@dai_ming/plugin-deliverables 1.0.20 → 1.0.22

package/INSTALL.md

@@ -1,6 +1,6 @@
 # plugin-deliverables 安装文档
 
-本文档描述 `@dai_ming/plugin-deliverables@1.0.16` 的安装、升级与验证方式。
+本文档描述 `@dai_ming/plugin-deliverables@1.0.22` 的安装、升级与验证方式。
 
 ## 1. 目标
 
@@ -22,7 +22,7 @@
 适用于已经支持 `openclaw plugins install` 的运行环境。
 
 ```bash
-openclaw plugins install @dai_ming/plugin-deliverables@1.0.16 --pin
+openclaw plugins install @dai_ming/plugin-deliverables@1.0.22 --pin
 openclaw plugins enable plugin-deliverables
 ```
 
@@ -47,7 +47,7 @@ openclaw plugins list
 
 ```yaml
 installPlugins:
-  - "@dai_ming/plugin-deliverables@1.0.16"
+  - "@dai_ming/plugin-deliverables@1.0.22"
 ```
 
 Helm 初始化时会自动完成：
@@ -66,8 +66,8 @@ Helm 初始化时会自动完成：
 ```bash
 mkdir -p /home/node/.openclaw/extensions-extra/plugin-deliverables
 cd /tmp
-npm pack @dai_ming/plugin-deliverables@1.0.16 --registry https://registry.npmjs.org
-tar xzf dai_ming-plugin-deliverables-1.0.16.tgz \
+npm pack @dai_ming/plugin-deliverables@1.0.22 --registry https://registry.npmjs.org
+tar xzf dai_ming-plugin-deliverables-1.0.22.tgz \
   -C /home/node/.openclaw/extensions-extra/plugin-deliverables \
   --strip-components=1
 ```
@@ -212,5 +212,5 @@ cat /home/node/.openclaw/extensions-extra/plugin-deliverables/package.json
 必须是：
 
 ```json
-{ "version": "1.0.16" }
+{ "version": "1.0.22" }
 ```

package/README.md

@@ -24,17 +24,18 @@ OpenClaw 交付物插件 — 让 AI Agent 将生成的文件（文章、HTML 页
 现在这个包同时支持 OpenClaw 原生插件加载。也就是说，除了网关侧用 `openclaw-plugin.json` 注入 MCP/skill/AGENTS 规则外，OpenClaw 还会读取 `openclaw.plugin.json` + `index.js`，把运行时 hook 也一并启用。
 
 ```bash
-openclaw plugins install @dai_ming/plugin-deliverables@1.0.16 --pin
+openclaw plugins install @dai_ming/plugin-deliverables@1.0.22 --pin
 openclaw plugins enable plugin-deliverables
 ```
 
 这一步启用后，插件会额外提供三层兜底：
 
 1. `before_prompt_build`：把“交付物必须 upload-first”的硬规则注入到主 agent 和子 agent 的系统上下文
-2. `before_tool_call`：阻止通过 `message` 附件字段直接发文件
-3. `message_sending`：如果仍然有媒体/文件旁路发送，最终发送前直接取消
+2. `before_tool_call`：记录 `write` 生成的工作区文件，并阻止通过 `message` 附件字段直接发文件
+3. Palz 出站补丁：最终消息发送前扫描内部工作区路径/近期写入文件，自动上传为交付物并改写成 gateway 链接
+4. `message_sending`：如果仍然有媒体/文件旁路发送，最终发送前直接取消
 
-> 注意：`message_sending` 只能改文本或取消发送，不能自动把错误发送重写成 `upload_deliverable`。所以它的职责是“兜底阻断”，不是“自动修正”。
+> 注意：非 Palz 渠道仍以 `before_prompt_build` + `before_tool_call` + `message_sending` 兜底为主；Palz 渠道具备自动上传和文本改写能力。
 
 ### 方式一：通过 claw-gateway Helm 部署（推荐）
 
@@ -43,11 +44,11 @@ openclaw plugins enable plugin-deliverables
 ```yaml
 # values.yaml（或 claw-gateway 管理界面的 Helm 参数）
 installPlugins:
-  - "@dai_ming/plugin-deliverables@1.0.16"
+  - "@dai_ming/plugin-deliverables@1.0.22"
 ```
 
 initContainer 执行顺序：
-1. **Phase 3**：`npm pack @dai_ming/plugin-deliverables@1.0.16` 下载 tarball → 解压到 `/data/extensions-extra/plugin-deliverables/`
+1. **Phase 3**：`npm pack @dai_ming/plugin-deliverables@1.0.22` 下载 tarball → 解压到 `/data/extensions-extra/plugin-deliverables/`
 2. **Phase 3b**：在插件目录执行 `npm install --omit=dev`（本插件无运行时依赖，此步骤跳过）
 3. **Phase 3e**：读取 `openclaw-plugin.json` 清单，自动：
    - 复制 `mcp-servers/deliverables.js` → `/data/mcp-servers/deliverables.js`
@@ -197,10 +198,11 @@ fi
 | Hook | 作用 |
 |------|------|
 | `before_prompt_build` | 把“生成文件必须走交付物上传”的硬规则注入系统上下文，覆盖主 agent 和子 agent |
-| `before_tool_call` | 阻止通过 `message` 工具的 `media/path/filePath/buffer` 等字段直接发送文件 |
+| `before_tool_call` | 记录 `write` 生成的工作区文件；阻止通过 `message` 工具的 `media/path/filePath/buffer` 等字段直接发送文件 |
+| Palz 出站补丁 | 扫描最终消息中的 `/data/workspace-*`、`output/*.ext`、反引号文件名等工作区文件引用，自动上传后替换为交付物链接 |
 | `message_sending` | 如果上游仍然产生了媒体/文件旁路发送，在最终出站前直接取消 |
 
