@spzhongwin/skill-logger-plugin 1.0.4 → 1.0.6

package/dist/index.js

@@ -141,6 +141,9 @@ function parseSkillVersion(content) {
 // src/updater.ts
 var execFileAsync = promisify(execFile);
 var ATTEMPT_COOLDOWN_MS = 30 * 60 * 1e3;
+function skillIdentityHash(code, version) {
+  return createHash("sha256").update(`${code} ${code} ${version}`).digest("hex");
+}
 async function systemUnzip(zipPath, destDir) {
   await fs3.mkdir(destDir, { recursive: true });
   await execFileAsync("unzip", ["-o", "-q", zipPath, "-d", destDir]);
@@ -259,6 +262,13 @@ var SkillUpdater = class {
         console.warn(`[skill-logger-plugin] ${skillName}@${version} \u4E0B\u8F7D\u5305\u65E0\u7248\u672C\u53F7\uFF0C\u653E\u5F03\u8986\u76D6`);
         return;
       }
+      if (dl.sha256) {
+        const actualHash = skillIdentityHash(skillName, packageVersion);
+        if (actualHash !== dl.sha256) {
+          console.warn(`[skill-logger-plugin] ${skillName}@${version} \u8EAB\u4EFD\u54C8\u5E0C\u4E0D\u4E00\u81F4\uFF0C\u653E\u5F03\u8986\u76D6`);
+          return;
+        }
+      }
       const metaPath = path3.join(srcRoot, ".meta.json");
       if (!await this.exists(metaPath)) {
         this.debug(`[skill-logger-plugin] \u4E3A ${skillName}@${version} \u81EA\u52A8\u751F\u6210 .meta.json`);
@@ -299,8 +309,9 @@ var SkillUpdater = class {
     const data = await res.json();
     const url = typeof data?.url === "string" ? data.url : typeof data?.downloadUrl === "string" ? data.downloadUrl : void 0;
     const resolvedVersion = typeof data?.version === "string" ? data.version : void 0;
+    const sha256 = typeof data?.sha256 === "string" ? data.sha256 : void 0;
     if (!url) return void 0;
-    return { url, version: resolvedVersion };
+    return { url, version: resolvedVersion, sha256 };
   }
   /** 在解压目录里定位含 SKILL.md 的目录（兼容包内是否带顶层目录）。深度上限 2。 */
   async locateSkillRoot(dir, depth) {
@@ -774,6 +785,44 @@ function defaultFetch(timeoutMs = DEFAULT_TIMEOUT_MS) {
   };
 }
 
