@xgjktech/xg_cwork_im 1.19.21 → 1.19.23

package/dist/src/tools/cron-appkey-binding-store.js

@@ -0,0 +1,239 @@
+/** Persistent Cron job -> user OpenAPI AppKey bindings. */
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { getOrCreateShared } from "../plugin/process-shared-store.js";
+export const CRON_BINDING_SCHEMA_VERSION = 1;
+const MAX_APP_KEY_LENGTH = 256;
+const LOCK_RETRIES = 20;
+const LOCK_RETRY_MS = 10;
+function getStore() {
+    return getOrCreateShared("cron-binding-store", () => ({
+        bindingPath: undefined,
+        bindingMtimeMs: -1,
+        bindings: new Map(),
+    }));
+}
+function warnLoadOnce(store, bindingPath, reason) {
+    const message = String(reason);
+    if (store.lastLoadWarning === message)
+        return;
+    store.lastLoadWarning = message;
+    console.warn(`[xg_cwork_im] [cron-binding] binding file read failed path=${bindingPath} reason=${message}`);
+}
+function replaceBindings(store, next) {
+    store.bindings.clear();
+    for (const [bindingKey, binding] of next)
+        store.bindings.set(bindingKey, binding);
+}
+function key(agentId, jobId) {
+    // OpenClaw canonicalizes agent/job segments case-insensitively in Cron
+    // SessionKeys. Normalize lookup keys the same way while preserving the
+    // original values in the persisted record for diagnostics.
+    return `${agentId.trim().toLowerCase()}\u0000${jobId.trim().toLowerCase()}`;
+}
+function validText(value) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_APP_KEY_LENGTH &&
+        !/[\0\r\n]/.test(value);
+}
+function validBinding(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const b = value;
+    // Only the lookup identity and AppKey are required. Metadata fields are
+    // optional so older/minimal binding files remain usable after restart.
+    return validText(b.agentId) && validText(b.jobId) &&
+        (b.appKey === "" || validText(b.appKey));
+}
+function resolvePath(stateDir) {
+    // resolveStateDir() normally points at ~/.openclaw/state; keep bindings in
+    // the documented sibling ~/.openclaw/xg-cwork-im directory.
+    const normalized = stateDir.replace(/[\\/]+$/, "");
+    const root = /[\\/]state$/i.test(normalized) ? dirname(normalized) : normalized;
+    return join(root, "xg-cwork-im", "cron-appkey-bindings.json");
+}
+function load(store, force = false) {
+    const bindingPath = store.bindingPath;
+    if (!bindingPath)
+        return;
+    let mtime = -1;
+    try {
+        mtime = statSync(bindingPath).mtimeMs;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            warnLoadOnce(store, bindingPath, err);
+            return;
+        }
+    }
+    if (!force && mtime === store.bindingMtimeMs)
+        return;
+    if (mtime < 0) {
+        store.bindingMtimeMs = -1;
+        store.bindings.clear();
+        return;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(bindingPath, "utf8"));
+        if (parsed.schemaVersion !== CRON_BINDING_SCHEMA_VERSION || !Array.isArray(parsed.bindings)) {
+            // Fail closed on an unreadable/incompatible file; do not retain a
+            // stale AppKey cache whose ownership can no longer be verified.
+            store.bindings.clear();
+            store.bindingMtimeMs = mtime;
+            return;
+        }
+        const next = new Map();
+        for (const raw of parsed.bindings) {
+            if (!validBinding(raw))
+                continue;
+            const now = new Date().toISOString();
+            const b = {
+                ...raw,
+                agentId: raw.agentId.trim(),
+                jobId: raw.jobId.trim(),
+                appKey: raw.appKey.trim(),
+                source: validText(raw.source) ? raw.source : "legacy",
+                createdAt: validText(raw.createdAt) ? raw.createdAt : now,
+                updatedAt: validText(raw.updatedAt) ? raw.updatedAt : now,
+                enabled: raw.enabled !== false,
+            };
+            const k = key(b.agentId, b.jobId);
+            const previous = next.get(k);
+            if (!previous || b.updatedAt >= previous.updatedAt)
+                next.set(k, b);
+        }
+        replaceBindings(store, next);
+        store.bindingMtimeMs = mtime;
+        store.lastLoadWarning = undefined;
+    }
+    catch (err) {
+        // Fail closed when the file is temporarily malformed. A later mtime
+        // change will cause a fresh load.
