weflow-cli 1.5.0 → 1.6.1

package/src/services/assistantMemory.ts

@@ -0,0 +1,193 @@
+/**
+ * 三层记忆 (参考 LangGraph checkpointer + Mem0 范式):
+ *   L1 工作记忆  最近 N 轮原文 (滑入滑出)
+ *   L2 滚动摘要  滑出的旧轮次压缩成摘要, 跨窗口保留脉络
+ *   L3 长期事实  从对话中提取的持久信息 (偏好/项目/关系), 注入系统提示
+ * 持久化: ~/.weflow-cli/assistant_memory.json
+ */
+import { join } from 'path'
+import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'fs'
+import os from 'os'
+
+const MEMORY_FILE = join(os.homedir(), '.weflow-cli', 'assistant_memory.json')
+
+const WORKING_MAX = 16 // 超过则最旧一半转摘要
+const SUMMARY_MAX = 800
+const FACTS_MAX = 30
+const FACT_EXTRACT_EVERY = 6
+
+export interface ChatTurn { role: 'user' | 'assistant'; content: string }
+export interface Fact { content: string; ts: number }
+
+interface UserMemory {
+  working: ChatTurn[]
+  summary: string
+  facts: Fact[]
+  turnCount: number
+}
+
+/** LLM 调用器抽象 (由 assistantService 注入, 避免循环依赖) */
+export type LlmCaller = (messages: ChatTurn[], maxTokens?: number) => Promise<string>
+
+export class AssistantMemory {
+  private states: Record<string, UserMemory> = {}
+  /** 本进程修改过的用户 (save 时只回写这些用户, 其余保留磁盘最新值) */
+  private dirtyUsers = new Set<string>()
+
+  constructor() { this.load() }
+
+  private normalize(s: any): UserMemory {
+    return {
+      working: Array.isArray(s.working) ? s.working : [],
+      summary: typeof s.summary === 'string' ? s.summary : '',
+      facts: Array.isArray(s.facts) ? s.facts : [],
+      turnCount: s.turnCount || 0,
+    }
+  }
+
+  private load(): void {
+    try {
+      if (existsSync(MEMORY_FILE)) {
+        const raw = JSON.parse(readFileSync(MEMORY_FILE, 'utf8'))
+        for (const [uid, s] of Object.entries<any>(raw)) {
+          this.states[uid] = this.normalize(s)
+        }
+      }
+    } catch { this.states = {} }
+  }
+
+  save(): void {
+    try {
+      // 读改写合并: MCP server / assistant 守护进程并发写同一文件,
+      // 只回写本进程修改过的用户, 防止旧快照覆盖其他进程刚写入的数据 (同 configService 策略)
+      const merged: Record<string, UserMemory> = {}
+      try {
+        if (existsSync(MEMORY_FILE)) {
+          const disk = JSON.parse(readFileSync(MEMORY_FILE, 'utf8'))
+          for (const [uid, s] of Object.entries<any>(disk)) {
+            if (this.dirtyUsers.has(uid)) continue
+            merged[uid] = this.normalize(s)
+          }
+        }
+      } catch { /* 磁盘损坏 → 只落内存态 */ }
+      for (const uid of this.dirtyUsers) {
+        if (this.states[uid]) merged[uid] = this.states[uid]
+      }
+      const dir = join(os.homedir(), '.weflow-cli')
+      if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+      const tmp = `${MEMORY_FILE}.tmp`
+      writeFileSync(tmp, JSON.stringify(merged), 'utf8')
+      renameSync(tmp, MEMORY_FILE)
+      this.states = merged
+      this.dirtyUsers.clear()
+    } catch { /* 持久化失败不阻断对话 */ }
+  }
+
+  private state(userId: string): UserMemory {
+    if (!this.states[userId]) {
+      this.states[userId] = { working: [], summary: '', facts: [], turnCount: 0 }
+    }
+    return this.states[userId]
+  }
+
+  reset(userId: string): void {
