@workclaw/openclaw-workclaw 1.0.0

package/src/api/session-api.ts

@@ -0,0 +1,247 @@
+import type { OpenClawPluginApi } from 'openclaw/plugin-sdk'
+import { Buffer } from 'node:buffer'
+import { getOpenclawWorkclawRuntime } from '../runtime.js'
+
+function sendJson(res: any, statusCode: number, payload: unknown): void {
+  res.statusCode = statusCode
+  res.setHeader('Content-Type', 'application/json')
+  res.end(JSON.stringify(payload))
+}
+
+async function readRequestBody(req: any): Promise<string> {
+  const chunks: Buffer[] = []
+  await new Promise<void>((resolve, reject) => {
+    req.on('data', (chunk: any) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+    })
+    req.on('end', () => resolve())
+    req.on('error', (err: unknown) => reject(err))
+  })
+  return Buffer.concat(chunks).toString('utf-8')
+}
+
+/**
+ * 构建会话 key
+ * 格式: openclaw-workclaw:{accountId}:{userId}
+ */
+function buildSessionKey(accountId: string, userId: string): string {
+  return `openclaw-workclaw:${accountId}:${userId}`
+}
+
+/**
+ * 解析会话 key
+ */
+function parseSessionKey(sessionKey: string): {
+  channel: string
+  accountId: string
+  userId: string
+} | null {
+  const parts = sessionKey.split(':')
+  if (parts.length !== 3 || parts[0] !== 'openclaw-workclaw') {
+    return null
+  }
+  return {
+    channel: parts[0],
+    accountId: parts[1],
+    userId: parts[2],
+  }
+}
+
+/**
+ * 重置/开启新会话
+ * 通过发送系统事件 /new 到指定会话
+ */
+async function resetSession(
+  sessionKey: string,
+  log?: { info?: (msg: string) => void, error?: (msg: string) => void },
+): Promise<{ success: boolean, message: string }> {
+  try {
+    const runtime = getOpenclawWorkclawRuntime()
+
+    // 使用 system.enqueueSystemEvent 发送 /new 命令
+    runtime.system.enqueueSystemEvent('/new', {
+      sessionKey,
+      contextKey: null,
+    })
+
+    log?.info?.(`[SessionAPI] Sent /new command to session: ${sessionKey}`)
+
+    return {
+      success: true,
+      message: `Session reset command sent to ${sessionKey}`,
+    }
+  }
+  catch (err) {
+    const errorMsg = `Failed to reset session: ${String(err)}`
+    log?.error?.(`[SessionAPI] ${errorMsg}`)
+    return { success: false, message: errorMsg }
+  }
+}
+
+/**
+ * 获取会话存储路径
+ */
+function getSessionStorePath(
+  agentId?: string,
+  log?: { info?: (msg: string) => void, error?: (msg: string) => void },
+): string | null {
+  try {
+    const runtime = getOpenclawWorkclawRuntime()
+    const storePath = runtime.channel.session.resolveStorePath(undefined, {
+      agentId,
+    })
+    return storePath
+  }
+  catch (err) {
+    log?.error?.(`[SessionAPI] Failed to resolve store path: ${String(err)}`)
+    return null
+  }
+}
+
+/**
+ * 读取会话最后更新时间
+ */
+async function getSessionLastUpdated(
+  sessionKey: string,
+  log?: { info?: (msg: string) => void, error?: (msg: string) => void },
+): Promise<number | null> {
+  try {
+    const runtime = getOpenclawWorkclawRuntime()
+    const storePath = runtime.channel.session.resolveStorePath()
+    const updatedAt = runtime.channel.session.readSessionUpdatedAt({
+      storePath,
+      sessionKey,
+    })
+    return updatedAt ?? null
+  }
+  catch (err) {
+    log?.error?.(`[SessionAPI] Failed to read session updated at: ${String(err)}`)
+    return null
+  }
+}
+
+export function createSessionApiHandler(api: OpenClawPluginApi) {
+  return async (req: any, res: any) => {
+    const method = String(req.method ?? 'GET').toUpperCase()
+    const url = new URL(req.url ?? '', 'http://localhost')
+    // 移除尾部斜杠并获取路径部分
+    const fullPath = url.pathname.replace(/\/+$/, '')