+        store.bindings.clear();
+        store.bindingMtimeMs = mtime;
+        warnLoadOnce(store, bindingPath, err);
+    }
+}
+function acquireLock(lockPath) {
+    for (let i = 0; i < LOCK_RETRIES; i += 1) {
+        try {
+            return openSync(lockPath, "wx");
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                return undefined;
+            const end = Date.now() + LOCK_RETRY_MS;
+            while (Date.now() < end) { /* synchronous, bounded lock wait */ }
+        }
+    }
+    return undefined;
+}
+export function initCronAppKeyBindingStore(stateDir) {
+    const store = getStore();
+    const nextPath = resolvePath(stateDir);
+    if (store.bindingPath !== nextPath) {
+        store.bindingPath = nextPath;
+        store.bindingMtimeMs = -1;
+        store.bindings.clear();
+        store.lastLoadWarning = undefined;
+    }
+    load(store, true);
+}
+export function isCronAppKeyBindingStoreInitialized() {
+    return Boolean(getStore().bindingPath);
+}
+export function getCronAppKeyBinding(agentId, jobId) {
+    if (!agentId || !jobId)
+        return undefined;
+    const store = getStore();
+    load(store);
+    const b = store.bindings.get(key(agentId, jobId));
+    return b?.enabled && validText(b.appKey) ? { ...b } : undefined;
+}
+export function bindCronAppKey(input) {
+    const store = getStore();
+    const bindingPath = store.bindingPath;
+    if (!bindingPath || !validText(input.agentId) || !validText(input.jobId) || !validText(input.appKey))
+        return undefined;
+    const dir = dirname(bindingPath);
+    const lockPath = `${bindingPath}.lock`;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const lockFd = acquireLock(lockPath);
+    if (lockFd === undefined)
+        return undefined;
+    let tmpPath;
+    try {
+        load(store, true);
+        const now = new Date().toISOString();
+        const existing = store.bindings.get(key(input.agentId.trim(), input.jobId.trim()));
+        const binding = {
+            agentId: input.agentId.trim(),
+            jobId: input.jobId.trim(),
+            appKey: input.appKey.trim(),
+            ...(input.userId ? { userId: input.userId } : existing?.userId ? { userId: existing.userId } : {}),
+            ...(input.userName ? { userName: input.userName } : existing?.userName ? { userName: existing.userName } : {}),
+            ...(input.ownerSessionKey ? { ownerSessionKey: input.ownerSessionKey } : existing?.ownerSessionKey ? { ownerSessionKey: existing.ownerSessionKey } : {}),
+            source: input.source ?? existing?.source ?? "im",
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+            enabled: true,
+        };
+        const next = new Map(store.bindings);
+        next.set(key(binding.agentId, binding.jobId), binding);
+        const payload = {
+            schemaVersion: CRON_BINDING_SCHEMA_VERSION,
+            updatedAt: now,
+            bindings: [...next.values()],
+        };
+        tmpPath = `${bindingPath}.${process.pid}.${Date.now()}.tmp`;
+        writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
+        const tmpFd = openSync(tmpPath, "r+");
+        try {
+            fsyncSync(tmpFd);
+        }
+        finally {
+            closeSync(tmpFd);
+        }
+        renameSync(tmpPath, bindingPath);
+        replaceBindings(store, next);
+        try {
+            store.bindingMtimeMs = statSync(bindingPath).mtimeMs;
+        }
+        catch {
+            store.bindingMtimeMs = -1;
+        }
+        return { ...binding };
+    }
+    catch {
+        if (tmpPath) {
+            try {
+                if (existsSync(tmpPath))
+                    unlinkSync(tmpPath);
+            }
+            catch { /* ignore */ }
+        }
+        return undefined;
+    }
+    finally {
+        try {
+            closeSync(lockFd);
+        }
+        catch { /* ignore */ }
+        try {
+            if (existsSync(lockPath))
+                unlinkSync(lockPath);
+        }
+        catch { /* ignore */ }
+    }
+}
+export function __resetCronAppKeyBindingStoreForTests() {
+    disposeCronAppKeyBindingStore();
+}
+/** Gateway 真正停止时清空共享缓存；Registry cleanup 不得调用。 */
