@spzhongwin/skill-logger-plugin 1.0.15 → 1.0.17

package/src/updater.ts

@@ -305,6 +305,26 @@ export class SkillUpdater {
     return undefined;
   }
 
+  /** 在解压目录里定位专家根目录；专家包根必须同时包含 AGENTS.md 和 SOUL.md。 */
+  private async locateExpertRoot(dir: string, depth: number): Promise<string | undefined> {
+    if (depth > 2) return undefined;
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return undefined;
+    }
+    const files = new Set(entries.filter((entry) => entry.isFile()).map((entry) => entry.name));
+    if (files.has("AGENTS.md") && files.has("SOUL.md")) return dir;
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const found = await this.locateExpertRoot(path.join(dir, entry.name), depth + 1);
+        if (found) return found;
+      }
+    }
+    return undefined;
+  }
+
   /**
    * 直接覆盖、不备份，但保证「不丢数据」：
    *   先把新内容暂存到同级临时目录 → 旧目录改名挪开 → 新内容 rename 换入 → 删掉挪开的旧目录。
@@ -372,6 +392,30 @@ export class SkillUpdater {
     }
   }
 
+  async installExpertZipFromUrl(url: string, targetDir: string): Promise<{success: boolean; message: string}> {
+    const work = path.join(this.tmpDir, `slp-expert-${randomUUID()}`);
+    await fs.mkdir(work, { recursive: true });
+    try {
+      const zipPath = path.join(work, "pkg.zip");
+      const res = await this.fetchImpl(url);
+      if (!res.ok) return { success: false, message: `下载失败: HTTP ${res.status}` };
+      await fs.writeFile(zipPath, Buffer.from(await res.arrayBuffer()));
+
+      const staging = path.join(work, "staging");
+      await this.unzip(zipPath, staging);
+      const expertRoot = await this.locateExpertRoot(staging, 0);
+      if (!expertRoot) {
+        return { success: false, message: "下载包内未找到同时含 AGENTS.md 和 SOUL.md 的专家根目录" };
+      }
+      await this.replaceDir(expertRoot, targetDir);
+      return { success: true, message: "安装成功" };
+    } catch (err: any) {
+      return { success: false, message: `执行出错: ${err.message}` };
+    } finally {
+      await fs.rm(work, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+
   async manualInstall(options: {
     code: string;
     url?: string;
@@ -404,6 +448,14 @@ export class SkillUpdater {
     });
 
     try {
+      if (
+        !code || code === "." || code === ".." || code.includes("/") ||
+        code.includes("\\") || code.includes("\0") || path.basename(code) !== code
+      ) {
+        const message = `非法的 Skill code: ${code}`;
+        emit("install.failed", { stage: currentStage, message, elapsedMs: Date.now() - startedAt });
+        return { success: false, message };
+      }
       if (!url) {
         // 若没有直接传入 ZIP 的 URL，向平台索取该 skill 的 latest 下载地址
         const lookupStartedAt = Date.now();

package/src/ws-client.test.ts

@@ -6,11 +6,115 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import {
   normalizeAssistantUserId,
+  normalizeCommandCode,
+  enabledAgentIdsFromAccounts,
+  resolveSkillInstallTarget,
   parseAssistantWorkspaceAgentId,
   readCronJobsByAgentId,
+  findInstalledExpertSkillsRoot,
   shouldSyncBuiltInTemplate,
 } from "./ws-client.ts";
 