+// src/semver.ts
+function parseCore(v) {
+  const core = v.trim().replace(/^[vV]/, "").split(/[-+]/, 1)[0];
+  if (!core) return null;
+  const parts = core.split(".");
+  const nums = [];
+  for (const p of parts) {
+    if (!/^\d+$/.test(p)) return null;
+    nums.push(Number(p));
+  }
+  return nums.length > 0 ? nums : null;
+}
+function compareVersions(a, b) {
+  const na = parseCore(a);
+  const nb = parseCore(b);
+  if (na && nb) {
+    const len = Math.max(na.length, nb.length);
+    for (let i = 0; i < len; i++) {
+      const x = na[i] ?? 0;
+      const y = nb[i] ?? 0;
+      if (x < y) return -1;
+      if (x > y) return 1;
+    }
+    return 0;
+  }
+  const sa = a.trim();
+  const sb = b.trim();
+  if (sa === sb) return 0;
+  return sa < sb ? -1 : 1;
+}
+function isOutdated(local, latest) {
+  if (!local || !latest) return false;
+  const na = parseCore(local);
+  const nb = parseCore(latest);
+  if (na && nb) return compareVersions(local, latest) < 0;
+  return local.trim() !== latest.trim();
+}
+
 // src/config-sync.ts
 var MAX_SCAN_DEPTH = 6;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".cache"]);
@@ -919,6 +968,60 @@ var ConfigSync = class {
   getInstallations() {
     return this.installations;
   }
+  /** 基于最近一次版本检查结果，找出所有本地版本落后的安装副本。 */
+  detectOutdated() {
+    const out = [];
+    for (const [skillName, copies] of this.installations) {
+      const cfg = this.configs.get(skillName);
+      const latestVersion = this.latestVersions.get(skillName) || cfg?.latestVersion || cfg?.version;
+      if (!latestVersion) continue;
+      for (const copy of copies) {
+        if (!isOutdated(copy.version, latestVersion)) continue;
+        out.push({
+          skillName,
+          rootDir: copy.rootDir,
+          localVersion: copy.version || "",
+          latestVersion
+        });
+      }
+    }
+    return out;
+  }
+  /** 扫描本地安装副本，拉取平台最新版本，检测落后副本并按配置触发自动更新。 */
+  async checkVersionsAndUpdate() {
+    if (this.checkingVersions) return;
+    this.checkingVersions = true;
+    try {
+      const installed = await this.scanInstalledSkills();
+      this.scanCache = { ts: Date.now(), skills: installed };
+      if (installed.length > 0) {
+        const { ok, configs } = await this.pullConfigs(
+          installed.map((s) => ({ name: s.name, version: s.version }))
+        );
+        if (ok) {
+          for (const cfg of configs) {
+            const latestVersion = cfg.latestVersion || cfg.version;
+            if (latestVersion) this.latestVersions.set(cfg.skillName, latestVersion);
+            if (cfg.version) {
+              this.configPool.set(`${cfg.skillName}@${cfg.version}`, cfg);
+              if (!this.configs.has(cfg.skillName)) this.configs.set(cfg.skillName, cfg);
+            }
+          }
+        }
+      }
+      const outdated = this.detectOutdated();
+      if (outdated.length > 0 && this.updater) {
+        await this.updater.applyUpdates(outdated);
+        const refreshed = await this.scanInstalledSkills();
+        this.scanCache = { ts: Date.now(), skills: refreshed };
+      }
+      await this.persist();
+    } catch (err) {
+      console.warn("[skill-logger-plugin] checkVersionsAndUpdate \u5F02\u5E38", err);
+    } finally {
+      this.checkingVersions = false;
+    }
+  }
   /** lazyCheck 专用：命中短 TTL 缓存则跳过整树遍历；reconcile 不走此路径，始终全新扫描。 */
   async scanInstalledSkillsCached() {
     const now = Date.now();
@@ -1418,6 +1521,22 @@ import fs6 from "fs/promises";
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var HEARTBEAT_ACK_TIMEOUT_MS = 75e3;
 var AGENT_SCAN_INTERVAL_MS = 3 * 60 * 1e3;
+var ASSISTANT_WORKSPACE_PREFIX = "workspace-assistant-";
+var ASSISTANT_AGENT_PREFIX = "assistant-";
+var ASSISTANT_WORKSPACE_ID_RE = /^\d{5,}$/;
+function parseAssistantWorkspaceAgentId(entryName) {
+  if (!entryName.startsWith(ASSISTANT_WORKSPACE_PREFIX)) return void 0;
+  const suffix = entryName.slice(ASSISTANT_WORKSPACE_PREFIX.length);
+  if (!ASSISTANT_WORKSPACE_ID_RE.test(suffix)) return void 0;
+  return `${ASSISTANT_AGENT_PREFIX}${suffix}`;
+}
+function normalizeAssistantUserId(userId) {
+  const safeUserId = path7.basename(userId);
+  if (safeUserId !== userId) return void 0;
+  const pureId = safeUserId.startsWith(ASSISTANT_AGENT_PREFIX) ? safeUserId.slice(ASSISTANT_AGENT_PREFIX.length) : safeUserId;
+  if (!ASSISTANT_WORKSPACE_ID_RE.test(pureId)) return void 0;
+  return pureId;
+}
 var GatewayWsClient = class {
   ws = null;
   options;
@@ -1543,7 +1662,8 @@ var GatewayWsClient = class {
     });
   }
   /**
-   * 扫描 OpenClaw 根目录下的 workspace-assistant-{userId} 目录
+   * 扫描 OpenClaw 根目录下的 workspace-assistant-{userId} 目录。
+   * userId 必须是至少 5 位数字。
    */
   async scanAndReportAgents(isInitialReport) {
     if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
@@ -1560,12 +1680,8 @@ var GatewayWsClient = class {
       }
       const newAgentIds = /* @__PURE__ */ new Set();
       for (const entry of entries) {
-        if (entry.startsWith("workspace-assistant-")) {
-          const suffix = entry.replace("workspace-assistant-", "").trim();
-          if (suffix && suffix === path7.basename(suffix) && !suffix.startsWith(".")) {
-            newAgentIds.add(`assistant-${suffix}`);
-          }
-        }
+        const agentId = parseAssistantWorkspaceAgentId(entry);
+        if (agentId) newAgentIds.add(agentId);
       }
       let changed = false;
       if (newAgentIds.size !== this.currentAgentIds.size) {
@@ -1708,9 +1824,12 @@ var GatewayWsClient = class {
       this.appendLogToFile("WARN", "Command", `Message dropped: missing action or userId`, msg);
       return;
     }
-    const safeUserId = path7.basename(userId);
     const safeCode = code ? path7.basename(code) : void 0;
-    const pureId = safeUserId.replace(/^assistant-/, "");
+    const pureId = normalizeAssistantUserId(userId);
+    if (!pureId) {
+      this.reply(replyId, { success: false, message: `Invalid userId: ${userId}`, action });
+      return;
+    }
     const targetDir = path7.join(openclawHome(), `workspace-assistant-${pureId}`, "skills");
     try {
       if (action === "INSTALL_SKILL") {
@@ -1828,6 +1947,48 @@ var GatewayWsClient = class {
             if (replyId) this.reply(replyId, { success: false, message: e.message, action });
           }
         }, delayMs);
+      } else if (action === "GET_EXPERT_REGISTRY") {
+        console.log(`[skill-logger-plugin][WS] Executing GET_EXPERT_REGISTRY for user ${userId}`);
+        this.appendLogToFile("INFO", "Command", `GET_EXPERT_REGISTRY received`, { userId });
+        const registryFilePath = path7.join(openclawHome(), `workspace-assistant-${pureId}`, ".openclaw", "userskill", "expert-registry.yaml");
+        let content = "";
+        let fileExists = false;
+        try {
+          const stat = await fs6.stat(registryFilePath);
+          fileExists = stat.isFile();
+        } catch (err) {
+          if (err?.code !== "ENOENT") throw err;
+        }
+        if (fileExists) {
+          content = await fs6.readFile(registryFilePath, "utf8");
+          const expertsList = [];
+          const lines = content.split("\n");
+          let currentExpert = null;
+          for (const line of lines) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith("#")) continue;
+            const idMatch = line.match(/^\s*-\s*id:\s*(.+)$/);
+            if (idMatch) {
+              if (currentExpert && currentExpert.id) expertsList.push(currentExpert);
+              currentExpert = { id: idMatch[1].trim() };
+              continue;
+            }
+            if (currentExpert) {
+              const nameMatch = line.match(/^\s*name:\s*(.+)$/);
+              if (nameMatch) {
+                currentExpert.name = nameMatch[1].trim();
+              }
+              const descMatch = line.match(/^\s*description:\s*(.+)$/);