+    delete this.states[userId]
+    this.dirtyUsers.add(userId)
+    this.save()
+  }
+
+  addTurn(userId: string, role: 'user' | 'assistant', content: string): void {
+    this.dirtyUsers.add(userId)
+    const s = this.state(userId)
+    s.working.push({ role, content })
+    if (role === 'user') s.turnCount++
+  }
+
+  /** L1 窗口 (喂给 LLM 的近期原文) */
+  workingWindow(userId: string): ChatTurn[] {
+    return this.state(userId).working
+  }
+
+  summary(userId: string): string { return this.state(userId).summary }
+  facts(userId: string): Fact[] { return this.state(userId).facts }
+  userCount(): number { return Object.keys(this.states).length }
+
+  /** L2: 窗口溢出时把最旧一半压进摘要 */
+  async compressIfNeeded(userId: string, llm: LlmCaller): Promise<boolean> {
+    const s = this.state(userId)
+    if (s.working.length <= WORKING_MAX) return false
+    this.dirtyUsers.add(userId)
+
+    const out = s.working.slice(0, Math.floor(s.working.length / 2))
+    s.working = s.working.slice(out.length)
+
+    try {
+      const prompt = `将以下对话压缩为摘要,与已有摘要合并。保留:关键事实、决定、人名、时间、待办。输出不超过500字,直接输出摘要正文,不要任何前后缀。
+
+[已有摘要]
+${s.summary || '(无)'}
+
+[新增对话]
+${out.map(t => `${t.role === 'user' ? '用户' : '助手'}: ${t.content}`).join('\n')}`
+      const merged = await llm([{ role: 'user', content: prompt }], 600)
+      s.summary = merged.trim().slice(0, SUMMARY_MAX)
+    } catch {
+      // LLM 失败时降级: 粗暴截断拼接, 保住不丢
+      const brief = out.map(t => `${t.role === 'user' ? '用户' : '助手'}: ${t.content.slice(0, 40)}`).join(' / ')
+      s.summary = `${s.summary} ${brief}`.slice(-SUMMARY_MAX)
+    }
+    return true
+  }
+
+  /** L3: 定期从最近对话提取持久事实 */
+  async extractFactsIfNeeded(userId: string, llm: LlmCaller): Promise<number> {
+    const s = this.state(userId)
+    if (s.turnCount === 0 || s.turnCount % FACT_EXTRACT_EVERY !== 0) return 0
+    const recent = s.working.slice(-FACT_EXTRACT_EVERY)
+    if (!recent.length) return 0
+    this.dirtyUsers.add(userId)
+
+    try {
+      const prompt = `从对话中提取关于用户的持久事实(背景/偏好/项目/人际关系/惯例)。每条不超过40字。只输出 JSON 字符串数组,最多3条,没有则输出 []。不要提取临时性内容。
+
+[对话]
+${recent.map(t => `${t.role === 'user' ? '用户' : '助手'}: ${t.content}`).join('\n')}`
+      const raw = await llm([{ role: 'user', content: prompt }], 300)
+      const m = raw.match(/\[[\s\S]*\]/)
+      if (!m) return 0
+      const items: unknown[] = JSON.parse(m[0])
+      let added = 0
+      for (const item of items) {
+        if (typeof item !== 'string' || !item.trim()) continue
+        const fact = item.trim().slice(0, 60)
+        // 去重: 与既有事实包含关系判断
+        if (s.facts.some(f => f.content.includes(fact) || fact.includes(f.content))) continue
+        s.facts.push({ content: fact, ts: Date.now() })
+        added++
+      }
+      if (s.facts.length > FACTS_MAX) s.facts = s.facts.slice(-FACTS_MAX)
+      return added
+    } catch {
+      return 0
+    }
+  }
+
+  /** L3 检索: 关键词命中 (为未来向量检索预留同一接口) */
+  searchFacts(userId: string, keyword: string): Fact[] {
+    const kw = keyword.trim()
+    if (!kw) return []