+export function disposeCronAppKeyBindingStore() {
+    const store = getStore();
+    store.bindingPath = undefined;
+    store.bindingMtimeMs = -1;
+    store.bindings.clear();
+    store.lastLoadWarning = undefined;
+}
+//# sourceMappingURL=cron-appkey-binding-store.js.map

package/dist/src/tools/cron-appkey-binding-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-appkey-binding-store.js","sourceRoot":"","sources":["../../../src/tools/cron-appkey-binding-store.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,OAAO,EACH,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,EAAE,CAAC;AA4BzB,SAAS,QAAQ;IACb,OAAO,iBAAiB,CAAmB,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,WAAW,EAAE,SAAS;QACtB,cAAc,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,IAAI,GAAG,EAA6B;KACjD,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,YAAY,CAAC,KAAuB,EAAE,WAAmB,EAAE,MAAe;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO;QAAE,OAAO;IAC9C,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,8DAA8D,WAAW,WAAW,OAAO,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,eAAe,CAAC,KAAuB,EAAE,IAAoC;IAClF,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,GAAG,CAAC,OAAe,EAAE,KAAa;IACvC,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB;QAC7F,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAmC,CAAC;IAC9C,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACjC,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAChF,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CAAC,KAAuB,EAAE,KAAK,GAAG,KAAK;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,CAAC;QACD,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;QACX,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC,cAAc;QAAE,OAAO;IACrD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACZ,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO;IACX,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAyB,CAAC;QACrF,IAAI,MAAM,CAAC,aAAa,KAAK,2BAA2B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1F,kEAAkE;YAClE,gEAAgE;YAChE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;YAC7B,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,GAAsB;gBACzB,GAAG,GAAG;gBACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC3B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACrD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;gBACzD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;gBACzD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK;aACjC,CAAC;YACF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;QAC7B,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,oEAAoE;QACpE,kCAAkC;QAClC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;QAC7B,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;YACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACrE,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACvD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACjC,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC7B,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mCAAmC;IAC/C,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAa;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,CAAC;IACZ,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAQ9B;IACG,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,WAAW,OAAO,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,OAAO,GAAsB;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxJ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI;YAChD,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,IAAI;SAChB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,OAAO,GAAgB;YACzB,aAAa,EAAE,2BAA2B;YAC1C,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;SAC/B,CAAC;QACF,OAAO,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC5D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACvD,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YAAC,KAAK,CAAC,cAAc,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBAAC,IAAI,UAAU,CAAC,OAAO,CAAC;oBAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;YAAS,CAAC;QACP,IAAI,CAAC;YAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC;IACjD,6BAA6B,EAAE,CAAC;AACpC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,6BAA6B;IACzC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC;AACtC,CAAC"}