+    // 提取子路径（去掉 /openclaw-workclaw/sessions 前缀）
+    const subPath = fullPath.replace(/^\/openclaw-workclaw\/sessions/, '').replace(/^\//, '') || '/'
+
+    const log = {
+      info: (msg: string) => api.logger?.info?.(`[SessionAPI] ${msg}`),
+      error: (msg: string) => api.logger?.error?.(`[SessionAPI] ${msg}`),
+    }
+
+    log?.info?.(`[SessionAPI] ${method} ${fullPath} (subPath: ${subPath})`)
+
+    // GET /sessions 或 /sessions/ - 列出会话信息
+    if (method === 'GET' && (subPath === '/' || subPath === '')) {
+      const sessionKey = url.searchParams.get('sessionKey')
+
+      if (sessionKey) {
+        // 获取特定会话信息
+        const parsed = parseSessionKey(sessionKey)
+        const updatedAt = await getSessionLastUpdated(sessionKey, log)
+
+        sendJson(res, 200, {
+          ok: true,
+          session: {
+            sessionKey,
+            parsed,
+            lastUpdatedAt: updatedAt,
+            lastUpdatedAtFormatted: updatedAt
+              ? new Date(updatedAt).toISOString()
+              : null,
+          },
+        })
+        return
+      }
+
+      // 返回 API 信息
+      sendJson(res, 200, {
+        ok: true,
+        message: 'Session Management API',
+        endpoints: {
+          'GET /sessions': '获取会话信息 (可选参数: sessionKey)',
+          'POST /sessions/reset': '重置/开启新会话 (参数: accountId + userId 或直接提供 sessionKey)',
+          'GET /sessions/store-path': '获取会话存储路径 (可选参数: agentId)',
+        },
+      })
+      return
+    }
+
+    // POST /sessions/reset - 重置会话
+    if (method === 'POST' && subPath === 'reset') {
+      const raw = await readRequestBody(req)
+      let input: any = {}
+      try {
+        input = raw ? JSON.parse(raw) : {}
+      }
+      catch {
+        sendJson(res, 400, { ok: false, error: 'Invalid JSON' })
+        return
+      }
+
+      const { accountId, userId, sessionKey: directSessionKey } = input
+
+      let sessionKey: string
+      if (directSessionKey) {
+        sessionKey = directSessionKey
+      }
+      else if (accountId && userId) {
+        sessionKey = buildSessionKey(accountId, userId)
+      }
+      else {
+        sendJson(res, 400, {
+          ok: false,
+          error: 'Missing required fields: either provide \'sessionKey\' or both \'accountId\' and \'userId\'',
+        })
+        return
+      }
+
+      const result = await resetSession(sessionKey, log)
+
+      if (result.success) {
+        sendJson(res, 200, {
+          ok: true,
+          message: result.message,
+          sessionKey,
+        })
+      }
+      else {
+        sendJson(res, 500, {
+          ok: false,
+          error: result.message,
+          sessionKey,
+        })
+      }
+      return
+    }
+
+    // GET /sessions/store-path - 获取会话存储路径
+    if (method === 'GET' && subPath === 'store-path') {
+      const agentId = url.searchParams.get('agentId') ?? undefined
+      const storePath = getSessionStorePath(agentId, log)
+
+      if (storePath) {
+        sendJson(res, 200, {
+          ok: true,
+          storePath,
+          agentId: agentId ?? 'default',
+        })
+      }
+      else {
+        sendJson(res, 500, {
+          ok: false,
+          error: 'Failed to resolve session store path',
+        })
+      }
+      return
+    }
+
+    // 404
+    sendJson(res, 404, { ok: false, error: 'Not Found' })
+  }
+}

package/src/api/skills-api.ts

@@ -0,0 +1,74 @@
+import type { OpenClawPluginApi } from 'openclaw/plugin-sdk'
+import { exec } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const execAsync = promisify(exec)
+
