@casatwy/deyo 0.2.1 → 0.2.5

package/openclaw-skill-update.mjs

@@ -0,0 +1,794 @@
+import { constants as fsConstants } from 'node:fs'
+import { createHash, randomBytes } from 'node:crypto'
+import { spawn } from 'node:child_process'
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  rename,
+  rm,
+} from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+
+const DAY_MS = 24 * 60 * 60 * 1000
+const TIMEOUT_MS = 20_000
+const OWNER = 'casatwy'
+const SLUG = 'deyo'
+const REGISTRY = 'https://clawhub.ai'
+const OWNER_QUALIFIED_SKILL = `@${OWNER}/${SLUG}`
+export const CONFIRM_LATEST_PHRASE = `update ${OWNER_QUALIFIED_SKILL} to latest now`
+const UPDATED_EXIT_CODE = 10
+const CONFIRMATION_EXIT_CODE = 11
+const STABLE_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
+const PRIVATE_DIRECTORY_MODE = 0o700
+const PRIVATE_FILE_MODE = 0o600
+
+function normalizeOwner(value) {
+  return typeof value === 'string' ? value.trim().replace(/^@/, '').toLowerCase() : ''
+}
+
+function normalizeSlug(value) {
+  if (typeof value !== 'string') return ''
+  return value.trim().replace(/^@casatwy\//i, '').toLowerCase()
+}
+
+function compareSemver(left, right) {
+  if (!STABLE_SEMVER.test(left) || !STABLE_SEMVER.test(right)) return null
+  const a = left.split('.').map(Number)
+  const b = right.split('.').map(Number)
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] - b[index]
+  }
+  return 0
+}
+
+function absoluteConfiguredPath(name, value, fallback) {
+  const selected = String(value || fallback || '').trim()
+  if (!selected || !path.isAbsolute(selected)) {
+    throw new Error(`${name} must be an absolute path`)
+  }
+  return path.normalize(selected)
+}
+
+function homeDirectory(environment) {
+  return absoluteConfiguredPath(
+    'HOME',
+    environment.HOME || environment.USERPROFILE,
+    os.homedir(),
+  )
+}
+
+function openClawStateDirectory(environment) {
+  const home = homeDirectory(environment)
+  if (environment.OPENCLAW_STATE_DIR) {
+    return absoluteConfiguredPath('OPENCLAW_STATE_DIR', environment.OPENCLAW_STATE_DIR)
+  }
+  const openClawHome = absoluteConfiguredPath('OPENCLAW_HOME', environment.OPENCLAW_HOME, home)
+  return path.join(openClawHome, '.openclaw')
+}
+
+function configRoot(environment) {
+  return absoluteConfiguredPath(
+    'XDG_CONFIG_HOME',
+    environment.XDG_CONFIG_HOME,
+    path.join(homeDirectory(environment), '.config'),
+  )
+}
+
+function stateRoot(environment) {
+  return absoluteConfiguredPath(
+    'XDG_STATE_HOME',
+    environment.XDG_STATE_HOME,
+    path.join(homeDirectory(environment), '.local', 'state'),
+  )
+}
+
+export function resolveManagedOriginPath({ scope, cwd = process.cwd(), env = process.env }) {
+  if (scope === 'workspace') {
+    return path.resolve(cwd, 'skills', SLUG, '.clawhub', 'origin.json')
+  }
+  if (scope !== 'global') throw new Error('OpenClaw scope must be global or workspace')
+  return path.join(openClawStateDirectory(env), 'skills', SLUG, '.clawhub', 'origin.json')
+}
+
+function installIdentity(scope, originPath) {
+  return createHash('sha256')
+    .update(`${scope}\0${path.normalize(originPath)}`, 'utf8')
+    .digest('hex')
+}
+
+export function resolveOpenClawUpdatePaths({ scope, cwd = process.cwd(), env = process.env }) {
