0,0 +1,122 @@
+/**
+ * Read-only Bash command allowlist.
+ *
+ * Used by worker.onApprovalRequest to short-circuit the dashboard approval
+ * flow for safe read-only commands under the `r_allow` policy. Designed
+ * fail-closed: anything that *might* be a write or a compound construct
+ * (pipes, redirects, command substitution, leading env assignment, line
+ * continuation) makes the command NOT match — it falls through to the
+ * existing human approval flow.
+ *
+ * Note: this only certifies the command shape is read-only. It does NOT
+ * gate the *target* — `cat /etc/shadow` still passes because `cat` is
+ * read-only. Secret/permission defenses rely on the executor's cwd being
+ * pinned to a sandbox + the agent prompt; not on this list.
+ *
+ * Read/Grep/Glob (claude) and codex's built-in read tools are never hooked
+ * by the approval gate, so they never reach this code path.
+ */
+// Single-token read-only commands. Bash built-ins and coreutils that only
+// inspect the filesystem / process state.
+export const READONLY_SINGLE = [
+    // 文件/目录浏览
+    "ls", "tree",
+    // 文件读取
+    "cat", "head", "tail", "wc",
+    // 元信息
+    "file", "stat",
+    // 搜索
+    "find", "fd", "rg", "grep", "ag", "ack",
+    // shell 内建只读
+    "echo", "pwd",
+    // 系统只读快照
+    "whoami", "uname", "date",
+    // 注:`env`/`printenv` 故意不放行 —— 全量打印环境变量会泄露 API_KEY 等
+    // secret。`curl`/`wget`/`nc`/`bash -c`/`sh -c`/`eval`/`source` 也不放行。
+];
+// `<head> <sub>` 双 token 只读组合,主要覆盖多子命令工具(git/rotom)。
+// 用 `${head} ${sub}` 字符串集合做精确匹配,避免 startsWith 误中。
+export const READONLY_MULTI = [
+    // git 只读子命令(写类 add/commit/push/pull/reset/checkout/stash/clean/rm/tag/config 一律不放行)
+    "git log", "git status", "git diff", "git show",
+    "git branch", "git remote", "git rev-parse", "git ls-files",
+    "git blame", "git ls-tree", "git shortlog", "git describe",
+    // rotom 只读子命令(同样不放行 issue/agent 增删改类)
+    "rotom status", "rotom whoami", "rotom --version", "rotom -v", "rotom help",
+    // 运行时版本号(纯只读)
+    "node --version", "node -v",
+    "npm --version", "npm -v",
+    "pnpm --version", "pnpm -v",
+    "python --version", "python -V",
+    "python3 --version", "python3 -V",
+];
+const SINGLE_SET = new Set(READONLY_SINGLE);
+const MULTI_SET = new Set(READONLY_MULTI);
+// 多子命令工具的 head —— 只有这些才查 MULTI 集合,避免 `cat_ls` 这种误中。
+const MULTI_HEADS = new Set([
+    "git", "rotom", "node", "npm", "pnpm", "python", "python3",
+]);
+// 任一命中即视为复合/危险命令,fail-closed。逐项列出便于单测定位。
+const DANGER_PATTERNS = [
+    /\|/, // 管道: cat a | rm b
+    /&/, // && / || / 后台 &
+    /;/, // 语句分隔: ls; rm x
+    />/, // 重定向写: echo > y
+    /</, // 重定向读 / heredoc
+    /`/, // 反引号命令替换
+    /\$\(/, // $(...) 命令替换
+    /\$\{/, // ${...} 参数展开(防 ${...} 嵌套命令)
+    /\\/, // 行续 `ls \\\n&& rm` 或转义
+];
+// 前导 env 赋值:`FOO=bar cmd ...` / `PATH=/x cmd ...`,防 PATH 劫持。
+const LEADING_ENV_ASSIGN = /^[A-Za-z_]\w*=\S+/;
+/**
+ * Returns true iff `command` is unambiguously read-only and safe to
+ * auto-approve. Conservative on purpose — when in doubt, returns false and
+ * lets the human approval flow handle it.
+ *
+ * See file-top JSDoc for the safety contract.
+ */
+export function isReadonlyCommand(command) {
+    // 1. 非字符串 / 空
+    if (typeof command !== "string")
+        return false;
+    const trimmed = command.trim();
+    if (!trimmed)
+        return false;
+    // 2. 危险字符短路
+    for (const p of DANGER_PATTERNS) {
+        if (p.test(trimmed))
+            return false;
+    }
+    // 3. 前导 env 赋值短路
+    if (LEADING_ENV_ASSIGN.test(trimmed))
+        return false;
+    // 4. tokenize
+    const tokens = trimmed.split(/\s+/).filter((t) => t.length > 0);
+    if (tokens.length === 0)
+        return false;
+    // 5. 取首个非 flag token 作为 head
+    const headRaw = tokens.find((t) => !t.startsWith("-"));
+    if (!headRaw)
+        return false;
+    // 6. basename 兼容 `/bin/ls` 形态(仅当 head 含 / 才做)
+    const head = headRaw.includes("/")
+        ? headRaw.split("/").pop() ?? headRaw
+        : headRaw;
+    // 7. 单 token 白名单
+    if (SINGLE_SET.has(head))
+        return true;
+    // 8. 多 token 白名单:head 必须是多子命令工具,第二个 token 原样查表。
+    //    不再过滤 flag —— 因为 MULTI 集合里既有 `git log`(positional sub)
+    //    也有 `node --version`(flag sub);MULTI 集合本身就是白名单,只要命中就放行。
+    //    例:`git status --short` → head=git, sub=status(第二个 token) → 命中。
+    //         `node --version`    → head=node, sub=--version → 命中。
+    if (MULTI_HEADS.has(head) && tokens.length >= 2) {
+        const sub = tokens[1];
+        if (MULTI_SET.has(`${head} ${sub}`))
+            return true;
+    }
+    // 9. 否则 fail-closed
+    return false;
+}