+function sendJson(res: any, statusCode: number, payload: unknown): void {
+  res.statusCode = statusCode
+  res.setHeader('Content-Type', 'application/json')
+  res.end(JSON.stringify(payload))
+}
+
+export function createSkillsApiHandler(api: OpenClawPluginApi) {
+  return async (req: any, res: any) => {
+    const method = String(req.method ?? 'GET').toUpperCase()
+
+    if (method === 'GET') {
+      try {
+        // 调用 openclaw skills list 命令
+        const { stdout, stderr } = await execAsync('openclaw skills list --json', {
+          timeout: 10000, // 10秒超时
+        })
+
+        if (stderr && !stdout) {
+          api.logger.error(`Skills list error: ${stderr}`)
+          sendJson(res, 500, { ok: false, error: 'Failed to list skills' })
+          return
+        }
+
+        // 尝试解析JSON输出
+        let skillsData: any
+        try {
+          skillsData = JSON.parse(stdout)
+        }
+        catch {
+          // 如果不支持--json输出，尝试解析文本输出
+          const lines = stdout.split('\n')
+          const skills = lines
+            .filter((line: string) => line.trim() && !line.includes('Skills'))
+            .map((line: string) => {
+              const parts = line.split(/\s{2,}/).map((p: string) => p.trim())
+              if (parts.length >= 3) {
+                return {
+                  status: parts[0]?.includes('✓') ? 'ready' : 'missing',
+                  name: parts[1],
+                  description: parts[2],
+                  source: parts[3] || 'openclaw-bundled',
+                }
+              }
+              return null
+            })
+            .filter((s: any) => s !== null)
+
+          skillsData = {
+            total: skills.length,
+            ready: skills.filter((s: any) => s.status === 'ready').length,
+            missing: skills.filter((s: any) => s.status === 'missing').length,
+            skills,
+          }
+        }
+
+        sendJson(res, 200, { ok: true, ...skillsData })
+        return
+      }
+      catch (error: any) {
+        api.logger.error(`Skills API error: ${error.message}`)
+        sendJson(res, 500, { ok: false, error: error.message })
+        return
+      }
+    }
+
+    sendJson(res, 405, { ok: false, error: 'Method Not Allowed' })
+  }
+}

package/src/api/workspace.ts

@@ -0,0 +1,43 @@
+import type { OpenClawPluginApi } from 'openclaw/plugin-sdk'
+import os from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+
+export function resolveWorkspaceDir(api: OpenClawPluginApi): string {
+  const agents = api.config.agents?.list ?? []
+  const defaultAgent
+    = agents.find(agent => agent?.default === true)
+      ?? agents.find(agent => String(agent?.id ?? '').toLowerCase() === 'main')
+
+  const workspaceRaw
+    = (typeof defaultAgent?.workspace === 'string' && defaultAgent.workspace.trim())
+      || (typeof api.config.agents?.defaults?.workspace === 'string'
+        && api.config.agents.defaults.workspace.trim())
+
+  if (workspaceRaw) {
+    return api.resolvePath(workspaceRaw)
+  }
+
+  const profile = process.env.OPENCLAW_PROFILE?.trim()
+  const suffix
+    = profile && profile.toLowerCase() !== 'default' ? `workspace-${profile}` : 'workspace'
+  return path.join(os.homedir(), '.openclaw', suffix)
+}
+
+export function isDefaultWorkspace(api: OpenClawPluginApi): boolean {
+  const agents = api.config.agents?.list ?? []
+  const defaultAgent
+    = agents.find(agent => agent?.default === true)
+      ?? agents.find(agent => String(agent?.id ?? '').toLowerCase() === 'main')
+
+  const workspaceRaw
+    = (typeof defaultAgent?.workspace === 'string' && defaultAgent.workspace.trim())