+              if (descMatch) {
+                currentExpert.description = descMatch[1].trim();
+              }
+            }
+          }
+          if (currentExpert && currentExpert.id) expertsList.push(currentExpert);
+          this.reply(replyId, { success: true, data: expertsList, action });
+        } else {
+          this.reply(replyId, { success: false, message: `\u672A\u627E\u5230\u7528\u6237\u6280\u80FD\u914D\u7F6E\u6587\u4EF6\uFF0C\u53EF\u80FD\u5C1A\u672A\u6CE8\u518C\u6216\u6587\u4EF6\u5DF2\u4E22\u5931`, action });
+        }
       } else {
         console.warn(`[skill-logger-plugin][WS] Unknown action: ${action}`);
         this.appendLogToFile("WARN", "Command", `Unknown action: ${action}`);
@@ -1879,6 +2040,71 @@ function extractAppKey(event, ctx) {
     return void 0;
   }
 }
+function asRecord(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+function stringifyErrorValue(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (typeof value === "string") return value;
+  if (value instanceof Error) return value.stack || value.message;
+  const obj = asRecord(value);
+  if (obj) {
+    for (const key of ["message", "error", "errorMessage", "error_message", "stderr"]) {
+      const nested = stringifyErrorValue(obj[key]);
+      if (nested) return nested;
+    }
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return String(value);
+    }
+  }
+  return String(value);
+}
+function hasFailureSignal(event) {
+  const records = [
+    event,
+    asRecord(event.result),
+    asRecord(event.output),
+    asRecord(event.response),
+    asRecord(event.data)
+  ].filter(Boolean);
+  for (const record of records) {
+    const status = String(record.status ?? record.state ?? "").toLowerCase();
+    if (["error", "failed", "failure"].includes(status)) return true;
+    if (record.success === false || record.ok === false || record.isError === true) return true;
+  }
+  return false;
+}
+function extractToolError(event) {
+  for (const key of ["error", "errorMessage", "error_message"]) {
+    const direct = stringifyErrorValue(event[key]);
+    if (direct) return direct;
+  }
+  for (const key of ["result", "output", "response", "data"]) {
+    const obj = asRecord(event[key]);
+    if (!obj) continue;
+    for (const nestedKey of ["error", "errorMessage", "error_message"]) {
+      const nested = stringifyErrorValue(obj[nestedKey]);
+      if (nested) return nested;
+    }
+  }
+  if (hasFailureSignal(event)) {
+    for (const key of ["message", "stderr", "result", "output", "response", "data"]) {
+      const fallback = stringifyErrorValue(event[key]);
+      if (fallback) return fallback;
+    }
+    return "tool call reported failure";
+  }
+  return void 0;
+}
+function extractDurationMs(event) {
+  for (const key of ["durationMs", "duration_ms", "elapsedMs", "elapsed_ms"]) {
+    const value = event[key];
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+  }
+  return void 0;
+}
 var Hooks = class {
   pending = /* @__PURE__ */ new Map();
   sessionAppKeys = /* @__PURE__ */ new Map();
@@ -1915,14 +2141,14 @@ var Hooks = class {
     return {
       event_id: randomUUID2(),
       event_type: "function_call",
-      skill_name: p.res.skillName,
-      skill_version: p.res.skillVersion,
-      function_id: p.res.functionId,
-      function_name: p.res.functionName,
-      match_type: p.res.matchType,
+      skill_name: p.skillName,
+      skill_version: p.skillVersion,
+      function_id: p.functionId,
+      function_name: p.functionName,
+      match_type: p.matchType,
       invoke_tool: p.invokeTool,
       command: p.command,
-      args: p.res.args,
+      args: p.args,
       status,
       error_message: error,
       duration_ms: durationMs,
@@ -1969,6 +2195,7 @@ var Hooks = class {
       this.sweepStalePending();
       const toolName = event.toolName;
       const params = event.params ?? {};
+      const toolCallId = event.toolCallId;
       const sk = this.sessionKeyOf(ctx);
       let appKey = void 0;
       if (sk) {
@@ -1985,6 +2212,19 @@ var Hooks = class {
         if (!skillName) return;
         this.debug(`Intercepted explicit 'skill' tool call for: ${skillName}`);
         this.recordTrigger(skillName, "tool", "skill", ctx, appKey);
+        if (toolCallId) {
+          this.pending.set(toolCallId, {
+            skillName,
+            skillVersion: this.configSync.getVersion(skillName),
+            invokeTool: toolName,
+            sessionId: this.sessionKeyOf(ctx),
+            agentId: ctx.agentId,
+            runId: ctx.runId,
+            appKey,
+            ts: Date.now()
+          });
+          this.capPending();
+        }
         return;
       }
       if (toolName === "read") {
@@ -2002,14 +2242,18 @@ var Hooks = class {
       const command = typeof params.command === "string" ? params.command : void 0;
       if (!res) {
         this.debug(`Tool call '${toolName}' did not match any function config.`);
-        this.maybeRecordUnattributed(toolName, command, active, ctx, appKey);
+        this.maybeRecordUnattributed(toolName, command, active, ctx, appKey, toolCallId);
         return;
       }
       this.debug(`Tool call '${toolName}' matched function ID: ${res.functionId} (${res.skillName}@${res.skillVersion})`);
-      const toolCallId = event.toolCallId;
       if (toolCallId) {
         this.pending.set(toolCallId, {
-          res,
+          skillName: res.skillName,
+          skillVersion: res.skillVersion,
+          functionId: res.functionId,
+          functionName: res.functionName,
+          matchType: res.matchType,
+          args: res.args,
           command,
           invokeTool: toolName,
           sessionId: this.sessionKeyOf(ctx),
@@ -2033,8 +2277,8 @@ var Hooks = class {
       const p = this.pending.get(toolCallId);
       if (!p) return;
       this.pending.delete(toolCallId);
-      const error = event.error;
-      const durationMs = typeof event.durationMs === "number" ? event.durationMs : void 0;
+      const error = extractToolError(event);
+      const durationMs = extractDurationMs(event);
       const appKey = p.appKey || extractAppKey(event, {});
       this.debug(`After tool call [${toolCallId}]: Status ${error ? "error" : "success"}, Duration ${durationMs}ms`);
       this.emitPending(p, error ? "error" : "success", error, durationMs, appKey);
@@ -2113,11 +2357,26 @@ var Hooks = class {
     };
   }
   /** 可选：无法归属到功能点时，若开启 recordUnattributed 且恰有一个激活 skill，记一条通用 exec。 */
-  maybeRecordUnattributed(toolName, command, active, ctx, appKey) {
+  maybeRecordUnattributed(toolName, command, active, ctx, appKey, toolCallId) {
     if (this.getConfig().recordUnattributed === false) return;
     if (toolName !== "exec" || active.size !== 1) return;
     const skillName = [...active][0];
     this.debug(`Recording unattributed function_call for skill: ${skillName}`);
+    if (toolCallId) {
+      this.pending.set(toolCallId, {
+        skillName,
+        skillVersion: this.configSync.getVersion(skillName),
+        invokeTool: toolName,
+        command,
+        appKey,
+        sessionId: this.sessionKeyOf(ctx),
+        agentId: ctx.agentId,
+        runId: ctx.runId,
+        ts: Date.now()
+      });
+      this.capPending();
+      return;
+    }
     this.emit({
       event_id: randomUUID2(),
       event_type: "function_call",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spzhongwin/skill-logger-plugin",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "type": "module",
   "exports": "./dist/index.js",
   "scripts": {
@@ -13,7 +13,9 @@
       "./dist/index.js"
     ],
     "contracts": {
-      "tools": ["report_skill_error"]
+      "tools": [
+        "report_skill_error"
+      ]
     },
     "compat": {
       "pluginApi": ">=2026.3.28",
@@ -32,4 +34,4 @@
   "dependencies": {
     "ws": "^8.21.0"
   }
-}
+}