+  const originPath = resolveManagedOriginPath({ scope, cwd, env })
+  const identity = installIdentity(scope, originPath)
+  const enrollmentDirectory = path.join(configRoot(env), 'deyo', 'openclaw-skill-update')
+  const runtimeDirectory = path.join(stateRoot(env), 'deyo', 'openclaw-skill-update')
+  return {
+    identity,
+    originPath,
+    enrollmentDirectory,
+    enrollmentPath: path.join(enrollmentDirectory, `${identity}.json`),
+    runtimeDirectory,
+    runtimePath: path.join(runtimeDirectory, `${identity}.json`),
+    lockPath: path.join(runtimeDirectory, `${identity}.lock`),
+  }
+}
+
+async function pathLstat(target) {
+  try {
+    return await lstat(target)
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null
+    throw error
+  }
+}
+
+async function inspectPrivateJson(target) {
+  const directory = path.dirname(target)
+  const ownedRoot = path.dirname(directory)
+  const [directoryStats, ownedRootStats] = await Promise.all([
+    pathLstat(directory),
+    pathLstat(ownedRoot),
+  ])
+  if (!directoryStats) return { exists: false, safe: true, value: null }
+  if (
+    path.basename(ownedRoot) !== 'deyo'
+    || !ownedRootStats
+    || ownedRootStats.isSymbolicLink()
+    || !ownedRootStats.isDirectory()
+    || (ownedRootStats.mode & 0o077) !== 0
+    ||
+    directoryStats.isSymbolicLink()
+    || !directoryStats.isDirectory()
+    || (directoryStats.mode & 0o077) !== 0
+  ) {
+    return { exists: false, safe: false, value: null }
+  }
+  const stats = await pathLstat(target)
+  if (!stats) return { exists: false, safe: true, value: null }
+  if (stats.isSymbolicLink() || !stats.isFile() || (stats.mode & 0o077) !== 0) {
+    return { exists: true, safe: false, value: null }
+  }
+  try {
+    return { exists: true, safe: true, value: JSON.parse(await readFile(target, 'utf8')) }
+  } catch {
+    return { exists: true, safe: false, value: null }
+  }
+}
+
+async function ensurePrivateDirectory(target) {
+  const ownedParent = path.dirname(target)
+  const parentStats = await pathLstat(ownedParent)
+  if (
+    path.basename(ownedParent) === 'deyo'
+    && (parentStats?.isSymbolicLink() || (parentStats && !parentStats.isDirectory()))
+  ) {
+    throw new Error(`Unsafe private directory: ${ownedParent}`)
+  }
+  const existing = await pathLstat(target)
+  if (existing?.isSymbolicLink() || (existing && !existing.isDirectory())) {
+    throw new Error(`Unsafe private directory: ${target}`)
+  }
+  await mkdir(target, { recursive: true, mode: PRIVATE_DIRECTORY_MODE })
+  const createdParent = await lstat(ownedParent)
+  if (
+    path.basename(ownedParent) === 'deyo'
+    && (createdParent.isSymbolicLink() || !createdParent.isDirectory())
+  ) {
+    throw new Error(`Unsafe private directory: ${ownedParent}`)
+  }
+  if (path.basename(ownedParent) === 'deyo') await chmod(ownedParent, PRIVATE_DIRECTORY_MODE)
+  const created = await lstat(target)
+  if (created.isSymbolicLink() || !created.isDirectory()) {
+    throw new Error(`Unsafe private directory: ${target}`)
+  }
+  await chmod(target, PRIVATE_DIRECTORY_MODE)
+}
+
+async function syncDirectory(target) {
+  let handle
+  try {
+    handle = await open(target, 'r')
+    await handle.sync()
+  } catch {
+    // Directory fsync is not available on every supported platform.
