@voko/lite 0.3.1

package/src/core/register-capabilities.js

@@ -0,0 +1,119 @@
+/**
+ * VOKO Agent 能力注册共享逻辑
+ *
+ * 供桌面端主进程（src/main.js）的 IPC handler、MCP 工具、下架流程等共同调用。
+ * 使用 DID + Ed25519 签名调用 /api/did-auth/register-capabilities。
+ */
+
+const { signAsync } = require('@noble/ed25519');
+const { VOKO_API_URL } = require('./api-signature');
+
+/**
+ * 将 PEM 格式 Ed25519 私钥解析为 raw 32 字节
+ * @param {string} pem
+ * @returns {Uint8Array}
+ */
+function extractEd25519PrivateKey(pem) {
+  const cleaned = String(pem || '')
+    .replace(/-----BEGIN [\w\s]+ KEY-----/g, '')
+    .replace(/-----END [\w\s]+ KEY-----/g, '')
+    .replace(/\s/g, '');
+  const bytes = Buffer.from(cleaned, 'base64');
+
+  if (bytes.length === 32) return new Uint8Array(bytes);
+
+  if (bytes.length > 32) {
+    const slice = bytes.slice(-32);
+    if (slice.length === 32) return new Uint8Array(slice);
+  }
+
+  if (cleaned.length === 64 && /^[0-9a-f]+$/i.test(cleaned)) {
+    return new Uint8Array(Buffer.from(cleaned, 'hex'));
+  }
+
+  console.warn('[extractEd25519PrivateKey] unexpected key length:', bytes.length, 'trying first 32 bytes');
+  return new Uint8Array(bytes.slice(0, 32));
+}
+
+/**
+ * 注册能力到服务器
+ * @param {object} params
+ * @param {object} params.db - better-sqlite3 数据库实例
+ * @param {string} params.agentId - Agent 标识 ID
+ * @param {object} [params.options={}] - 选项
+ * @param {boolean} [params.options.discoverable] - 是否可被发现；默认根据 access_mode 推断
+ * @returns {Promise<{success: boolean, message?: string, error?: string, detail?: object}>}
+ */
+async function registerCapabilitiesForAgent({ db, agentId, options = {} }) {
+  const { discoverable } = options;
+  try {
+    const stmt = db.prepare(`SELECT did, private_key, ability, capability, publish_status, access_mode FROM agents WHERE agent_id = ?`);
+    const row = stmt.get(agentId);
+    if (!row) return { success: false, error: 'Agent not found' };
+    if (!row.did) return { success: false, error: 'Agent has no DID, please register first' };
+    if (!row.private_key) return { success: false, error: 'Agent has no private key, please register first' };
+
+    // 普通模式能力（来自 agents.ability 列，UI 编辑）
+    let normalCapabilities = [];
+    if (row.ability) {
+      try {
+        normalCapabilities = JSON.parse(row.ability);
+        if (!Array.isArray(normalCapabilities)) normalCapabilities = [];
+      } catch (e) {
+        normalCapabilities = [];
+      }
+    }
+
+    // 开发者模式能力（来自 agents.capability 列，MCP declare_capabilities）
+    let capabilities = [];
+    if (row.capability) {
+      try {
+        const parsed = JSON.parse(row.capability);
+        if (parsed && parsed.skills) {
+          capabilities = parsed.skills;
+        } else if (Array.isArray(parsed)) {
+          capabilities = parsed;
+        }
+      } catch (e) {
+        capabilities = [];
+      }
+    }
+
+    const isDiscoverable = discoverable !== undefined ? discoverable : (row.access_mode !== 'private');
+    const bodyPayload = JSON.stringify({ capabilities, normalCapabilities });
+    const nonce = Math.random().toString(36).substring(2, 15) + Date.now().toString(36);
+    const timestamp = Math.floor(Date.now() / 1000);
+    const toSign = row.did + '\n' + nonce + '\n' + timestamp + '\n' + bodyPayload;
+    const rawKey = extractEd25519PrivateKey(row.private_key);
+    const sigBytes = await signAsync(new TextEncoder().encode(toSign), rawKey);
+    const signature = Buffer.from(sigBytes).toString('base64');
+
