@spzhongwin/skill-logger-plugin 1.0.17 → 1.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spzhongwin/skill-logger-plugin",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "type": "module",
   "exports": "./dist/index.js",
   "scripts": {

package/src/ws-client.test.ts

@@ -13,6 +13,8 @@ import {
   readCronJobsByAgentId,
   findInstalledExpertSkillsRoot,
   shouldSyncBuiltInTemplate,
+  resolveGatewaySkillTarget,
+  isGatewaySkillCommand,
 } from "./ws-client.ts";
 
 describe("command code boundary", () => {
@@ -156,6 +158,20 @@ describe("built-in template update boundary", () => {
   });
 });
 
+describe("Gateway 公共 Skill 安装边界", () => {
+  it("固定安装到 OpenClaw 顶层 skills，不接受指令传入任意目录", () => {
+    assert.equal(resolveGatewaySkillTarget("/var/openclaw"), "/var/openclaw/skills");
+  });
+
+  it("仅允许 Skill 安装、更新和卸载使用 gateway 作用域", () => {
+    assert.equal(isGatewaySkillCommand("INSTALL_SKILL", "gateway"), true);
+    assert.equal(isGatewaySkillCommand("UPDATE_SKILL", "gateway"), true);
+    assert.equal(isGatewaySkillCommand("UNINSTALL_SKILL", "gateway"), true);
+    assert.equal(isGatewaySkillCommand("LIST_SKILLS", "gateway"), false);
+    assert.equal(isGatewaySkillCommand("UPDATE_SKILL", "agent"), false);
+  });
+});
+
 describe("expert skill update target", () => {
   it("返回 .user/skills 父目录，由安装器统一追加 skill code", async () => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-expert-skill-"));

package/src/ws-client.ts

@@ -140,6 +140,15 @@ export function shouldSyncBuiltInTemplate(action: string, isBuiltIn: unknown): b
   return action === "UPDATE_SKILL" && isBuiltIn === true;
 }
 
+export function resolveGatewaySkillTarget(home = openclawHome()): string {
+  return path.join(home, "skills");
+}
+
+export function isGatewaySkillCommand(action: unknown, installScope: unknown): boolean {
+  return installScope === "gateway"
+    && ["INSTALL_SKILL", "UPDATE_SKILL", "UNINSTALL_SKILL"].includes(String(action || ""));
+}
+
 export async function findInstalledExpertSkillsRoot(
   rootPath: string,
   pureId: string,
@@ -505,6 +514,7 @@ export class GatewayWsClient {
       agentIds: Array.from(this.currentAgentIds),
       clientTime: Date.now(),
       supportsBatch: true,
+      supportsGatewaySkillScope: true,
     }, "Heartbeat");
   }
 
@@ -537,7 +547,7 @@ export class GatewayWsClient {
    * 核心指令分发中心：完全跳过沙盒，基于 userId 直接进行底层物理文件操作
    */
   private async handleMessage(msg: any) {
-    const { action, userId, code, url, force, version, replyId, isBuiltIn } = msg;
+    const { action, userId, code, url, force, version, replyId, isBuiltIn, installScope } = msg;
     this.appendLogToFile("INFO", "Command", `Received WS message`, {
       action,
       userId,
@@ -545,6 +555,7 @@ export class GatewayWsClient {
       version,
       replyId,
       isBuiltIn,
+      installScope,
       hasDirectUrl: Boolean(url),
     });
 
@@ -587,16 +598,19 @@ export class GatewayWsClient {
       return;
     }
 
-    // 100% 确定性安全寻址：userId 只接受纯数字或 assistant-数字，且数字至少 5 位。
-    const pureId = normalizeAssistantUserId(userId);
-    if (!pureId) {
+    const gatewaySkillCommand = isGatewaySkillCommand(action, installScope);
+    // Gateway 公共 Skill 命令不依赖 Agent。其余命令继续执行严格的用户目录寻址。
+    const pureId = gatewaySkillCommand ? undefined : normalizeAssistantUserId(userId);
+    if (!gatewaySkillCommand && !pureId) {
       this.reply(replyId, { success: false, message: `Invalid userId: ${userId}`, action });
       return;
     }
     try {
       if (action === "INSTALL_SKILL") {
         if (!safeCode) throw new Error("Missing code parameter");
-        const targetDir = await this.resolveRegularSkillTarget(userId);
+        const targetDir = gatewaySkillCommand
+          ? resolveGatewaySkillTarget()
+          : await this.resolveRegularSkillTarget(userId);
         console.log(`[skill-logger-plugin][WS] Executing INSTALL for user ${userId}, code: ${safeCode}`);
         this.appendLogToFile("INFO", "Command", `INSTALL_SKILL received`, { userId, code: safeCode, version });
         const result = await this.options.updater.manualInstall({
@@ -607,113 +621,111 @@ export class GatewayWsClient {
           targetDir,
           trace: this.createInstallTrace({ action, replyId, userId, code: safeCode }),
         });
-        this.reply(replyId, { success: result.success, message: result.message, action });
+        this.reply(replyId, {
+          success: result.success, message: result.message, action,
+          data: {code: safeCode, version, installScope: gatewaySkillCommand ? "gateway" : "agent"},
+        });
 