+  } finally {
+    await handle?.close().catch(() => {})
+  }
+}
+
+async function writePrivateJson(target, value) {
+  const parent = path.dirname(target)
+  await ensurePrivateDirectory(parent)
+  const existing = await pathLstat(target)
+  if (existing?.isSymbolicLink() || (existing && !existing.isFile())) {
+    throw new Error(`Unsafe private state file: ${target}`)
+  }
+  const temporary = path.join(
+    parent,
+    `.${path.basename(target)}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`,
+  )
+  const handle = await open(temporary, 'wx', PRIVATE_FILE_MODE)
+  let temporaryExists = true
+  try {
+    try {
+      await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8')
+      await handle.sync()
+    } finally {
+      await handle.close()
+    }
+    await chmod(temporary, PRIVATE_FILE_MODE)
+    const rechecked = await pathLstat(target)
+    if (rechecked?.isSymbolicLink() || (rechecked && !rechecked.isFile())) {
+      throw new Error(`Unsafe private state file: ${target}`)
+    }
+    await rename(temporary, target)
+    temporaryExists = false
+    await chmod(target, PRIVATE_FILE_MODE)
+    await syncDirectory(parent)
+  } finally {
+    if (temporaryExists) await rm(temporary, { force: true })
+  }
+}
+
+async function acquireLock(lockPath) {
+  await ensurePrivateDirectory(path.dirname(lockPath))
+  try {
+    const handle = await open(
+      lockPath,
+      fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY,
+      PRIVATE_FILE_MODE,
+    )
+    await handle.writeFile(`${process.pid}\n`)
+    await handle.sync()
+    await chmod(lockPath, PRIVATE_FILE_MODE)
+    return handle
+  } catch (error) {
+    if (error?.code === 'EEXIST') return null
+    throw error
+  }
+}
+
+function validOrigin(raw, originPath) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null
+  const registry = typeof raw.registry === 'string' ? raw.registry.replace(/\/+$/, '') : ''
+  const ownerHandle = normalizeOwner(raw.ownerHandle)
+  const slug = normalizeSlug(raw.slug)
+  const version = raw.installedVersion
+  const fingerprint = raw.fingerprint
+  if (
+    raw.version !== 1
+    || registry !== REGISTRY
+    || ownerHandle !== OWNER
+    || slug !== SLUG
+    || typeof version !== 'string'
+    || !STABLE_SEMVER.test(version)
+    || !Number.isFinite(raw.installedAt)
+    || !/^[a-f0-9]{64}$/.test(fingerprint || '')
+  ) return null
+  return { originPath, registry, ownerHandle, slug, version, fingerprint }
+}
+
+export async function readManagedOrigin(originPath) {
+  try {
+    const skillDirectory = path.dirname(path.dirname(originPath))
+    const metadataDirectory = path.dirname(originPath)
+    const [skillStats, metadataStats, originStats] = await Promise.all([
+      lstat(skillDirectory),
+      lstat(metadataDirectory),
+      lstat(originPath),
+    ])
+    if (
+      skillStats.isSymbolicLink()
+      || !skillStats.isDirectory()
+      || metadataStats.isSymbolicLink()
+      || !metadataStats.isDirectory()
+      || originStats.isSymbolicLink()
+      || !originStats.isFile()
+    ) return { ok: false, reason: 'unsafe_origin', path: originPath }
+    const origin = validOrigin(JSON.parse(await readFile(originPath, 'utf8')), originPath)
+    return origin
+      ? { ok: true, ...origin }
+      : { ok: false, reason: 'invalid_origin', path: originPath }
+  } catch (error) {
+    return {
+      ok: false,
+      reason: error?.code === 'ENOENT' ? 'missing_origin' : 'unreadable_origin',
+      path: originPath,
+    }
+  }
+}
+
+function validEnrollment(value, { scope, identity, originPath }) {
+  return Boolean(
+    value
+    && value.schema === 1
+    && value.enabled === true
+    && value.scope === scope
+    && value.identity === identity
+    && value.originPath === originPath
+    && value.registry === REGISTRY
+    && normalizeOwner(value.ownerHandle) === OWNER
+    && normalizeSlug(value.slug) === SLUG
+    && typeof value.enrolledAt === 'string'
+    && typeof value.enrolledByCliVersion === 'string'
+  )
+}
+
