GCWing · xielixing · Sep 6, 2026 · Sep 6, 2026 · Sep 7, 2026 · Sep 7, 2026
diff --git a/.github/workflows/desktop-package.yml b/.github/workflows/desktop-package.yml
@@ -288,6 +288,11 @@ jobs:
           node-version: 22
           cache: pnpm
 
+      - name: Setup Python (bundled loopx CLI)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:

diff --git a/.github/workflows/nightly-artifacts.yml b/.github/workflows/nightly-artifacts.yml
@@ -142,6 +142,11 @@ jobs:
           node-version: 22
           package-manager-cache: false
 
+      - name: Setup Python (bundled loopx CLI)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:

diff --git a/.gitignore b/.gitignore
@@ -100,6 +100,9 @@ external/
 .design/
 .pnpm-store/
 
+# Generated by scripts/build-loopx.mjs (never commit the compiled binary)
+src/apps/desktop/resources/loopx/
+
 # KMP shared mobile core and the platform apps that include it (Gradle).
 # Written per-directory rather than as a bare `local.properties` so the pattern
 # cannot accidentally hide a checked-in file elsewhere in the repo. local.properties

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/MiniApp/Demo/git-graph/README.md b/MiniApp/Demo/git-graph/README.md
@@ -28,7 +28,7 @@ This demo showcases OpenBitFun MiniApp's full-stack collaboration capability —
 1. **UI → Bridge**: `app.call('git.log', { cwd, maxCount })` etc. via `window.app` (JSON-RPC)
 2. **Bridge → Tauri**: postMessage intercepted by the host `useMiniAppBridge`, which calls `miniapp_worker_call`
 3. **Tauri → Worker**: Rust writes the request to Worker stdin (JSON-RPC)
-4. **Worker**: `worker_host.js` loads `source/worker.js`; exported handlers are invoked — primarily `git.graphData` (returns commits + refs + stashes + uncommitted in one response), plus `git.show`, `git.checkout`, `git.merge`, `git.push`, `git.stashPush`, and 20+ other methods — all backed by the `simple-git` npm package
+4. **Worker**: `worker_host.cjs` loads `source/worker.js`; exported handlers are invoked — primarily `git.graphData` (returns commits + refs + stashes + uncommitted in one response), plus `git.show`, `git.checkout`, `git.merge`, `git.push`, `git.stashPush`, and 20+ other methods — all backed by the `simple-git` npm package
 5. **Worker → Tauri → Bridge → UI**: response travels back via stderr → Rust → postMessage to iframe → UI refreshes graph and detail panel
 
 ### Directory Structure
@@ -117,7 +117,7 @@ miniapps/git-graph/
 1. **UI → Bridge**：`app.call('git.log', { cwd, maxCount })` 等通过 `window.app` 发起 RPC
 2. **Bridge → Tauri**：postMessage 被宿主 `useMiniAppBridge` 接收，调用 `miniapp_worker_call`
 3. **Tauri → Worker**：Rust 将请求写入 Worker 进程 stdin（JSON-RPC）
-4. **Worker**：`worker_host.js` 加载本目录 `source/worker.js`，其导出的处理函数被调用 — 主要是 `git.graphData`（一次返回提交 + refs + stash + 未提交变更），以及 `git.show`、`git.checkout`、`git.merge`、`git.push`、`git.stashPush` 等 20+ 个方法 — 均基于 `simple-git` npm 包
+4. **Worker**：`worker_host.cjs` 加载本目录 `source/worker.js`，其导出的处理函数被调用 — 主要是 `git.graphData`（一次返回提交 + refs + stash + 未提交变更），以及 `git.show`、`git.checkout`、`git.merge`、`git.push`、`git.stashPush` 等 20+ 个方法 — 均基于 `simple-git` npm 包
 5. **Worker → Tauri → Bridge → UI**：响应经 stderr 回传 Rust，再 postMessage 回 iframe，UI 更新图谱与详情
 
 ### 目录结构

diff --git a/MiniApp/Skills/miniapp-dev/SKILL.md b/MiniApp/Skills/miniapp-dev/SKILL.md
@@ -121,10 +121,10 @@ src/web-ui/src/flow_chat/tool-cards/MiniAppToolDisplay.tsx   # InitMiniAppDispla
 ### Worker 宿主
 
 ```
-src/apps/desktop/resources/worker_host.js
+src/apps/desktop/resources/worker_host.cjs
 ```
 
