@lightcone-ai/daemon 0.16.0 → 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightcone-ai/daemon",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "type": "module",
   "main": "src/index.js",
   "bin": {

package/src/chat-bridge.js

@@ -904,11 +904,16 @@ server.tool('search_messages', 'Search messages within a specific workspace. You
     const data = await api('GET', `/search?${params}`);
     if (!data.results || data.results.length === 0)
       return { content: [{ type: 'text', text: 'No search results.' }] };
+    // Use full content rather than snippet — the snippet truncates at ~200 chars,
+    // which routinely cuts URLs / structured data in half (e.g. a forwarded list
+    // of mp.weixin.qq.com article URLs becomes useless if only the second one
+    // shrinks below its query-string). For search the agent's intent is usually
+    // "give me the original message verbatim so I can act on it", not a teaser.
     const formatted = data.results.map((r, i) => [
       `[${i + 1}] msg=${r.id} seq=${r.seq} time=${r.createdAt}`,
       `workspace: #${r.workspaceName}`,
       `sender: @${r.senderName}${r.senderType === 'agent' ? ' (agent)' : ''}`,
-      `content: ${r.snippet}`,
+      `content: ${r.content ?? r.snippet}`,
     ].join('\n')).join('\n\n');
     return { content: [{ type: 'text', text: `## Search Results for "${trimmed}" (${data.results.length} results)\n\n${formatted}` }] };
   } catch (err) {
@@ -1482,7 +1487,21 @@ server.tool('record_url_narration',
   'Record a silent video of a URL by driving Chromium on an Xvfb display and capturing it with Playwright recordVideo, driven by a video plan; ffmpeg then transcodes the recording to mp4. Outputs a silent mp4 that can be passed to compose_video_v2 as a video-kind segment with an audio_path for narration.\n\nUse this as the canonical recording step for URL-narration videos. Falls back: if the page needs interactions outside the visual_action vocabulary (clicks, waits, OCR loops), use Monitor (Bash) with custom Playwright instead.\n\nRuntime requirements: this tool only works on a Linux daemon machine with Xvfb + Chromium + ffmpeg installed (ffmpeg is used to transcode the recording to mp4; no x11grab device support needed). macOS / Windows daemons will fail at startup.',
   {
     url: z.string().describe('Page URL to record'),
-    plan: z.record(z.any()).describe('A video plan: an object with `phases` (or `sections`), each a "visual beat" with `action` (scroll_to_dwell / linear_scroll_during / scroll_back / hold / ...), a target (`target_y` or `focus_region:[y1,y2]`) for scroll-type actions, and `dwell_ms` (how long to hold that beat — should match the segment\'s TTS duration). It can be hand-written or the output of plan_video_segments (whose returned segments array doubles as a valid plan).'),
+    plan: z.record(z.any()).describe(
+      'A video plan: an object with `phases` (or `sections`), each a "visual beat" with '
+      + '`action` (scroll_to_dwell / linear_scroll_during / scroll_back / hold / ...), a '
+      + 'target (`target_y` or `focus_region:[y1,y2]`) for scroll-type actions, and '
+      + '`dwell_ms` (how long to hold that beat — should match the segment\'s TTS duration).\n\n'
+      + 'For RECRUITMENT URLs (mp.weixin.qq.com / 校招 / 实习 / 岗位 content), each section MUST '
+      + 'also declare `target_y_content_label` — a short Chinese label describing what content '
+      + 'sits at that pixel y position on the page (e.g. "标题区" / "岗位信息卡片" / "公司介绍" / '
+      + '"届别说明"). Look at the take_page_screenshot output, find the y-pixel, and label it. '
+      + 'Labels matching forbidden regions ("二维码" / "扫码" / "投递入口" / "投递方式" / "联系方式" / '
+      + '"微信号" / "QR" / "阅读原文" / "外链") will cause the tool to refuse the recording — '
+      + 'recruitment content must NOT dwell on these areas (see fragments.md '
+      + 'frag.short.recruitment_url_mode_policy). Pick a different target_y in the 标题/岗位 '
+      + 'information area and rewrite that section.'
+    ),
     output_path: z.string().optional().describe('Workspace-relative output mp4 path. Default tmp/wx3_video/recorded-{ts}.mp4'),
     events_path: z.string().optional().describe('Workspace-relative events.json path. Default ${output_path}.events.json'),
     viewport: z.object({