+describe("command code boundary", () => {
+  it("只接受单一路径段，不静默改写路径穿越输入", () => {
+    assert.equal(normalizeCommandCode("demo-skill"), "demo-skill");
+    assert.equal(normalizeCommandCode("../demo"), undefined);
+    assert.equal(normalizeCommandCode("a/b"), undefined);
+    assert.equal(normalizeCommandCode("a\\b"), undefined);
+    assert.equal(normalizeCommandCode("."), undefined);
+    assert.equal(normalizeCommandCode(".."), undefined);
+    assert.equal(normalizeCommandCode(""), undefined);
+    assert.equal(normalizeCommandCode(123), undefined);
+  });
+});
+
+describe("gateway heartbeat agent accounts", () => {
+  it("reports enabled accounts and accounts without an explicit enabled field", () => {
+    const agentIds = enabledAgentIdsFromAccounts({
+      channels: {
+        xg_cwork_im: {
+          accounts: {
+            "assistant-enabled": { agentId: "assistant-enabled", enabled: true },
+            "assistant-legacy": { agentId: "assistant-legacy" },
+            default: { groupPolicy: "mention" },
+          },
+        },
+      },
+    });
+
+    assert.deepEqual(agentIds, ["assistant-enabled", "assistant-legacy"]);
+  });
+
+  it("filters accounts explicitly disabled in openclaw.json", () => {
+    const agentIds = enabledAgentIdsFromAccounts({
+      channels: {
+        xg_cwork_im: {
+          accounts: {
+            "assistant-1514822133731725314": {
+              agentId: "assistant-1514822133731725314",
+              enabled: false,
+              name: "个人助理",
+              robotKey: "secret-is-not-used-for-heartbeats",
+            },
+            "assistant-active": { agentId: "assistant-active", enabled: true },
+          },
+        },
+      },
+    });
+
+    assert.deepEqual(agentIds, ["assistant-active"]);
+  });
+
+  it("returns no agents when the account path is absent or malformed", () => {
+    assert.deepEqual(enabledAgentIdsFromAccounts({}), []);
+    assert.deepEqual(enabledAgentIdsFromAccounts({ channels: { xg_cwork_im: { accounts: [] } } }), []);
+  });
+});
+
+describe("普通 Skill 配置驱动的安装目录", () => {
+  const config = {
+    channels: {
+      xg_cwork_im: {
+        accounts: {
+          "assistant-12345": { agentId: "assistant-12345", enabled: true },
+          "assistant-67890": { agentId: "assistant-67890", enabled: false },
+        },
+      },
+    },
+    bindings: [{
+      agentId: "sales-agent",
+      match: { channel: "xg_cwork_im", accountId: "assistant-12345" },
+    }],
+    agents: {
+      defaults: { workspace: "/var/openclaw/default" },
+      list: [{ id: "sales-agent", workspace: "/var/openclaw/sales" }],
+    },
+  };
+
+  it("通过 account、binding 和 agent workspace 解析目录", () => {
+    assert.deepEqual(resolveSkillInstallTarget(config, "assistant-12345"), {
+      localAgentId: "sales-agent",
+      skillsDir: "/var/openclaw/sales/skills",
+    });
+  });
+
+  it("拒绝显式 disabled 的 account", () => {
+    assert.throws(() => resolveSkillInstallTarget(config, "assistant-67890"), /已禁用/);
+  });
+
+  it("找不到 account、binding 后的 agent 或 workspace 时拒绝回退到命名目录", () => {
+    assert.throws(() => resolveSkillInstallTarget(config, "assistant-99999"), /未找到 userId/);
+    assert.throws(() => resolveSkillInstallTarget({
+      ...config,
+      bindings: [{ agentId: "missing-agent", match: { channel: "xg_cwork_im", accountId: "assistant-12345" } }],
+    }, "assistant-12345"), /未找到本地 Agent/);
+    assert.throws(() => resolveSkillInstallTarget({
+      ...config,
+      agents: { list: [{ id: "sales-agent" }] },
+    }, "assistant-12345"), /未配置 workspace/);
+  });
+});
+
 describe("assistant workspace naming", () => {
   it("accepts workspace-assistant-* only when suffix is at least 5 digits", () => {
     assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-12345"), "assistant-12345");
@@ -52,6 +156,21 @@ describe("built-in template update boundary", () => {
   });
 });
 