+    const requestBody = {
+      did: row.did, nonce, timestamp, signature,
+      capabilities, normalCapabilities
+    };
+
+    console.log(`[registerCapabilities] Agent ${agentId}: sending discoverable=${isDiscoverable}...`);
+    const response = await fetch(`${VOKO_API_URL}/api/did-auth/register-capabilities`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(requestBody)
+    });
+
+    const result = await response.json();
+    console.log(`[registerCapabilities] Agent ${agentId} response:`, result);
+    if (result.success) {
+      db.prepare(`UPDATE agents SET cap_error = NULL, updated_at = ? WHERE agent_id = ?`).run(Date.now(), agentId);
+      return { success: true, message: '能力已注册到服务器' };
+    }
+    const errMsg = result.message || '注册失败';
+    db.prepare(`UPDATE agents SET cap_error = ?, updated_at = ? WHERE agent_id = ?`).run(errMsg, Date.now(), agentId);
+    return { success: false, error: errMsg, detail: result };
+  } catch (e) {
+    console.error(`[registerCapabilities] Agent ${agentId} error:`, e);
+    db.prepare(`UPDATE agents SET cap_error = ?, updated_at = ? WHERE agent_id = ?`).run(e.message, Date.now(), agentId);
+    return { success: false, error: e.message };
+  }
+}
+
+module.exports = { registerCapabilitiesForAgent };

package/src/core/search-capabilities.js

@@ -0,0 +1,136 @@
+/**
+ * VOKO Agent 能力搜索共享逻辑
+ *
+ * 供桌面端主进程（src/main.js）和 MCP Lite 模式（src/mcp/standalone.js）共同调用：
+ * - DID 认证搜索：/api/did-auth/search-agents（优先）
+ * - HMAC 认证搜索：/api/external/v1/agents/search（兜底）
+ */
+
+const { signAsync } = require('@noble/ed25519');
+const { VOKO_API_URL, VOKO_API_KEY, generateApiSignature } = require('./api-signature');
+
+/**
+ * 将 PEM 格式 Ed25519 私钥解析为 raw 32 字节
+ * @param {string} pem
+ * @returns {Uint8Array}
+ */
+function extractEd25519PrivateKey(pem) {
+  const cleaned = String(pem || '')
+    .replace(/-----BEGIN [\w\s]+ KEY-----/g, '')
+    .replace(/-----END [\w\s]+ KEY-----/g, '')
+    .replace(/\s/g, '');
+  const bytes = Buffer.from(cleaned, 'base64');
+
+  if (bytes.length === 32) return new Uint8Array(bytes);
+
+  if (bytes.length > 32) {
+    const slice = bytes.slice(-32);
+    if (slice.length === 32) return new Uint8Array(slice);
+  }
+
+  if (cleaned.length === 64 && /^[0-9a-f]+$/i.test(cleaned)) {
+    return new Uint8Array(Buffer.from(cleaned, 'hex'));
+  }
+
+  console.warn('[extractEd25519PrivateKey] unexpected key length:', bytes.length, 'trying first 32 bytes');
+  return new Uint8Array(bytes.slice(0, 32));
+}
+
+/**
+ * 生成 DID 认证搜索请求签名
+ *
+ * 注意：/api/did-auth/search-agents 要求 bodyPayload 仅含 keyword/page/limit
+ * 三个 key，且顺序固定为 keyword、page、limit，不是字母序。
+ *
+ * @param {string} did
+ * @param {string} privateKey
+ * @param {object} businessFields
+ * @returns {Promise<{did, nonce, timestamp, signature}>}
+ */
+async function signDidSearchRequest(did, privateKey, businessFields) {
+  const nonce = Math.random().toString(36).substring(2, 15) + Date.now().toString(36);
+  const timestamp = Math.floor(Date.now() / 1000);
+  const orderedPayload = {
+    keyword: businessFields.keyword || '',
+    page: businessFields.page || 1,
+    limit: businessFields.limit || 50,
+  };
+  const bodyPayload = JSON.stringify(orderedPayload);
+  const toSign = did + '\n' + nonce + '\n' + timestamp + '\n' + bodyPayload;
+  const rawKey = extractEd25519PrivateKey(privateKey);
+  const sigBytes = await signAsync(new TextEncoder().encode(toSign), rawKey);
+  const signature = Buffer.from(sigBytes).toString('base64');