package/src/config-sync.ts

@@ -226,6 +226,65 @@ export class ConfigSync {
     return this.installations;
   }
 
+  /** 基于最近一次版本检查结果，找出所有本地版本落后的安装副本。 */
+  detectOutdated(): OutdatedCopy[] {
+    const out: OutdatedCopy[] = [];
+    for (const [skillName, copies] of this.installations) {
+      const cfg = this.configs.get(skillName);
+      const latestVersion = this.latestVersions.get(skillName) || cfg?.latestVersion || cfg?.version;
+      if (!latestVersion) continue;
+      for (const copy of copies) {
+        if (!isOutdated(copy.version, latestVersion)) continue;
+        out.push({
+          skillName,
+          rootDir: copy.rootDir,
+          localVersion: copy.version || "",
+          latestVersion,
+        });
+      }
+    }
+    return out;
+  }
+
+  /** 扫描本地安装副本，拉取平台最新版本，检测落后副本并按配置触发自动更新。 */
+  async checkVersionsAndUpdate(): Promise<void> {
+    if (this.checkingVersions) return;
+    this.checkingVersions = true;
+    try {
+      const installed = await this.scanInstalledSkills();
+      this.scanCache = { ts: Date.now(), skills: installed };
+
+      if (installed.length > 0) {
+        const { ok, configs } = await this.pullConfigs(
+          installed.map((s) => ({ name: s.name, version: s.version }))
+        );
+        if (ok) {
+          for (const cfg of configs) {
+            const latestVersion = cfg.latestVersion || cfg.version;
+            if (latestVersion) this.latestVersions.set(cfg.skillName, latestVersion);
+            if (cfg.version) {
+              this.configPool.set(`${cfg.skillName}@${cfg.version}`, cfg);
+              if (!this.configs.has(cfg.skillName)) this.configs.set(cfg.skillName, cfg);
+            }
+          }
+        }
+      }
+
+      const outdated = this.detectOutdated();
+      if (outdated.length > 0 && this.updater) {
+        await this.updater.applyUpdates(outdated);
+        const refreshed = await this.scanInstalledSkills();
+        this.scanCache = { ts: Date.now(), skills: refreshed };
+      }
+
+      await this.persist();
+    } catch (err) {
+      console.warn("[skill-logger-plugin] checkVersionsAndUpdate 异常", err);
+    } finally {
+      this.checkingVersions = false;
+    }
+  }
+
   /** lazyCheck 专用：命中短 TTL 缓存则跳过整树遍历；reconcile 不走此路径，始终全新扫描。 */
   private async scanInstalledSkillsCached(): Promise<InstalledSkill[]> {
     const now = Date.now();

package/src/hooks.test.ts

@@ -61,6 +61,26 @@ describe("Hooks 端到端串联", () => {
     assert.ok(activeSkills.getActive("s1").has("model-usage"));
   });
 