+describe("expert skill update target", () => {
+  it("返回 .user/skills 父目录，由安装器统一追加 skill code", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-expert-skill-"));
+    try {
+      const skillsRoot = path.join(root, "workspace-assistant-12345", ".user", "skills");
+      fs.mkdirSync(path.join(skillsRoot, "demo"), { recursive: true });
+
+      assert.equal(await findInstalledExpertSkillsRoot(root, "12345", "demo"), skillsRoot);
+      assert.equal(await findInstalledExpertSkillsRoot(root, "12345", "missing"), undefined);
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("cron job sqlite lookup", () => {
   it("returns all cron_jobs rows for the requested agent_id", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-cron-jobs-"));

package/src/ws-client.ts

@@ -13,6 +13,105 @@ const ASSISTANT_WORKSPACE_PREFIX = "workspace-assistant-";
 const ASSISTANT_AGENT_PREFIX = "assistant-";
 const ASSISTANT_WORKSPACE_ID_RE = /^\d{5,}$/;
 
+type OpenClawAccount = {
+  agentId?: unknown;
+  enabled?: unknown;
+};
+
+type SkillInstallTarget = {
+  /** 普通 Skill 的安装根目录。 */
+  skillsDir: string;
+  /** 解析出的本地 OpenClaw agent，便于日志与后续专家链路复用。 */
+  localAgentId: string;
+};
+
+/**
+ * 从 `channels.xg_cwork_im.accounts` 提取应上报给中控的 agent ID。
+ *
+ * `enabled: false` 是唯一的禁用标识；旧配置未填写 enabled 时维持原有可用语义。
+ * 没有有效 agentId 的配置项（例如 default）不会被上报。
+ */
+export function enabledAgentIdsFromAccounts(config: unknown): string[] {
+  if (!config || typeof config !== "object") return [];
+
+  const channels = (config as { channels?: unknown }).channels;
+  if (!channels || typeof channels !== "object") return [];
+  const cworkConfig = (channels as { xg_cwork_im?: unknown }).xg_cwork_im;
+  if (!cworkConfig || typeof cworkConfig !== "object") return [];
+  const accounts = (cworkConfig as { accounts?: unknown }).accounts;
+  if (!accounts || typeof accounts !== "object" || Array.isArray(accounts)) return [];
+
+  const agentIds = new Set<string>();
+  for (const account of Object.values(accounts as Record<string, OpenClawAccount>)) {
+    if (!account || typeof account !== "object" || account.enabled === false) continue;
+    if (typeof account.agentId !== "string") continue;
+    const agentId = account.agentId.trim();
+    if (agentId) agentIds.add(agentId);
+  }
+  return [...agentIds];
+}
+
+/**
+ * 根据 OpenClaw 配置解析普通 Skill 的安装目录。
+ *
+ * 只有同时满足以下条件才返回目标目录：
+ * 1. xg_cwork_im 中存在 `agentId === userId` 的 account；
+ * 2. account 没有显式 disabled；
+ * 3. account（或它的 binding）映射到一个配置了 workspace 的本地 agent。
+ *
+ * 这里故意不回退到 `workspace-assistant-<id>` 命名规则。配置缺失时拒绝执行，
+ * 防止禁用或已迁移 workspace 的用户仍被写入历史目录。
+ */
+export function resolveSkillInstallTarget(config: unknown, userId: string): SkillInstallTarget {
+  if (!config || typeof config !== "object") throw new Error("openclaw.json 配置无效");