+  return { did, nonce, timestamp, signature };
+}
+
+/**
+ * 使用 DID + Ed25519 签名搜索 agent 能力
+ * @param {object} options
+ * @param {object} options.db - better-sqlite3 数据库实例
+ * @param {string} options.agentId - 发起搜索的 agent ID
+ * @param {string} [options.keyword='']
+ * @param {number} [options.page=1]
+ * @param {number} [options.limit=20]
+ * @returns {Promise<{success:true, data, page, count}>}
+ */
+async function searchCapabilitiesByDid({ db, agentId, keyword = '', page = 1, limit = 50 }) {
+  if (!db) throw new Error('searchCapabilitiesByDid requires db');
+  if (!agentId) throw new Error('缺少 agentId');
+
+  const row = db.prepare('SELECT did, private_key FROM agents WHERE agent_id = ?').get(agentId);
+  if (!row) throw new Error('Agent not found');
+  if (!row.did) throw new Error('Agent has no DID');
+  if (!row.private_key) throw new Error('Agent has no private key');
+
+  const safePage = parseInt(page) || 1;
+  const safeLimit = Math.min(parseInt(limit) || 20, 100);
+  const businessFields = { keyword: keyword || '', page: safePage, limit: safeLimit };
+
+  const { did, nonce, timestamp, signature } = await signDidSearchRequest(row.did, row.private_key, businessFields);
+
+  const res = await fetch(`${VOKO_API_URL}/api/did-auth/search-agents`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ did, nonce, timestamp, signature, ...businessFields }),
+  });
+
+  const json = await res.json();
+  if (!json.success) throw new Error(json.message || '搜索失败');
+  return { success: true, data: json.data, page: json.page, count: json.count };
+}
+
+/**
+ * 使用 HMAC 签名搜索 agent 能力（外部 API Key 兜底）
+ * @param {object} options
+ * @param {string} [options.keyword='']
+ * @param {number} [options.page=1]
+ * @param {number} [options.limit=20]
+ * @returns {Promise<{success:true, data, page, count}>}
+ */
+async function searchCapabilitiesByHmac({ keyword = '', page = 1, limit = 50 }) {
+  const apiPath = '/api/external/v1/agents/search';
+  const safePage = parseInt(page) || 1;
+  const safeLimit = Math.min(parseInt(limit) || 20, 100);
+  const body = { keyword: keyword || '', page: safePage, limit: safeLimit };
+  const { timestamp, signature } = generateApiSignature(apiPath, body);
+
+  const res = await fetch(`${VOKO_API_URL}${apiPath}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'X-API-Key': VOKO_API_KEY,
+      'X-Timestamp': timestamp,
+      'X-Signature': signature,
+    },
+    body: JSON.stringify(body),
+  });
+
+  const json = await res.json();
+  if (!json.success) throw new Error(json.message || '搜索失败');
+  return { success: true, data: json.data, page: json.page, count: json.count };
+}
+
+module.exports = {
+  searchCapabilitiesByDid,
+  searchCapabilitiesByHmac,
+};

package/src/core/send-message.js

@@ -0,0 +1,85 @@
+/**
+ * VOKO 发送 IM 消息共享逻辑
+ *
+ * 供桌面端主进程（src/main.js）的 IPC handler、HTTP API、MCP 工具共同调用。
+ * 流程：写 DB → 自动加白名单 → worker.send → 通知 UI，不等待回执。
+ */
+
+const ac = require('./access-control-api');
+const bus = require('./lite-bus');
+
+/**
+ * 创建 sendMessageToWorker 函数
+ * @param {object} deps
+ * @param {object} deps.db - better-sqlite3 数据库实例
+ * @param {Map} deps.agentWorkers - agentId → { worker, config } 的 Map
+ * @param {BrowserWindow|null} deps.mainWindow - Electron 主窗口实例
+ * @returns {Function} sendMessageToWorker(agentId, channelId, content, fromUid, messageType)
+ */
+function createSendMessageToWorker({ db, agentWorkers, mainWindow }) {