-Node/Bun 标准脚本：从 argv 读策略 JSON，stdin 收 RPC、stderr 回响应，内置 fs/shell/net/os/storage dispatch + 加载用户 `source/worker.js` 自定义方法。
+Node/Bun 标准脚本：从 `BITFUN_WORKER_POLICY` 环境变量读策略 JSON（argv[2] 仅作手动运行兜底），stdin 收 RPC、stderr 回响应，内置 fs/shell/net/os/storage dispatch + 加载用户 `source/worker.js` 自定义方法。
 
 ## MiniApp 数据模型 (V2)
 
@@ -217,6 +217,14 @@ MiniApp 框架**只暴露下列能力**，没有任何"通用 OpenBitFun 后端
 
 > 维护者：以后若新增 `app.openbitfun.*` / `app.workspace.*` 这类宿主直通通道，请同步更新本节，避免"文档说没有、代码偷偷加了"的不一致。
 
+### 内置产品私有扩展
+
+源码、来源和运行域都由宿主验证的内置产品界面可以获得私有 namespace，但它不属于
+MiniApp 公共 API，也不会注入普通、导入或市场 MiniApp。当前仅
+`builtin-bitfun-loopx` 使用私有 `app.loopx` 连接持久宿主控制器；每次调用仍由宿主
+复核原始 bundle、非 draft、非本地覆盖和本地执行域。生成 MiniApp 不得探测、声明或
+模拟这些私有 namespace；需要复用的能力必须先形成产品无关、带权限合同的公开 API。
+
 ## window.app 运行时 API
 