+    return this.state(userId).facts.filter(f =>
+      f.content.includes(kw) || kw.split(/\s+/).some(w => w.length >= 2 && f.content.includes(w)))
+  }
+
+  /** L3 写入 (save_memory 工具用, 立即生效) */
+  addFact(userId: string, content: string): boolean {
+    this.dirtyUsers.add(userId)
+    const s = this.state(userId)
+    if (s.facts.some(f => f.content.includes(content) || content.includes(f.content))) return false
+    s.facts.push({ content, ts: Date.now() })
+    if (s.facts.length > FACTS_MAX) s.facts = s.facts.slice(-FACTS_MAX)
+    this.save()
+    return true
+  }
+}

package/src/services/assistantPrivacy.ts

@@ -0,0 +1,87 @@
+/**
+ * 隐私关卡 — 本地/云端数据出境的唯一检查点。
+ *
+ * 原则:
+ * - 数据库查询、记忆存储、工具执行全部在本机 (可信区)
+ * - 只有经 redact() 处理后的文本才允许发往云端 LLM
+ * - 本地推理引擎 (Ollama 等) 不出境, 跳过脱敏以保留完整能力
+ *
+ * 模式 (config: assistantPrivacy):
+ * - open    不脱敏 (自担风险)
+ * - balanced 默认; 工具输出中的 PII (电话/证件/邮箱/密钥/链接) 打码
+ * - strict   balanced 基础上, 第三方聊天正文不出境 (仅保留时间/方向/类型)
+ */
+import { join } from 'path'
+import { existsSync, mkdirSync, appendFileSync } from 'fs'
+import os from 'os'
+import { configService } from './configService.js'
+
+export type PrivacyMode = 'open' | 'balanced' | 'strict'
+
+const AUDIT_FILE = join(os.homedir(), '.weflow-cli', 'assistant_audit.log')
+
+interface Rule { re: RegExp; mask: string }
+
+const PII_RULES: Rule[] = [
+  { re: /(?<!\d)1[3-9]\d{9}(?!\d)/g, mask: '[电话]' },
+  { re: /(?<!\d)\d{17}[\dXx](?!\d)/g, mask: '[证件号]' },
+  { re: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, mask: '[邮箱]' },
+  { re: /sk-[a-zA-Z0-9]{16,}/g, mask: '[密钥]' },
+  { re: /https?:\/\/\S+/g, mask: '[链接]' },
+]
+
+export function redactText(text: string, mode: PrivacyMode, localInference: boolean): { safe: string; redactions: number } {
+  if (mode === 'open' || localInference) {
+    return { safe: text, redactions: 0 }
+  }
+  let count = 0
+  let safe = text
+  for (const { re, mask } of PII_RULES) {
+    safe = safe.replace(re, () => { count++; return mask })
+  }
+  return { safe, redactions: count }
+}
+
+export function maskMessageBodyText(body: string, mode: PrivacyMode, localInference: boolean): string {
+  if (mode !== 'strict' || localInference) return body
+  return `[内容${body.length}字已按严格模式屏蔽]`
+}
+
+export class PrivacyGate {
+  mode(): PrivacyMode {
+    const m = configService.get('assistantPrivacy')
+    return m === 'open' || m === 'strict' ? m : 'balanced'
+  }
+
+  /** 本地引擎数据不出机器, 无需脱敏 */
+  isLocalInference(): boolean {
+    const engine = configService.get('aiEngine')
+    return engine === 'ollama' || engine === 'lmstudio' || engine === 'local'
+  }
+
+  /**
+   * 出境前脱敏。仅用于「工具从数据库挖出的第三方数据」;
+   * 用户自己输入的话按原意发送 (用户对自己的话有处置权)。
+   */
+  redact(text: string): { safe: string; redactions: number } {
+    return redactText(text, this.mode(), this.isLocalInference())
+  }
+
+  /** strict 模式: 第三方聊天正文不出境, 只保留元数据形态 */
+  maskMessageBody(body: string): string {
+    return maskMessageBodyText(body, this.mode(), this.isLocalInference())
+  }
+
+  /** 审计日志 — 只记事件与字节量, 绝不记内容 */
