@ynhcj/xiaoyi-channel 0.0.45-beta → 0.0.45-next

package/dist/index.d.ts

@@ -1,5 +1,4 @@
 import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
-import { xyPlugin } from "./src/channel.js";
 /**
  * Xiaoyi Channel Plugin Entry Point.
  * Exports the plugin for OpenClaw to load.
@@ -13,4 +12,3 @@ declare const plugin: {
     register(api: OpenClawPluginApi): void;
 };
 export default plugin;
-export { xyPlugin };

package/dist/index.js

@@ -1,6 +1,10 @@
 import { emptyPluginConfigSchema } from "openclaw/plugin-sdk";
 import { xyPlugin } from "./src/channel.js";
 import { setXYRuntime } from "./src/runtime.js";
+import { tryInjectSteer } from "./src/steer-injector.js";
+import { callCsplApi } from "./src/cspl/call-api.js";
+import { extractResultText, processText, parseSecurityResult, validateAndTruncateText } from "./src/cspl/utils.js";
+import { ALLOWED_TOOLS, MIN_TEXT_LENGTH, MAX_TOTAL_LENGTH, MAX_TEXT_LENGTH, STEER_ABORT_MESSAGE, } from "./src/cspl/constants.js";
 /**
  * Xiaoyi Channel Plugin Entry Point.
  * Exports the plugin for OpenClaw to load.
@@ -14,8 +18,44 @@ const plugin = {
     register(api) {
         setXYRuntime(api.runtime);
         api.registerChannel({ plugin: xyPlugin });
+        // CSPL after_tool_call hook: 监听工具结果，发送至 CSPL API 进行安全检测
+        // 如果响应为 REJECT，注入 steer 消息中止当前对话
+        api.on("after_tool_call", async (event, ctx) => {
+            if (!ALLOWED_TOOLS.includes(event.toolName)) {
+                return;
+            }
+            console.log(`[CSPL] after_tool_call triggered: toolName=${event.toolName}, sessionKey=${ctx.sessionKey ?? "none"}`);
+            try {
+                const resultText = extractResultText(event, event.toolName);
+                const resultLength = resultText.length;
+                if (resultLength <= MIN_TEXT_LENGTH || resultLength > MAX_TOTAL_LENGTH) {
+                    return;
+                }
+                // 构造 sentinel_hook 格式的 payload: { tool, output: [{ content }] }
+                const questionText = {
+                    tool: event.toolName,
+                    output: [{ content: "" }],
+                };
+                const originText = processText(resultText);
+                questionText.output[0].content = originText;
+                let finalJson = JSON.stringify(questionText);
+                if (finalJson.length > MAX_TEXT_LENGTH) {
+                    const diff = finalJson.length - MAX_TEXT_LENGTH;
+                    const { text: trimmed } = validateAndTruncateText(originText, MAX_TEXT_LENGTH - diff);
+                    questionText.output[0].content = trimmed;
+                    finalJson = JSON.stringify(questionText);
+                }
+                const response = await callCsplApi(finalJson, api.config);
+                const result = parseSecurityResult(response);
+                console.log(`[CSPL] Security result: status=${result.status}`);
+                if (result.status === "REJECT") {
+                    await tryInjectSteer(ctx.sessionKey, STEER_ABORT_MESSAGE);
+                }
+            }
+            catch (err) {
+                api.logger.error(`[CSPL] after_tool_call error: ${err}`);
+            }
+        });
     },
 };
 export default plugin;
-// Also export the plugin directly for testing
-export { xyPlugin };

package/dist/src/bot.d.ts

@@ -8,6 +8,7 @@ export interface HandleXYMessageParams {
     runtime: RuntimeEnv;
     message: A2AJsonRpcRequest;
     accountId: string;
+    webSocketSessionId?: string;
 }
 /**
  * Handle an incoming A2A message.