+  const root = config as {
+    channels?: { xg_cwork_im?: { accounts?: unknown } };
+    bindings?: unknown;
+    agents?: { defaults?: { workspace?: unknown }; list?: unknown };
+  };
+  const accounts = root.channels?.xg_cwork_im?.accounts;
+  if (!accounts || typeof accounts !== "object" || Array.isArray(accounts)) {
+    throw new Error(`未找到 userId=${userId} 的 xg_cwork_im account`);
+  }
+
+  const matched = Object.entries(accounts as Record<string, OpenClawAccount>)
+    .filter(([, account]) => account && typeof account === "object" && account.agentId === userId);
+  if (matched.length !== 1) {
+    throw new Error(matched.length > 1
+      ? `userId=${userId} 存在多个 xg_cwork_im account，无法确定安装目录`
+      : `未找到 userId=${userId} 的 xg_cwork_im account`);
+  }
+  const [accountId, account] = matched[0];
+  if (account.enabled === false) throw new Error(`userId=${userId} 对应 Agent 已禁用`);
+
+  // 规范配置以 binding 决定本地 agent；兼容历史配置中 account key/agentId 作为 accountId 的写法。
+  const bindingAccountIds = new Set([accountId, userId]);
+  const bindings = Array.isArray(root.bindings) ? root.bindings : [];
+  const binding = bindings.find((item): item is { agentId?: unknown; match?: { channel?: unknown; accountId?: unknown } } => {
+    if (!item || typeof item !== "object") return false;
+    const candidate = item as { agentId?: unknown; match?: { channel?: unknown; accountId?: unknown } };
+    return candidate.match?.channel === "xg_cwork_im"
+      && typeof candidate.match.accountId === "string"
+      && bindingAccountIds.has(candidate.match.accountId)
+      && typeof candidate.agentId === "string"
+      && candidate.agentId.length > 0;
+  });
+  const localAgentId = typeof binding?.agentId === "string" ? binding.agentId : userId;
+
+  const list = Array.isArray(root.agents?.list) ? root.agents.list : [];
+  const agent = list.find((item): item is { id?: unknown; workspace?: unknown } =>
+    Boolean(item) && typeof item === "object" && (item as { id?: unknown }).id === localAgentId,
+  );
+  if (!agent) throw new Error(`未找到本地 Agent 配置: ${localAgentId}`);
+  const workspace = typeof agent.workspace === "string"
+    ? agent.workspace
+    : root.agents?.defaults?.workspace;
+  if (typeof workspace !== "string" || !workspace.trim()) {
+    throw new Error(`本地 Agent ${localAgentId} 未配置 workspace`);
+  }
+  return { skillsDir: path.join(workspace, "skills"), localAgentId };
+}
+
 export function parseAssistantWorkspaceAgentId(entryName: string): string | undefined {
   if (!entryName.startsWith(ASSISTANT_WORKSPACE_PREFIX)) return undefined;
   const suffix = entryName.slice(ASSISTANT_WORKSPACE_PREFIX.length);
@@ -30,10 +129,31 @@ export function normalizeAssistantUserId(userId: string): string | undefined {
   return pureId;
 }
 