package/dist/src/tools/cron-appkey-binding-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cron-appkey-binding-store.test.d.ts.map

package/dist/src/tools/cron-appkey-binding-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-appkey-binding-store.test.d.ts","sourceRoot":"","sources":["../../../src/tools/cron-appkey-binding-store.test.ts"],"names":[],"mappings":""}

package/dist/src/tools/cron-appkey-binding-store.test.js

@@ -0,0 +1,387 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { __resetActiveCronContextStoreForTests, getActiveCronContexts, setActiveCronContext, } from "./active-cron-context-store.js";
+import { __resetCronAppKeyBindingStoreForTests, bindCronAppKey, getCronAppKeyBinding, initCronAppKeyBindingStore, } from "./cron-appkey-binding-store.js";
+import { disposePluginModule } from "../plugin/plugin-dispose.js";
+import { extractCronJobIdFromResult, isCronCreateCommand, parseCronSessionKey, parseCronSessionTarget, registerCronAppKeyBindingHook, registerExecEnvHook } from "./register-exec-env-hook.js";
+import { __resetSessionEnvStoreForTests, flushSessionEnvPersistence, getSessionEnv, initSessionEnvPersistence, setSessionEnvEntry, setSessionUserContext, XG_OPENAPI_APP_KEY, } from "../session/session-env-store.js";
+let dirs = [];
+afterEach(() => {
+    __resetActiveCronContextStoreForTests();
+    __resetCronAppKeyBindingStoreForTests();
+    __resetSessionEnvStoreForTests();
+    for (const dir of dirs.splice(0))
+        rmSync(dir, { recursive: true, force: true });
+});
+describe("cron appKey binding store", () => {
+    it("persists and reloads an agent + job binding", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const created = bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1", userId: "u1" });
+        assert.equal(created?.appKey, "key-1");
+        assert.equal(getCronAppKeyBinding("agent-a", "job-1")?.userId, "u1");
+        __resetCronAppKeyBindingStoreForTests();
+        initCronAppKeyBindingStore(join(dir, "state"));
+        assert.equal(getCronAppKeyBinding("agent-a", "job-1")?.appKey, "key-1");
+    });
+    it("reuses one process-shared binding store across register and old Registry cleanup", async () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        const stateDir = join(dir, "state");
+        initCronAppKeyBindingStore(stateDir);
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        // A new Registry initializes the same process store before the old
+        // Registry cleanup runs.
+        initCronAppKeyBindingStore(stateDir);
+        await disposePluginModule({ skipConnections: true, skipPlanResources: true });
+        assert.equal(getCronAppKeyBinding("agent-a", "job-1")?.appKey, "key-1");
+    });
+    it("rejects invalid values and ignores malformed records", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        assert.equal(bindCronAppKey({ agentId: "a", jobId: "j", appKey: "bad\nkey" }), undefined);
+        const path = join(dir, "xg-cwork-im", "cron-appkey-bindings.json");
+        mkdirSync(join(dir, "xg-cwork-im"), { recursive: true });
+        writeFileSync(path, JSON.stringify({ schemaVersion: 1, bindings: [{ agentId: "a" }] }));
+        assert.equal(getCronAppKeyBinding("a", "j"), undefined);
+        assert.equal(readFileSync(path, "utf8").includes("bad"), false);
+    });
+    it("keeps empty-appKey migration placeholders but never injects them", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const path = join(dir, "xg-cwork-im", "cron-appkey-bindings.json");
+        mkdirSync(join(dir, "xg-cwork-im"), { recursive: true });
+        writeFileSync(path, JSON.stringify({ schemaVersion: 1, updatedAt: "2026-08-31T00:00:00.000Z", bindings: [{ agentId: "a", jobId: "j", appKey: "", source: "migration", createdAt: "2026-08-31T00:00:00.000Z", updatedAt: "2026-08-31T00:00:00.000Z", enabled: true }] }));
+        assert.equal(getCronAppKeyBinding("a", "j"), undefined);
+    });
+    it("binds production native Cron details.job.id to the exact creator session", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:2095111117868310530";