       } else if (action === "UNINSTALL_SKILL") {
         if (!safeCode) throw new Error("Missing code parameter");
-        const targetDir = await this.resolveRegularSkillTarget(userId);
+        const targetDir = gatewaySkillCommand
+          ? resolveGatewaySkillTarget()
+          : await this.resolveRegularSkillTarget(userId);
         console.log(`[skill-logger-plugin][WS] Executing UNINSTALL for user ${userId}, code: ${safeCode}`);
         this.appendLogToFile("INFO", "Command", `UNINSTALL_SKILL received`, { userId, code: safeCode });
         const skillPath = path.join(targetDir, safeCode);
         await fs.rm(skillPath, { recursive: true, force: true });
-        this.reply(replyId, { success: true, message: `Skill ${safeCode} removed`, action });
+        this.reply(replyId, {
+          success: true, message: `Skill ${safeCode} removed`, action,
+          data: {code: safeCode, installScope: gatewaySkillCommand ? "gateway" : "agent", removed: true},
+        });
 
       } else if (action === "LIST_SKILLS") {
-        const targetDir = await this.resolveRegularSkillTarget(userId);
-        let list: any[] = [];
-        let targetDirExists = false;
-        try {
-          const targetStat = await fs.stat(targetDir);
-          targetDirExists = targetStat.isDirectory();
-        } catch (err: any) {
-          if (err?.code !== "ENOENT") throw err;
-        }
-        if (!targetDirExists) {
-          throw new Error(`Target skills directory does not exist: ${targetDir}`);
-        }
-
-        const entries = await fs.readdir(targetDir, { withFileTypes: true });
-        
-        const dirs = entries.filter(e => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith("."));
-        
-        for (const e of dirs) {
-          const skillDir = path.join(targetDir, e.name);
-          const skillMdPath = path.join(skillDir, 'SKILL.md');
-          
+        const regularTargetDir = await this.resolveRegularSkillTarget(userId);
+
+        // 用户视角的有效 Skill = Agent workspace Skill + Gateway 顶层公共 Skill。
+        // 同 code 时公共内置版本后写覆盖，确保不会被快照差分误判为缺失。
+        const skillsByCode = new Map<string, any>();
+        const sources = [
+          {dir: regularTargetDir, gatewayBuiltIn: false},
+          {dir: resolveGatewaySkillTarget(), gatewayBuiltIn: true},
+        ];
+        for (const source of sources) {
+          let entries;
           try {
-            const stat = await fs.stat(skillMdPath);
-            if (!stat.isFile()) continue;
-          } catch (err) {
-            continue;
+            entries = await fs.readdir(source.dir, {withFileTypes: true});
+          } catch (err: any) {
+            // 新用户的 Agent 私有目录尚未创建时，仍必须返回 Gateway 公共内置 Skill。
+            if (err?.code === "ENOENT") continue;
+            throw err;
           }
-          
-          const metaPath = path.join(skillDir, '.meta.json');
-          let isPlatform = false;
-          let isBuiltIn = e.isSymbolicLink();
-          let metaData: any = null;
-          let name = e.name;
-          let description = "";
-          let skillVersion = "";
-
-          try {
-            const mdContent = await fs.readFile(skillMdPath, 'utf8');
-            const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(mdContent)?.[1] ?? "";
-            const parsedName = /(^|\n)name:\s*(.+)/.exec(fm)?.[2]?.trim();
-            if (parsedName) name = parsedName;
-
-            const descMatch = /(^|\n)description:\s*(?:>\s*\n\s*)?(.*?)(?=\n[a-z]+:|\n---|$)/is.exec(fm);
-            if (descMatch && descMatch[2]) {
-               description = descMatch[2].replace(/\n\s+/g, ' ').trim();
+          const dirs = entries.filter(e => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith("."));
+          for (const e of dirs) {
+            const skillDir = path.join(source.dir, e.name);
+            const skillMdPath = path.join(skillDir, "SKILL.md");
+            try {
+              const stat = await fs.stat(skillMdPath);
+              if (!stat.isFile()) continue;
+            } catch {
+              continue;
             }
-          } catch (err) {}
-          
-          try {
-            const metaContent = await fs.readFile(metaPath, 'utf8');
-            const parsed = JSON.parse(metaContent);
-            if (parsed) {
-              if (parsed.ownerId === 'CMS' || parsed.ownerId === 'CMS_COMPAT') isPlatform = true;
-              if (parsed.isBuiltIn === true || parsed.ownerId === 'built-in') isBuiltIn = true;
-              metaData = parsed;
+
+            const metaPath = path.join(skillDir, ".meta.json");
+            let isPlatform = source.gatewayBuiltIn;
+            let isBuiltIn = source.gatewayBuiltIn || e.isSymbolicLink();
+            let metaData: any = null;
+            let name = e.name;
+            let description = "";
+            let skillVersion = "";
+
+            try {
+              const mdContent = await fs.readFile(skillMdPath, "utf8");
+              const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(mdContent)?.[1] ?? "";
+              const parsedName = /(^|\n)name:\s*(.+)/.exec(fm)?.[2]?.trim();
+              if (parsedName) name = parsedName;
+              const descMatch = /(^|\n)description:\s*(?:>\s*\n\s*)?(.*?)(?=\n[a-z]+:|\n---|$)/is.exec(fm);
+              if (descMatch?.[2]) description = descMatch[2].replace(/\n\s+/g, " ").trim();
+            } catch {}
+
+            try {
+              const parsed = JSON.parse(await fs.readFile(metaPath, "utf8"));
+              if (parsed) {
+                if (parsed.ownerId === "CMS" || parsed.ownerId === "CMS_COMPAT") isPlatform = true;
+                if (parsed.isBuiltIn === true || parsed.ownerId === "built-in") isBuiltIn = true;
+                metaData = parsed;
+              }
+            } catch {}
+
+            const resolvedVersion = await readSkillVersion(skillDir);
+            if (resolvedVersion) skillVersion = resolvedVersion;
+
+            if (isPlatform) {
+              skillsByCode.set(e.name, {
+                code: e.name, isPlatform: true, isBuiltIn, version: skillVersion,
+                name, description, publishedAt: metaData?.publishedAt,
+              });
+            } else {
+              skillsByCode.set(e.name, {
+                code: e.name, isPlatform: false, isBuiltIn, version: skillVersion,
+                name, description,
+              });
             }
-          } catch (err) {}
-
-          const resolvedVersion = await readSkillVersion(skillDir);
-          if (resolvedVersion) skillVersion = resolvedVersion;
-          
-          if (isPlatform) {
-            list.push({
-              code: e.name,
-              isPlatform: true,
-              isBuiltIn: isBuiltIn,
-              version: skillVersion,
-              name,
-              description,
-              publishedAt: metaData?.publishedAt
-            });
-          } else {
-            list.push({
-              code: e.name,
-              isPlatform: false,
-              isBuiltIn: isBuiltIn,
-              version: skillVersion,
-              name: name,
-              description: description
-            });
           }
         }
-        this.reply(replyId, { success: true, data: list, action });
+        this.reply(replyId, { success: true, data: [...skillsByCode.values()], action });
 