+  it("skill 工具直调有 toolCallId 时 after 报错 → 补记 function_call(error)", async () => {
+    const { hooks, captured } = setup();
+    hooks.onBeforeToolCall(
+      { toolName: "skill", params: { skill: "model-usage" }, toolCallId: "skill-t1" },
+      { sessionId: "s1" }
+    );
+    hooks.onAfterToolCall({ toolCallId: "skill-t1", errorMessage: "skill failed", elapsedMs: 9 });
+    await tick();
+
+    assert.equal(captured.length, 2);
+    assert.equal(captured[0].event_type, "skill_trigger");
+    const call = captured[1];
+    assert.equal(call.event_type, "function_call");
+    assert.equal(call.skill_name, "model-usage");
+    assert.equal(call.invoke_tool, "skill");
+    assert.equal(call.status, "error");
+    assert.equal(call.error_message, "skill failed");
+    assert.equal(call.duration_ms, 9);
+  });
+
   it("after 未到达：flushAllPending 补记 unknown", async () => {
     const { hooks, captured } = setup();
     hooks.onBeforeToolCall(
@@ -125,6 +145,81 @@ describe("Hooks 端到端串联", () => {
     assert.equal(captured[0].error_message, "boom");
   });
 
+  it("after 的结构化错误与失败状态也会归为 error", async () => {
+    const { hooks, captured } = setup();
+    hooks.onBeforeToolCall(
+      { toolName: "exec", params: { command: "python /e/skills/model-usage/scripts/model_usage.py --mode current" }, toolCallId: "t4" },
+      { sessionId: "s1" }
+    );
+    await tick();
+    hooks.onAfterToolCall({ toolCallId: "t4", status: "failed", message: "process failed", duration_ms: 7 });
+    await tick();
+    assert.equal(captured[0].status, "error");
+    assert.equal(captured[0].error_message, "process failed");
+    assert.equal(captured[0].duration_ms, 7);
+  });
+
+  it("after 的嵌套 result 失败信号会提取 stderr", async () => {
+    const { hooks, captured } = setup();
+    hooks.onBeforeToolCall(
+      { toolName: "exec", params: { command: "python /e/skills/model-usage/scripts/model_usage.py --mode current" }, toolCallId: "t6" },
+      { sessionId: "s1" }
+    );
+    await tick();
+    hooks.onAfterToolCall({ toolCallId: "t6", result: { ok: false, stderr: "stderr failed" } });
+    await tick();
+    assert.equal(captured[0].status, "error");
+    assert.equal(captured[0].error_message, "stderr failed");
+  });
+
+  it("未匹配 exec 但会话中只有一个激活 skill → 等 after 补记状态和错误", async () => {
+    const { hooks, captured } = setup();
+    hooks.onBeforeToolCall({ toolName: "read", params: { path: "/e/skills/model-usage/SKILL.md" } }, { sessionId: "s1" });
+    await tick();
+    captured.length = 0;
+
+    hooks.onBeforeToolCall(
+      { toolName: "exec", params: { command: "custom command --bad" }, toolCallId: "t5" },
+      { sessionId: "s1" }
+    );
+    await tick();
+    assert.equal(captured.length, 0);
+
+    hooks.onAfterToolCall({ toolCallId: "t5", error: { message: "custom failed" }, durationMs: 11 });
+    await tick();
+    assert.equal(captured.length, 1);
+    assert.equal(captured[0].event_type, "function_call");
+    assert.equal(captured[0].skill_name, "model-usage");
+    assert.equal(captured[0].invoke_tool, "exec");
+    assert.equal(captured[0].command, "custom command --bad");
+    assert.equal(captured[0].status, "error");
+    assert.equal(captured[0].error_message, "custom failed");
+    assert.equal(captured[0].duration_ms, 11);
+  });
+
+  it("report_skill_error 手动上报会记录 error 事件并携带会话 appKey", async () => {
+    const { hooks, captured } = setup();
+    hooks.onMessageReceived({ content: "appKey: abcdef123456" }, { sessionId: "s1" });
+    hooks.onManualErrorRecord(
+      {
+        skill_name: "model-usage",
+        tool_name: "usage_current",
+        error_message: "manual failure",
+        input_args: "--mode current",
+      },
+      { sessionId: "s1", agentId: "main", runId: "r1" }
+    );
+    await tick();
+    assert.equal(captured.length, 1);
+    assert.equal(captured[0].event_type, "function_call");
+    assert.equal(captured[0].skill_name, "model-usage");
+    assert.equal(captured[0].invoke_tool, "report_skill_error");
+    assert.equal(captured[0].status, "error");
+    assert.equal(captured[0].error_message, "manual failure");
+    assert.equal(captured[0].app_key, "abcdef123456");
+    assert.deepEqual(captured[0].args, { raw_args: "--mode current" });
+  });
+
   it("未命中且默认配置 → 不记录", async () => {
     const { hooks, captured } = setup();
     hooks.onBeforeToolCall({ toolName: "exec", params: { command: "ls -la" }, toolCallId: "t3" }, { sessionId: "s1" });

package/src/hooks.ts

@@ -21,7 +21,12 @@ type HookEvent = Record<string, unknown>;
 type HookCtx = Record<string, unknown>;
 
 type Pending = {
-  res: MatchResult;
+  skillName: string;
+  skillVersion?: string;
+  functionId?: string;
+  functionName?: string;
+  matchType?: MatchResult["matchType"];
+  args?: Record<string, unknown>;
   command?: string;
   invokeTool: string;
   sessionId?: string;
@@ -57,6 +62,79 @@ function extractAppKey(event: HookEvent, ctx: HookCtx): string | undefined {
   }
 }
 