package/dist/shared/rotom-cli-prompt.js ADDED Viewed

@@ -0,0 +1,23 @@
+/**
+ * rotom CLI 使用规则 — 注入到每一个 CLI agent prompt 的最前段。
+ *
+ * 设计要点:
+ * - 这是一段**短**的 meta 信息(不是 skill description),与所有 agent 看到的都一致。
+ * - 完整命令参考放在 `~/.rotom/SKILL.md`,由 rotom CLI 启动时把
+ *   `skill/rotom-a2a-communicate/SKILL.md` 内联写入。Agent 需要时自行 Read。
+ *   提示里只放一句"去看 SKILL.md"+ 锚点名,不重复列命令清单。
+ * - 不同 provider (claude/codex/openclaw/hermes/generic) 各自的
+ *   "skill 机制位置" 不一致 —— 因此 rotom 自己做一份"自家文档"放在约定路径,
+ *   不依赖任何 provider 的 skill 系统。
+ */
+export const ROTOM_CLI_PROMPT_VERSION = "rotomCliPrompt@2026-06-29a";
+export const ROTOM_CLI_PROMPT = `[rotom CLI]
+通过 Bash 调 \`rotom\`(身份自动,不要传 --as;详情 Read ~/.rotom/SKILL.md)。
+- 写盘前必须有 in_progress issue(见下 [当前群活跃 issue])。
+- **你的回复正文就是群消息**——写什么群里就显示什么。提问其他 agent 时直接在正文里写 \`@对方 <问题> #reply\`,**不要调 \`rotom group send\`**。系统检测到 #reply 自动起 5min 超时 timer。
+- **被其他 agent 提问时,回复正文以 @提问者 开头**(例:\`@西花-claude 回复内容...\`)。
+- 收到 [ask-bridge 复述] 系统消息后:对方没 @ 你但系统检测到回复了,基于复述继续任务。
+- 普通 @ (不带 #reply) 不起 timer,只是提到对方。
+- **要 @ 人前不知道群里谁是谁 / 各自岗位,调 \`rotom group members <groupId>\` 查**(返回 position / bio / category / status);按岗位匹配目标,不要按名字猜。
+- exit≠0 看 stderr 第一行,先 \`rotom status\` 自检。
+`;