+  audit(event: string, bytes = 0, extra = ''): void {
+    try {
+      const dir = join(os.homedir(), '.weflow-cli')
+      if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+      const line = `[${new Date().toLocaleString('zh-CN')}] ${event}` +
+        (bytes ? ` ${bytes}B` : '') + (extra ? ` ${extra}` : '')
+      appendFileSync(AUDIT_FILE, line + '\n', 'utf8')
+    } catch { /* 审计失败不阻断主流程 */ }
+  }
+}
+
+export const privacyGate = new PrivacyGate()

package/src/services/assistantRouting.ts

@@ -0,0 +1,92 @@
+import type { WechatInboundMessage } from '../types.js'
+
+export type AssistantAccessReason =
+  | 'allowed'
+  | 'direct-not-whitelisted'
+  | 'group-not-whitelisted'
+  | 'group-sender-missing'
+  | 'group-sender-not-whitelisted'
+  | 'group-mention-required'
+
+export interface AssistantAccessPolicy {
+  directWhitelist: string
+  groupWhitelist: string
+  requireGroupMention: boolean
+}
+
+export interface AssistantAccessDecision {
+  allowed: boolean
+  reason: AssistantAccessReason
+}
+
+function parseList(value: string): Set<string> {
+  return new Set(value.split(/[,;\s]+/).map(item => item.trim()).filter(Boolean))
+}
+
+export function evaluateAssistantAccess(
+  message: Pick<WechatInboundMessage, 'conversationType' | 'conversationId' | 'senderId' | 'mentionedBot'>,
+  policy: AssistantAccessPolicy,
+): AssistantAccessDecision {
+  const directWhitelist = parseList(policy.directWhitelist)
+  if (message.conversationType !== 'group') {
+    return directWhitelist.has(message.senderId)
+      ? { allowed: true, reason: 'allowed' }
+      : { allowed: false, reason: 'direct-not-whitelisted' }
+  }
+
+  if (!parseList(policy.groupWhitelist).has(message.conversationId)) {
+    return { allowed: false, reason: 'group-not-whitelisted' }
+  }
+  if (!message.senderId) return { allowed: false, reason: 'group-sender-missing' }
+  if (!directWhitelist.has(message.senderId)) {
+    return { allowed: false, reason: 'group-sender-not-whitelisted' }
+  }
+  if (policy.requireGroupMention && !message.mentionedBot) {
+    return { allowed: false, reason: 'group-mention-required' }
+  }
+  return { allowed: true, reason: 'allowed' }
+}
+
+function firstString(record: Record<string, any>, keys: string[]): string {
+  for (const key of keys) {
+    const value = record[key]
+    if (typeof value === 'string' && value.trim()) return value.trim()
+  }
+  return ''
+}
+
+function isBotMentioned(record: Record<string, any>, botId: string): boolean {
+  if (record.is_at_bot === true || record.is_mentioned === true || record.mentioned_bot === true) return true
+  if (!botId) return false
+  for (const key of ['at_user_ids', 'mentioned_user_ids', 'mention_list']) {
+    const value = record[key]
+    if (Array.isArray(value) && value.some(item => String(item) === botId)) return true
+  }
+  return false
+}
+
+/**
+ * Accept group routing only when the upstream payload explicitly identifies a group.
+ * Unknown payloads remain direct messages so a platform change cannot silently enable groups.