+  return function sendMessageToWorker(agentId, channelId, content, fromUid, messageType) {
+    const entry = agentWorkers.get(agentId);
+    if (!entry) return { success: false, error: 'Agent 未连接' };
+
+    const now = Date.now();
+    const msgId = `msg-${agentId}-${channelId}-${now}`;
+    const timestamp = Math.floor(now / 1000);
+    const uid = fromUid || 'voko';
+
+    // 归一化换行：客户端可能将 \n 作为字面字符发送
+    content = content.replace(/\\n/g, '\n');
+
+    // 1. 写入 messages 表
+    // content_type: 1=文字, 2=图片, 3=文件
+    let contentType = 1;
+    if (messageType === 'image') contentType = 2;
+    else if (messageType === 'file') contentType = 3;
+    try {
+      db.prepare(`
+        INSERT INTO messages (id, from_uid, to_uid, content, channel_id, channel_type, agent_id, timestamp, is_me, status, message_seq, client_msg_no, no_persist, red_dot, sync_once, content_type)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(msgId, uid, channelId, content, channelId, 1, agentId, timestamp, 1, 'sent', null, null, 0, 0, 0, contentType);
+    } catch (e) {
+      if (!e.message.includes('UNIQUE constraint')) {
+        console.error('[sendMessage] 写入消息失败:', e.message);
+      }
+    }
+
+    // 1.5 自动将接收方加入白名单（静默，不通知）
+    // 主动发消息给某人 = 信任该访客，避免对方回复时被私密模式拦截
+    try {
+      if (!ac.isWhitelisted(db, agentId, channelId)) {
+        ac.addEntry(db, { agentId, listType: 'whitelist', visitorId: channelId });
+      }
+    } catch (_) { /* 静默失败不影响消息发送 */ }
+
+    // 2. 更新 conversations 表
+    try {
+      const agentRow = db.prepare(`SELECT imUid FROM agents WHERE agent_id = ?`).get(agentId);
+      const convUserUid = agentRow?.imUid || uid;
+      const exist = db.prepare(`SELECT user_uid FROM conversations WHERE user_uid = ? AND channel_id = ?`).get(convUserUid, channelId);
+      if (exist) {
+        db.prepare(`UPDATE conversations SET last_message = ?, last_timestamp = ? WHERE user_uid = ? AND channel_id = ?`)
+          .run(content, timestamp, convUserUid, channelId);
+      } else {
+        db.prepare(`INSERT INTO conversations (user_uid, channel_id, channel_type, name, last_message, last_timestamp, unread_count, agent_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+          .run(convUserUid, channelId, 1, channelId, content, timestamp, 0, agentId);
+      }
+    } catch (e) {
+      console.error('[sendMessage] 更新会话失败:', e.message);
+    }
+
+    // 3. 通过 worker 发送（fire and forget）
+    entry.worker.send({ type: 'send', channelId, content, messageType: messageType || 'text', localMsgId: msgId });
+
+    // 4. 通知渲染进程（通过事件总线）
+    bus.emit('agent-wukongim:message', {
+      agentId, fromUid: uid, toUid: channelId, channelId, content,
+      messageId: msgId, timestamp, isMe: true, contentType
+    });
+
+    return { success: true, messageId: msgId };
+  };
+}
+
+module.exports = { createSendMessageToWorker };

package/src/core/set-agent-status.js

@@ -0,0 +1,65 @@
+/**
+ * Agent 上下架 / 公开私有状态设置
+ *
+ * 通过 DID 认证 Ed25519 签名调用服务端接口。
+ * 供主进程 IPC 和 MCP 工具共享。
+ */
+
+const { VOKO_API_URL } = require('./api-signature');
+const { signDidRequest } = require('./did-auth');
+
+/**
+ * 设置 Agent 上下架和公开私有状态
+ * @param {Object} opts
+ * @param {Object} opts.db - better-sqlite3 Database 实例
+ * @param {string} opts.agentId
+ * @param {number} opts.status - 0=下架, 1=上架
+ * @param {number} opts.visibility - 0=私有, 1=公开
+ * @returns {Promise<{success: boolean, error?: string}>}
+ */
+async function setAgentStatus(opts) {
+  const { db, agentId, status, visibility } = opts || {};