package/dist/shared/skill-context.js ADDED Viewed

@@ -0,0 +1,19 @@
+/**
+ * Skill 极简指针层 —— prompt 末尾一行,告诉 agent 有多少可用 skill + 怎么查。
+ *
+ * skill 是非核心工作(能力,不是当前任务上下文),绝不展开 content、不抢核心任务 prompt。
+ * agent 按需 `rotom skill mine <groupId>` / `rotom skill get <name>` 拉取。
+ *
+ * count=0 → 不注入。
+ */
+export function buildSkillPointerLayer(p) {
+    if (p.count === 0)
+        return null;
+    const groupIdHint = p.groupId ? ` <groupId>` : "";
+    return {
+        layer: "skill-pointer",
+        content: `[可用技能] ${p.count} 个。用 \`rotom skill mine${groupIdHint}\` 查列表,` +
+            `\`rotom skill get <name>\` 看详情;无关技能忽略,不要硬套。\n`,
+        source: "agent_skill_bindings count (runtime, group+agent scoped)",
+    };
+}

package/dist/shared/skill-md.js ADDED Viewed

@@ -0,0 +1,43 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { fileURLToPath } from "node:url";
+const ROTOM_HOME = process.env.ROTOM_HOME || path.join(os.homedir(), ".rotom");
+const ROTOM_SKILL_MD = path.join(ROTOM_HOME, "SKILL.md");
+/**
+ * 把仓库内的 `skill/rotom-a2a-communicate/SKILL.md` 写到 `~/.rotom/SKILL.md`。
+ *
+ * 幂等:内容相同就跳过,不触发文件 mtime 变化(避免和正在跑的 agent 抢文件)。
+ * 这个文件是 rotom 自家的"完整 rotom CLI 命令参考" — 跟 `src/shared/rotom-cli-prompt.ts`
+ * 里的 [rotom CLI 使用规则] 段配对使用:prompt 段塞短 hint,agent 真要查命令时
+ * 自己 `Read ~/.rotom/SKILL.md`。这样不依赖任何 provider 的 skill 机制。
+ *
+ * 在 rotom CLI 与 executor 两个入口都调用,保证只起 executor 不跑 rotom 时也能落盘。
+ */
+export function ensureRotomSkillMd() {
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        const skillSrc = path.join(here, "..", "..", "skill", "rotom-a2a-communicate", "SKILL.md");
+        if (!fs.existsSync(skillSrc)) {
+            return;
+        }
+        const content = fs.readFileSync(skillSrc, "utf-8");
+        let needsWrite = true;
+        if (fs.existsSync(ROTOM_SKILL_MD)) {
+            try {
+                const existing = fs.readFileSync(ROTOM_SKILL_MD, "utf-8");
+                if (existing === content)
+                    needsWrite = false;
+            }
+            catch { /* 读失败 → 重写 */ }
+        }
+        if (needsWrite) {
+            if (!fs.existsSync(ROTOM_HOME))
+                fs.mkdirSync(ROTOM_HOME, { recursive: true });
+            fs.writeFileSync(ROTOM_SKILL_MD, content, "utf-8");
+        }
+    }
+    catch (err) {
+        process.stderr.write(`[rotom] WARN: failed to write ~/.rotom/SKILL.md: ${err.message}\n`);
+    }
+}