package/dist/src/bot.js

@@ -1,12 +1,15 @@
 import { getXYRuntime } from "./runtime.js";
+import { setCachedContext } from "./steer-injector.js";
 import { createXYReplyDispatcher } from "./reply-dispatcher.js";
-import { parseA2AMessage, extractTextFromParts, extractFileParts, extractPushId, extractTriggerData } from "./parser.js";
+import { parseA2AMessage, extractTextFromParts, extractFileParts, extractPushId, extractDeviceType, extractTriggerData } from "./parser.js";
+import { downloadFilesFromParts } from "./file-download.js";
 import { resolveXYConfig } from "./config.js";
 import { sendStatusUpdate, sendClearContextResponse, sendTasksCancelResponse, sendA2AResponse } from "./formatter.js";
 import { registerSession, unregisterSession, runWithSessionContext } from "./tools/session-manager.js";
 import { configManager } from "./utils/config-manager.js";
 import { addPushId } from "./utils/pushid-manager.js";
 import { getPushDataById } from "./utils/pushdata-manager.js";
+import { saveRuntimeInfo } from "./utils/runtime-manager.js";
 import { registerTaskId, decrementTaskIdRef, lockTaskId, unlockTaskId, hasActiveTask, } from "./task-manager.js";
 /**
  * Handle an incoming A2A message.
@@ -14,16 +17,16 @@ import { registerTaskId, decrementTaskIdRef, lockTaskId, unlockTaskId, hasActive
  * Runtime is expected to be validated before calling this function.
  */
 export async function handleXYMessage(params) {
-    const { cfg, runtime, message, accountId } = params;
+    const { cfg, runtime, message, accountId, webSocketSessionId } = params;
     const log = runtime?.log ?? console.log;
     const error = runtime?.error ?? console.error;
+    // 每次收到消息时更新缓存，供 steer 注入使用
+    setCachedContext(cfg, runtime, accountId);
     // Get runtime (already validated in monitor.ts, but get reference for use)
     const core = getXYRuntime();
     try {
         // Check for special messages BEFORE parsing (these have different param structures)
         const messageMethod = message.method;
-        log(`[BOT-ENTRY] <<<<<<< Received message with method: ${messageMethod}, id: ${message.id} >>>>>>>`);
-        log(`[BOT-ENTRY] Stack trace for debugging:`, new Error().stack?.split('\n').slice(1, 4).join('\n'));
         // Handle clearContext messages (params only has sessionId)
         if (messageMethod === "clearContext" || messageMethod === "clear_context") {
             const sessionId = message.params?.sessionId;
@@ -74,8 +77,6 @@ export async function handleXYMessage(params) {
                 }
                 log(`[BOT] ✅ Found pushData, sending direct response`);
                 log(`[BOT]   - pushDataId: ${pushDataItem.pushDataId}`);
-                log(`[BOT]   - time: ${pushDataItem.time}`);
-                log(`[BOT]   - content length: ${pushDataItem.dataDetail.length} chars`);
                 const config = resolveXYConfig(cfg);
                 // 直接发送响应（final=true，不走 openclaw 流程）
                 await sendA2AResponse({
@@ -116,9 +117,6 @@ export async function handleXYMessage(params) {
         const pushId = extractPushId(parsed.parts);
         if (pushId) {
             log(`[BOT] 📌 Extracted push_id from user message`);
-            log(`[BOT]   - Session ID: ${parsed.sessionId}`);
-            log(`[BOT]   - Push ID preview: ${pushId.substring(0, 20)}...`);
-            log(`[BOT]   - Full push_id: ${pushId}`);
             configManager.updatePushId(parsed.sessionId, pushId);
             // 持久化 pushId 到本地文件（异步，不阻塞主流程）
             addPushId(pushId).catch((err) => {
@@ -128,6 +126,18 @@ export async function handleXYMessage(params) {
         else {
             log(`[BOT] ℹ️  No push_id found in message, will use config default`);
         }
+        // Extract deviceType if present (same level as push_id in systemVariables)
+        const deviceType = extractDeviceType(parsed.parts);
+        if (deviceType) {
+            log(`[BOT] 📱 Extracted deviceType from user message: ${deviceType}`);
+        }
+        // 保存 runtime 信息到 .xiaoyiruntime 文件（异步，不阻塞主流程）
+        saveRuntimeInfo(webSocketSessionId || parsed.sessionId, // SESSION_ID (WebSocket 层级，如果没有则 fallback)
+        parsed.sessionId, // CONVERSATION_ID (param 里的 sessionId)
+        parsed.taskId // TASK_ID (param.id)
+        ).catch((err) => {