+function validRuntime(value, identity) {
+  return Boolean(
+    value
+    && value.schema === 3
+    && value.identity === identity
+    && Number.isSafeInteger(value.attempt)
+    && value.attempt >= 0
+    && (value.lastAttemptAt === null || typeof value.lastAttemptAt === 'string')
+    && typeof value.status === 'string'
+  )
+}
+
+export function isDue(state, now = Date.now()) {
+  const lastAttempt = Date.parse(state?.lastAttemptAt ?? '')
+  return !Number.isFinite(lastAttempt) || now - lastAttempt >= DAY_MS
+}
+
+export function isAutoUpdateDisabled(environment = process.env) {
+  return environment.DEYO_OPENCLAW_AUTO_UPDATE === '0'
+}
+
+export function isVerificationClean(envelope, expectedInstalledVersion, selector = 'tag') {
+  const candidateVersion = envelope?.version
+  const installedVersion = envelope?.openclaw?.resolution?.installedVersion
+  const selectorMatches = selector === 'tag'
+    ? envelope?.resolvedFrom === 'tag' && envelope?.tag === 'latest'
+    : false
+  return envelope?.schema === 'clawhub.skill.verify.v1'
+    && normalizeOwner(envelope?.publisherHandle) === OWNER
+    && normalizeSlug(envelope?.slug) === SLUG
+    && typeof candidateVersion === 'string'
+    && STABLE_SEMVER.test(candidateVersion)
+    && selectorMatches
+    && envelope?.openclaw?.resolution?.source === 'installed'
+    && envelope?.openclaw?.resolution?.selector === selector
+    && installedVersion === expectedInstalledVersion
+    && compareSemver(candidateVersion, expectedInstalledVersion) >= 0
+    && envelope?.ok === true
+    && envelope?.decision === 'pass'
+    && envelope?.security?.passed === true
+    && envelope?.security?.status === 'clean'
+}
+
+export async function runWithDeadline(command, args, options = {}) {
+  const remainingMs = options.deadline - Date.now()
+  if (remainingMs <= 0) throw new Error('OpenClaw operation timed out')
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const stdout = []
+    const stderr = []
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      child.kill('SIGKILL')
+    }, remainingMs)
+    child.stdout.on('data', chunk => stdout.push(Buffer.from(chunk)))
+    child.stderr.on('data', chunk => stderr.push(Buffer.from(chunk)))
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      reject(error)
+    })
+    child.on('close', (code, signal) => {
+      clearTimeout(timer)
+      if (timedOut) {
+        reject(new Error('OpenClaw operation timed out'))
+        return
+      }
+      resolve({
+        code: code ?? 1,
+        signal: signal || null,
+        stdout: Buffer.concat(stdout).toString('utf8'),
+        stderr: Buffer.concat(stderr).toString('utf8'),
+      })
+    })
+  })
+}
+
+function baseRuntime(identity, attempt, attemptedAt, origin, status) {
+  return {
+    schema: 3,
+    identity,
+    lastAttemptAt: attemptedAt,
+    attempt,
+    status,
+    fromVersion: origin?.version ?? null,
+    fromFingerprint: origin?.fingerprint ?? null,
+    candidateVersion: null,
+    candidateVerifiedAt: null,
+    verificationDecision: null,
+    securityStatus: null,
+  }
+}
+
+function pendingRuntime(base, candidateVersion, verifiedAt) {
+  return {
+    ...base,
+    status: 'pending_confirmation',
+    candidateVersion,
+    candidateVerifiedAt: verifiedAt,
+    verificationDecision: 'pass',
+    securityStatus: 'clean',
+  }
+}
+
+async function readEnrollmentAndRuntime(paths, scope) {
+  const [enrollmentMetadata, runtimeMetadata] = await Promise.all([
+    inspectPrivateJson(paths.enrollmentPath),
+    inspectPrivateJson(paths.runtimePath),
+  ])
+  const enrollmentState = !enrollmentMetadata.exists
+    ? 'not_enrolled'
+    : enrollmentMetadata.safe && validEnrollment(enrollmentMetadata.value, {
+      scope,
+      identity: paths.identity,
+      originPath: paths.originPath,
+    })
+      ? 'enrolled'
+      : 'invalid'
+  const runtimeState = !runtimeMetadata.exists
+    ? 'missing'
+    : runtimeMetadata.safe && validRuntime(runtimeMetadata.value, paths.identity)
+      ? 'valid'
+      : 'invalid'