+
+  if (!db) return { success: false, error: 'db is required' };
+  if (!agentId) return { success: false, error: 'agentId is required' };
+  if (status === undefined || visibility === undefined) {
+    return { success: false, error: '缺少 status 或 visibility' };
+  }
+
+  try {
+    const row = db.prepare(`SELECT did, private_key FROM agents WHERE agent_id = ?`).get(agentId);
+    if (!row?.did || !row?.private_key) {
+      console.warn(`[setAgentStatus] Agent ${agentId} 无 DID，跳过状态同步`);
+      return { success: false, error: 'Agent has no DID' };
+    }
+
+    const businessFields = { status, visibility };
+    const signed = await signDidRequest(row.did, row.private_key, businessFields);
+
+    const requestBody = { ...signed, ...businessFields };
+    console.log(`[setAgentStatus] Agent ${agentId}: status=${status}, visibility=${visibility}`);
+
+    const response = await fetch(`${VOKO_API_URL}/api/did-auth/set-agent-status`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(requestBody)
+    });
+    const result = await response.json();
+    if (result.success) {
+      // 同步本地 agents 表状态
+      const publishStatus = status === 1 ? 'published' : 'unpublished';
+      const accessMode = visibility === 1 ? 'public' : 'private';
+      db.prepare(`UPDATE agents SET publish_status=?, access_mode=?, updated_at=? WHERE agent_id=?`)
+        .run(publishStatus, accessMode, Date.now(), agentId);
+      console.log(`[setAgentStatus] Agent ${agentId} 成功 -> publish_status=${publishStatus}, access_mode=${accessMode}`);
+      return { success: true, publishStatus, accessMode };
+    }
+    console.warn(`[setAgentStatus] Agent ${agentId} 失败:`, result.message);
+    return { success: false, error: result.message || '设置状态失败' };
+  } catch (e) {
+    console.error(`[setAgentStatus] Agent ${agentId} error:`, e);
+    return { success: false, error: e.message };
+  }
+}
+
+module.exports = { setAgentStatus };

package/src/core/update-agent-profile.js

@@ -0,0 +1,102 @@
+/**
+ * Agent 基础信息更新
+ *
+ * 通过 DID 认证 Ed25519 签名调用服务端更新接口，并同步本地 SQLite。
+ * 供主进程 IPC 和 MCP 工具共享。
+ */
+
+const { signAsync } = require('@noble/ed25519');
+const { VOKO_API_URL } = require('./api-signature');
+const { extractEd25519PrivateKey } = require('./did-auth');
+
+/**
+ * 更新 Agent 基础信息
+ * @param {Object} opts
+ * @param {Object} opts.db - better-sqlite3 Database 实例
+ * @param {string} opts.agentId
+ * @param {string} [opts.name]
+ * @param {string} [opts.description]
+ * @param {string} [opts.short_description]
+ * @param {string} [opts.category]
+ * @param {string} [opts.address]
+ * @param {string} [opts.contact_phone]
+ * @param {string} [opts.icon_url]
+ * @param {string} [opts.cover_url]
+ * @param {string|string[]} [opts.tags]
+ * @returns {Promise<{success: boolean, message?: string, error?: string, data?: any}>}
+ */
+async function updateAgentProfile(opts) {
+  const { db, agentId, name, description, short_description, category } = opts || {};
+  const { address, contact_phone, icon_url, cover_url, tags } = opts || {};
+
+  if (!db) return { success: false, error: 'db is required' };
+  if (!agentId) return { success: false, error: 'agentId is required' };
+
+  try {
+    const stmt = db.prepare(`SELECT did, private_key FROM agents WHERE agent_id = ?`);
+    const row = stmt.get(agentId);
+    if (!row) return { success: false, error: 'Agent not found' };
+    if (!row.did) return { success: false, error: 'Agent has no DID' };