package/src/record-url-narration-tool.js

@@ -69,6 +69,74 @@ function assertPipelineCompliance(plan) {
   }
 }
 
+// Forbidden region keywords for recruitment content. If a section's
+// target_y_content_label matches, we refuse to record — the resulting video
+// would show 投递入口 / 二维码 / contact info, which violates the recruitment
+// content policy (see fragments.md frag.short.recruitment_url_mode_policy).
+//
+// Discovered after Task #25 v1 ended up dwelling on FunPlus's QR/投递 area:
+// the agent's plan declared target_y=2180 with dwell_ms=8500 without checking
+// what content lived at that pixel position. This is a prompt-level rule
+// that's been ignored often enough that we enforce it at the tool layer.
+const FORBIDDEN_REGION_PATTERNS = [
+  /二维码/, /扫码/, /扫一扫/,
+  /投递入口/, /投递方式/, /投递通道/, /投递渠道/, /报名入口/, /报名方式/,
+  /联系方式/, /联系人/, /微信号/, /\bWeChat\b/i, /\bQQ群\b/,
+  /阅读原文/, /外链/, /\bQR\b/i,
+];
+
+function isRecruitmentLikeUrl(url) {
+  // Conservative URL-based heuristic: mp.weixin.qq.com pages forwarding 招聘 /
+  // 校招 / 实习 / job content. Until we have content classification, treat
+  // mp.weixin.qq.com URLs as recruitment-class for safety — the cost of a
+  // mis-flag is "agent must add a label", not "recording fails permanently".
+  if (typeof url !== 'string') return false;
+  return /mp\.weixin\.qq\.com/.test(url);
+}
+
+function describeForbiddenMatch(label) {
+  for (const pattern of FORBIDDEN_REGION_PATTERNS) {
+    if (pattern.test(label)) return pattern.source;
+  }
+  return null;
+}
+
+/**
+ * For recruitment-class URLs, every plan section must declare what content
+ * sits at its target_y, and the label must NOT match the forbidden-region
+ * patterns. Returns null on pass, error message string on fail.
+ */
+function checkSafeRegionLabels({ url, plan }) {
+  if (!isRecruitmentLikeUrl(url)) return null;
+  const segments = planSegments(plan);
+  if (!segments) return null;
+  for (let i = 0; i < segments.length; i += 1) {
+    const seg = segments[i] ?? {};
+    const label = normalizeText(seg.target_y_content_label ?? seg.targetYContentLabel ?? '');
+    if (!label) {
+      return (
+        `record_url_narration: section[${i}] is missing required field `
+        + `\`target_y_content_label\`. For recruitment URLs (mp.weixin.qq.com / `
+        + `校招 / 实习等) you MUST label what content lives at target_y so the `
+        + `tool can verify it is not 二维码/投递入口/联系方式. Look at the page `
+        + `screenshot, find what is at target_y=${seg.target_y ?? '<unset>'}, `
+        + `and add a short label like "标题区" / "岗位信息卡片" / "公司介绍".`
+      );
+    }
+    const match = describeForbiddenMatch(label);
+    if (match) {
+      return (
+        `record_url_narration: section[${i}] target_y=${seg.target_y ?? '?'} `
+        + `is labeled "${label}", which matches a forbidden region pattern `
+        + `/${match}/. Recruitment content must NOT dwell on 投递入口 / 二维码 / `
+        + `联系方式 areas. Pick a different target_y inside the 标题区 / 岗位 `
+        + `信息卡片 / 公司介绍 area and rewrite this section.`
+      );
+    }
+  }
+  return null;
+}
+
 export function validateRecordUrlNarrationArgs(args = {}) {
   const normalizedUrl = normalizeText(args.url);
   if (!normalizedUrl) {
@@ -140,6 +208,18 @@ export async function runRecordUrlNarrationTool({
     return toolError(`Error: ${error.message}`);
   }
 