+        setSessionEnvEntry(sessionKey, XG_OPENAPI_APP_KEY, "key-1");
+        setSessionUserContext(sessionKey, "u1", "User");
+        let after;
+        registerCronAppKeyBindingHook({ on: (name, handler) => { if (name === "after_tool_call")
+                after = handler; } });
+        after?.({
+            toolName: "cron",
+            params: { action: "add" },
+            result: { details: { created: true, job: { id: "90a5c486-624e-4148-bc00-9760b5893a04" } } },
+        }, { sessionKey, agentId: "agent-a" });
+        const binding = getCronAppKeyBinding("agent-a", "90a5c486-624e-4148-bc00-9760b5893a04");
+        assert.equal(binding?.appKey, "key-1");
+        assert.equal(binding?.agentId, "agent-a");
+        assert.equal(binding?.jobId, "90a5c486-624e-4148-bc00-9760b5893a04");
+        assert.equal(binding?.ownerSessionKey, sessionKey);
+        assert.equal(binding?.userId, "u1");
+    });
+    it("recognizes the IM-exposed Cron CLI and binds its JSON result", () => {
+        assert.equal(isCronCreateCommand("openclaw cron add --every 5m --json"), true);
+        assert.equal(isCronCreateCommand("openclaw gateway call cron.create --json"), true);
+        assert.equal(isCronCreateCommand("openclaw cron list --json"), false);
+        assert.equal(extractCronJobIdFromResult({ content: [{ type: "text", text: '{"id":"10d05140-09a8-4354-93f0-dd7fd0ff5e9"}' }] }), "10d05140-09a8-4354-93f0-dd7fd0ff5e9");
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const sessionKey = "agent:agent-a:main";
+        setSessionEnvEntry(sessionKey, XG_OPENAPI_APP_KEY, "key-cli");
+        let after;
+        registerCronAppKeyBindingHook({ on: (name, handler) => { if (name === "after_tool_call")
+                after = handler; } });
+        after?.({ toolName: "exec", params: { command: "openclaw cron add --every 5m --json" }, result: { content: [{ text: "{\"id\":\"10d05140-09a8-4354-93f0-dd7fd0ff5e9\"}" }] } }, { sessionKey, agentId: "agent-a" });
+        assert.equal(getCronAppKeyBinding("agent-a", "10d05140-09a8-4354-93f0-dd7fd0ff5e9")?.appKey, "key-cli");
+    });
+    it("accepts isolated Cron session keys and non-UUID structured job ids", () => {
+        assert.deepEqual(parseCronSessionKey("agent:agent-a:cron:daily-report"), {
+            agentId: "agent-a",
+            jobId: "daily-report",
+            runId: "",
+        });
+        assert.equal(extractCronJobIdFromResult({ details: { jobId: "daily-report" } }), "daily-report");
+        assert.equal(extractCronJobIdFromResult({ details: { created: true, job: { id: "daily-report" } } }), "daily-report");
+        assert.equal(extractCronJobIdFromResult({ content: [{ type: "text", text: '{"id":"daily-report"}' }] }), "daily-report");
+    });
+    it("parses only confirmed session:agent: Cron targets", () => {
+        assert.deepEqual(parseCronSessionTarget("session:agent:agent-a:xg_cwork_im:group:g1"), {
+            agentId: "agent-a",
+            sessionKey: "agent:agent-a:xg_cwork_im:group:g1",
+        });
+        assert.equal(parseCronSessionTarget("isolated"), undefined);
+        assert.equal(parseCronSessionTarget("main"), undefined);
+        assert.equal(parseCronSessionTarget("session:main"), undefined);
+    });
+    it("sessionTarget=session:... keeps its exact Cron binding after finished cleanup", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        let before;
+        let changed;
+        const api = {
+            runtime: { config: { current: () => ({ channels: { xg_cwork_im: {} } }) } },
+            on: (name, handler) => {
+                if (name === "before_tool_call")
+                    before = handler;
+                if (name === "cron_changed")
+                    changed = handler;
+            },
+        };
+        registerExecEnvHook(api);
+        registerCronAppKeyBindingHook(api);
+        changed?.({
+            action: "started",
+            jobId: "job-1",
+            agentId: "agent-a",
+            job: { sessionTarget: `session:${sessionKey}` },
+        }, {});
+        changed?.({ action: "finished", jobId: "job-1", agentId: "agent-a" }, {});
+        assert.equal(getActiveCronContexts("agent-a", sessionKey).length, 0);