-这三层一起工作的目标是：即使 prompt 漂移，也尽量把“message + file/media”这条旁路堵住，统一收敛到 `deliverables__upload_deliverable`。
+这些兜底一起工作的目标是：即使 prompt 漂移，也尽量把“工作区路径 / message + file/media”这类旁路堵住，统一收敛到 gateway 交付物链接。
 
 另外，Palz 渠道下如果交付物回复包含可信 gateway 交付物链接，会被拆成“内容简介 + 最终链接”两条消息；任意外部 URL 或非 gateway OSS URL 不会被包装成 `file_url` 文件消息。runtime plugin 还会分别打印这两次真实 HTTP 发送的 request/response 日志，便于直接从 pod stdout 排查。
 
@@ -224,7 +226,7 @@ npm publish --registry https://registry.npmjs.org --access public
 
 | claw-gateway 版本 | plugin 版本 |
 |-------------------|-------------|
-| 当前              | 1.0.16      |
+| 当前              | 1.0.22      |
 
 ---
 

package/index.js

@@ -1,16 +1,76 @@
 "use strict";
 
+const fs = require("fs");
+const http = require("http");
+const https = require("https");
+const path = require("path");
+
 const FETCH_PATCH_KEY = "__plugin_deliverables_palz_fetch_patch__";
 const SUMMARY_CACHE_KEY = "__plugin_deliverables_summary_cache__";
+const PENDING_FILES_KEY = "__plugin_deliverables_pending_files__";
+const UPLOAD_CACHE_KEY = "__plugin_deliverables_upload_cache__";
 const SUMMARY_CACHE_LIMIT = 200;
 const SHORT_SUMMARY_THRESHOLD = 120;
 const DEFAULT_GATEWAY_PUBLIC_URL = "https://claw-gateway.csagentai.com";
 const DEFAULT_GATEWAY_INTERNAL_URL = "http://claw-gateway:8080";
+const AUTO_UPLOAD_TTL_MS = 15 * 60 * 1000;
+const AUTO_UPLOAD_MAX_FILES = 8;
+const AUTO_UPLOAD_MAX_BYTES = 200 * 1024 * 1024;
+const AUTO_UPLOAD_SCAN_MAX_ENTRIES = 4000;
+const AUTO_UPLOAD_SCAN_DEPTH = 5;
 const DELIVERABLE_GATEWAY_PATH_RE = /^\/openclaw-gateway\/(?:output|preview)(?:\/|$)/u;
 const DELIVERABLE_LINK_PREFIX_RE =
   /^\s*(?:[-*+]\s+)?(?:预览链接|下载链接|文件列表|项目入口|在线预览|在线体验|目录链接)\s*[:：]/u;
 const DELIVERABLE_LINK_LABEL_RE =
   /^\s*(?:[-*+]\s+)?(?:预览链接|下载链接|文件列表|项目入口|在线预览|在线体验|目录链接)\s*[:：]\s*\[[^\]]+\]\([^)]+\)\s*$/u;
+const INTERNAL_ABSOLUTE_PATH_RE =
+  /(?:\/data\/workspace-[^\s`"'<>，。；：、)）\]}]+|\/home\/node\/\.openclaw\/workspace(?:-[A-Za-z0-9_.-]+)?\/[^\s`"'<>，。；：、)）\]}]+)/gu;
+const INLINE_FILE_REF_RE = /`([^`\n]{1,512}\.[A-Za-z0-9]{1,16})`/gu;
+const OUTPUT_RELATIVE_REF_RE = /(?:^|[\s(:：])((?:\.\/)?output\/[^\s`"'<>，。；：、)）\]}]+\.[A-Za-z0-9]{1,16})/gu;
+const FILE_EXTENSION_RE = /\.[A-Za-z0-9]{1,16}$/u;
+const TEXT_EXTENSIONS = new Set([
+  ".css",
+  ".csv",
+  ".html",
+  ".htm",
+  ".js",
+  ".json",
+  ".jsx",
+  ".log",
+  ".md",
+  ".markdown",
+  ".mjs",
+  ".py",
+  ".sql",
+  ".svg",
+  ".ts",
+  ".tsx",
+  ".txt",
+  ".xml",
+  ".yaml",
+  ".yml",
+]);
+const IMAGE_EXTENSIONS = new Set([".apng", ".avif", ".bmp", ".gif", ".ico", ".jpeg", ".jpg", ".png", ".svg", ".webp"]);
+const VIDEO_EXTENSIONS = new Set([".avi", ".m4v", ".mkv", ".mov", ".mp4", ".mpeg", ".mpg", ".webm"]);
+const PPT_EXTENSIONS = new Set([".ppt", ".pptx"]);
+const ARCHIVE_EXTENSIONS = new Set([".7z", ".gz", ".rar", ".tar", ".tgz", ".zip"]);
+const IGNORED_PATH_PARTS = new Set([
+  ".git",
+  ".hg",
+  ".svn",
+  "node_modules",
+  "sessions",
+  "skills",
+  ".cache",
+  "__pycache__",
+]);
+const IGNORED_FILE_NAMES = new Set([
+  "AGENTS.md",
+  "SOUL.md",
+  "openclaw.json",
+  "openclaw-runtime.json",
+  "package-lock.json",
+]);
 
 const RUNTIME_DELIVERABLES_GUIDANCE = [
   "## Deliverables Runtime Guard (HARD CONSTRAINT)",
@@ -29,6 +89,648 @@ function isString(value) {
   return typeof value === "string";
 }
 