+ */
+export function resolveInboundRouting(record: Record<string, any>, botId = ''): Pick<WechatInboundMessage, 'conversationType' | 'conversationId' | 'senderId' | 'mentionedBot'> {
+  const fromUserId = firstString(record, ['from_user_id', 'fromUserId'])
+  const groupId = firstString(record, ['chatroom_id', 'chat_room_id', 'group_id', 'groupId', 'room_id', 'roomId'])
+    || (fromUserId.endsWith('@chatroom') ? fromUserId : '')
+  if (!groupId) {
+    return {
+      conversationType: 'direct',
+      conversationId: fromUserId,
+      senderId: fromUserId,
+      mentionedBot: false,
+    }
+  }
+
+  const explicitSender = firstString(record, ['sender_id', 'sender_user_id', 'member_id', 'from_member_id'])
+  return {
+    conversationType: 'group',
+    conversationId: groupId,
+    senderId: explicitSender || (fromUserId !== groupId ? fromUserId : ''),
+    mentionedBot: isBotMentioned(record, botId),
+  }
+}

package/src/services/assistantService.ts

@@ -0,0 +1,295 @@
+/**
+ * 第二大脑助手 — 持久化 Agent (主流框架标准架构)。
+ *
+ * 架构 (参考 LangGraph Agent Loop + Mem0 三层记忆):
+ *   微信(iLink) ⇄ 常驻进程
+ *     ├─ ReAct 循环: LLM 决策 → 本地工具执行 → 观察回填 → 直到产出回答
+ *     ├─ 三层记忆: L1 工作窗口 / L2 滚动摘要 / L3 长期事实 (本地 JSON)
+ *     └─ 隐私关卡: 工具结果脱敏后才出境到云端 LLM (本地引擎则完全不出境)
+ */
+import { WechatMessageService } from './wechatMessageService.js'
+import { configService } from './configService.js'
+import { AssistantMemory, type ChatTurn } from './assistantMemory.js'
+import { privacyGate } from './assistantPrivacy.js'
+import { TOOL_DEFS, executeTool } from './assistantTools.js'
+import { appendLog } from './assistantDaemon.js'
+import type { Message, WechatInboundMessage } from '../types.js'
+import { buildEvidenceReviewInput } from './evidenceService.js'
+import { evaluateAssistantAccess } from './assistantRouting.js'
+
+const MAX_TOOL_ROUNDS = 6
+/** 每日 LLM 处理上限 (护栏: 防 bug 死循环/异常流量烧钱; 0 = 不限制) */
+const DAILY_LIMIT = 100
+
+const BASE_PROMPT = `你是"第二大脑", 运行在用户自己的电脑上, 通过微信与用户对话。
+你可以调用工具查询用户本地微信数据(会话/聊天记录/收藏), 以及读写关于用户的长期记忆。
+
+行为准则:
+- 涉及用户数据的问题, 先调工具查证再回答, 不要编造
+- 用户让你记住某事时, 用 save_memory 工具保存
+- 回复用微信聊天风格, 简洁, 不用 markdown 符号
+- 数据不足时直说需要什么, 不要瞎猜
+- 回复控制在 300 字内, 列表类可放宽`
+
+interface ApiMessage {
+  role: 'system' | 'user' | 'assistant' | 'tool'
+  content: string
+  tool_calls?: any[]
+  tool_call_id?: string
+}
+
+export class AssistantService {
+  private svc: WechatMessageService | null = null
+  private memory = new AssistantMemory()
+  private running = false
+  /** 消息串行队列: 保证 handleMessage 不并发交错 (记忆窗口一致性) */
+  private queue: Promise<void> = Promise.resolve()
+  /** 每日用量计数 (内存态, 重启重置 — 配额护栏防烧钱, 无需持久精确) */
+  private dailyCount = 0
+  private dailyDate = new Date().toDateString()
+
+  private engineConfig(): { url: string; model: string; key: string | null; local: boolean } {
+    const engine = String(configService.get('aiEngine') || 'deepseek')
+    if (engine === 'ollama' || engine === 'lmstudio') {
+      const port = engine === 'lmstudio' ? 1234 : 11434
+      const model = String(configService.get('localModel') || 'llama3')
+      return { url: `http://localhost:${port}/v1`, model, key: null, local: true }
+    }
+    // 自定义 OpenAI 兼容端点 (中转站) 优先
+    const baseUrl = String(configService.get('aiBaseUrl') || '').trim().replace(/\/+$/, '')
+    if (baseUrl) {
+      const model = String(configService.get('aiModel') || 'deepseek-chat')
+      return { url: baseUrl, model, key: configService.get('deepseekApiKey'), local: false }
+    }
+    return { url: 'https://api.deepseek.com/v1', model: 'deepseek-chat', key: configService.get('deepseekApiKey'), local: false }
+  }
+
+  /**
+   * Direct messages require an explicit sender allowlist. Groups are disabled
+   * until the upstream provides an explicit group ID, and then require all
+   * three controls: group allowlist, sender allowlist, and an @ mention.