+            error(`[BOT] Failed to save runtime info:`, err);
+        });
         // Resolve configuration (needed for status updates)
         const config = resolveXYConfig(cfg);
         // ✅ Resolve agent route (following feishu pattern)
@@ -143,12 +153,6 @@ export async function handleXYMessage(params) {
             },
         });
         log(`xy: resolved route accountId=${route.accountId}, sessionKey=${route.sessionKey}`);
-        // 🔑 注册session（带引用计数）
-        log(`[BOT] 📝 About to register session for tools...`);
-        log(`[BOT]   - sessionKey: ${route.sessionKey}`);
-        log(`[BOT]   - sessionId: ${parsed.sessionId}`);
-        log(`[BOT]   - taskId: ${parsed.taskId}`);
-        log(`[BOT]   - isSecondMessage: ${isSecondMessage}`);
         registerSession(route.sessionKey, {
             config,
             sessionId: parsed.sessionId,
@@ -156,7 +160,6 @@ export async function handleXYMessage(params) {
             messageId: parsed.messageId,
             agentId: route.accountId,
         });
-        log(`[BOT] ✅ Session registered for tools`);
         // 🔑 发送初始状态更新（第二条消息也要发，用新taskId）
         log(`[STATUS] Sending initial status update for session ${parsed.sessionId}`);
         void sendStatusUpdate({
@@ -164,7 +167,7 @@ export async function handleXYMessage(params) {
             sessionId: parsed.sessionId,
             taskId: parsed.taskId,
             messageId: parsed.messageId,
-            text: isSecondMessage ? "新消息已接收，正在处理..." : "任务正在处理中，请稍后~",
+            text: isSecondMessage ? "新消息已接收，正在处理..." : "任务正在处理中，请稍候~",
             state: "working",
         }).catch((err) => {
             error(`Failed to send initial status update:`, err);
@@ -172,9 +175,9 @@ export async function handleXYMessage(params) {
         // Extract text and files from parts
         const text = extractTextFromParts(parsed.parts);
         const fileParts = extractFileParts(parsed.parts);
-        // Build media payload directly from file URIs (openclaw can download them)
-        // No need to download files locally - pass URIs directly to openclaw
-        const mediaPayload = buildXYMediaPayload(fileParts);
+        // Download files to local disk
+        const downloadedFiles = await downloadFilesFromParts(fileParts);
+        const mediaPayload = buildXYMediaPayload(downloadedFiles);
         // Resolve envelope format options (following feishu pattern)
         const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);
         // Build message body with speaker prefix (following feishu pattern)
@@ -217,9 +220,7 @@ export async function handleXYMessage(params) {
         });
         // 🔑 创建dispatcher（dispatcher会自动使用动态taskId）
         log(`[BOT-DISPATCHER] 🎯 Creating reply dispatcher`);
-        log(`[BOT-DISPATCHER]   - session: ${parsed.sessionId}`);
         log(`[BOT-DISPATCHER]   - taskId: ${parsed.taskId}`);
-        log(`[BOT-DISPATCHER]   - isSecondMessage: ${isSecondMessage}`);
         const { dispatcher, replyOptions, markDispatchIdle, startStatusInterval } = createXYReplyDispatcher({
             cfg,
             runtime,
@@ -229,19 +230,12 @@ export async function handleXYMessage(params) {
             accountId: route.accountId,
             isSteerFollower: isSecondMessage, // 🔑 标记第二条消息
         });
-        log(`[BOT-DISPATCHER] ✅ Reply dispatcher created successfully`);
         // 🔑 只有第一条消息启动状态定时器
         // 第二条消息会很快返回，不需要定时器
         if (!isSecondMessage) {
             startStatusInterval();
             log(`[BOT-DISPATCHER] ✅ Status interval started for first message`);
         }
-        else {
-            log(`[BOT-DISPATCHER] ⏭️  Skipped status interval for steer follower`);
-        }
-        log(`xy: dispatching to agent (session=${parsed.sessionId})`);
-        // Dispatch to OpenClaw core using correct API (following feishu pattern)
-        log(`[BOT] 🚀 Starting dispatcher with session: ${route.sessionKey}`);
         // Build session context for AsyncLocalStorage
         const sessionContext = {
             config,
@@ -249,13 +243,14 @@ export async function handleXYMessage(params) {
             taskId: parsed.taskId,
             messageId: parsed.messageId,
             agentId: route.accountId,
+            deviceType,
         };