+      || (typeof api.config.agents?.defaults?.workspace === 'string'
+        && api.config.agents.defaults.workspace.trim())
+
+  if (workspaceRaw)
+    return false
+
+  const profile = process.env.OPENCLAW_PROFILE?.trim()
+  return !profile || profile.toLowerCase() === 'default'
+}

package/src/channel.ts

@@ -0,0 +1,227 @@
+import type {
+  ChannelGatewayContext,
+  ChannelPlugin,
+  OpenClawConfig,
+} from 'openclaw/plugin-sdk'
+import type { OpenclawWorkclawConfig, ResolvedOpenclawWorkclawAccount } from './types.js'
+import { appendFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import {
+  isOpenclawWorkclawAccountConfigured,
+  listOpenclawWorkclawAccountIds,
+  resolveOpenclawWorkclawAccount,
+} from './accounts.js'
+import { OpenclawWorkclawConfigSchema } from './config-schema.js'
+import { startOpenclawWorkclawGateway, stopOpenclawWorkclawGateway } from './gateway/workclaw-gateway.js'
+import { sendMessageOpenclawWorkclaw } from './outbound/index.js'
+import { getOpenclawWorkclawRuntime } from './runtime.js'
+
+const DEFAULT_ACCOUNT_ID = 'default'
+
+function buildChannelConfigSchema(schema: unknown): any {
+  return schema
+}
+
+function formatPairingApproveHint(_channelId: string): string {
+  return '请回复验证码完成配对'
+}
+
+const meta = {
+  id: 'openclaw-workclaw',
+  label: '智小途',
+  selectionLabel: '智小途',
+  docsPath: '/channels/openclaw-workclaw',
+  docsLabel: '智小途',
+  blurb: '智小途 OpenClaw通道',
+  aliases: [],
+  order: 90,
+}
+
+/**
+ * 写入文件日志到磁盘
+ * @param message 日志消息
+ */
+function writeFileLog(message: string): void {
+  const timestamp = new Date().toISOString()
+  const logLine = `[${timestamp}] ${message}\n`
+  const logDir = join(homedir(), '.openclaw', 'logs')
+  const logFile = join(logDir, 'sendtext-outbound.log')
+
+  try {
+    appendFileSync(logFile, logLine)
+  }
+  catch (err) {
+    console.error(`[writeFileLog] Failed to write log: ${err}`)
+  }
+}
+
+export const openclawWorkclawDock = {
+  id: 'openclaw-workclaw',
+  capabilities: {
+    chatTypes: ['direct', 'group'],
+    media: true,
+    blockStreaming: true,
+  },
+}
+
+export const openclawWorkclawPlugin: ChannelPlugin<ResolvedOpenclawWorkclawAccount> = {
+  id: 'openclaw-workclaw',
+  meta,
+  capabilities: {
+    chatTypes: ['direct', 'group'],
+    media: true,
+    reactions: false,
+    threads: false,
+    polls: false,
+    nativeCommands: false,
+    blockStreaming: true,
+  },
+  reload: { configPrefixes: ['channels.openclaw-workclaw'] },
+  configSchema: buildChannelConfigSchema(OpenclawWorkclawConfigSchema),
+  config: {
+    listAccountIds: cfg => listOpenclawWorkclawAccountIds(cfg as OpenClawConfig),
+    resolveAccount: (cfg, accountId) =>
+      resolveOpenclawWorkclawAccount({ cfg: cfg as OpenClawConfig, accountId }),
+    isConfigured: account => isOpenclawWorkclawAccountConfigured(account.config),
+    describeAccount: account => ({
+      accountId: account.accountId,
+      name: account.name,
+      enabled: account.enabled,
+      configured: isOpenclawWorkclawAccountConfigured(account.config),
+    }),
+  },
+  security: {
+    resolveDmPolicy: ({ cfg, accountId, account }) => {
+      const resolvedAccountId = accountId ?? account.accountId ?? DEFAULT_ACCOUNT_ID
+      const channelConfig = cfg.channels?.['openclaw-workclaw'] as OpenclawWorkclawConfig | undefined
+      const useAccountPath = Boolean(channelConfig?.accounts?.[resolvedAccountId])
+      const basePath = useAccountPath
+        ? `channels.openclaw-workclaw.accounts.${resolvedAccountId}.`
+        : 'channels.openclaw-workclaw.'