+   */
+  private accessDecision(message: WechatInboundMessage): ReturnType<typeof evaluateAssistantAccess> {
+    return evaluateAssistantAccess(message, {
+      directWhitelist: String(configService.get('assistantWhitelist') || ''),
+      groupWhitelist: String(configService.get('assistantGroupWhitelist') || ''),
+      requireGroupMention: configService.get('assistantGroupRequireMention') !== 'false',
+    })
+  }
+
+  private dailyQuotaLeft(): number {
+    const today = new Date().toDateString()
+    if (today !== this.dailyDate) { this.dailyDate = today; this.dailyCount = 0 }
+    return DAILY_LIMIT - this.dailyCount
+  }
+
+  /** 底层 LLM 调用 (含出境审计) */
+  private async callLLM(messages: ApiMessage[], tools?: any[], maxTokens = 800): Promise<any> {
+    const { url, model, key, local } = this.engineConfig()
+    if (!key && !local) {
+      throw new Error('未配置 LLM (config set deepseekApiKey 或切换 ollama)')
+    }
+    const body: Record<string, unknown> = { model, messages, max_tokens: maxTokens, temperature: 0.4 }
+    if (tools?.length) { body.tools = tools; body.tool_choice = 'auto' }
+
+    const res = await fetch(`${url}/chat/completions`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...(key ? { Authorization: `Bearer ${key}` } : {}),
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(120_000),
+    })
+    privacyGate.audit('CLOUD_CALL', JSON.stringify(body).length,
+      local ? 'local' : `${url.split('//')[1].split('/')[0]}`)
+    if (!res.ok) {
+      const t = await res.text().catch(() => '')
+      throw new Error(`LLM ${res.status}: ${t.slice(0, 120)}`)
+    }
+    return res.json()
+  }
+
+  /** 在明确授权后分析本地聊天，输出证据线索而非法律结论。 */
+  async reviewEvidence(talker: string, messages: Message[], allowCloud = false): Promise<{ text: string; localInference: boolean; redactions: number }> {
+    const { local } = this.engineConfig()
+    if (!local && !allowCloud) {
+      throw new Error('默认禁止将聊天正文发送到云端；请切换本地模型，或明确使用 --allow-cloud')
+    }
+    const input = buildEvidenceReviewInput(talker, messages, privacyGate.mode(), local)
+    const response = await this.callLLM([
+      {
+        role: 'system',
+        content: `你是电子数据整理助手，不是律师。只根据提供的聊天原文进行线索整理，不判断“必然违法”、不判断法院必然采信，也不编造法律条文或事实。
+请用中文输出以下结构：
+## 疑似争议线索
+逐项引用消息ID，区分原文事实和你的待核查推测。
+## 可能涉及的法律主题
+只写宽泛主题，例如合同履行、借贷、劳动争议、名誉侵权、隐私或个人信息；不作定性结论。
+## 还需要核验的材料
+列出原设备、完整上下文、转账/合同/平台记录、身份归属等缺口。
+## 保全建议
+提醒保留原始设备、原始数据、完整对话和导出记录。
+如果信息不足，明确写“信息不足”，不要补全。${local ? '' : '\n当前不是本地推理：不要复述已被隐私模式屏蔽的聊天正文。'}`,
+      },
+      { role: 'user', content: input.transcript },
+    ], undefined, 1800)
+    return {
+      text: (response.choices?.[0]?.message?.content || '信息不足，未生成分析。').trim(),
+      localInference: local,
+      redactions: input.redactions,
+    }
+  }
+
+  /** 组装系统提示: 基础人格 + L2 摘要 + L3 事实 */
+  private buildSystemPrompt(userId: string): string {
+    const parts = [BASE_PROMPT]
+    const summary = this.memory.summary(userId)
+    if (summary) parts.push(`\n[此前对话摘要]\n${summary}`)