+export function normalizeCommandCode(code: unknown): string | undefined {
+  if (typeof code !== "string" || code.length === 0 || code === "." || code === "..") return undefined;
+  if (code.includes("/") || code.includes("\\") || code.includes("\0")) return undefined;
+  if (path.basename(code) !== code) return undefined;
+  return code;
+}
+
 export function shouldSyncBuiltInTemplate(action: string, isBuiltIn: unknown): boolean {
   return action === "UPDATE_SKILL" && isBuiltIn === true;
 }
 
+export async function findInstalledExpertSkillsRoot(
+  rootPath: string,
+  pureId: string,
+  code: string
+): Promise<string | undefined> {
+  const skillsRoot = path.join(rootPath, `workspace-assistant-${pureId}`, ".user", "skills");
+  try {
+    const stat = await fs.stat(path.join(skillsRoot, code));
+    return stat.isDirectory() ? skillsRoot : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function defaultOpenclawSqlitePath(): string {
   return path.join(openclawHome(), "state", "openclaw.sqlite");
 }
@@ -110,6 +230,18 @@ export class GatewayWsClient {
     };
   }
 
+  /** 普通 Skill 的所有读写操作共用这一个配置驱动的寻址入口。 */
+  private async resolveRegularSkillTarget(userId: string): Promise<string> {
+    const configPath = path.join(openclawHome(), "openclaw.json");
+    let config: unknown;
+    try {
+      config = JSON.parse(await fs.readFile(configPath, "utf-8"));
+    } catch (err: any) {
+      throw new Error(`无法读取 openclaw.json: ${err?.message || String(err)}`);
+    }
+    return resolveSkillInstallTarget(config, userId).skillsDir;
+  }
+
   constructor(options: WsClientOptions) {
     this.options = options;
   }
@@ -224,31 +356,29 @@ export class GatewayWsClient {
     });
   }
 
-  /**
-   * 扫描 OpenClaw 根目录下的 workspace-assistant-{userId} 目录。
-   * userId 必须是至少 5 位数字。
-   */
+  /** 从 openclaw.json 的 xg_cwork_im accounts 读取当前启用的 agent。 */
   private async scanAndReportAgents(isInitialReport: boolean) {
     if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
     
     try {
-      const rootPath = openclawHome();
-      let entries: string[] = [];
+      const configPath = path.join(openclawHome(), "openclaw.json");
+      let rawConfig: string;
       try {
-        entries = await fs.readdir(rootPath);
+        rawConfig = await fs.readFile(configPath, "utf-8");
       } catch (e) {
-        // 读目录失败通常是瞬时性的（磁盘抖动/权限/句柄耗尽等），不代表这台机器真的没有用户了。
-        // 跳过本轮上报、保留上次已知状态，等下一次扫描自然重试，避免把瞬时故障放大成
-        // "全部用户离线"（服务端收到空列表会把这台网关下所有用户标记 OFFLINE）。
-        this.appendLogToFile("WARN", "AgentScan", "OpenClaw home is not readable; skipping this scan cycle", e);
+        // 配置文件临时不可读时，保留上次成功读取的列表，避免把所有用户误报为离线。
+        this.appendLogToFile("WARN", "AgentScan", "OpenClaw config is not readable; skipping this scan cycle", e);
         return;
       }
 
-      const newAgentIds = new Set<string>();
-      for (const entry of entries) {
-        const agentId = parseAssistantWorkspaceAgentId(entry);
-        if (agentId) newAgentIds.add(agentId);
+      let config: unknown;
+      try {
+        config = JSON.parse(rawConfig);
+      } catch (e) {
+        this.appendLogToFile("WARN", "AgentScan", "OpenClaw config is invalid JSON; skipping this scan cycle", e);
+        return;
       }
+      const newAgentIds = new Set(enabledAgentIdsFromAccounts(config));
 
       let changed = false;
       if (newAgentIds.size !== this.currentAgentIds.size) {
@@ -450,8 +580,12 @@ export class GatewayWsClient {
       return;
     }
 
-    // 闭环完善：清理 code，并严格校验 userId，防止恶意指令通过 '../' 引发宿主机目录穿越攻击
-    const safeCode = code ? path.basename(code) : undefined;
+    // code 必须是单一路径段；不允许通过 basename 静默改写恶意输入。
+    const safeCode = normalizeCommandCode(code);
+    if (code !== undefined && !safeCode) {
+      this.reply(replyId, { success: false, message: `Invalid code: ${String(code)}`, action });
+      return;
+    }
 
     // 100% 确定性安全寻址：userId 只接受纯数字或 assistant-数字，且数字至少 5 位。
     const pureId = normalizeAssistantUserId(userId);
@@ -459,11 +593,10 @@ export class GatewayWsClient {
       this.reply(replyId, { success: false, message: `Invalid userId: ${userId}`, action });
       return;
     }
-    const targetDir = path.join(openclawHome(), `workspace-assistant-${pureId}`, "skills");
-
     try {
       if (action === "INSTALL_SKILL") {
         if (!safeCode) throw new Error("Missing code parameter");
+        const targetDir = await this.resolveRegularSkillTarget(userId);
         console.log(`[skill-logger-plugin][WS] Executing INSTALL for user ${userId}, code: ${safeCode}`);
         this.appendLogToFile("INFO", "Command", `INSTALL_SKILL received`, { userId, code: safeCode, version });
         const result = await this.options.updater.manualInstall({
@@ -478,6 +611,7 @@ export class GatewayWsClient {
 