package/dist/shared/slash-commands.js ADDED Viewed

@@ -0,0 +1,50 @@
+/**
+ * Issue slash command 白名单与解析。
+ *
+ * 设计：master 在 POST /groups/:groupId/issues 时调 parseSlashCommand(title)
+ * 解析首个 token；若命中 SLASH_COMMAND_REGISTRY 则写入 issues.slash_command。
+ * worker 收到 issue_assigned 后据此向底层 CLI 注入对应执行模式。
+ */
+export const SLASH_COMMAND_REGISTRY = {
+    "/plan": {
+        name: "/plan",
+        backends: ["claude", "codex", "pi"],
+        description: "以计划模式执行：先输出方案，等待用户审批后才落盘",
+    },
+};
+/**
+ * 解析 title 首个 token。仅当 token 形如 /[a-z][a-z0-9-]* 才视为 slash command
+ * 候选；其他形如 "/path/to" 之类的不会被误判。
+ *
+ * - 命中注册表 → 返回 { command, stripped }。
+ * - 匹配前缀模式但未注册 → 返回 { command, stripped, unknown:true } 由调用方决定如何处理。
+ * - 完全不匹配 → 返回 null。
+ */
+export function parseSlashCommand(title) {
+    if (!title)
+        return null;
+    const m = title.match(/^(\/[a-z][a-z0-9-]*)(?:\s+([\s\S]*))?$/);
+    if (!m)
+        return null;
+    const command = m[1];
+    const stripped = (m[2] || "").trim();
+    return {
+        command,
+        stripped,
+        known: Object.prototype.hasOwnProperty.call(SLASH_COMMAND_REGISTRY, command),
+    };
+}
+/**
+ * 给 Codex 用的 plan 模式 developerInstructions。Codex 没有原生 plan 模式，
+ * 通过开发者系统指令引导其"先方案后落盘"。
+ */
+export function buildPlanModeInstruction() {
+    return [
+        "[plan-mode]",
+        "你当前处于「计划模式」执行任务。规则：",
+        "1. 先彻底理解需求并探索代码（只允许读操作：阅读文件、grep、列目录）。",
+        "2. 把方案以清晰的 Markdown 输出（包含：背景、改动文件清单、关键步骤、风险/回退、验证方式）。",
+        "3. 输出方案后立即停下，等待用户审批确认；未经确认不要执行任何写操作（写文件、改配置、跑构建/迁移、提交、推送等）。",
+        "4. 用户确认后再开始实现；用户驳回则根据反馈调整方案再次输出。",
+    ].join("\n");
+}

package/dist/shared/time.js ADDED Viewed

@@ -0,0 +1,80 @@
+/**
+ * 全 codebase 统一的时间格式化器:北京时间字符串 "YYYY-MM-DD HH:MM:SS.mmm"。
+ *
+ * 设计:
+ *  - 不依赖服务器时区(永远输出北京时间,无视 process.env.TZ)
+ *  - 不带 Z / 时区后缀——本地时间字符串,所见即所过滤
+ *  - 字典序比较 = 时间顺序比较(毫秒精度),ORDER BY 直接生效
+ *  - 替代 `new Date().toISOString()`(后者返回 UTC,显示和过滤要 mental 换算,
+ *    实测群消息轮询时把本地时间字符串拿去对比 UTC ISO 会 silently 滤掉)
+ *
+ * 用法:
+ *   import { nowBeijing } from "../shared/time.js";
+ *   const ts = nowBeijing();  // "2026-06-30 18:02:04.123"
+ *
+ * 存量数据(migration 046 之前)仍是 UTC ISO,046 会一次性转成北京时间字符串。
+ */
+const BEIJING_OFFSET_MS = 8 * 3600 * 1000;
+/** Internal: decompose a Date (or epoch ms) into Beijing-time calendar parts. */
+function beijingParts(input) {
+    const d = input instanceof Date ? input : new Date(input);
+    const u = new Date(d.getTime() + BEIJING_OFFSET_MS);
+    const pad2 = (n) => String(n).padStart(2, "0");
+    const pad3 = (n) => String(n).padStart(3, "0");
+    return {
+        Y: String(u.getUTCFullYear()),
+        M: pad2(u.getUTCMonth() + 1),
+        D: pad2(u.getUTCDate()),
+        h: pad2(u.getUTCHours()),
+        m: pad2(u.getUTCMinutes()),
+        s: pad2(u.getUTCSeconds()),
+        ms: pad3(u.getUTCMilliseconds()),
+    };
+}
+export function nowBeijing() {
+    return toBeijing(Date.now());
+}
+/**
+ * 把任意时间戳(UTC ISO / Date / 毫秒数)转成北京时间字符串。
+ * 用于 migration 把存量 UTC ISO 行转成新格式,或边界处把外部输入归一。
+ */
+export function toBeijing(input) {
+    const d = input instanceof Date ? input : new Date(input);
+    if (Number.isNaN(d.getTime())) {
+        throw new Error(`toBeijing: invalid time input: ${input}`);
+    }
+    const p = beijingParts(d);
+    return `${p.Y}-${p.M}-${p.D} ${p.h}:${p.m}:${p.s}.${p.ms}`;
+}
+/** Compact Beijing timestamp "YYYYMMDD-HHmmss" (e.g. for sortable upload filenames). */
+export function toBeijingCompact(input = Date.now()) {
+    const d = input instanceof Date ? input : new Date(input);
+    if (Number.isNaN(d.getTime())) {
+        throw new Error(`toBeijingCompact: invalid time input: ${input}`);
+    }
+    const p = beijingParts(d);
+    return `${p.Y}${p.M}${p.D}-${p.h}${p.m}${p.s}`;
+}
+/** Year-month bucket "YYYY-MM" in Beijing time (used for upload directory layout). */
+export function toBeijingYearMonth(input = Date.now()) {
+    const d = input instanceof Date ? input : new Date(input);
+    if (Number.isNaN(d.getTime())) {
+        throw new Error(`toBeijingYearMonth: invalid time input: ${input}`);
+    }
+    const p = beijingParts(d);
+    return `${p.Y}-${p.M}`;
+}
+/**
+ * 把一个北京时间字符串平移 deltaMs 毫秒,返回新的北京时间字符串。
+ * 用于"上一条消息后 1ms"这种 marker 计算——不依赖服务器时区。
+ *
+ * 注意:输入必须是北京时间字符串(不是 UTC ISO),否则解析会偏。
+ */
+export function shiftBeijing(beijingStr, deltaMs) {
+    // 用 +08:00 显式标注时区,让 Date.parse 把字符串当作北京时间读出绝对 instant
+    const abs = Date.parse(beijingStr.replace(" ", "T") + "+08:00");
+    if (Number.isNaN(abs)) {
+        throw new Error(`shiftBeijing: invalid Beijing time string: ${beijingStr}`);
+    }
+    return toBeijing(abs + deltaMs);
+}

