From aa7b67fc2bdc1329ea027bb1c1150e9dad54fc0c Mon Sep 17 00:00:00 2001
From: mohe <mohe@yoin.fun>
Date: Sun, 21 Jun 2026 10:40:47 +0800
Subject: [PATCH] readonly: discard LLM response, never send; default=readonly
 for non-coordinator

---
 xmpp_agent_core.py | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/xmpp_agent_core.py b/xmpp_agent_core.py
index 878da1a..5b8c7ab 100644
--- a/xmpp_agent_core.py
+++ b/xmpp_agent_core.py
@@ -188,10 +188,42 @@ class AgentBot(ClientXMPP):
 
             room = sender.split('/')[0]
 
-            # 4. 被 REVOKE 的人：只读模式
+            # 4. 判断权限：协调者/被授权者可发言，其他人只读
+            if not _is_coordinator and not _is_granted:
+                _rr = sender.split('/')[0]
+                _ro_body = f"【只读消息】你目前不是协调者，只需了解内容。\n\n[核心群 {_rr}] {nickname} 说: {body}"
+                try:
+                    _ro_payload = json.dumps({
+                        "model": "hermes-agent",
+                        "messages": [{"role": "user", "content": _ro_body}]
+                    }).encode()
+                    _ro_req = urllib.request.Request(GATEWAY, data=_ro_payload, method="POST")
+                    _ro_req.add_header("Content-Type", "application/json")
+                    _ro_req.add_header("Authorization", f"Bearer {API_KEY}")
+                    _ro_req.add_header("X-Hermes-Session-Id", SESSION_ID)
+                    _ro_loop = asyncio.get_event_loop()
+                    await _ro_loop.run_in_executor(None, lambda: _opener.open(_ro_req, timeout=30))
+                except Exception:
+                    pass
+                return  # 不发送任何回复
+
+            # 5. 被 REVOKE 的人：只读（虽然上面已经覆盖了，作为额外保障）
             if time.time() < getattr(self, '_revoked_until', 0):
-                _readonly = f"【只读消息】你目前被收回发言权。只需了解内容。输出 __SILENT__。\n\n[核心群 {room}] {nickname} 说: {body}"
-                await self.call_hermes(_readonly, sender, is_group=True)
+                _rr2 = sender.split('/')[0]
+                _rv_body = f"【只读消息】你目前被收回发言权。只需了解内容。\n\n[核心群 {_rr2}] {nickname} 说: {body}"
+                try:
+                    _rv_payload = json.dumps({
+                        "model": "hermes-agent",
+                        "messages": [{"role": "user", "content": _rv_body}]
+                    }).encode()
+                    _rv_req = urllib.request.Request(GATEWAY, data=_rv_payload, method="POST")
+                    _rv_req.add_header("Content-Type", "application/json")
+                    _rv_req.add_header("Authorization", f"Bearer {API_KEY}")
+                    _rv_req.add_header("X-Hermes-Session-Id", SESSION_ID)
+                    _rv_loop = asyncio.get_event_loop()
+                    await _rv_loop.run_in_executor(None, lambda: _opener.open(_rv_req, timeout=30))
+                except Exception:
+                    pass
                 return
 
             # 硬闭嘴闸门：hmo 说闭嘴类的话 → 静默 5 分钟