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" ? (value as Record<string, unknown>) : undefined;
+}
+
+function stringifyErrorValue(value: unknown): string | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value === "string") return value;
+  if (value instanceof Error) return value.stack || value.message;
+  const obj = asRecord(value);
+  if (obj) {
+    for (const key of ["message", "error", "errorMessage", "error_message", "stderr"]) {
+      const nested = stringifyErrorValue(obj[key]);
+      if (nested) return nested;
+    }
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return String(value);
+    }
+  }
+  return String(value);
+}
+
+function hasFailureSignal(event: HookEvent): boolean {
+  const records = [
+    event,
+    asRecord(event.result),
+    asRecord(event.output),
+    asRecord(event.response),
+    asRecord(event.data),
+  ].filter(Boolean) as Record<string, unknown>[];
+  for (const record of records) {
+    const status = String(record.status ?? record.state ?? "").toLowerCase();
+    if (["error", "failed", "failure"].includes(status)) return true;
+    if (record.success === false || record.ok === false || record.isError === true) return true;
+  }
+  return false;
+}
+
+function extractToolError(event: HookEvent): string | undefined {
+  for (const key of ["error", "errorMessage", "error_message"]) {
+    const direct = stringifyErrorValue(event[key]);
+    if (direct) return direct;
+  }
+
+  for (const key of ["result", "output", "response", "data"]) {
+    const obj = asRecord(event[key]);
+    if (!obj) continue;
+    for (const nestedKey of ["error", "errorMessage", "error_message"]) {
+      const nested = stringifyErrorValue(obj[nestedKey]);
+      if (nested) return nested;
+    }
+  }
+
+  if (hasFailureSignal(event)) {
+    for (const key of ["message", "stderr", "result", "output", "response", "data"]) {
+      const fallback = stringifyErrorValue(event[key]);
+      if (fallback) return fallback;
+    }
+    return "tool call reported failure";
+  }
+
+  return undefined;
+}
+
+function extractDurationMs(event: HookEvent): number | undefined {
+  for (const key of ["durationMs", "duration_ms", "elapsedMs", "elapsed_ms"]) {
+    const value = event[key];
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+  }
+  return undefined;
+}
+
 export class Hooks {
   private readonly pending = new Map<string, Pending>();
   private readonly sessionAppKeys = new Map<string, string>();
@@ -110,14 +188,14 @@ export class Hooks {
     return {
       event_id: randomUUID(),
       event_type: "function_call",
-      skill_name: p.res.skillName,
-      skill_version: p.res.skillVersion,
-      function_id: p.res.functionId,
-      function_name: p.res.functionName,
-      match_type: p.res.matchType,
+      skill_name: p.skillName,
+      skill_version: p.skillVersion,
+      function_id: p.functionId,
+      function_name: p.functionName,
+      match_type: p.matchType,
       invoke_tool: p.invokeTool,
       command: p.command,
-      args: p.res.args,
+      args: p.args,
       status,
       error_message: error,
       duration_ms: durationMs,
@@ -169,6 +247,7 @@ export class Hooks {
       this.sweepStalePending();
       const toolName = event.toolName as string;
       const params = (event.params as Record<string, unknown>) ?? {};
+      const toolCallId = event.toolCallId as string | undefined;
       
       const sk = this.sessionKeyOf(ctx);
       let appKey: string | undefined = undefined;
@@ -191,6 +270,19 @@ export class Hooks {
         if (!skillName) return;
         this.debug(`Intercepted explicit 'skill' tool call for: ${skillName}`);
         this.recordTrigger(skillName, "tool", "skill", ctx, appKey);
+        if (toolCallId) {
+          this.pending.set(toolCallId, {
+            skillName,
+            skillVersion: this.configSync.getVersion(skillName),
+            invokeTool: toolName,
+            sessionId: this.sessionKeyOf(ctx),
+            agentId: ctx.agentId as string,
+            runId: ctx.runId as string,
+            appKey,
+            ts: Date.now(),
+          });
+          this.capPending();
+        }
         return;
       }
 
@@ -214,16 +306,20 @@ export class Hooks {
 
       if (!res) {
         this.debug(`Tool call '${toolName}' did not match any function config.`);
-        this.maybeRecordUnattributed(toolName, command, active, ctx, appKey);
+        this.maybeRecordUnattributed(toolName, command, active, ctx, appKey, toolCallId);
         return;
       }
 
       this.debug(`Tool call '${toolName}' matched function ID: ${res.functionId} (${res.skillName}@${res.skillVersion})`);
 
-      const toolCallId = event.toolCallId as string | undefined;
       if (toolCallId) {
         this.pending.set(toolCallId, {
-          res,
+          skillName: res.skillName,
+          skillVersion: res.skillVersion,
+          functionId: res.functionId,
+          functionName: res.functionName,
+          matchType: res.matchType,
+          args: res.args,
           command,
           invokeTool: toolName,
           sessionId: this.sessionKeyOf(ctx),
@@ -250,8 +346,8 @@ export class Hooks {
       if (!p) return;
       this.pending.delete(toolCallId);
 