package/dist/shared/title.js ADDED Viewed

@@ -0,0 +1,46 @@
+/**
+ * Issue title 自动生成与展示工具。
+ *
+ * 设计：合并 title/description 后,用户只填一个内容字段(description)。
+ * title 从 description 前 N 字符截断生成,用于列表、详情 header 等紧凑展示。
+ * 若 description 以 `/plan` 开头,截断后的 title 保留 `/plan` 前缀以便
+ * parseSlashCommand 解析;展示侧用 displayTitle 剥掉前缀避免污染。
+ */
+export const TITLE_MAX_LENGTH = 40;
+/**
+ * 从内容截断生成 title。
+ * - 折叠空白为单空格
+ * - 超长时优先在最后一个空格处截断,避免词中间断开
+ * - 截断后追加 …
+ */
+export function truncateTitle(content) {
+    const text = (content || "").trim().replace(/\s+/g, " ");
+    if (text.length <= TITLE_MAX_LENGTH)
+        return text;
+    const slice = text.slice(0, TITLE_MAX_LENGTH);
+    const lastSpace = slice.lastIndexOf(" ");
+    const cut = lastSpace > TITLE_MAX_LENGTH * 0.5 ? slice.slice(0, lastSpace) : slice;
+    return cut.trim() + "…";
+}
+/**
+ * 展示用 title —— 若 slash_command 为 /plan,剥掉 title 开头的 `/plan ` 前缀。
+ * 列表已有 plan 徽标,title 本体无需重复暴露元信息。
+ */
+export function displayTitle(issue) {
+    if (issue.slash_command === "/plan" && issue.title.startsWith("/plan")) {
+        return issue.title.slice("/plan".length).trim() || issue.title;
+    }
+    return issue.title;
+}
+/**
+ * 展示用 description —— 若 slash_command 为 /plan 且 description 以 /plan 开头,
+ * 剥掉前缀,避免元信息污染正文。
+ */
+export function displayDescription(issue) {
+    const desc = issue.description || "";
+    if (issue.slash_command === "/plan" &&
+        desc.startsWith("/plan")) {
+        return desc.slice("/plan".length).trim();
+    }
+    return desc;
+}