+        const result = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "ai-wrong" } } }, { sessionKey, agentId: "agent-a" });
+        assert.equal(result.params.env.XG_OPENAPI_APP_KEY, "key-1");
+    });
+    it("new Registry reads the active context created by the old Registry after cleanup", async () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        let oldChanged;
+        registerCronAppKeyBindingHook({
+            on: (name, handler) => { if (name === "cron_changed")
+                oldChanged = handler; },
+        });
+        oldChanged?.({ action: "started", jobId: "job-1", sessionTarget: `session:${sessionKey}` }, {});
+        let newBefore;
+        registerExecEnvHook({
+            runtime: { config: { current: () => ({ channels: { xg_cwork_im: {} } }) } },
+            on: (name, handler) => { if (name === "before_tool_call")
+                newBefore = handler; },
+        });
+        await disposePluginModule({ skipConnections: true, skipPlanResources: true });
+        const result = newBefore?.({ toolName: "exec", params: { env: {} } }, { sessionKey, agentId: "agent-a" });
+        assert.equal(result.params.env.XG_OPENAPI_APP_KEY, "key-1");
+    });
+    it("sessionTarget Cron child inherits through its persisted parent chain after finished", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        const parentSessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        const childSessionKey = "agent:agent-a:subagent:child-1";
+        let before;
+        let changed;
+        const api = {
+            runtime: {
+                config: { current: () => ({ channels: { xg_cwork_im: {} } }) },
+                agent: { session: {
+                        resolveStorePath: () => "test-store",
+                        getSessionEntry: ({ sessionKey }) => sessionKey === childSessionKey ? { spawnedBy: parentSessionKey } : undefined,
+                    } },
+            },
+            on: (name, handler) => {
+                if (name === "before_tool_call")
+                    before = handler;
+                if (name === "cron_changed")
+                    changed = handler;
+            },
+        };
+        registerExecEnvHook(api);
+        registerCronAppKeyBindingHook(api);
+        changed?.({ action: "started", jobId: "job-1", job: { sessionTarget: `session:${parentSessionKey}` } }, {});
+        changed?.({ action: "finished", jobId: "job-1", agentId: "agent-a" }, {});
+        const result = before?.({ toolName: "exec", params: { env: {} } }, { sessionKey: childSessionKey, agentId: "agent-a" });
+        assert.equal(result.params.env.XG_OPENAPI_APP_KEY, "key-1");
+    });
+    it("sessionTarget Cron binding survives session store restart after finished", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        const stateDir = join(dir, "state");
+        initCronAppKeyBindingStore(stateDir);
+        initSessionEnvPersistence(stateDir);
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        let changed;
+        registerCronAppKeyBindingHook({
+            on: (name, handler) => { if (name === "cron_changed")
+                changed = handler; },
+        });
+        changed?.({ action: "started", jobId: "job-1", agentId: "agent-a", sessionTarget: `session:${sessionKey}` }, {});
+        changed?.({ action: "finished", jobId: "job-1", agentId: "agent-a" }, {});
+        flushSessionEnvPersistence();
+        __resetSessionEnvStoreForTests();
+        initSessionEnvPersistence(stateDir);
+        assert.deepEqual(getSessionEnv(sessionKey), { [XG_OPENAPI_APP_KEY]: "key-1" });
+    });
+    it("sessionTarget Cron with no exact binding clears a stale session AppKey", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        setSessionEnvEntry(sessionKey, XG_OPENAPI_APP_KEY, "stale-key");
+        let changed;
+        registerCronAppKeyBindingHook({
+            on: (name, handler) => { if (name === "cron_changed")
+                changed = handler; },
+        });
+        changed?.({ action: "started", jobId: "job-missing", agentId: "agent-a", sessionTarget: `session:${sessionKey}` }, {});