+  return {
+    enrollmentState,
+    enrollment: enrollmentState === 'enrolled' ? enrollmentMetadata.value : null,
+    runtimeState,
+    runtime: runtimeState === 'valid' ? runtimeMetadata.value : null,
+  }
+}
+
+export async function enrollOpenClawAutoUpdate({
+  scope,
+  cliVersion,
+  cwd = process.cwd(),
+  env = process.env,
+  now = Date.now(),
+}) {
+  process.umask(0o077)
+  const paths = resolveOpenClawUpdatePaths({ scope, cwd, env })
+  const origin = await readManagedOrigin(paths.originPath)
+  if (!origin.ok) throw new Error(`Cannot enroll an unverified OpenClaw origin: ${origin.reason}`)
+  await writePrivateJson(paths.runtimePath, {
+    ...baseRuntime(paths.identity, 0, null, origin, 'enrolled'),
+  })
+  await writePrivateJson(paths.enrollmentPath, {
+    schema: 1,
+    enabled: true,
+    identity: paths.identity,
+    scope,
+    originPath: paths.originPath,
+    registry: REGISTRY,
+    ownerHandle: OWNER,
+    slug: SLUG,
+    enrolledAt: new Date(now).toISOString(),
+    enrolledByCliVersion: cliVersion,
+    enrolledVersion: origin.version,
+    enrolledFingerprint: origin.fingerprint,
+  })
+  return {
+    state: 'enrolled',
+    enrollmentPath: paths.enrollmentPath,
+    runtimePath: paths.runtimePath,
+    version: origin.version,
+  }
+}
+
+export async function inspectOpenClawAutoUpdate({
+  scope,
+  cwd = process.cwd(),
+  env = process.env,
+}) {
+  try {
+    const paths = resolveOpenClawUpdatePaths({ scope, cwd, env })
+    const local = await readEnrollmentAndRuntime(paths, scope)
+    return {
+      enrollment: local.enrollmentState,
+      runtime: local.runtimeState,
+      lastAttemptAt: local.runtime?.lastAttemptAt ?? null,
+      status: local.runtime?.status ?? null,
+      fromVersion: local.runtime?.fromVersion ?? null,
+      fromFingerprint: local.runtime?.fromFingerprint ?? null,
+      candidateVersion: local.runtime?.candidateVersion ?? null,
+      candidateVerifiedAt: local.runtime?.candidateVerifiedAt ?? null,
+      reloadRequiredAt: local.runtime?.reloadRequiredAt ?? null,
+    }
+  } catch {
+    return {
+      enrollment: 'invalid',
+      runtime: 'invalid',
+      lastAttemptAt: null,
+      status: null,
+      fromVersion: null,
+      fromFingerprint: null,
+      candidateVersion: null,
+      candidateVerifiedAt: null,
+      reloadRequiredAt: null,
+    }
+  }
+}
+
+async function verifyLatest({ before, scope, cwd, env, deadline, run }) {
+  const scopeArgs = scope === 'global' ? ['--global'] : []
+  const verification = await run('openclaw', [
+    'skills', 'verify', OWNER_QUALIFIED_SKILL, '--tag', 'latest', ...scopeArgs,
+  ], { deadline, cwd, env })
+  if (verification.code !== 0) return { ok: false }
+  let envelope
+  try {
+    envelope = JSON.parse(verification.stdout)
+  } catch {
+    return { ok: false }
+  }
+  if (!isVerificationClean(envelope, before.version)) return { ok: false }
+  return { ok: true, envelope, candidateVersion: envelope.version }
+}
+
+export async function runOpenClawInvocationCheck({
+  scope,
+  cwd = process.cwd(),
+  env = process.env,
+  now = Date.now(),
+  run = runWithDeadline,
+}) {
+  if (isAutoUpdateDisabled(env)) return { exitCode: 0, status: 'disabled' }
+  process.umask(0o077)
+  let paths
+  try {
+    paths = resolveOpenClawUpdatePaths({ scope, cwd, env })
+    const local = await readEnrollmentAndRuntime(paths, scope)
+    if (local.enrollmentState !== 'enrolled') {
+      return { exitCode: 0, status: local.enrollmentState }
+    }
+    if (local.runtimeState === 'invalid') return { exitCode: 0, status: 'invalid_runtime' }
+    if (!isDue(local.runtime, now)) return { exitCode: 0, status: 'not_due' }
+  } catch {
+    return { exitCode: 0, status: 'state_unavailable' }
+  }
+
+  let lock
+  try {
+    lock = await acquireLock(paths.lockPath)
+  } catch {
+    return { exitCode: 0, status: 'state_unavailable' }
+  }
+  if (!lock) return { exitCode: 0, status: 'busy' }
+  try {
+    const local = await readEnrollmentAndRuntime(paths, scope)