+    const facts = this.memory.facts(userId)
+    if (facts.length) {
+      parts.push(`\n[关于用户的长期记忆]\n${facts.map(f => `· ${f.content}`).join('\n')}`)
+    }
+    return parts.join('\n')
+  }
+
+  /** 单条消息处理: 指令路由 → ReAct 循环 → 记忆更新 */
+  async handleMessage(userId: string, text: string, kind: string): Promise<string> {
+    if (kind !== 'text') return '目前只支持文字消息哦'
+
+    const t = text.trim()
+
+    if (t === '帮助' || t.toLowerCase() === 'help') {
+      return ['🧠 第二大脑 Agent', '',
+        '直接用自然语言问, 我会自动查本地数据回答:',
+        '「我最近都在忙什么?」',
+        '「总结我和XX的聊天」',
+        '「收藏里有哪些AI文章?」',
+        '「记住: 我的项目叫weflow-cli」',
+        '', '记忆: 三层 (窗口/摘要/长期事实), 重启不丢',
+        '隐私: 数据库不出本机, 出境内容自动脱敏',
+        '', '指令: 记忆 | 清空记忆'].join('\n')
+    }
+    if (t === '清空记忆' || t === '重置') {
+      this.memory.reset(userId)
+      privacyGate.audit('MEMORY_RESET', 0, userId.slice(0, 8))
+      return '✓ 对话记忆已清空, 重新开始'
+    }
+    if (t === '记忆') {
+      const facts = this.memory.facts(userId)
+      const s = this.memory.summary(userId)
+      const lines = [`工作窗口: ${this.memory.workingWindow(userId).length} 条`]
+      lines.push(`滚动摘要: ${s ? `${s.length}字` : '无'}`)
+      lines.push(`长期事实: ${facts.length} 条`)
+      if (facts.length) lines.push(facts.slice(-5).map(f => `· ${f.content}`).join('\n'))
+      lines.push(`隐私模式: ${privacyGate.mode()}${privacyGate.isLocalInference() ? ' (本地推理, 不出境)' : ''}`)
+      lines.push(`今日用量: ${this.dailyCount}/${DAILY_LIMIT}`)
+      return lines.join('\n')
+    }
+
+    // === ReAct 主循环 ===
+    this.memory.addTurn(userId, 'user', t)
+    const messages: ApiMessage[] = [
+      { role: 'system', content: this.buildSystemPrompt(userId) },
+      ...this.memory.workingWindow(userId).map(turn => ({ role: turn.role, content: turn.content })),
+    ]
+
+    let reply = ''
+    let toolCalls = 0
+    try {
+      for (let round = 0; round < MAX_TOOL_ROUNDS; round++) {
+        const data = await this.callLLM(messages, TOOL_DEFS)
+        const msg = data.choices?.[0]?.message
+        if (!msg) throw new Error('LLM 返回为空')
+
+        if (msg.tool_calls?.length) {
+          messages.push({ role: 'assistant', content: msg.content || '', tool_calls: msg.tool_calls })
+          for (const tc of msg.tool_calls) {
+            toolCalls++
+            let args: Record<string, any> = {}
+            try { args = JSON.parse(tc.function?.arguments || '{}') } catch { /* 参数容错 */ }
+            const raw = await executeTool(tc.function?.name || '', args, { userId, memory: this.memory })
+            const { safe, redactions } = privacyGate.redact(raw)
+            privacyGate.audit(`TOOL:${tc.function?.name}`, raw.length, redactions ? `redacted=${redactions}` : '')
+            messages.push({ role: 'tool', tool_call_id: tc.id, content: safe })
+          }
+          continue
+        }
+        reply = (msg.content || '').trim() || '(空回复)'
+        break
+      }
+      if (!reply) reply = '(这轮处理太复杂了, 换个问法试试?)'