       } else if (action === "UPDATE_SKILL") {
         if (!safeCode) throw new Error("Missing code parameter");
         // 更新可能是大批量广播，增加防阻塞的随机延时 (0~5秒)
         const delayMs = Math.random() * 5000;
-        const syncBuiltInTemplate = shouldSyncBuiltInTemplate(action, isBuiltIn);
+        const syncBuiltInTemplate = !gatewaySkillCommand && shouldSyncBuiltInTemplate(action, isBuiltIn);
         console.log(`[skill-logger-plugin][WS] Scheduled UPDATE for user ${userId}, code: ${safeCode} in ${Math.round(delayMs)}ms`);
         this.appendLogToFile("INFO", "Command", `Scheduled UPDATE_SKILL`, {
           userId,
           code: safeCode,
           version,
           isBuiltIn,
+          installScope,
           syncBuiltInTemplate,
           delayMs: Math.round(delayMs),
         });
@@ -721,13 +733,17 @@ export class GatewayWsClient {
         setTimeout(async () => {
           try {
             // 延时期间配置可能变化；在真正写盘前重新校验 enabled 与 workspace。
-            const targetDir = await this.resolveRegularSkillTarget(userId);
+            const targetDir = gatewaySkillCommand
+              ? resolveGatewaySkillTarget()
+              : await this.resolveRegularSkillTarget(userId);
             const additionalTargetDirs: string[] = syncBuiltInTemplate
               ? [path.join(openclawHome(), "workspace-xgjk-assistant-template", "skills")]
               : [];
 
             // 同步更新用户的 expert skill 目录
-            const userSkillRoot = await findInstalledExpertSkillsRoot(openclawHome(), pureId, safeCode);
+            const userSkillRoot = pureId
+              ? await findInstalledExpertSkillsRoot(openclawHome(), pureId, safeCode)
+              : undefined;
             if (userSkillRoot) additionalTargetDirs.push(userSkillRoot);
             const result = await this.options.updater.manualInstall({
               code: safeCode,
@@ -754,7 +770,10 @@ export class GatewayWsClient {
               syncBuiltInTemplate,
             });
             if (replyId) {
-              this.reply(replyId, { success: result.success, message: result.message, action });
+              this.reply(replyId, {
+                success: result.success, message: result.message, action,
+                data: {code: safeCode, version, installScope: gatewaySkillCommand ? "gateway" : "agent"},
+              });
             }
           } catch (e: any) {
             this.appendLogToFile("ERROR", "Command", `UPDATE_SKILL threw`, {