-      const error = event.error as string | undefined;
-      const durationMs = typeof event.durationMs === "number" ? event.durationMs : undefined;
+      const error = extractToolError(event);
+      const durationMs = extractDurationMs(event);
       
       const appKey = p.appKey || extractAppKey(event, {});
       this.debug(`After tool call [${toolCallId}]: Status ${error ? "error" : "success"}, Duration ${durationMs}ms`);
@@ -360,12 +456,28 @@ export class Hooks {
     command: string | undefined,
     active: ReadonlySet<string>,
     ctx: HookCtx,
-    appKey?: string
+    appKey?: string,
+    toolCallId?: string
   ): void {
     if (this.getConfig().recordUnattributed === false) return;
     if (toolName !== "exec" || active.size !== 1) return;
     const skillName = [...active][0];
     this.debug(`Recording unattributed function_call for skill: ${skillName}`);
+    if (toolCallId) {
+      this.pending.set(toolCallId, {
+        skillName,
+        skillVersion: this.configSync.getVersion(skillName),
+        invokeTool: toolName,
+        command,
+        appKey,
+        sessionId: this.sessionKeyOf(ctx),
+        agentId: ctx.agentId as string,
+        runId: ctx.runId as string,
+        ts: Date.now(),
+      });
+      this.capPending();
+      return;
+    }
     this.emit({
       event_id: randomUUID(),
       event_type: "function_call",

package/src/updater.ts

@@ -205,6 +205,13 @@ export class SkillUpdater {
         console.warn(`[skill-logger-plugin] ${skillName}@${version} 下载包无版本号，放弃覆盖`);
         return;
       }
+      if (dl.sha256) {
+        const actualHash = skillIdentityHash(skillName, packageVersion);
+        if (actualHash !== dl.sha256) {
+          console.warn(`[skill-logger-plugin] ${skillName}@${version} 身份哈希不一致，放弃覆盖`);
+          return;
+        }
+      }
 
       // [兼容处理] 缺少 .meta.json 时主动补齐
       const metaPath = path.join(srcRoot, ".meta.json");
@@ -235,7 +242,7 @@ export class SkillUpdater {
   private async fetchDownloadUrl(
     skillName: string,
     version: string
-  ): Promise<{ url: string; version?: string } | undefined> {
+  ): Promise<{ url: string; version?: string; sha256?: string } | undefined> {
     const cfg = this.getConfig();
     const endpoint = cfg.platformBaseUrl!.replace(/\/$/, "") + "/skill_package/pull";
     const headers: Record<string, string> = { "Content-Type": "application/json" };
@@ -252,8 +259,9 @@ export class SkillUpdater {
     const data = (await res.json()) as { url?: unknown; downloadUrl?: unknown; version?: unknown; sha256?: unknown };
     const url = typeof data?.url === "string" ? data.url : typeof data?.downloadUrl === "string" ? data.downloadUrl : undefined;
     const resolvedVersion = typeof data?.version === "string" ? data.version : undefined;
+    const sha256 = typeof data?.sha256 === "string" ? data.sha256 : undefined;
     if (!url) return undefined;
-    return { url, version: resolvedVersion };
+    return { url, version: resolvedVersion, sha256 };
   }
 
   /** 在解压目录里定位含 SKILL.md 的目录（兼容包内是否带顶层目录）。深度上限 2。 */

package/src/ws-client.test.ts

@@ -0,0 +1,37 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  normalizeAssistantUserId,
+  parseAssistantWorkspaceAgentId,
+} from "./ws-client.ts";
+
+describe("assistant workspace naming", () => {
+  it("accepts workspace-assistant-* only when suffix is at least 5 digits", () => {
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-12345"), "assistant-12345");
+    assert.equal(
+      parseAssistantWorkspaceAgentId("workspace-assistant-12342325232333223223"),
+      "assistant-12342325232333223223"
+    );
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-000001"), "assistant-000001");
+  });
+
+  it("rejects short, non-numeric, and malformed workspace names", () => {
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-1234"), undefined);
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-1234a"), undefined);
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-assistant-abcde"), undefined);
+    assert.equal(parseAssistantWorkspaceAgentId("workspace-coder-12345"), undefined);
+  });
+
+  it("normalizes command userId using the same numeric suffix rule", () => {
+    assert.equal(normalizeAssistantUserId("12345"), "12345");
+    assert.equal(normalizeAssistantUserId("assistant-12345"), "12345");
+    assert.equal(normalizeAssistantUserId("assistant-000001"), "000001");
+  });
+
+  it("rejects unsafe or non-conforming command userId values", () => {
+    assert.equal(normalizeAssistantUserId("1234"), undefined);
+    assert.equal(normalizeAssistantUserId("assistant-1234"), undefined);
+    assert.equal(normalizeAssistantUserId("assistant-1234a"), undefined);
+    assert.equal(normalizeAssistantUserId("../assistant-12345"), undefined);
+  });
+});