+function trimString(value) {
+  return isString(value) ? value.trim() : "";
+}
+
+function getPendingFileStore() {
+  if (!globalThis[PENDING_FILES_KEY] || !(globalThis[PENDING_FILES_KEY] instanceof Map)) {
+    globalThis[PENDING_FILES_KEY] = new Map();
+  }
+  return globalThis[PENDING_FILES_KEY];
+}
+
+function getUploadCache() {
+  if (!globalThis[UPLOAD_CACHE_KEY] || !(globalThis[UPLOAD_CACHE_KEY] instanceof Map)) {
+    globalThis[UPLOAD_CACHE_KEY] = new Map();
+  }
+  return globalThis[UPLOAD_CACHE_KEY];
+}
+
+function pruneTimedMap(map, ttlMs) {
+  const now = Date.now();
+  for (const [key, value] of map.entries()) {
+    if (!value || !value.createdAt || now - Number(value.createdAt) > ttlMs) {
+      map.delete(key);
+    }
+  }
+}
+
+function normalizeSlash(value) {
+  return String(value || "").replace(/\\/g, "/");
+}
+
+function stripTrailingPathPunctuation(value) {
+  return String(value || "").replace(/[.,;:!?，。；：！？、)）\]}》】]+$/u, "");
+}
+
+function hasFileExtension(value) {
+  return FILE_EXTENSION_RE.test(path.basename(stripTrailingPathPunctuation(value)));
+}
+
+function isURLLike(value) {
+  return /^[a-z][a-z0-9+.-]*:\/\//i.test(String(value || ""));
+}
+
+function fileExtension(filePath) {
+  return path.extname(stripTrailingPathPunctuation(filePath)).toLowerCase();
+}
+
+function isTextLikeFile(filePath) {
+  return TEXT_EXTENSIONS.has(fileExtension(filePath));
+}
+
+function deliverableTypeForPath(filePath, isDirectory) {
+  if (isDirectory) {
+    return "game";
+  }
+  const ext = fileExtension(filePath);
+  if (IMAGE_EXTENSIONS.has(ext) && ext !== ".svg") {
+    return "image";
+  }
+  if (VIDEO_EXTENSIONS.has(ext)) {
+    return "video";
+  }
+  if (PPT_EXTENSIONS.has(ext)) {
+    return "ppt";
+  }
+  if (ARCHIVE_EXTENSIONS.has(ext)) {
+    return "zip";
+  }
+  return "article";
+}
+
+function isAllowedWorkspacePath(candidatePath) {
+  const normalized = normalizeSlash(path.resolve(candidatePath));
+  return (
+    normalized.indexOf("/data/workspace-") === 0 ||
+    normalized.indexOf("/home/node/.openclaw/workspace") === 0
+  );
+}
+
+function shouldIgnorePath(candidatePath) {
+  const normalized = normalizeSlash(candidatePath);
+  const parts = normalized.split("/").filter(Boolean);
+  for (const part of parts) {
+    if (IGNORED_PATH_PARTS.has(part)) {
+      return true;
+    }
+  }
+  return IGNORED_FILE_NAMES.has(path.basename(normalized));
+}
+
+function safeStat(candidatePath) {
+  try {
+    return fs.statSync(candidatePath);
+  } catch (_err) {
+    return null;
+  }
+}
+
+function workspaceRoots() {
+  const roots = [];
+  ["/home/node/.openclaw/workspace-main", "/home/node/.openclaw/workspace"].forEach((root) => {
+    if (safeStat(root)) {
+      roots.push(root);
+    }
+  });
+  try {
+    for (const entry of fs.readdirSync("/data")) {
+      if (!entry || entry.indexOf("workspace-") !== 0) {
+        continue;
+      }
+      const root = path.join("/data", entry);
+      if (safeStat(root)) {
+        roots.push(root);
+      }
+    }
+  } catch (_err) {
+    // /data is not guaranteed in non-pod test environments.
+  }
+  return roots;
+}
+
+function resolveCandidatePath(rawPath) {
+  const cleaned = stripTrailingPathPunctuation(trimString(rawPath));
+  if (!cleaned || isURLLike(cleaned)) {
+    return "";
+  }
+  if (path.isAbsolute(cleaned)) {
+    return path.resolve(cleaned);
+  }
+  return cleaned;
+}
+
+function findFileByRelativeOrBaseName(rawRef) {
+  const cleaned = stripTrailingPathPunctuation(trimString(rawRef)).replace(/^\.\//, "");
+  if (!cleaned || isURLLike(cleaned) || !hasFileExtension(cleaned)) {
+    return "";
+  }
+  const roots = workspaceRoots();
+  const directCandidates = [];
+  for (const root of roots) {
+    directCandidates.push(path.join(root, cleaned));
+    directCandidates.push(path.join(root, "output", cleaned));
+    directCandidates.push(path.join(root, path.basename(cleaned)));
+    directCandidates.push(path.join(root, "output", path.basename(cleaned)));
+  }
+  for (const candidate of directCandidates) {
+    const stat = safeStat(candidate);
+    if (stat && (stat.isFile() || stat.isDirectory()) && isAllowedWorkspacePath(candidate) && !shouldIgnorePath(candidate)) {
+      return path.resolve(candidate);
+    }
+  }
+
+  const basename = path.basename(cleaned);
+  const found = [];
+  let visited = 0;
+  function scan(dir, depth) {
+    if (depth < 0 || visited > AUTO_UPLOAD_SCAN_MAX_ENTRIES || shouldIgnorePath(dir)) {
+      return;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch (_err) {
+      return;
+    }
+    for (const entry of entries) {
+      if (visited > AUTO_UPLOAD_SCAN_MAX_ENTRIES) {
+        return;
+      }
+      visited += 1;
+      const full = path.join(dir, entry.name);
+      if (shouldIgnorePath(full)) {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        scan(full, depth - 1);
+        continue;
+      }
+      if (entry.isFile() && entry.name === basename) {
+        const stat = safeStat(full);
+        if (stat) {
+          found.push({ path: full, mtimeMs: stat.mtimeMs });
+        }
+      }
+    }
+  }
+  for (const root of roots) {
+    scan(root, AUTO_UPLOAD_SCAN_DEPTH);
+  }
+  found.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return found.length > 0 ? path.resolve(found[0].path) : "";
+}
+
+function extractFileReferencesFromText(text) {
+  const normalized = String(text || "");
+  const refs = [];
+  const seen = new Set();
+  function add(raw, value, kind) {
+    const cleaned = stripTrailingPathPunctuation(value);
+    if (!cleaned || isURLLike(cleaned)) {
+      return;
+    }
+    const key = `${kind}:${cleaned}`;
+    if (seen.has(key)) {
+      return;
+    }
+    seen.add(key);
+    refs.push({ raw, value: cleaned, kind });
+  }
+
+  for (const match of normalized.matchAll(INTERNAL_ABSOLUTE_PATH_RE)) {
+    add(match[0], match[0], "absolute");
+  }
+  for (const match of normalized.matchAll(INLINE_FILE_REF_RE)) {
+    add(match[0], match[1], "inline");
+  }
+  for (const match of normalized.matchAll(OUTPUT_RELATIVE_REF_RE)) {
+    add(match[1], match[1], "relative");
+  }
+  return refs;
+}
+
+function resolveFileReference(ref) {
+  if (!ref || !ref.value) {