package/dist/shared/url-extractor.js ADDED Viewed

@@ -0,0 +1,99 @@
+/**
+ * URL 抽取 + 规范化 —— 链接采集层的基础工具。
+ *
+ * 用法:从消息正文里抽 URL(markdown [text](url) + 裸 URL),规范化后供 dedup/入库。
+ *
+ * 设计原则:
+ *   - 纯函数,无 IO,可单测
+ *   - 解析失败 / 非 http(s) 直接丢
+ *   - 规范化去掉追踪参数(utm_* / fbclid / gclid / ref 等)和 hash,host 小写,去 www. 前缀,删末尾 /
+ */
+const MD_URL_RE = /\[(?:[^\]]+)\]\((https?:\/\/[^\s)]+)\)/g;
+const BARE_URL_RE = /(https?:\/\/[^\s<>"')]+[^\s<>"').,;:!?])/g;
+/** 从文本抽 URL。返回 [{raw, index}],不去重(同一 URL 多次出现各算一条)。 */
+export function extractUrls(text) {
+    if (!text)
+        return [];
+    const out = [];
+    const seen = new Set(); // 防同一位置被两个正则同时命中
+    // 1. markdown [text](url) 形式 —— 抓括号内的 url
+    for (const m of text.matchAll(MD_URL_RE)) {
+        const url = m[1];
+        const idx = (m.index ?? 0) + m[0].indexOf(url);
+        if (!seen.has(idx)) {
+            out.push({ raw: url, index: idx });
+            seen.add(idx);
+        }
+    }
+    // 2. 裸 URL —— 剥掉 trailing 标点
+    for (const m of text.matchAll(BARE_URL_RE)) {
+        const url = m[1];
+        const idx = (m.index ?? 0) + (m[0].length - url.length);
+        if (!seen.has(idx)) {
+            out.push({ raw: url, index: idx });
+            seen.add(idx);
+        }
+    }
+    // 按出现位置排序,context snippet 用
+    out.sort((a, b) => a.index - b.index);
+    return out;
+}
+const TRACKING_PARAMS = new Set([
+    "utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content",
+    "utm_id", "utm_name",
+    "fbclid", "gclid", "gclsrc", "dclid", "msclkid", "yclid",
+    "ref", "ref_src", "ref_url",
+    "_hsenc", "_hsmi", "hsCtaTracking",
+    "mc_cid", "mc_eid",
+    "si", // youtube shorts tracking
+]);
+/**
+ * 规范化 URL。
+ * 失败(非法 URL / 非 http(s))返回 null,调用方丢弃。
+ */
+export function normalizeUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+    // host:小写 + 去 www.
+    const host = parsed.hostname.toLowerCase().replace(/^www\./, "");
+    // path:去末尾 /,空 path 留空
+    let path = parsed.pathname;
+    if (path.length > 1 && path.endsWith("/"))
+        path = path.slice(0, -1);
+    // percent-encoded 大写一致性(避开大小写差异导致的 dedup miss)
+    try {
+        path = decodeURIComponent(path);
+    }
+    catch {
+        // decode 失败(乱码)保留原样
+    }
+    // query:剥追踪参数,剩余按 key 字典序排(dedup 友好)
+    const keepParams = [];
+    const search = parsed.searchParams;
+    if (search.size > 0) {
+        for (const [k, v] of search.entries()) {
+            if (TRACKING_PARAMS.has(k.toLowerCase()))
+                continue;
+            keepParams.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
+        }
+        keepParams.sort();
+    }
+    const norm = `https://${host}${path}${keepParams.length > 0 ? `?${keepParams.join("&")}` : ""}`;
+    return { raw, norm, host };
+}
+/** 从文本 + URL 位置截 context snippet(url 前后各 100 字,去 newline)。 */
+export function extractContextSnippet(text, urlIndex, urlLen, radius = 100) {
+    if (!text)
+        return "";
+    const start = Math.max(0, urlIndex - radius);
+    const end = Math.min(text.length, urlIndex + urlLen + radius);
+    const snippet = text.slice(start, end);
+    return snippet.replace(/\s+/g, " ").trim();
+}