package/src/ws-client.ts

@@ -8,6 +8,26 @@ import { readSkillVersion } from "./skill-version.ts";
 const HEARTBEAT_INTERVAL_MS = 30_000;
 const HEARTBEAT_ACK_TIMEOUT_MS = 75_000;
 const AGENT_SCAN_INTERVAL_MS = 3 * 60 * 1000;
+const ASSISTANT_WORKSPACE_PREFIX = "workspace-assistant-";
+const ASSISTANT_AGENT_PREFIX = "assistant-";
+const ASSISTANT_WORKSPACE_ID_RE = /^\d{5,}$/;
+
+export function parseAssistantWorkspaceAgentId(entryName: string): string | undefined {
+  if (!entryName.startsWith(ASSISTANT_WORKSPACE_PREFIX)) return undefined;
+  const suffix = entryName.slice(ASSISTANT_WORKSPACE_PREFIX.length);
+  if (!ASSISTANT_WORKSPACE_ID_RE.test(suffix)) return undefined;
+  return `${ASSISTANT_AGENT_PREFIX}${suffix}`;
+}
+
+export function normalizeAssistantUserId(userId: string): string | undefined {
+  const safeUserId = path.basename(userId);
+  if (safeUserId !== userId) return undefined;
+  const pureId = safeUserId.startsWith(ASSISTANT_AGENT_PREFIX)
+    ? safeUserId.slice(ASSISTANT_AGENT_PREFIX.length)
+    : safeUserId;
+  if (!ASSISTANT_WORKSPACE_ID_RE.test(pureId)) return undefined;
+  return pureId;
+}
 
 export interface WsClientOptions {
   serverUrl: string;       // 例如: wss://api.aishuo.co/gateway/ws
@@ -163,7 +183,8 @@ export class GatewayWsClient {
   }
 
   /**
-   * 扫描 OpenClaw 根目录下的 workspace-assistant-{userId} 目录
+   * 扫描 OpenClaw 根目录下的 workspace-assistant-{userId} 目录。
+   * userId 必须是至少 5 位数字。
    */
   private async scanAndReportAgents(isInitialReport: boolean) {
     if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
@@ -182,12 +203,8 @@ export class GatewayWsClient {
 
       const newAgentIds = new Set<string>();
       for (const entry of entries) {
-        if (entry.startsWith("workspace-assistant-")) {
-          const suffix = entry.replace("workspace-assistant-", "").trim();
-          if (suffix && suffix === path.basename(suffix) && !suffix.startsWith(".")) {
-            newAgentIds.add(`assistant-${suffix}`);
-          }
-        }
+        const agentId = parseAssistantWorkspaceAgentId(entry);
+        if (agentId) newAgentIds.add(agentId);
       }
 
       let changed = false;
@@ -354,12 +371,15 @@ export class GatewayWsClient {
       return;
     }
 
-    // 闭环完善：强制清理 userId 和 code 字符串，防止恶意指令通过 '../' 引发宿主机目录穿越攻击
-    const safeUserId = path.basename(userId);
+    // 闭环完善：清理 code，并严格校验 userId，防止恶意指令通过 '../' 引发宿主机目录穿越攻击
     const safeCode = code ? path.basename(code) : undefined;
 
-    // 100% 确定性安全寻址 (去掉 userId 中可能带有的 assistant- 前缀，统一用 workspace-assistant- 拼接)
-    const pureId = safeUserId.replace(/^assistant-/, "");
+    // 100% 确定性安全寻址：userId 只接受纯数字或 assistant-数字，且数字至少 5 位。
+    const pureId = normalizeAssistantUserId(userId);
+    if (!pureId) {
+      this.reply(replyId, { success: false, message: `Invalid userId: ${userId}`, action });
+      return;
+    }
     const targetDir = path.join(openclawHome(), `workspace-assistant-${pureId}`, "skills");
 
     try {
@@ -485,6 +505,57 @@ export class GatewayWsClient {
           }
         }, delayMs);
 
+      } else if (action === "GET_EXPERT_REGISTRY") {
+        console.log(`[skill-logger-plugin][WS] Executing GET_EXPERT_REGISTRY for user ${userId}`);
+        this.appendLogToFile("INFO", "Command", `GET_EXPERT_REGISTRY received`, { userId });
+        
+        const registryFilePath = path.join(openclawHome(), `workspace-assistant-${pureId}`, ".openclaw", "userskill", "expert-registry.yaml");
+        let content = "";
+        let fileExists = false;
+        try {
+          const stat = await fs.stat(registryFilePath);
+          fileExists = stat.isFile();
+        } catch (err: any) {
+          if (err?.code !== "ENOENT") throw err;
+        }
+
+        if (fileExists) {
+           content = await fs.readFile(registryFilePath, "utf8");
+           
+           // 解析 YAML 提取需要的字段
+           const expertsList: any[] = [];
+           const lines = content.split('\n');
+           let currentExpert: any = null;
+           
+           for (const line of lines) {
+             const trimmed = line.trim();
+             if (trimmed.startsWith('#')) continue;
+
+             const idMatch = line.match(/^\s*-\s*id:\s*(.+)$/);
+             if (idMatch) {
+               if (currentExpert && currentExpert.id) expertsList.push(currentExpert);
+               currentExpert = { id: idMatch[1].trim() };
+               continue;
+             }
+
+             if (currentExpert) {
+               const nameMatch = line.match(/^\s*name:\s*(.+)$/);
+               if (nameMatch) {
+                 currentExpert.name = nameMatch[1].trim();
+               }
+               const descMatch = line.match(/^\s*description:\s*(.+)$/);
+               if (descMatch) {
+                 currentExpert.description = descMatch[1].trim();
+               }
+             }
+           }
+           if (currentExpert && currentExpert.id) expertsList.push(currentExpert);
+
+           this.reply(replyId, { success: true, data: expertsList, action });
+        } else {
+           this.reply(replyId, { success: false, message: `未找到用户技能配置文件，可能尚未注册或文件已丢失`, action });
+        }
+
       } else {
         console.warn(`[skill-logger-plugin][WS] Unknown action: ${action}`);
         this.appendLogToFile("WARN", "Command", `Unknown action: ${action}`);