+    return null;
+  }
+  const candidate = resolveCandidatePath(ref.value);
+  const resolved = path.isAbsolute(candidate) ? candidate : findFileByRelativeOrBaseName(candidate);
+  if (!resolved) {
+    return null;
+  }
+  const stat = safeStat(resolved);
+  if (!stat || (!stat.isFile() && !stat.isDirectory())) {
+    return null;
+  }
+  if (!isAllowedWorkspacePath(resolved) || shouldIgnorePath(resolved)) {
+    return null;
+  }
+  return {
+    raw: ref.raw,
+    path: resolved,
+    fileName: path.basename(resolved),
+    isDirectory: stat.isDirectory(),
+    size: stat.isDirectory() ? 0 : stat.size,
+    mtimeMs: stat.mtimeMs,
+  };
+}
+
+function collectDirectoryFiles(dirPath) {
+  const files = [];
+  let total = 0;
+  let visited = 0;
+  function scan(current, depth) {
+    if (depth < 0 || visited > AUTO_UPLOAD_SCAN_MAX_ENTRIES || shouldIgnorePath(current)) {
+      return;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(current, { withFileTypes: true });
+    } catch (_err) {
+      return;
+    }
+    for (const entry of entries) {
+      if (visited > AUTO_UPLOAD_SCAN_MAX_ENTRIES || files.length >= AUTO_UPLOAD_MAX_FILES * 50) {
+        return;
+      }
+      visited += 1;
+      const full = path.join(current, entry.name);
+      if (shouldIgnorePath(full)) {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        scan(full, depth - 1);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      const stat = safeStat(full);
+      if (!stat || total + stat.size > AUTO_UPLOAD_MAX_BYTES) {
+        continue;
+      }
+      total += stat.size;
+      const rel = normalizeSlash(path.relative(dirPath, full));
+      if (isTextLikeFile(full)) {
+        files.push({ name: rel, contentText: fs.readFileSync(full, "utf8") });
+      } else {
+        files.push({ name: rel, contentBase64: fs.readFileSync(full).toString("base64") });
+      }
+    }
+  }
+  scan(dirPath, AUTO_UPLOAD_SCAN_DEPTH);
+  return files;
+}
+
+function extractStringField(obj, keys) {
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
+    return "";
+  }
+  for (const key of keys) {
+    const value = obj[key];
+    if (isString(value) && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+
+function extractContextString(event, keys) {
+  const direct = extractStringField(event, keys);
+  if (direct) {
+    return direct;
+  }
+  const containers = [
+    event && event.params,
+    event && event.metadata,
+    event && event.context,
+    event && event.ctx,
+    event && event.message,
+  ];
+  for (const container of containers) {
+    const value = extractStringField(container, keys);
+    if (value) {
+      return value;
+    }
+  }
+  return "";
+}
+
+function payloadResourceId(body) {
+  return extractStringField(body, ["resource_id", "resourceId", "conversation_id", "conversationId"]);
+}
+
+function payloadGroupId(body) {
+  return extractStringField(body, ["group_id", "groupId", "conversation_id", "conversationId"]);
+}
+
+function payloadUserId(body) {
+  return extractStringField(body, ["user_id", "userId", "sender_id", "senderId", "owner_id", "ownerId"]);
+}
+
+function isWriteTool(toolName) {
+  const normalized = normalizeToolName(toolName);
+  return normalized === "write" || normalized.endsWith("__write") || normalized === "write_file" || normalized.endsWith("__write_file");
+}
+
+function extractWritePath(params) {
+  if (!params || typeof params !== "object" || Array.isArray(params)) {
+    return "";
+  }
+  return extractStringField(params, [
+    "path",
+    "file_path",
+    "filePath",
+    "filename",
+    "fileName",
+    "target",
+    "target_path",
+    "targetPath",
+    "destination",
+  ]);
+}
+
+function rememberPendingFile(event) {
+  const params = event && event.params;
+  const writePath = extractWritePath(params);
+  if (!writePath || isURLLike(writePath)) {
+    return;
+  }
+  const store = getPendingFileStore();
+  pruneTimedMap(store, AUTO_UPLOAD_TTL_MS);
+  const resourceId = extractContextString(event, ["resource_id", "resourceId", "conversation_id", "conversationId"]);
+  const key = `${resourceId || "unknown"}:${writePath}`;
+  store.set(key, {
+    path: writePath,
+    resourceId,
+    createdAt: Date.now(),
+  });
+}
+
+function pendingCandidatesForPayload(body) {
+  const resourceId = payloadResourceId(body);
+  if (!resourceId) {
+    return [];
+  }
+  const store = getPendingFileStore();
+  pruneTimedMap(store, AUTO_UPLOAD_TTL_MS);
+  const out = [];
+  for (const entry of store.values()) {
+    if (!entry || entry.resourceId !== resourceId) {
+      continue;
+    }
+    const ref = { raw: entry.path, value: entry.path, kind: "pending" };
+    const resolved = resolveFileReference(ref);
+    if (resolved) {
+      out.push(resolved);
+    }
+  }
+  return out;
+}
+
+function gatewayURL() {
+  return (process.env.CLAW_GATEWAY_URL || DEFAULT_GATEWAY_INTERNAL_URL).replace(/\/$/, "");
+}
+
+function gatewayPublicURL() {
+  return (process.env.CLAW_GATEWAY_PUBLIC_URL || process.env.CLAW_GATEWAY_URL || DEFAULT_GATEWAY_PUBLIC_URL).replace(/\/$/, "");
+}
+
+function apiKey() {
+  return process.env.CLAW_GATEWAY_API_KEY || process.env.OPENCLAW_GATEWAY_API_KEY || "api-key-1";
+}
+
+function deriveReleaseName() {
+  let release = process.env.botID || process.env.OPENCLAW_RELEASE || process.env.BOT_ID || "";
+  if (!release) {
+    const tok = process.env.OPENCLAW_GATEWAY_TOKEN || "";
+    if (tok.indexOf("oc-") === 0) {
+      release = tok.slice(3);
+    }
+  }
+  return release;
+}
+
+function httpJSONRequest(method, requestPath, body) {
+  return new Promise((resolve, reject) => {
+    let parsed;
+    try {
+      parsed = new URL(gatewayURL() + requestPath);
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    const isHTTPS = parsed.protocol === "https:";
+    const transport = isHTTPS ? https : http;
+    const bodyStr = body ? JSON.stringify(body) : "";
+    const req = transport.request(
+      {
+        hostname: parsed.hostname,
+        port: parsed.port || (isHTTPS ? 443 : 80),
+        path: parsed.pathname + (parsed.search || ""),
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          "X-API-Key": apiKey(),