+        log(`[BOT-DISPATCH] ⏳ withReplyDispatcher starting, sessionKey=${route.sessionKey}`);
         await core.channel.reply.withReplyDispatcher({
             dispatcher,
             onSettled: () => {
                 log(`[BOT] 🏁 onSettled called for session: ${route.sessionKey}`);
                 log(`[BOT]   - isSecondMessage: ${isSecondMessage}`);
-                markDispatchIdle();
                 // 🔑 减少引用计数
                 decrementTaskIdRef(parsed.sessionId);
                 // 🔑 如果是第一条消息完成，解锁
@@ -269,12 +264,32 @@ export async function handleXYMessage(params) {
             },
             run: () => 
             // 🔐 Use AsyncLocalStorage to provide session context to tools
-            runWithSessionContext(sessionContext, () => core.channel.reply.dispatchReplyFromConfig({
-                ctx: ctxPayload,
-                cfg,
-                dispatcher,
-                replyOptions,
-            })),
+            runWithSessionContext(sessionContext, async () => {
+                log(`[BOT-DISPATCH] ⏳ dispatchReplyFromConfig starting...`);
+                log(`[BOT-DISPATCH]   - sessionKey: ${ctxPayload.SessionKey}`);
+                log(`[BOT-DISPATCH]   - provider: ${ctxPayload.Provider}`);
+                log(`[BOT-DISPATCH]   - surface: ${ctxPayload.Surface}`);
+                log(`[BOT-DISPATCH]   - from: ${ctxPayload.From}`);
+                log(`[BOT-DISPATCH]   - body length: ${ctxPayload.Body?.length ?? 0}`);
+                try {
+                    const result = await core.channel.reply.dispatchReplyFromConfig({
+                        ctx: ctxPayload,
+                        cfg,
+                        dispatcher,
+                        replyOptions,
+                    });
+                    log(`[BOT-DISPATCH] ✅ dispatchReplyFromConfig returned`);
+                    log(`[BOT-DISPATCH]   - result: ${JSON.stringify(result)}`);
+                    return result;
+                }
+                catch (dispatchErr) {
+                    error(`[BOT-DISPATCH] ❌ dispatchReplyFromConfig threw`);
+                    error(`[BOT-DISPATCH]   - error name: ${dispatchErr instanceof Error ? dispatchErr.name : "unknown"}`);
+                    error(`[BOT-DISPATCH]   - error message: ${String(dispatchErr)}`);
+                    error(`[BOT-DISPATCH]   - error stack: ${dispatchErr instanceof Error ? dispatchErr.stack?.slice(0, 500) : "N/A"}`);
+                    throw dispatchErr;
+                }
+            }),
         });
         log(`[BOT] ✅ Dispatcher completed for session: ${parsed.sessionId}`);
         log(`xy: dispatch complete (session=${parsed.sessionId})`);
@@ -318,34 +333,17 @@ export async function handleXYMessage(params) {
 /**
  * Build media payload for inbound context.
  * Following feishu pattern: buildFeishuMediaPayload().
- * Uses remote URIs directly - openclaw will download them.
+ *
+ * @param mediaList - Downloaded files with local paths
  */
-function buildXYMediaPayload(fileParts) {
-    const first = fileParts[0];
-    const uris = fileParts.map((file) => file.uri);
-    const mediaTypes = fileParts.map((file) => file.mimeType).filter(Boolean);
+function buildXYMediaPayload(mediaList) {
+    const first = mediaList[0];
+    const mediaPaths = mediaList.map((media) => media.path);
+    const mediaTypes = mediaList.map((media) => media.mimeType).filter(Boolean);
     return {
-        MediaPath: first?.uri,
+        MediaPath: first?.path,
         MediaType: first?.mimeType,
-        MediaUrl: first?.uri,
-        MediaPaths: uris.length > 0 ? uris : undefined,
-        MediaUrls: uris.length > 0 ? uris : undefined,
+        MediaPaths: mediaPaths.length > 0 ? mediaPaths : undefined,
         MediaTypes: mediaTypes.length > 0 ? mediaTypes : undefined,
     };
 }
-/**
- * Infer OpenClaw media type from file type string.
- */
-function inferMediaType(fileType) {
-    const lower = fileType.toLowerCase();
-    if (lower.includes("image") || /\.(jpg|jpeg|png|gif|bmp|webp)$/i.test(lower)) {
-        return "image";
-    }
-    if (lower.includes("video") || /\.(mp4|avi|mov|mkv|webm)$/i.test(lower)) {
-        return "video";
-    }
-    if (lower.includes("audio") || /\.(mp3|wav|ogg|m4a)$/i.test(lower)) {
-        return "audio";
-    }
-    return "file";
-}