+      return {
+        policy: account.config.dmPolicy ?? 'pairing',
+        allowFrom: account.config.allowFrom ?? [],
+        policyPath: `${basePath}dmPolicy`,
+        allowFromPath: `${basePath}allowFrom`,
+        approveHint: formatPairingApproveHint('openclaw-workclaw'),
+        normalizeEntry: raw => raw.replace(/^openclaw-workclaw:/i, ''),
+      }
+    },
+  },
+  status: {
+    buildAccountSnapshot: async ({ account }) => {
+      const { getOpenclawWorkclawWsConnection } = await import('./runtime.js')
+      const ws = getOpenclawWorkclawWsConnection(account.accountId)
+      const isConnected = ws && ws.readyState === 1 // WebSocket.OPEN = 1
+
+      return {
+        accountId: account.accountId,
+        name: account.name,
+        enabled: account.enabled,
+        configured: account.configured,
+        connected: isConnected,
+        running: account.enabled && account.configured,
+        mode: account.config.connectionMode || 'workclaw',
+      }
+    },
+  },
+  outbound: {
+    deliveryMode: 'direct',
+    chunker: (text: string, _limit: number) => [text],
+    textChunkLimit: 4096,
+    sendText: async ({ to, text, accountId, cfg, replyToId }) => {
+      writeFileLog(`outbound sendText called: replyToId=${replyToId}, to=${to}, text=${text.substring(0, 100)}`)
+      const result = await sendMessageOpenclawWorkclaw({
+        accountId: accountId ?? undefined,
+        cfg: cfg as OpenClawConfig,
+        to,
+        text,
+      })
+      return {
+        channel: 'openclaw-workclaw',
+        ok: true,
+        messageId: result.messageId,
+      }
+    },
+    sendMedia: async ({ to, text, mediaUrl, accountId, cfg }) => {
+      if (!mediaUrl && !text.trim()) {
+        throw new Error('mediaUrl is required for outbound media')
+      }
+      const runtime = getOpenclawWorkclawRuntime() as any
+      const log = runtime.log ?? console.warn
+      if (typeof log === 'function') {
+        log(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`)
+      }
+      else if (log?.info) {
+        log.info(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`)
+      }
+      const messageText = text.trim() ? text : mediaUrl ?? ''
+      const result = await sendMessageOpenclawWorkclaw({
+        accountId: accountId ?? undefined,
+        cfg: cfg as OpenClawConfig,
+        to,
+        text: messageText,
+        mediaUrl: mediaUrl ?? undefined,
+      })
+      return {
+        channel: 'openclaw-workclaw',
+        ok: true,
+        messageId: result.messageId,
+      }
+    },
+  },
+  gateway: {
+    startAccount: async (ctx: ChannelGatewayContext<ResolvedOpenclawWorkclawAccount>) => {
+      const { setStatus, getStatus, account, accountId, cfg, log } = ctx
+      log?.info?.(`startAccount called for ${accountId}`)
+
+      await startOpenclawWorkclawGateway({
+        accountId,
+        account,
+        cfg,
+        log,
+      })
+
+      setStatus({
+        ...getStatus(),
+        running: true,
+        lastStartAt: Date.now(),
+        lastError: null,
+      })
+      log?.info?.(`startAccount completed for ${accountId}, keeping pending until abort`)
+
+      // 保持 pending 状态直到 abortSignal 触发（防止 OpenClaw 3.8 认为启动立即退出）
+      await new Promise<void>((resolve) => {
+        if (ctx.abortSignal.aborted) {
+          resolve()
+          return
+        }
+        ctx.abortSignal.addEventListener('abort', () => resolve(), { once: true })
+      })
+
+      // abort 触发后，清理资源
+      log?.info?.(`startAccount abort signal received for ${accountId}`)
+      const wsStrategy = (account.config as any)?.wsConnectionStrategy || 'per-account'
+      stopOpenclawWorkclawGateway(accountId, wsStrategy)
+      setStatus({
+        ...getStatus(),
+        running: false,
+        lastStopAt: Date.now(),
+      })
+    },
+    stopAccount: async (ctx: ChannelGatewayContext<ResolvedOpenclawWorkclawAccount>) => {
+      const { setStatus, getStatus, accountId, account } = ctx
+
+      // Stop WorkClaw gateway
+      const wsStrategy = (account.config as any)?.wsConnectionStrategy || 'per-account'
+      stopOpenclawWorkclawGateway(accountId, wsStrategy)
+
+      setStatus({
+        ...getStatus(),
+        running: false,
+        lastStopAt: Date.now(),
+      })
+    },
+  },
+}

package/src/config-schema.ts

@@ -0,0 +1,110 @@
+import { z } from 'zod'
+
+export { z }
+
+const DmPolicySchema = z.enum(['open', 'pairing', 'allowlist'])
+const OpenclawWorkclawConnectionModeSchema = z.enum(['websocket'])
+const WsConnectionStrategySchema = z.enum(['per-account', 'per-appKey'])
+
+const DmConfigSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    systemPrompt: z.string().optional(),
+  })
+  .strict()
+  .optional()
+
+// Message render mode: auto (default) = detect markdown, raw = plain text, card = always card
+const RenderModeSchema = z.enum(['auto', 'raw', 'card']).optional()
+const ChannelHeartbeatVisibilitySchema = z
+  .object({
+    visibility: z.enum(['visible', 'hidden']).optional(),
+    intervalMs: z.number().int().positive().optional(),
+  })
+  .strict()
+  .optional()
+
+/**
+ * Per-account config schema
+ * Only fields that make sense to configure per-account.