+          "Content-Length": Buffer.byteLength(bodyStr),
+        },
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf8");
+          let obj;
+          try {
+            obj = JSON.parse(text);
+          } catch (_err) {
+            reject(new Error(`gateway ${res.statusCode}: non-JSON response: ${text.slice(0, 200)}`));
+            return;
+          }
+          if (res.statusCode >= 400) {
+            reject(new Error(`gateway ${res.statusCode}: ${obj.message || text.slice(0, 200)}`));
+            return;
+          }
+          resolve(obj);
+        });
+      },
+    );
+    req.on("error", reject);
+    if (bodyStr) {
+      req.write(bodyStr);
+    }
+    req.end();
+  });
+}
+
+function uploadCacheKey(candidate, resourceId) {
+  return `${resourceId || ""}:${candidate.path}:${candidate.mtimeMs || 0}:${candidate.size || 0}`;
+}
+
+async function uploadCandidate(candidate, body) {
+  const resourceId = payloadResourceId(body);
+  const cache = getUploadCache();
+  pruneTimedMap(cache, AUTO_UPLOAD_TTL_MS);
+  const cacheKey = uploadCacheKey(candidate, resourceId);
+  const cached = cache.get(cacheKey);
+  if (cached && cached.result) {
+    return cached.result;
+  }
+
+  const stat = safeStat(candidate.path);
+  if (!stat) {
+    throw new Error(`file no longer exists: ${candidate.fileName}`);
+  }
+  const requestBody = {
+    resourceId,
+    groupId: payloadGroupId(body),
+    userId: payloadUserId(body),
+    release: deriveReleaseName(),
+    type: deliverableTypeForPath(candidate.path, stat.isDirectory()),
+    fileName: candidate.fileName || path.basename(candidate.path),
+  };
+  if (stat.isDirectory()) {
+    const files = collectDirectoryFiles(candidate.path);
+    if (files.length === 0) {
+      throw new Error(`directory has no uploadable files: ${candidate.fileName}`);
+    }
+    requestBody.files = files;
+  } else {
+    if (stat.size > AUTO_UPLOAD_MAX_BYTES) {
+      throw new Error(`file exceeds auto-upload limit: ${candidate.fileName}`);
+    }
+    requestBody.contentBase64 = fs.readFileSync(candidate.path).toString("base64");
+  }
+
+  const response = await httpJSONRequest("POST", "/openclaw-gateway/be/deliverables", requestBody);
+  const data = response.data || response;
+  const previewURL = data.previewUrl || `${gatewayPublicURL()}/openclaw-gateway/preview/${data.uuid}`;
+  const result = {
+    fileName: requestBody.fileName,
+    uuid: data.uuid,
+    previewURL,
+    downloadURL: data.downloadUrl || previewURL,
+  };
+  cache.set(cacheKey, { result, createdAt: Date.now() });
+  return result;
+}
+
+function dedupeCandidates(candidates) {
+  const out = [];
+  const seen = new Set();
+  for (const candidate of candidates) {
+    if (!candidate || !candidate.path) {
+      continue;
+    }
+    const key = path.resolve(candidate.path);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    out.push(candidate);
+    if (out.length >= AUTO_UPLOAD_MAX_FILES) {
+      break;
+    }
+  }
+  return out;
+}
+
+function escapeMarkdownLabel(label) {
+  return String(label || "文件").replace(/[[\]()`]/g, "");
+}
+
+function removeInternalPathLeaks(text, candidates) {
+  let out = String(text || "");
+  for (const candidate of candidates) {
+    if (!candidate || !candidate.raw) {
+      continue;
+    }
+    out = out.split(candidate.raw).join(candidate.fileName || path.basename(candidate.path));
+  }
+  return out;
+}
+
+function appendDeliverableLinks(text, uploads) {
+  const lines = [];
+  uploads.forEach((upload) => {
+    const label = escapeMarkdownLabel(upload.fileName);
+    if (upload.previewURL) {
+      lines.push(`预览链接：[${label}](${upload.previewURL})`);
+    }
+    if (upload.downloadURL && upload.downloadURL !== upload.previewURL) {
+      lines.push(`下载链接：[${label}](${upload.downloadURL})`);
+    }
+  });
+  if (lines.length === 0) {
+    return text;
+  }
+  return `${String(text || "").trim()}\n\n交付物链接：\n${lines.join("\n")}`;
+}
+
+function hasTrustedDeliverableLink(text) {
+  return splitDeliverableMessage(text) !== null;
+}
+
+function shouldSkipAutoUploadPayload(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return true;
+  }
+  if (!isString(body.content) || !body.content.trim()) {
+    return true;
+  }
+  if (body.stream_id || body.seq !== undefined || body.delta !== undefined || body.is_final !== undefined) {
+    return true;
+  }
+  if (body.palz_msg_type || body.tool_content) {
+    return true;
+  }
+  return false;
+}
+
+async function autoUploadAndRewritePayload(body, api) {
+  if (shouldSkipAutoUploadPayload(body) || hasTrustedDeliverableLink(body.content)) {
+    return body;
+  }
+  const refs = extractFileReferencesFromText(body.content);
+  const explicitCandidates = refs.map(resolveFileReference).filter(Boolean);
+  const candidates = dedupeCandidates(explicitCandidates.concat(pendingCandidatesForPayload(body)));
+  if (candidates.length === 0) {
+    return body;
+  }
+
+  const uploads = [];
+  const failures = [];
+  for (const candidate of candidates) {
+    try {
+      uploads.push(await uploadCandidate(candidate, body));
+    } catch (err) {
+      failures.push({ candidate, error: err });
+      api.logger.warn?.(
+        `[plugin-deliverables] auto-upload failed file=${candidate.fileName || candidate.path} error=${err.message}`,
+      );
+    }
+  }
+  if (uploads.length === 0) {
+    if (explicitCandidates.length === 0) {
+      return body;
+    }
+    const next = Object.assign({}, body);
+    next.content = "交付物上传失败，已阻止发送工作区内部文件路径。请稍后重试或联系管理员排查上传链路。";
+    return next;
+  }
+  const next = Object.assign({}, body);
+  next.content = appendDeliverableLinks(removeInternalPathLeaks(body.content, candidates), uploads);
+  if (failures.length > 0) {
+    next.content += `\n\n另有 ${failures.length} 个文件上传失败，已避免发送内部路径。`;
+  }
+  api.logger.info?.(
+    `[plugin-deliverables] auto-uploaded ${uploads.length} workspace file(s) for target=${String(body.conversation_id || "")}`,
+  );
+  return next;
+}
+
 function getSummaryCache() {
   if (!globalThis[SUMMARY_CACHE_KEY] || !(globalThis[SUMMARY_CACHE_KEY] instanceof Map)) {
     globalThis[SUMMARY_CACHE_KEY] = new Map();
@@ -520,6 +1222,7 @@ function splitDeliverableMessage(text) {
 