 MiniApp UI 内通过 **window.app** 访问：

diff --git a/MiniApp/Skills/miniapp-dev/api-reference.md b/MiniApp/Skills/miniapp-dev/api-reference.md
@@ -115,6 +115,16 @@ app.platform     // 'win32' | 'darwin' | 'linux'
 app.mode         // 'hosted'
 ```
 
+### 内置产品私有扩展不属于公共 API
+
+宿主可以为源码和来源均通过校验的内置产品界面注入私有 namespace。此类 namespace
+不会进入普通或市场 MiniApp 的编译结果，也不属于 `window.app` 公共能力合同。
+当前 `builtin-bitfun-loopx` 使用私有 `app.loopx` 连接持久宿主控制器；宿主在每次调用时
+还会校验内置 id、原始 bundle 内容、非 draft/非本地覆盖状态和执行域。
+
+生成、导入和市场 MiniApp 不得声明、探测或依赖 `app.loopx`，也不得以自定义 Worker
+模拟该控制器。需要类似能力时应先建立新的公开、产品无关且有权限合同的 MiniApp API。
+
 ### `app.fs.*` — 文件系统
 
 需在 `permissions.fs` 中声明读写范围。

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -67,3 +67,24 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+## loopx
+
+- Project: loopx
+- Source: https://github.com/huangruiteng/loopx
+- License: Apache-2.0
+- Copyright: Copyright 2026 LoopX contributors
+
+BitFun bundles a compiled, self-contained build of the loopx CLI as a desktop
+sidecar resource (`resources/loopx/`). It powers the built-in bitfun-loopx
+MiniApp's issue-fixing loop and is built at packaging time by
+`scripts/build-loopx.mjs` from the pinned upstream release recorded in
+`resources/loopx/manifest.json` (version, commit, content hash, and build
+toolchain). The upstream Apache-2.0 license, NOTICE, historical MIT license, and
+trademark policy ship alongside the binary as `resources/loopx/LICENSE`,
+`resources/loopx/NOTICE`, `resources/loopx/LICENSE-MIT`, and
+`resources/loopx/TRADEMARKS.md` in binary release packages. When the bundled
+sidecar is unavailable, the local Desktop may download the pinned source tag
+into BitFun-managed storage; that checkout retains the same upstream compliance
+files. The `loopx` name is used descriptively to refer to the upstream project;
+bitfun-loopx is a third-party integration and is not a LoopX project release.
diff --git a/docs/interactive-capabilities/README.md b/docs/interactive-capabilities/README.md
@@ -27,9 +27,9 @@ OpenBitFun Playbook currently contains **22 features**, **21 settings pages**, a
 - Generated per-item interaction audit: `docs/interactive-capabilities/technical/product-control-open-audit.json`
 - Generated low-level audit map: `docs/interactive-capabilities/technical/tauri-command-map.json`
 
-说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **660** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
+说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **667** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
 
-Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **660** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
+Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **667** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
 
 ## 控制边界 / Control boundary
 

diff --git a/docs/interactive-capabilities/technical/tauri-command-map.json b/docs/interactive-capabilities/technical/tauri-command-map.json
@@ -2,12 +2,12 @@
   "schemaVersion": 2,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
   "catalogDigest": "5473331e06ecd4bfafbf9b547d48b4fe1561ccf69d86fdfde51ea10dc919531c",
-  "commandCount": 660,
+  "commandCount": 667,
   "coverage": {
-    "commandCount": 660,
+    "commandCount": 667,
     "documentedCommandCount": 613,
-    "implementationCommandCount": 47,
-    "implementationDigest": "401fd0a5f64377e65573d1b0883fbfa844570096adfafd4c11a999d749ba5859"
+    "implementationCommandCount": 54,
+    "implementationDigest": "242daa957f208d78ed9ffcbb7e0694ef22f4c5569a0eeec4c50c985d4fb29ea8"
   },
   "commands": [
     {
@@ -5766,6 +5766,104 @@
       "signature": "fn miniapp_install_deps( state: State<'_, AppState>, app_id: String, ) -> Result<CoreInstallResult, String>",
       "remoteWorkspacePolicy": "LegacyUnaudited"
     },
+    {
+      "id": "miniapp_loopx_action",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_action",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_action( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxActionRequest, ) -> Result<LoopxActionResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_attach",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_attach",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_attach( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxAttachRequest, ) -> Result<LoopxAttachResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_create_task",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_create_task",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_create_task( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxCreateTaskRequest, ) -> Result<LoopxCreateTaskResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_events_since",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_events_since",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_events_since( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxEventsSinceRequest, ) -> Result<LoopxEventsSinceResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_list_models",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_list_models",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_list_models( app_state: State<'_, AppState>, request: MiniAppLoopxListModelsRequest, ) -> Result<Vec<MiniAppAiModelInfo>, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_resolve_intake",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_resolve_intake",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_resolve_intake( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxResolveIntakeRequest, ) -> Result<LoopxResolveIntakeResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
+    {
+      "id": "miniapp_loopx_turn_output_since",
+      "moduleId": "miniapp_loopx",
+      "capabilityId": "feature.miniapps",
+      "capabilityIds": [
+        "feature.miniapps"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::miniapp_loopx_api::miniapp_loopx_turn_output_since",
+      "sourceFile": "src/apps/desktop/src/api/miniapp_loopx_api.rs",
+      "signature": "fn miniapp_loopx_turn_output_since( app_state: State<'_, AppState>, controller: State<'_, LoopxControllerState>, request: MiniAppLoopxTurnOutputSinceRequest, ) -> Result<LoopxTurnOutputSinceResponse, String>",
+      "remoteWorkspacePolicy": "RemoteUnsupported"
+    },
     {
       "id": "miniapp_market_browse",
       "moduleId": "miniapp_market",

diff --git a/package.json b/package.json
@@ -92,6 +92,7 @@
     "verify:webkit-compatibility": "node scripts/verify-webkit-compatibility.cjs",
     "verify:webkit-compatibility:test": "node --test scripts/verify-webkit-compatibility.test.mjs",
     "build:web": "pnpm run appearance:contract-audit && node scripts/build-web-parallel.mjs && node scripts/generate-frontend-revision.mjs && pnpm run verify:monaco-assets && pnpm run verify:webkit-compatibility",
+    "build:loopx": "node scripts/build-loopx.mjs",
     "build:mobile-web": "pnpm --dir src/mobile-web build",
     "build:miniapp-market": "pnpm --dir src/miniapp-market-web build",
     "type-check:miniapp-market": "pnpm --dir src/miniapp-market-web type-check",