+ */
+export const openclawWorkclawAccountConfigSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    name: z.string().optional(),
+    agentId: z.union([z.string(), z.number()]).optional(),
+    userId: z.union([z.string(), z.number()]).optional(),
+    openConversationId: z.string().optional(),
+    replyEndpoint: z.string().optional(),
+    pushEndpoint: z.string().optional(),
+    dmPolicy: DmPolicySchema.optional(),
+    allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    requireMention: z.boolean().optional(),
+    historyLimit: z.number().int().min(0).optional(),
+    dmHistoryLimit: z.number().int().min(0).optional(),
+    dms: z.record(z.string(), DmConfigSchema).optional(),
+    textChunkLimit: z.number().int().positive().optional(),
+    chunkMode: z.enum(['length', 'newline']).optional(),
+    mediaMaxMb: z.number().positive().optional(),
+    heartbeat: ChannelHeartbeatVisibilitySchema,
+    renderMode: RenderModeSchema,
+  })
+  .strict()
+
+/**
+ * Top-level plugin config schema
+ */
+export const OpenclawWorkclawConfigSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    connectionMode: OpenclawWorkclawConnectionModeSchema.optional().default('websocket'),
+    wsConnectionStrategy: WsConnectionStrategySchema.optional().default('per-account'),
+    baseUrl: z.string().url().optional(),
+    websocketUrl: z.string().url().optional(),
+    appKey: z.string().optional(),
+    appSecret: z.string().optional(),
+    agentId: z.union([z.string(), z.number()]).optional(),
+    localIp: z.string().optional(),
+    userId: z.union([z.string(), z.number()]).optional(),
+    replyEndpoint: z.string().optional(),
+    pushEndpoint: z.string().optional(),
+    requestTimeout: z.number().int().positive().optional(),
+    allowInsecureTls: z.boolean().optional(),
+    allowRawJsonPayload: z.boolean().optional(),
+    capabilities: z.array(z.string()).optional(),
+    uploadUrl: z.string().url().optional(),
+    uploadFieldName: z.string().optional(),
+    uploadHeaders: z.record(z.string(), z.string()).optional(),
+    uploadFormFields: z
+      .record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
+      .optional(),
+    uploadResponseUrlPath: z.string().optional(),
+    dmPolicy: DmPolicySchema.optional().default('pairing'),
+    allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    historyLimit: z.number().int().min(0).optional(),
+    dmHistoryLimit: z.number().int().min(0).optional(),
+    dms: z.record(z.string(), DmConfigSchema).optional(),
+    textChunkLimit: z.number().int().positive().optional(),
+    chunkMode: z.enum(['length', 'newline']).optional(),
+    mediaMaxMb: z.number().positive().optional(),
+    heartbeat: ChannelHeartbeatVisibilitySchema,
+    renderMode: RenderModeSchema,
+    accounts: z.record(z.string(), openclawWorkclawAccountConfigSchema.optional()).optional(),
+  })
+  .strict()
+  .superRefine((value, ctx) => {
+    if (value.dmPolicy === 'open') {
+      const allowFrom = value.allowFrom ?? []
+      const hasWildcard = allowFrom.some(entry => String(entry).trim() === '*')
+      if (!hasWildcard) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['allowFrom'],
+          message:
+            'channels.openclaw-workclaw.dmPolicy="open" requires channels.openclaw-workclaw.allowFrom to include "*"',
+        })
+      }
+    }
+  })
+
+export const openclawWorkclawConfigSchema = OpenclawWorkclawConfigSchema