+        assert.equal(getSessionEnv(sessionKey), undefined);
+    });
+    it("finished removes active context immediately and TTL removes a missing-finished context", () => {
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        setActiveCronContext({ agentId: "agent-a", sessionKey, jobId: "job-1", ttlMs: 100, now: 1_000 });
+        assert.equal(getActiveCronContexts("agent-a", sessionKey, 1_099).length, 1);
+        assert.equal(getActiveCronContexts("agent-a", sessionKey, 1_100).length, 0);
+        let changed;
+        registerCronAppKeyBindingHook({ on: (name, handler) => { if (name === "cron_changed")
+                changed = handler; } });
+        changed?.({ action: "started", jobId: "job-2", agentId: "agent-a", sessionTarget: `session:${sessionKey}` }, {});
+        assert.equal(getActiveCronContexts("agent-a", sessionKey).length, 1);
+        changed?.({ action: "finished", jobId: "job-2", agentId: "agent-a" }, {});
+        assert.equal(getActiveCronContexts("agent-a", sessionKey).length, 0);
+    });
+    it("allows equal active Cron AppKeys and rejects conflicting AppKeys", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "same-key" });
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-2", appKey: "same-key" });
+        setActiveCronContext({ agentId: "agent-a", sessionKey, jobId: "job-1" });
+        setActiveCronContext({ agentId: "agent-a", sessionKey, jobId: "job-2" });
+        let before;
+        registerExecEnvHook({
+            runtime: { config: { current: () => ({ channels: { xg_cwork_im: {} } }) } },
+            on: (name, handler) => { if (name === "before_tool_call")
+                before = handler; },
+        });
+        const equal = before?.({ toolName: "exec", params: { env: {} } }, { sessionKey, agentId: "agent-a" });
+        assert.equal(equal.params.env.XG_OPENAPI_APP_KEY, "same-key");
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-2", appKey: "different-key" });
+        const conflict = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "ai-wrong" } } }, { sessionKey, agentId: "agent-a" });
+        assert.deepEqual(conflict.params.env, {});
+    });
+    it("keeps ordinary exec parameters when the Cron binding file is unreadable", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        const stateDir = join(dir, "state");
+        initCronAppKeyBindingStore(stateDir);
+        const bindingPath = join(dir, "xg-cwork-im", "cron-appkey-bindings.json");
+        mkdirSync(join(dir, "xg-cwork-im"), { recursive: true });
+        writeFileSync(bindingPath, "{not-json");
+        const sessionKey = "agent:agent-a:xg_cwork_im:group:g1";
+        setActiveCronContext({ agentId: "agent-a", sessionKey, jobId: "job-1" });
+        let before;
+        registerExecEnvHook({
+            runtime: { config: { current: () => ({ channels: { xg_cwork_im: {} } }) } },
+            on: (name, handler) => { if (name === "before_tool_call")
+                before = handler; },
+        });
+        const result = before?.({ toolName: "exec", params: { command: "echo ok", env: { XG_OPENAPI_APP_KEY: "ai-wrong", KEEP: "1" } } }, { sessionKey, agentId: "agent-a" });
+        assert.equal(result.params.command, "echo ok");
+        assert.deepEqual(result.params.env, { KEEP: "1" });
+    });
+    it("does not guess a creator AppKey from cron_changed without sessionKey", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        setSessionEnvEntry("agent:agent-a:main", XG_OPENAPI_APP_KEY, "key-1");
+        let changed;
+        registerCronAppKeyBindingHook({ on: (name, handler) => { if (name === "cron_changed")
+                changed = handler; } });
+        changed?.({ action: "added", jobId: "job-1", agentId: "agent-a", job: { id: "job-1" } }, {});
+        assert.equal(getCronAppKeyBinding("agent-a", "job-1"), undefined);
+    });
+    it("loads a minimal persisted binding without optional metadata", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        const path = join(dir, "xg-cwork-im", "cron-appkey-bindings.json");
+        mkdirSync(join(dir, "xg-cwork-im"), { recursive: true });
+        writeFileSync(path, JSON.stringify({ schemaVersion: 1, bindings: [{ agentId: "agent-a", jobId: "daily-report", appKey: "key-1" }] }));
