@memtensor/memos-local-openclaw-plugin 1.0.4-beta.9 → 1.0.4

package/src/skill/upgrader.ts

@@ -91,18 +91,30 @@ export class SkillUpgrader {
       return { upgraded: false, qualityScore: null };
     }
 
+    const backupDir = skill.dirPath + ".backup-" + Date.now();
+    try { fs.cpSync(skill.dirPath, backupDir, { recursive: true }); } catch { /* best-effort */ }
+
     fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), newContent, "utf-8");
 
+    await this.rebuildCompanionFiles(skill, newContent, task);
+
     const validation = await this.validator.validate(skill.dirPath, {
       previousContent: currentContent,
     });
 
     if (!validation.valid) {
       this.ctx.log.warn(`SkillUpgrader: validation failed for "${skill.name}", reverting: ${validation.errors.join("; ")}`);
-      fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), currentContent, "utf-8");
+      if (fs.existsSync(backupDir)) {
+        fs.rmSync(skill.dirPath, { recursive: true });
+        fs.renameSync(backupDir, skill.dirPath);
+      } else {
+        fs.writeFileSync(path.join(skill.dirPath, "SKILL.md"), currentContent, "utf-8");
+      }
       return { upgraded: false, qualityScore: null };
     }
 
+    try { if (fs.existsSync(backupDir)) fs.rmSync(backupDir, { recursive: true }); } catch { /* cleanup */ }
+
     const newVersion = skill.version + 1;
     const newDescription = this.parseDescription(newContent) || skill.description;
 
@@ -216,4 +228,130 @@ export class SkillUpgrader {
     if (match2) return match2[1];
     return "";
   }
+
+  private async rebuildCompanionFiles(skill: Skill, newContent: string, task: Task): Promise<void> {
+    const chain = buildSkillConfigChain(this.ctx);
+    if (chain.length === 0) return;
+
+    const chunks = this.store.getChunksByTask(task.id);
+    const conversationText = chunks
+      .filter(c => c.role === "user" || c.role === "assistant" || c.role === "tool")
+      .map(c => `[${c.role === "user" ? "User" : c.role === "assistant" ? "Assistant" : "Tool"}]: ${c.content.slice(0, 500)}`)
+      .join("\n\n")
+      .slice(0, 6000);
+
+    const scriptsPrompt = `Based on the following upgraded SKILL.md and task record, extract reusable automation scripts.
+Rules:
+- Only extract if the task record contains concrete shell commands, Python scripts, or TypeScript code that form a complete, reusable automation.
+- Each script must be self-contained and runnable.
+- If there are no automatable scripts, return an empty array.
+- Don't fabricate scripts — only extract what was actually used.
+
+SKILL.md:
+${newContent.slice(0, 4000)}
+
+Task conversation highlights:
+${conversationText}
+
+Reply with a JSON array only:
+[{"filename": "deploy.sh", "content": "#!/bin/bash\\n..."}]
+If no scripts, reply with: []`;
+
+    try {
+      const raw = await callLLMWithFallback(chain, scriptsPrompt, this.ctx.log, "SkillUpgrader.scripts", {
+        maxTokens: 3000, temperature: 0.1, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const scripts = this.parseJSONArray<{ filename: string; content: string }>(raw);
+
+      const scriptsDir = path.join(skill.dirPath, "scripts");
+      if (fs.existsSync(scriptsDir)) fs.rmSync(scriptsDir, { recursive: true });
+      if (scripts.length > 0) {
+        fs.mkdirSync(scriptsDir, { recursive: true });
+        for (const s of scripts) {
+          fs.writeFileSync(path.join(scriptsDir, s.filename), s.content, "utf-8");
+        }
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${scripts.length} scripts for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion scripts rebuild failed: ${err}`);
+    }
+
+    try {
+      const evalsPrompt = `Based on the following skill, generate 3-4 realistic test prompts that should trigger this skill.
+Requirements:
+- Write test prompts that a real user would type, mix direct and indirect phrasings
+- LANGUAGE RULE: Write in the SAME language as the skill content.
+
+Skill:
+${newContent.slice(0, 4000)}
+
+Reply with a JSON array only:
+[{"id": 1, "prompt": "A realistic user message", "expectations": ["Expected behavior 1"], "trigger_confidence": "high"}]`;
+
+      const raw = await callLLMWithFallback(chain, evalsPrompt, this.ctx.log, "SkillUpgrader.evals", {
+        maxTokens: 2000, temperature: 0.3, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const evals = this.parseJSONArray<{ id: number; prompt: string; expectations: string[] }>(raw);
+
+      const evalsDir = path.join(skill.dirPath, "evals");
+      if (fs.existsSync(evalsDir)) fs.rmSync(evalsDir, { recursive: true });
+      if (evals.length > 0) {
+        fs.mkdirSync(evalsDir, { recursive: true });
+        fs.writeFileSync(
+          path.join(evalsDir, "evals.json"),
+          JSON.stringify({ skill_name: skill.name, evals }, null, 2),
+          "utf-8",
+        );
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${evals.length} evals for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion evals rebuild failed: ${err}`);
+    }
+
+    try {
+      const refsPrompt = `Based on the following upgraded SKILL.md and task record, extract reference documentation worth preserving.
+Rules:
+- Only extract real reference content that appeared in the task (API docs, config examples, architecture notes).
+- Each reference should be a standalone document useful for understanding the skill's domain.
+- If there are no meaningful references, return an empty array.
+- Don't fabricate content — only extract what was actually discussed or used.
+- LANGUAGE RULE: Write in the SAME language as the skill content.
+
+SKILL.md:
+${newContent.slice(0, 4000)}
+
+Task conversation highlights:
+${conversationText}
+
+Reply with a JSON array only:
+[{"filename": "api-notes.md", "content": "# API Reference\\n..."}]
+If no references, reply with: []`;
+
+      const raw = await callLLMWithFallback(chain, refsPrompt, this.ctx.log, "SkillUpgrader.references", {
+        maxTokens: 3000, temperature: 0.1, timeoutMs: 60_000, openclawAPI: this.ctx.openclawAPI,
+      });
+      const refs = this.parseJSONArray<{ filename: string; content: string }>(raw);
+
+      const refsDir = path.join(skill.dirPath, "references");
+      if (fs.existsSync(refsDir)) fs.rmSync(refsDir, { recursive: true });
+      if (refs.length > 0) {
+        fs.mkdirSync(refsDir, { recursive: true });
+        for (const r of refs) {
+          fs.writeFileSync(path.join(refsDir, r.filename), r.content, "utf-8");
+        }
+        this.ctx.log.info(`SkillUpgrader: rebuilt ${refs.length} references for "${skill.name}"`);
+      }
+    } catch (err) {
+      this.ctx.log.warn(`SkillUpgrader: companion references rebuild failed: ${err}`);
+    }
+  }
+
+  private parseJSONArray<T>(raw: string): T[] {
+    const match = raw.match(/\[[\s\S]*\]/);
+    if (!match) return [];
+    try {
+      const arr = JSON.parse(match[0]);
+      return Array.isArray(arr) ? arr : [];
+    } catch { return []; }
+  }
 }