package/dist/src/channel.js

@@ -1,7 +1,6 @@
 import { resolveXYConfig, listXYAccountIds, getDefaultXYAccountId } from "./config.js";
 import { xyConfigSchema } from "./config-schema.js";
 import { xyOutbound } from "./outbound.js";
-import { xyOnboardingAdapter } from "./onboarding.js";
 import { locationTool } from "./tools/location-tool.js";
 import { noteTool } from "./tools/note-tool.js";
 import { searchNoteTool } from "./tools/search-note-tool.js";
@@ -22,8 +21,13 @@ import { searchAlarmTool } from "./tools/search-alarm-tool.js";
 import { modifyAlarmTool } from "./tools/modify-alarm-tool.js";
 import { deleteAlarmTool } from "./tools/delete-alarm-tool.js";
 import { sendFileToUserTool } from "./tools/send-file-to-user-tool.js";
-import { xiaoyiCollectionTool } from "./tools/xiaoyi-collection-tool.js";
 import { viewPushResultTool } from "./tools/view-push-result-tool.js";
+import { imageReadingTool } from "./tools/image-reading-tool.js";
+import { timestampToUtc8Tool } from "./tools/timestamp-to-utc8-tool.js";
+import { sendCommandToCarTool } from "./tools/send-command-to-car-tool.js";
+import { filterToolsByDevice } from "./tools/device-tool-map.js";
+import { getCurrentSessionContext } from "./tools/session-manager.js";
+import { logger } from "./utils/logger.js";
 /**
  * Xiaoyi Channel Plugin for OpenClaw.
  * Implements Xiaoyi A2A protocol with dual WebSocket connections.
@@ -62,8 +66,13 @@ export const xyPlugin = {
         schema: xyConfigSchema,
     },
     outbound: xyOutbound,
-    onboarding: xyOnboardingAdapter,
-    agentTools: [locationTool, noteTool, searchNoteTool, modifyNoteTool, calendarTool, searchCalendarTool, searchContactTool, searchPhotoGalleryTool, uploadPhotoTool, xiaoyiGuiTool, callPhoneTool, searchMessageTool, sendMessageTool, searchFileTool, uploadFileTool, createAlarmTool, searchAlarmTool, modifyAlarmTool, deleteAlarmTool, sendFileToUserTool, xiaoyiCollectionTool, viewPushResultTool],
+    agentTools: () => {
+        const allTools = [locationTool, noteTool, searchNoteTool, modifyNoteTool, calendarTool, searchCalendarTool, searchContactTool, searchPhotoGalleryTool, uploadPhotoTool, xiaoyiGuiTool, callPhoneTool, searchMessageTool, sendMessageTool, searchFileTool, uploadFileTool, createAlarmTool, searchAlarmTool, modifyAlarmTool, deleteAlarmTool, sendFileToUserTool, viewPushResultTool, imageReadingTool, timestampToUtc8Tool, sendCommandToCarTool];
+        const ctx = getCurrentSessionContext();
+        const filtered = filterToolsByDevice(allTools, ctx?.deviceType);
+        logger.log(`[DEVICE-FILTER] deviceType=${ctx?.deviceType ?? "(none)"}, tools: ${allTools.length} → ${filtered.length} (${filtered.map(t => t.name).join(", ")})`);
+        return filtered;
+    },
     messaging: {
         normalizeTarget: (raw) => {
             const trimmed = raw.trim();
@@ -80,6 +89,22 @@ export const xyPlugin = {
             hint: "<sessionId>",
         },
     },
+    bindings: {
+        compileConfiguredBinding: ({ conversationId }) => {
+            const sessionId = conversationId.trim();
+            if (!sessionId)
+                return null;
+            return {
+                conversationId: sessionId,
+                parentConversationId: undefined,
+            };
+        },
+        matchInboundConversation: ({ compiledBinding, conversationId }) => {
+            return compiledBinding.conversationId === conversationId
+                ? { conversationId, matchPriority: 2 }
+                : null;
+        },
+    },
     reload: {
         configPrefixes: ["channels.xiaoyi-channel"],
     },