+  // Safe-region check for recruitment URLs — refuse plans that dwell on
+  // forbidden regions (二维码 / 投递入口 / 联系方式) before we even start
+  // Chromium. The agent must label each target_y with the content that lives
+  // there, and the labels are pattern-matched against a forbidden list.
+  const safeRegionError = checkSafeRegionLabels({
+    url: validatedInput.url,
+    plan: validatedInput.plan,
+  });
+  if (safeRegionError) {
+    return toolError(`Error: ${safeRegionError}`);
+  }
+
   try {
     const result = await runMandatoryLocalToolFn({
       toolName: 'record_url_narration',

package/src/upload-job-manager.js

@@ -35,6 +35,12 @@ export const PART_RETRY_ATTEMPTS = 3;
 export const PART_RETRY_BASE_MS = 1_000;             // 1s, 3s, 9s
 export const TERMINAL_JOB_TTL_MS = 7 * 24 * 3600 * 1000;     // sweep done/dead_letter after 7 days
 export const HOUSEKEEPING_INTERVAL_MS = 6 * 3600 * 1000;     // run housekeeping every 6h
+// Per-PUT timeout — Node's fetch has no overall request timeout. Without this
+// a stalled COS connection wedges the chunk loop forever (observed during the
+// first Task #25 upload: chunk 1 PUT hung 7+ minutes with no progress, no
+// error). 5 minutes covers slow networks for an 8MB chunk (~25kB/s floor)
+// while still letting failures surface to the chunk-level retry loop.
+export const PUT_REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
 
 function nowIso() { return new Date().toISOString(); }
 
@@ -61,6 +67,23 @@ function partBackoffMs(attempt) {
 
 function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
 
+async function fetchWithTimeout(fetchFn, url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchFn(url, { ...init, signal: controller.signal });
+  } catch (err) {
+    if (err?.name === 'AbortError' || controller.signal.aborted) {
+      const wrapped = new Error(`PUT timed out after ${Math.round(timeoutMs / 1000)}s (COS unresponsive)`);
+      wrapped.cause = err;
+      throw wrapped;
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * UploadJobManager — singleton in daemon process.
  *
@@ -319,7 +342,7 @@ export class UploadJobManager {
     this._persist(job);
 
     const fileBuf = await fsPromises.readFile(job.localPath);
-    const resp = await this.fetchFn(presign.uploadUrl, {
+    const resp = await fetchWithTimeout(this.fetchFn, presign.uploadUrl, {
       method: presign.method ?? 'PUT',
       headers: {
         'Content-Type': job.mime,
@@ -327,7 +350,7 @@ export class UploadJobManager {
         ...(presign.headers ?? {}),
       },
       body: fileBuf,
-    });
+    }, PUT_REQUEST_TIMEOUT_MS);
     if (!resp.ok) {
       const text = await resp.text().catch(() => '');
       throw new Error(`single PUT failed: HTTP ${resp.status} ${text.slice(0, 200)}`);
@@ -403,14 +426,14 @@ export class UploadJobManager {
           cosUploadId: job.cosUploadId,
           partNumber,
         });
-        const resp = await this.fetchFn(presign.url, {
+        const resp = await fetchWithTimeout(this.fetchFn, presign.url, {
           method: presign.method ?? 'PUT',
           headers: {
             'Content-Length': String(buf.length),
             ...(presign.headers ?? {}),
           },
           body: buf,
-        });
+        }, PUT_REQUEST_TIMEOUT_MS);
         if (!resp.ok) {
           const text = await resp.text().catch(() => '');
           throw new Error(`HTTP ${resp.status} ${text.slice(0, 200)}`);