+        assert.equal(getCronAppKeyBinding("agent-a", "daily-report")?.appKey, "key-1");
+    });
+    it("injects only the matching agent/job binding and strips unbound values", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        let before;
+        registerExecEnvHook({
+            runtime: { config: { current: () => ({ channels: { xg_cwork_im: {} } }) } },
+            on: (name, handler) => { if (name === "before_tool_call")
+                before = handler; },
+        });
+        const debugLines = [];
+        const originalDebug = console.debug;
+        console.debug = (...args) => debugLines.push(args.map(String).join(" "));
+        try {
+            const bound = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "***", KEEP: "1" } } }, { sessionKey: "agent:agent-a:cron:job-1:run:r" });
+            assert.equal(bound.params.env.XG_OPENAPI_APP_KEY, "key-1");
+            const isolated = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "***" } } }, { sessionKey: "agent:agent-a:cron:job-1" });
+            assert.equal(isolated.params.env.XG_OPENAPI_APP_KEY, "key-1");
+            const unbound = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "***" } } }, { sessionKey: "agent:agent-b:cron:job-1:run:r" });
+            assert.deepEqual(unbound.params.env, {});
+        }
+        finally {
+            console.debug = originalDebug;
+        }
+        assert.equal(debugLines.some((line) => line.includes("sessionKey=agent:agent-b:cron:job-1:run:r") && line.includes("jobId=job-1") && line.includes("bindingFound=false")), true);
+    });
+    it("Cron 子 Agent 沿 OpenClaw 父链按 agentId + jobId 恢复绑定", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        bindCronAppKey({ agentId: "agent-a", jobId: "job-1", appKey: "key-1" });
+        let before;
+        registerExecEnvHook({
+            runtime: {
+                config: { current: () => ({ channels: { xg_cwork_im: {} } }) },
+                agent: {
+                    session: {
+                        resolveStorePath: () => "test-store",
+                        getSessionEntry: ({ sessionKey }) => sessionKey === "agent:agent-a:child" ? { spawnedBy: "agent:agent-a:cron:job-1:run:old" } : undefined,
+                    },
+                },
+            },
+            on: (name, handler) => { if (name === "before_tool_call")
+                before = handler; },
+        });
+        const result = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "ai-wrong" } } }, { sessionKey: "agent:agent-a:child", agentId: "agent-a" });
+        assert.equal(result.params.env.XG_OPENAPI_APP_KEY, "key-1");
+    });
+    it("Cron 绑定缺失时不回退到普通父 Session 的 AppKey", () => {
+        const dir = mkdtempSync(join(tmpdir(), "xg-cron-binding-"));
+        dirs.push(dir);
+        initCronAppKeyBindingStore(join(dir, "state"));
+        setSessionEnvEntry("agent:agent-a:root", XG_OPENAPI_APP_KEY, "ordinary-key");
+        let before;
+        registerExecEnvHook({
+            runtime: {
+                config: { current: () => ({ channels: { xg_cwork_im: {} } }) },
+                agent: { session: {
+                        resolveStorePath: () => "test-store",
+                        getSessionEntry: ({ sessionKey }) => {
+                            if (sessionKey === "agent:agent-a:child")
+                                return { spawnedBy: "agent:agent-a:cron:job-missing:run:r" };
+                            if (sessionKey === "agent:agent-a:cron:job-missing:run:r")
+                                return { spawnedBy: "agent:agent-a:root" };
+                            return undefined;
+                        },
+                    } },
+            },
+            on: (name, handler) => { if (name === "before_tool_call")
+                before = handler; },
+        });
+        const result = before?.({ toolName: "exec", params: { env: { XG_OPENAPI_APP_KEY: "ai-wrong" } } }, { sessionKey: "agent:agent-a:child", agentId: "agent-a" });
+        assert.deepEqual(result.params.env, {});
+    });
+});
+//# sourceMappingURL=cron-appkey-binding-store.test.js.map