+    if (local.enrollmentState !== 'enrolled') return { exitCode: 0, status: 'not_enrolled' }
+    if (local.runtimeState === 'invalid') return { exitCode: 0, status: 'invalid_runtime' }
+    if (!isDue(local.runtime, now)) return { exitCode: 0, status: 'not_due' }
+
+    const before = await readManagedOrigin(paths.originPath)
+    if (!before.ok) return { exitCode: 0, status: 'origin_unavailable' }
+    const attemptedAt = new Date(now).toISOString()
+    const attempt = (local.runtime?.attempt ?? 0) + 1
+    const base = baseRuntime(paths.identity, attempt, attemptedAt, before, 'attempting')
+    try {
+      await writePrivateJson(paths.runtimePath, base)
+    } catch {
+      return { exitCode: 0, status: 'state_unavailable' }
+    }
+
+    let verified
+    try {
+      verified = await verifyLatest({
+        before,
+        scope,
+        cwd,
+        env,
+        deadline: now + TIMEOUT_MS,
+        run,
+      })
+    } catch {
+      await writePrivateJson(paths.runtimePath, { ...base, status: 'verification_failed' }).catch(() => {})
+      return { exitCode: 0, status: 'verification_failed' }
+    }
+    if (!verified.ok) {
+      await writePrivateJson(paths.runtimePath, { ...base, status: 'verification_failed' }).catch(() => {})
+      return { exitCode: 0, status: 'verification_failed' }
+    }
+
+    if (compareSemver(verified.candidateVersion, before.version) === 0) {
+      await writePrivateJson(paths.runtimePath, {
+        ...base,
+        status: 'up_to_date',
+        candidateVersion: verified.candidateVersion,
+        candidateVerifiedAt: new Date().toISOString(),
+        verificationDecision: 'pass',
+        securityStatus: 'clean',
+      }).catch(() => {})
+      return { exitCode: 0, status: 'up_to_date' }
+    }
+
+    const candidateVerifiedAt = new Date().toISOString()
+    try {
+      await writePrivateJson(
+        paths.runtimePath,
+        pendingRuntime(base, verified.candidateVersion, candidateVerifiedAt),
+      )
+    } catch {
+      return { exitCode: 0, status: 'state_unavailable' }
+    }
+    return {
+      exitCode: CONFIRMATION_EXIT_CODE,
+      status: 'pending_confirmation',
+      fromVersion: before.version,
+      candidateVersion: verified.candidateVersion,
+      message: `Deyo Skill update available: ${OWNER_QUALIFIED_SKILL} ${before.version} -> ${verified.candidateVersion}; source=ClawHub owner=${OWNER}; security=pass/clean. Ask the current user: 是否现在更新Deyo到latest？`,
+    }
+  } catch {
+    return { exitCode: 0, status: 'check_failed' }
+  } finally {
+    await lock.close().catch(() => {})
+    await rm(paths.lockPath, { force: true })
+  }
+}
+
+export async function runOpenClawConfirmedUpdate({
+  scope,
+  confirmation,
+  cwd = process.cwd(),
+  env = process.env,
+  now = Date.now(),
+  run = runWithDeadline,
+}) {
+  if (confirmation !== CONFIRM_LATEST_PHRASE) {
+    return { exitCode: 1, status: 'confirmation_required' }
+  }
+  if (isAutoUpdateDisabled(env)) return { exitCode: 0, status: 'disabled' }
+  process.umask(0o077)
+  let paths
+  try {
+    paths = resolveOpenClawUpdatePaths({ scope, cwd, env })
+  } catch {
+    return { exitCode: 0, status: 'state_unavailable' }
+  }
+  let lock
+  try {
+    lock = await acquireLock(paths.lockPath)
+  } catch {
+    return { exitCode: 0, status: 'state_unavailable' }
+  }
+  if (!lock) return { exitCode: 0, status: 'busy' }
+  try {
+    const local = await readEnrollmentAndRuntime(paths, scope)
+    if (local.enrollmentState !== 'enrolled') return { exitCode: 0, status: 'not_enrolled' }
+    if (
+      local.runtimeState !== 'valid'
+      || local.runtime?.status !== 'pending_confirmation'
+      || !STABLE_SEMVER.test(local.runtime?.candidateVersion || '')
+      || !STABLE_SEMVER.test(local.runtime?.fromVersion || '')
+      || !/^[a-f0-9]{64}$/.test(local.runtime?.fromFingerprint || '')
+    ) return { exitCode: 0, status: 'confirmation_missing' }
+
+    const before = await readManagedOrigin(paths.originPath)
+    if (
+      !before.ok