       } else if (action === "UNINSTALL_SKILL") {
         if (!safeCode) throw new Error("Missing code parameter");
+        const targetDir = await this.resolveRegularSkillTarget(userId);
         console.log(`[skill-logger-plugin][WS] Executing UNINSTALL for user ${userId}, code: ${safeCode}`);
         this.appendLogToFile("INFO", "Command", `UNINSTALL_SKILL received`, { userId, code: safeCode });
         const skillPath = path.join(targetDir, safeCode);
@@ -485,6 +619,7 @@ export class GatewayWsClient {
         this.reply(replyId, { success: true, message: `Skill ${safeCode} removed`, action });
 
       } else if (action === "LIST_SKILLS") {
+        const targetDir = await this.resolveRegularSkillTarget(userId);
         let list: any[] = [];
         let targetDirExists = false;
         try {
@@ -585,16 +720,15 @@ export class GatewayWsClient {
         
         setTimeout(async () => {
           try {
+            // 延时期间配置可能变化；在真正写盘前重新校验 enabled 与 workspace。
+            const targetDir = await this.resolveRegularSkillTarget(userId);
             const additionalTargetDirs: string[] = syncBuiltInTemplate
               ? [path.join(openclawHome(), "workspace-xgjk-assistant-template", "skills")]
               : [];
 
             // 同步更新用户的 expert skill 目录
-            const userSkillDir = path.join(openclawHome(), `workspace-assistant-${pureId}`, ".user", "skills", safeCode);
-            try {
-              await fs.stat(userSkillDir);
-              additionalTargetDirs.push(userSkillDir);
-            } catch {} // 目录不存在则跳过
+            const userSkillRoot = await findInstalledExpertSkillsRoot(openclawHome(), pureId, safeCode);
+            if (userSkillRoot) additionalTargetDirs.push(userSkillRoot);
             const result = await this.options.updater.manualInstall({
               code: safeCode,
               url,
@@ -656,7 +790,7 @@ export class GatewayWsClient {
 
         if (!skipInstall) {
           await fs.mkdir(path.dirname(expertTarget), { recursive: true });
-          const expertResult = await this.options.updater.installZipFromUrl(downloadUrl, expertTarget);
+          const expertResult = await this.options.updater.installExpertZipFromUrl(downloadUrl, expertTarget);
           if (!expertResult.success) {
             throw new Error(`专家安装失败: ${expertResult.message}`);
           }
@@ -672,16 +806,26 @@ export class GatewayWsClient {
         const skillResults: string[] = [];
         if (Array.isArray(skills)) {
           for (const sk of skills) {
-            if (!sk.code || !sk.downloadUrl) {
-              skillResults.push(`${sk.code || 'unknown'}: 缺少下载地址`);
+            const skillCode = normalizeCommandCode(sk?.code);
+            if (!skillCode) {
+              skillResults.push(`${String(sk?.code || 'unknown')}: 失败 - 非法的 Skill code`);
+              continue;
+            }
+            if (!sk.downloadUrl) {
+              skillResults.push(`${skillCode}: 失败 - 缺少下载地址`);
               continue;
             }
             try {
-              const skTarget = path.join(skillTargetRoot, sk.code);
-              const result = await this.options.updater.installZipFromUrl(sk.downloadUrl, skTarget);
-              skillResults.push(`${sk.code}: ${result.success ? '成功' : '失败 - ' + result.message}`);
+              const result = await this.options.updater.manualInstall({
+                code: skillCode,
+                url: sk.downloadUrl,
+                version: sk.version,
+                force: true,
+                targetDir: skillTargetRoot,
+              });
+              skillResults.push(`${skillCode}: ${result.success ? '成功' : '失败 - ' + result.message}`);
             } catch (e: any) {
-              skillResults.push(`${sk.code}: 失败 - ${e.message}`);
+              skillResults.push(`${skillCode}: 失败 - ${e.message}`);
             }
           }
         }