   const linkLines = [];
   const linkUrls = [];
+  const linkItems = [];
   for (let i = firstLinkIndex; i < lines.length; i += 1) {
     const line = lines[i];
     if (isLinksHeading(line)) {
@@ -532,6 +1235,7 @@ function splitDeliverableMessage(text) {
         const url = extractDeliverableURL(normalizedLine);
         if (url) {
           linkUrls.push(url);
+          linkItems.push({ line: normalizedLine, url });
         }
       }
     }
@@ -546,10 +1250,54 @@ function splitDeliverableMessage(text) {
   return {
     summary,
     links,
+    linkUrls,
+    linkItems,
     primaryLinkUrl: linkUrls.length > 0 ? linkUrls[0] : "",
+    fileLinkUrl: selectPalzFileURL(linkItems),
   };
 }
 
+function extractDeliverableIdentity(rawURL) {
+  if (!isString(rawURL) || !rawURL.trim()) {
+    return "";
+  }
+  let parsed;
+  try {
+    parsed = new URL(rawURL.trim());
+  } catch (_err) {
+    return "";
+  }
+  if (!DELIVERABLE_GATEWAY_PATH_RE.test(parsed.pathname)) {
+    return "";
+  }
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+  for (const part of parts) {
+    if (uuidRe.test(part)) {
+      return part.toLowerCase();
+    }
+  }
+  return parsed.href;
+}
+
+function selectPalzFileURL(linkItems) {
+  if (!Array.isArray(linkItems) || linkItems.length === 0) {
+    return "";
+  }
+  const identities = new Set();
+  for (const item of linkItems) {
+    const identity = extractDeliverableIdentity(item && item.url);
+    if (identity) {
+      identities.add(identity);
+    }
+  }
+  if (identities.size !== 1) {
+    return "";
+  }
+  const download = linkItems.find((item) => /下载链接/u.test(String((item && item.line) || "")));
+  return (download && download.url) || linkItems[0].url || "";
+}
+
 function cloneBody(body, content, suffix) {
   const next = {};
   Object.keys(body).forEach((key) => {
@@ -605,6 +1353,7 @@ function shouldSplitPalzPayload(body) {
       summary: cachedSummary,
       links: split.links,
       primaryLinkUrl: split.primaryLinkUrl,
+      fileLinkUrl: split.fileLinkUrl,
     };
   }
   return split;
@@ -678,6 +1427,11 @@ function installPalzFetchPatch(api) {
       return originalFetch(input, init);
     }
 