package/dist/src/client.js

@@ -23,7 +23,6 @@ export function getXYWebSocketManager(config) {
     let cached = wsManagerCache.get(cacheKey);
     if (cached && cached.isConfigMatch(config)) {
         const log = runtime?.log ?? console.log;
-        log(`[WS-MANAGER-CACHE] ✅ Reusing cached WebSocket manager: ${cacheKey}, total managers: ${wsManagerCache.size}`);
         return cached;
     }
     // Create new manager
@@ -73,21 +72,14 @@ export function getCachedManagerCount() {
  * Helps identify connection issues and orphan connections.
  */
 export function diagnoseAllManagers() {
-    console.log("========================================");
-    console.log("📊 WebSocket Manager Global Diagnostics");
-    console.log("========================================");
     console.log(`Total cached managers: ${wsManagerCache.size}`);
-    console.log("");
     if (wsManagerCache.size === 0) {
         console.log("ℹ️  No managers in cache");
-        console.log("========================================");
         return;
     }
     let orphanCount = 0;
     wsManagerCache.forEach((manager, key) => {
         const diag = manager.getConnectionDiagnostics();
-        console.log(`📌 Manager: ${key}`);
-        console.log(`   Shutting down: ${diag.isShuttingDown}`);
         console.log(`   Total event listeners on manager: ${diag.totalEventListeners}`);
         // Connection
         console.log(`   🔌 Connection:`);
@@ -111,7 +103,6 @@ export function diagnoseAllManagers() {
     else {
         console.log(`✅ No orphan connections found`);
     }
-    console.log("========================================");
 }
 /**
  * Clean up orphan connections across all managers.