package/dist/active-skills.js

@@ -1,67 +0,0 @@
-/**
- * 按 session 记录「已触发（激活）的 skill」，供 matcher 在通用命令（curl、共享 CLI）
- * 出现多候选时消歧——优先归属到本 session 已激活的 skill。
- *
- * 内存态，带 TTL + 容量上限，防止长跑 gateway 进程里无限增长。
- */
-const DEFAULT_TTL_MS = 30 * 60 * 1000; // 30 分钟
-const DEFAULT_MAX_SESSIONS = 500;
-export class ActiveSkills {
-    ttlMs;
-    maxSessions;
-    now;
-    /** sessionKey -> (skillName -> entry)。用 Map 保留插入顺序以便 LRU 淘汰。 */
-    bySession = new Map();
-    constructor(opts = {}) {
-        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
-        this.maxSessions = opts.maxSessions ?? DEFAULT_MAX_SESSIONS;
-        this.now = opts.now ?? Date.now;
-    }
-    /** 标记某 session 触发了某 skill。 */
-    markActive(sessionKey, skillName) {
-        const key = sessionKey || "__nosession__";
-        let skills = this.bySession.get(key);
-        if (!skills) {
-            skills = new Map();
-            this.bySession.set(key, skills);
-        }
-        else {
-            // 触碰即刷新 LRU 顺序
-            this.bySession.delete(key);
-            this.bySession.set(key, skills);
-        }
-        skills.set(skillName, { name: skillName, ts: this.now() });
-        this.evictIfNeeded();
-    }
-    /** 取某 session 当前仍在 TTL 内的已激活 skill 集合。 */
-    getActive(sessionKey) {
-        const key = sessionKey || "__nosession__";
-        const skills = this.bySession.get(key);
-        const out = new Set();
-        if (!skills)
-            return out;
-        const cutoff = this.now() - this.ttlMs;
-        for (const [name, entry] of skills) {
-            if (entry.ts >= cutoff)
-                out.add(name);
-            else
-                skills.delete(name);
-        }
-        if (skills.size === 0)
-            this.bySession.delete(key);
-        return out;
-    }
-    /** session 结束时清掉其激活记录（释放内存 + 避免跨会话误判）。 */
-    clearSession(sessionKey) {
-        this.bySession.delete(sessionKey || "__nosession__");
-    }
-    /** 超出 session 上限时，按 LRU 淘汰最旧的 session。 */
-    evictIfNeeded() {
-        while (this.bySession.size > this.maxSessions) {
-            const oldest = this.bySession.keys().next().value;
-            if (oldest === undefined)
-                break;
-            this.bySession.delete(oldest);
-        }
-    }
-}

package/dist/active-skills.test.js

@@ -1,29 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-import { ActiveSkills } from "./active-skills.ts";
-describe("ActiveSkills", () => {
-    it("标记并取回激活 skill", () => {
-        const a = new ActiveSkills();
-        a.markActive("s1", "skA");
-        a.markActive("s1", "skB");
-        assert.deepEqual([...a.getActive("s1")].sort(), ["skA", "skB"]);
-        assert.deepEqual([...a.getActive("s2")], []);
-    });
-    it("TTL 过期后不再返回", () => {
-        let t = 1000;
-        const a = new ActiveSkills({ ttlMs: 100, now: () => t });
-        a.markActive("s", "skA");
-        t = 1050;
-        assert.deepEqual([...a.getActive("s")], ["skA"]);
-        t = 2000;
-        assert.deepEqual([...a.getActive("s")], []);
-    });
-    it("超出 session 上限按 LRU 淘汰最旧", () => {
-        const a = new ActiveSkills({ maxSessions: 2 });
-        a.markActive("s1", "x");
-        a.markActive("s2", "x");
-        a.markActive("s3", "x"); // 淘汰 s1
-        assert.deepEqual([...a.getActive("s1")], []);
-        assert.deepEqual([...a.getActive("s3")], ["x"]);
-    });
-});