+    const rewritten = await autoUploadAndRewritePayload(parsed, api);
+    if (rewritten !== parsed) {
+      parsed = rewritten;
+    }
+
     const split = shouldSplitPalzPayload(parsed);
     if (!split) {
       const suspiciousURL = isString(parsed.content)
@@ -695,14 +1449,15 @@ function installPalzFetchPatch(api) {
     }
 
     const summaryBody = cloneBody(parsed, split.summary, "__summary");
-    const linksBody = split.primaryLinkUrl
-      ? cloneBodyAsFileLink(parsed, split.primaryLinkUrl, "__links")
+    const fileLinkUrl = split.fileLinkUrl || "";
+    const linksBody = fileLinkUrl
+      ? cloneBodyAsFileLink(parsed, fileLinkUrl, "__links")
       : cloneBody(parsed, split.links, "__links");
     const summaryBodyStr = JSON.stringify(summaryBody);
     const linksBodyStr = JSON.stringify(linksBody);
 
     api.logger.info?.(
-      `[plugin-deliverables] split deliverable reply injected by plugin-deliverables target=${String(parsed.conversation_id || "")} summaryMsgId=${String(summaryBody.msg_id || "")} linksMsgId=${String(linksBody.msg_id || "")} linksMode=${split.primaryLinkUrl ? "file_url" : "text"}`,
+      `[plugin-deliverables] split deliverable reply injected by plugin-deliverables target=${String(parsed.conversation_id || "")} summaryMsgId=${String(summaryBody.msg_id || "")} linksMsgId=${String(linksBody.msg_id || "")} linksMode=${fileLinkUrl ? "file_url" : "text"}`,
     );
     api.logger.info?.(
       `[plugin-deliverables] palz summary request body_length=${summaryBodyStr.length}\n  request_body=${summaryBodyStr}`,
@@ -759,6 +1514,10 @@ const plugin = {
         cacheUploadSummary(event.params);
         return;
       }
+      if (isWriteTool(event.toolName)) {
+        rememberPendingFile(event);
+        return;
+      }
       if (!isOutboundMessageTool(event.toolName)) {
         return;
       }
@@ -789,11 +1548,14 @@ const plugin = {
 };
 
 plugin.__test = {
+  deliverableTypeForPath,
+  extractFileReferencesFromText,
   extractDeliverableURL,
   findUntrustedOSSDeliverableURL,
   isDeliverableLinkLine,
   isOSSLikeURL,
   isTrustedDeliverableURL,
+  selectPalzFileURL,
   splitDeliverableMessage,
 };
 

package/mcp-servers/deliverables.js

@@ -274,12 +274,70 @@ function normalizeBase64Content(value, label) {
   return Buffer.from(padded, "base64").toString("base64");
 }
 
+function candidateWorkspaceRoots() {
+  var roots = [];
+  [
+    process.env.OPENCLAW_WORKSPACE_PATH,
+    process.env.WORKSPACE_PATH,
+    "/home/node/.openclaw/workspace-main",
+    "/home/node/.openclaw/workspace",
+    "/data/workspace",
+    "/data/workspace-main"
+  ].forEach(function(root) {
+    root = trimString(root);
+    if (root && roots.indexOf(root) < 0) {
+      roots.push(root);
+    }
+  });
+  try {
+    fs.readdirSync("/data").forEach(function(entry) {
+      if (entry && entry.indexOf("workspace-") === 0) {
+        var root = path.join("/data", entry);
+        if (roots.indexOf(root) < 0) {
+          roots.push(root);
+        }
+      }
+    });
+  } catch (_err) {}
+  return roots;
+}
+
+function resolveReadableFilePath(filePath) {
+  var rawPath = trimString(filePath);
+  if (!rawPath) {
+    return "";
+  }
+  var candidates = [];
+  function add(candidate) {
+    if (candidate && candidates.indexOf(candidate) < 0) {
+      candidates.push(candidate);
+    }
+  }
+  if (path.isAbsolute(rawPath)) {
+    add(rawPath);
+  } else {
+    add(path.resolve(process.cwd(), rawPath));
+    candidateWorkspaceRoots().forEach(function(root) {
+      add(path.join(root, rawPath));
+    });
+  }
+  for (var i = 0; i < candidates.length; i += 1) {
+    try {
+      var stat = fs.statSync(candidates[i]);
+      if (stat.isFile()) {
+        return candidates[i];
+      }
+    } catch (_err) {}
+  }
+  return candidates[0] || rawPath;
+}
+
 function readFileAsBase64(filePath, label) {
   var rawPath = trimString(filePath);
   if (!rawPath) {
     return "";
   }
-  var resolvedPath = path.resolve(process.cwd(), rawPath);
+  var resolvedPath = resolveReadableFilePath(rawPath);
   var stat;
   try {
     stat = fs.statSync(resolvedPath);
@@ -448,7 +506,8 @@ function startMCPServer() {
 module.exports.__test = {
   buildContentPayload: buildContentPayload,
   buildUploadRequestBody: buildUploadRequestBody,
-  normalizeBase64Content: normalizeBase64Content
+  normalizeBase64Content: normalizeBase64Content,
+  resolveReadableFilePath: resolveReadableFilePath
 };
 
 if (require.main === module) {

package/openclaw-plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "plugin-deliverables",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "npm_package": "@dai_ming/plugin-deliverables",
   "description": "Deliverables plugin: MCP server + skill + AGENTS rules for AI-generated file uploads",
   "mcp_servers": {