+    } catch (e: any) {
+      reply = `❌ 大脑暂时离线: ${e.message?.slice(0, 100)}\n(本地指令仍可用: 发「帮助」)`
+    }
+
+    // === 记忆更新 (L2 压缩 + L3 提取) ===
+    this.memory.addTurn(userId, 'assistant', reply)
+    const llm = (msgs: ChatTurn[], maxTokens?: number) =>
+      this.callLLM(msgs as ApiMessage[], undefined, maxTokens).then(
+        (d: any) => d.choices?.[0]?.message?.content || '')
+    try { await this.memory.compressIfNeeded(userId, llm) } catch { /* 压缩失败不阻断 */ }
+    try { await this.memory.extractFactsIfNeeded(userId, llm) } catch { /* 提取失败不阻断 */ }
+    this.memory.save()
+    privacyGate.audit('TURN_DONE', reply.length, `tools=${toolCalls}`)
+    return reply
+  }
+
+  /** 启动常驻监听 */
+  async start(onLog?: (line: string) => void): Promise<void> {
+    const token = configService.get('wechatOcToken')
+    if (!token) throw new Error('未登录消息通道, 先运行 weflow-cli login-wechat')
+
+    this.svc = new WechatMessageService({ token })
+    this.running = true
+    const { local } = this.engineConfig()
+    onLog?.(`助手已启动 (bot: ${configService.get('wechatOcAccountId')}, ` +
+      `引擎: ${local ? '本地' : '云端'}, 记忆用户数: ${this.memory.userCount()})`)
+
+    this.svc.onMessage((msg) => {
+      // 串行入队: 并发到达的消息按顺序处理, 记忆窗口不交错
+      this.queue = this.queue.then(async () => {
+        if (!this.running) return
+        const access = this.accessDecision(msg)
+        const sessionId = msg.conversationId
+
+        if (!access.allowed) {
+          privacyGate.audit(`DENY_${access.reason.toUpperCase().replace(/-/g, '_')}`, 0, sessionId.slice(0, 12))
+          onLog?.(`  → 拒绝: ${sessionId.slice(0, 12)}… ${access.reason} (未回复, 不耗 LLM)`)
+          return
+        }
+        if (msg.messageKind !== 'text') {
+          onLog?.(`  → 忽略非文本消息 (${msg.messageKind})`)
+          return
+        }
+        if (this.dailyQuotaLeft() <= 0) {
+          privacyGate.audit('DENY_DAILY_LIMIT', this.dailyCount)
+          appendLog(`[配额] 今日 ${DAILY_LIMIT} 条上限已用尽, 拒绝: ${msg.messageStr.slice(0, 30)}`)
+          await this.svc!.sendText(sessionId, '今日额度已用完, 明天再来吧').catch(() => {})
+          return
+        }
+
+        onLog?.(`[${new Date().toLocaleTimeString('zh-CN')}] ${sessionId.slice(0, 12)}…: ${msg.messageStr.slice(0, 40)}`)
+        try {
+          const reply = await this.handleMessage(sessionId, msg.messageStr, msg.messageKind)
+          this.dailyCount++
+          const ok = await this.svc!.sendText(sessionId, reply)
+          onLog?.(`  → ${ok ? `已回复 (${reply.length}字, 今日 ${this.dailyCount}/${DAILY_LIMIT})` : '回复失败'}`)
+        } catch (e: any) {
+          onLog?.(`  → 处理异常: ${e.message}`)
+          appendLog(`[${new Date().toLocaleTimeString('zh-CN')}] 异常: ${e.message}`)
+        }
+      }).catch((e: any) => appendLog(`队列异常: ${e.message}`))
+    })
+
+    await this.svc.startPolling()
+  }
+
+  stop(): void {
+    this.running = false
+    this.svc?.stop()
+  }
+
+  isRunning(): boolean { return this.running }
+  memoryUserCount(): number { return this.memory.userCount() }
+}