+      || before.version !== local.runtime.fromVersion
+      || before.fingerprint !== local.runtime.fromFingerprint
+    ) {
+      return {
+        exitCode: UPDATED_EXIT_CODE,
+        status: before.ok ? 'origin_changed' : 'origin_indeterminate',
+        message: 'Deyo Skill origin changed or became unreadable after confirmation; invoke /deyo again before transcription.',
+      }
+    }
+
+    const deadline = now + TIMEOUT_MS
+    let verified
+    try {
+      verified = await verifyLatest({ before, scope, cwd, env, deadline, run })
+    } catch {
+      return { exitCode: 0, status: 'verification_failed' }
+    }
+    if (!verified.ok) return { exitCode: 0, status: 'verification_failed' }
+    if (verified.candidateVersion !== local.runtime.candidateVersion) {
+      const refreshed = pendingRuntime(
+        baseRuntime(
+          paths.identity,
+          local.runtime.attempt + 1,
+          new Date(now).toISOString(),
+          before,
+          'pending_confirmation',
+        ),
+        verified.candidateVersion,
+        new Date().toISOString(),
+      )
+      try {
+        await writePrivateJson(paths.runtimePath, refreshed)
+      } catch {
+        return { exitCode: 0, status: 'state_unavailable' }
+      }
+      return {
+        exitCode: CONFIRMATION_EXIT_CODE,
+        status: 'confirmation_stale',
+        fromVersion: before.version,
+        candidateVersion: verified.candidateVersion,
+        message: `Deyo Skill latest candidate changed to ${verified.candidateVersion}; source=ClawHub owner=${OWNER}; security=pass/clean. Ask the current user again: 是否现在更新Deyo到latest？`,
+      }
+    }
+
+    const scopeArgs = scope === 'global' ? ['--global'] : []
+    let update
+    let indeterminate = false
+    try {
+      update = await run('openclaw', [
+        'skills', 'update', OWNER_QUALIFIED_SKILL, ...scopeArgs,
+      ], { deadline, cwd, env })
+    } catch {
+      indeterminate = true
+    }
+
+    const after = await readManagedOrigin(paths.originPath)
+    const changed = after.ok && (
+      after.version !== before.version || after.fingerprint !== before.fingerprint
+    )
+    const knownFailureUnchanged = !indeterminate && after.ok && !changed && update?.code !== 0
+    const reloadRequired = !knownFailureUnchanged
+    const status = indeterminate || !after.ok
+      ? 'update_indeterminate'
+      : changed
+        ? after.version === verified.candidateVersion ? 'updated' : 'updated_other_trusted'
+        : update?.code === 0 ? 'update_indeterminate' : 'update_failed'
+    const finalState = {
+      ...baseRuntime(
+        paths.identity,
+        local.runtime.attempt + 1,
+        new Date(now).toISOString(),
+        before,
+        status,
+      ),
+      status,
+      candidateVersion: verified.candidateVersion,
+      candidateVerifiedAt: new Date().toISOString(),
+      verificationDecision: 'pass',
+      securityStatus: 'clean',
+      toVersion: after.ok ? after.version : null,
+      toFingerprint: after.ok ? after.fingerprint : null,
+      ...(reloadRequired ? { reloadRequiredAt: new Date().toISOString() } : {}),
+    }
+    try {
+      await writePrivateJson(paths.runtimePath, finalState)
+    } catch {
+      if (!reloadRequired) return { exitCode: 0, status: 'state_unavailable' }
+    }
+    if (reloadRequired) {
+      return {
+        exitCode: UPDATED_EXIT_CODE,
+        status,
+        fromVersion: before.version,
+        toVersion: after.ok ? after.version : null,
+        message: 'Deyo Skill may have changed; invoke Deyo again to load or re-check the active version.',
+      }
+    }
+    return { exitCode: 0, status, fromVersion: before.version, toVersion: before.version }
+  } catch {
+    return { exitCode: 0, status: 'update_failed' }
+  } finally {
+    await lock.close().catch(() => {})
+    await rm(paths.lockPath, { force: true })
+  }
+}
+
+export const __test = {
+  CONFIRM_LATEST_PHRASE,
+  CONFIRMATION_EXIT_CODE,
+  OWNER_QUALIFIED_SKILL,
+  UPDATED_EXIT_CODE,
+  writePrivateJson,
+}