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "plugin-deliverables",
   "name": "Deliverables",
   "description": "Deliverables runtime guard for upload-first file delivery with Palz split-send diagnostics.",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "skills": ["./skills"],
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dai_ming/plugin-deliverables",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "OpenClaw deliverables plugin — upload AI-generated files to OSS and return shareable preview/download links",
   "keywords": [
     "openclaw",

package/test/index.test.js

@@ -6,9 +6,12 @@ process.env.CLAW_GATEWAY_PUBLIC_URL = "https://claw-gateway.csagentai.com";
 
 const plugin = require("../index.js");
 const {
+  deliverableTypeForPath,
+  extractFileReferencesFromText,
   findUntrustedOSSDeliverableURL,
   isDeliverableLinkLine,
   isTrustedDeliverableURL,
+  selectPalzFileURL,
   splitDeliverableMessage,
 } = plugin.__test;
 
@@ -38,6 +41,19 @@ const split = splitDeliverableMessage(
 );
 assert.ok(split);
 assert.strictEqual(split.primaryLinkUrl, gatewayURL);
+assert.strictEqual(split.fileLinkUrl, gatewayURL);
+
+const outputURL =
+  "https://claw-gateway.csagentai.com/openclaw-gateway/output/user/res/uuid/7a9e27b7-08ca-4453-81e8-fe6a630d4566/report.md";
+const previewURL =
+  "https://claw-gateway.csagentai.com/openclaw-gateway/preview/7a9e27b7-08ca-4453-81e8-fe6a630d4566";
+assert.strictEqual(
+  selectPalzFileURL([
+    { line: `预览链接：[点击预览](${previewURL})`, url: previewURL },
+    { line: `下载链接：[点击下载](${outputURL})`, url: outputURL },
+  ]),
+  outputURL,
+);
 
 assert.strictEqual(
   splitDeliverableMessage(
@@ -71,3 +87,28 @@ assert.strictEqual(
   ),
   "",
 );
+
+const multiSplit = splitDeliverableMessage(
+  [
+    "已生成多个文件。",
+    "",
+    `预览链接：[设计文档](${gatewayURL})`,
+    `下载链接：[测试报告](https://claw-gateway.csagentai.com/openclaw-gateway/output/user/res/uuid/report.md)`,
+  ].join("\n"),
+);
+assert.ok(multiSplit);
+assert.strictEqual(multiSplit.linkUrls.length, 2);
+
+const refs = extractFileReferencesFromText(
+  "设计文档：`game-brief.md`\n开发路径：/data/workspace-lobster_abc/output/app/index.html\n相对路径 output/report.pdf",
+);
+assert.deepStrictEqual(
+  refs.map((ref) => ref.value),
+  ["/data/workspace-lobster_abc/output/app/index.html", "game-brief.md", "output/report.pdf"],
+);
+
+assert.strictEqual(deliverableTypeForPath("intro.pdf", false), "article");
+assert.strictEqual(deliverableTypeForPath("cover.png", false), "image");
+assert.strictEqual(deliverableTypeForPath("slides.pptx", false), "ppt");
+assert.strictEqual(deliverableTypeForPath("dist.zip", false), "zip");
+assert.strictEqual(deliverableTypeForPath("/data/workspace-lobster_abc/output/site", true), "game");

package/test/mcp-server.test.js

@@ -8,6 +8,7 @@ const path = require("path");
 const {
   buildUploadRequestBody,
   normalizeBase64Content,
+  resolveReadableFilePath,
 } = require("../mcp-servers/deliverables.js").__test;
 
 assert.strictEqual(
@@ -24,6 +25,7 @@ assert.throws(
 );
 
 const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "deliverables-mcp-"));
+process.env.OPENCLAW_WORKSPACE_PATH = tmpDir;
 const pdfPath = path.join(tmpDir, "sample.pdf");
 const pdfBytes = Buffer.from("%PDF-1.3\nsample\n", "utf8");
 fs.writeFileSync(pdfPath, pdfBytes);
@@ -42,3 +44,17 @@ assert.strictEqual(body.resourceId, "res-1");
 assert.strictEqual(body.fileName, "sample.pdf");
 assert.strictEqual(body.contentText, "");
 assert.strictEqual(body.contentBase64, pdfBytes.toString("base64"));
+
+const outputDir = path.join(tmpDir, "output");
+fs.mkdirSync(outputDir, { recursive: true });
+const relativeDoc = path.join(outputDir, "relative.md");
+fs.writeFileSync(relativeDoc, "# Relative\n", "utf8");
+assert.strictEqual(resolveReadableFilePath("output/relative.md"), relativeDoc);
+
+const relativeBody = buildUploadRequestBody({
+  resource_id: "res-1",
+  type: "article",
+  file_name: "relative.md",
+  file_path: "output/relative.md",
+});
+assert.strictEqual(relativeBody.contentBase64, Buffer.from("# Relative\n").toString("base64"));