package/src/skill/validator.ts

@@ -31,6 +31,9 @@ export class SkillValidator {
     this.validateFormat(dirPath, result);
     if (!result.valid) return result;
 
+    this.checkCompanionConsistency(dirPath, result);
+    this.scanSecrets(dirPath, result);
+
     if (opts?.previousContent) {
       this.regressionCheck(dirPath, opts.previousContent, result);
     }
@@ -133,6 +136,82 @@ export class SkillValidator {
     }
   }
 
+  private checkCompanionConsistency(dirPath: string, result: ValidationResult): void {
+    const skillMdPath = path.join(dirPath, "SKILL.md");
+    const content = fs.readFileSync(skillMdPath, "utf-8");
+
+    const referencedScripts = [...content.matchAll(/`scripts\/([^`]+)`/g)].map(m => m[1]);
+    const referencedRefs = [...content.matchAll(/`references\/([^`]+)`/g)].map(m => m[1]);
+
+    const scriptsDir = path.join(dirPath, "scripts");
+    const refsDir = path.join(dirPath, "references");
+
+    for (const f of referencedScripts) {
+      if (!fs.existsSync(path.join(scriptsDir, f))) {
+        result.warnings.push(`SKILL.md references scripts/${f} but file does not exist`);
+      }
+    }
+    for (const f of referencedRefs) {
+      if (!fs.existsSync(path.join(refsDir, f))) {
+        result.warnings.push(`SKILL.md references references/${f} but file does not exist`);
+      }
+    }
+
+    if (fs.existsSync(scriptsDir)) {
+      try {
+        const actualScripts = fs.readdirSync(scriptsDir);
+        for (const f of actualScripts) {
+          if (!referencedScripts.includes(f)) {
+            result.warnings.push(`scripts/${f} exists but is not referenced in SKILL.md`);
+          }
+        }
+      } catch { /* best-effort */ }
+    }
+
+    const evalsPath = path.join(dirPath, "evals", "evals.json");
+    if (fs.existsSync(evalsPath)) {
+      try {
+        const evalsData = JSON.parse(fs.readFileSync(evalsPath, "utf-8"));
+        if (!Array.isArray(evalsData?.evals) && !Array.isArray(evalsData)) {
+          result.warnings.push("evals/evals.json exists but has unexpected structure");
+        }
+      } catch {
+        result.warnings.push("evals/evals.json exists but is not valid JSON");
+      }
+    }
+  }
+
+  private static readonly SECRET_PATTERNS: Array<{ label: string; regex: RegExp }> = [
+    { label: "API key (sk-...)", regex: /\bsk-[a-zA-Z0-9]{20,}\b/ },
+    { label: "Bearer token", regex: /\bBearer\s+[a-zA-Z0-9_\-.]{20,}\b/ },
+    { label: "AWS key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
+    { label: "Generic secret assignment", regex: /(api[_-]?key|secret|token|password|credential)\s*[:=]\s*["'][^"']{8,}["']/i },
+    { label: "Base64 encoded secret (long)", regex: /\b[A-Za-z0-9+/]{40,}={0,2}\b/ },
+  ];
+
+  private scanSecrets(dirPath: string, result: ValidationResult): void {
+    const filesToScan = ["SKILL.md"];
+    const scriptsDir = path.join(dirPath, "scripts");
+    if (fs.existsSync(scriptsDir)) {
+      try {
+        for (const f of fs.readdirSync(scriptsDir)) filesToScan.push(path.join("scripts", f));
+      } catch { /* best-effort */ }
+    }
+
+    for (const relPath of filesToScan) {
+      const fullPath = path.join(dirPath, relPath);
+      if (!fs.existsSync(fullPath)) continue;
+      try {
+        const content = fs.readFileSync(fullPath, "utf-8");
+        for (const { label, regex } of SkillValidator.SECRET_PATTERNS) {
+          if (regex.test(content)) {
+            result.warnings.push(`Potential secret detected in ${relPath}: ${label}`);
+          }
+        }
+      } catch { /* best-effort */ }
+    }
+  }
+
   private async assessQuality(dirPath: string, result: ValidationResult): Promise<void> {
     const chain = buildSkillConfigChain(this.ctx);
     if (chain.length === 0) return;