+    if (!row.private_key) return { success: false, error: 'Agent has no private key' };
+
+    // 构建 bodyPayload（仅可更新字段，key 按字母序排序）
+    const payload = {};
+    if (name !== undefined) payload.name = name;
+    if (description !== undefined) payload.description = description;
+    if (address !== undefined) payload.address = address;
+    if (contact_phone !== undefined) payload.contact_phone = contact_phone;
+    if (category !== undefined) payload.category = category;
+    if (short_description !== undefined) payload.short_description = short_description;
+    if (icon_url !== undefined) payload.icon_url = icon_url;
+    if (cover_url !== undefined) payload.cover_url = cover_url;
+    if (tags !== undefined) payload.tags = typeof tags === 'string' ? JSON.parse(tags) : tags;
+    const bodyPayload = JSON.stringify(payload, Object.keys(payload).sort());
+
+    // 签名
+    const nonce = Math.random().toString(36).substring(2, 15) + Date.now().toString(36);
+    const timestamp = Math.floor(Date.now() / 1000);
+    const toSign = row.did + '\n' + nonce + '\n' + timestamp + '\n' + bodyPayload;
+    const rawKey = extractEd25519PrivateKey(row.private_key);
+    const sigBytes = await signAsync(new TextEncoder().encode(toSign), rawKey);
+    const signature = Buffer.from(sigBytes).toString('base64');
+
+    const requestBody = { did: row.did, nonce, timestamp, signature, ...payload };
+
+    console.log(`[updateProfile] Agent ${agentId}: sending...`, JSON.stringify({ did: row.did, fields: Object.keys(payload) }));
+
+    const response = await fetch(`${VOKO_API_URL}/api/did-auth/update-agent-profile`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(requestBody)
+    });
+    const result = await response.json();
+    console.log(`[updateProfile] Agent ${agentId} response:`, result);
+
+    if (result.success) {
+      // 本地同步更新
+      const sets = ['updated_at = ?'];
+      const vals = [Date.now()];
+      if (name !== undefined) { sets.push('agent_name = ?'); vals.push(name); }
+      if (description !== undefined) { sets.push('description = ?'); vals.push(description); }
+      if (address !== undefined) { sets.push('address = ?'); vals.push(address); }
+      if (contact_phone !== undefined) { sets.push('contact_phone = ?'); vals.push(contact_phone); }
+      if (category !== undefined) { sets.push('category = ?'); vals.push(category); }
+      // 从服务端响应中提取 category_label
+      const serverCategoryLabel = result.data?.categoryLabel || result.data?.category_label;
+      if (serverCategoryLabel) { sets.push('category_label = ?'); vals.push(serverCategoryLabel); }
+      if (short_description !== undefined) { sets.push('short_description = ?'); vals.push(short_description); }
+      if (icon_url !== undefined) { sets.push('icon_url = ?'); vals.push(icon_url); }
+      if (cover_url !== undefined) { sets.push('cover_url = ?'); vals.push(cover_url); }
+      if (tags !== undefined) { sets.push('tags = ?'); vals.push(typeof tags === 'string' ? tags : JSON.stringify(tags)); }
+      vals.push(agentId);
+      db.prepare(`UPDATE agents SET ${sets.join(', ')} WHERE agent_id = ?`).run(...vals);
+      return { success: true, message: '基础信息已更新', data: result.data };
+    }
+    return { success: false, error: result.message || '更新失败', detail: result };
+  } catch (e) {
+    console.error('[updateProfile] error:', e);
+    return { success: false, error: e.message };
+  }
+}
+
+module.exports = { updateAgentProfile };