package/dist/src/cspl/call-api.d.ts

@@ -0,0 +1,3 @@
+import type { ClawdbotConfig } from "openclaw/plugin-sdk";
+import type { ApiResponse } from "./constants.js";
+export declare function callCsplApi(questionText: string, cfg: ClawdbotConfig): Promise<ApiResponse>;

package/dist/src/cspl/call-api.js

@@ -0,0 +1,86 @@
+// CSPL API 请求模块
+import https from "node:https";
+import { URL } from "node:url";
+import { randomBytes } from "node:crypto";
+import { getCsplConfig } from "./config.js";
+import { DEFAULT_HTTP_PORT, HTTP_STATUS_BAD_REQUEST } from "./constants.js";
+function generateTraceId() {
+    return randomBytes(16).toString("hex");
+}
+function buildHeaders(config) {
+    return {
+        "x-hag-trace-id": generateTraceId(),
+        "x-uid": config.uid,
+        "x-api-key": config.apiKey,
+        "x-request-from": config.requestFrom,
+        "x-skill-id": config.skillId,
+        "content-type": "application/json",
+    };
+}
+function buildRequestOptions(url, headers, timeout) {
+    const urlObj = new URL(url);
+    return {
+        hostname: urlObj.hostname,
+        port: urlObj.port || DEFAULT_HTTP_PORT,
+        path: urlObj.pathname,
+        method: "POST",
+        headers: headers,
+        timeout,
+    };
+}
+function parseResponse(data) {
+    if (!data?.trim())
+        throw new Error("[CSPL] API response is empty");
+    const json = JSON.parse(data);
+    if (json.retCode && json.retCode !== "0") {
+        throw new Error(`[CSPL] API error: ${json.retMsg || "unknown"}`);
+    }
+    if (!json.retCode && json.code) {
+        throw new Error(`[CSPL] Backend error: ${json.desc || "unknown"}`);
+    }
+    return json;
+}
+export async function callCsplApi(questionText, cfg) {
+    const config = getCsplConfig(cfg);
+    const headers = buildHeaders(config);
+    const payload = {
+        questionText,
+        textSource: config.textSource,
+        action: config.action,
+    };
+    return new Promise((resolve, reject) => {
+        const options = buildRequestOptions(config.api.url, headers, config.api.timeout);
+        const req = https.request(options, (res) => {
+            if (res.statusCode && res.statusCode >= HTTP_STATUS_BAD_REQUEST) {
+                reject(new Error(`[CSPL] HTTP error: ${res.statusCode}`));
+                return;
+            }
+            let data = "";
+            res.on("data", (chunk) => {
+                data += chunk;
+            });
+            res.on("end", () => {
+                try {
+                    const result = parseResponse(data);
+                    console.log(`[CSPL API] ✅ 请求成功`);
+                    resolve(result);
+                }
+                catch (e) {
+                    console.error(`[CSPL API] ❌ 请求失败: ${e instanceof Error ? e.message : String(e)}`);
+                    reject(e);
+                }
+            });
+        });
+        req.on("error", (error) => {
+            console.error(`[CSPL API] ❌ 请求错误: ${error instanceof Error ? error.message : String(error)}`);
+            reject(error);
+        });
+        req.on("timeout", () => {
+            console.error(`[CSPL API] ⏰ 请求超时 (${config.api.timeout}ms)`);
+            req.destroy();
+            reject(new Error("[CSPL] Request timeout"));
+        });
+        req.write(JSON.stringify(payload));
+        req.end();
+    });
+}

package/dist/src/cspl/config.d.ts

@@ -0,0 +1,19 @@
+import type { ClawdbotConfig } from "openclaw/plugin-sdk";
+export interface ApiConfig {
+    url: string;
+    timeout: number;
+}
+export interface CsplConfig {
+    api: ApiConfig;
+    uid: string;
+    apiKey: string;
+    skillId: string;
+    requestFrom: string;
+    textSource: string;
+    action: string;
+}
+/**
+ * 构建 CSPL 配置。uid 和 apiKey 复用 XYChannelConfig，避免重复配置。
+ * serviceUrl 从 .xiaoyienv 文件读取，skillId 写死在常量中。
+ */
+export declare function getCsplConfig(cfg: ClawdbotConfig): CsplConfig;

package/dist/src/cspl/config.js

@@ -0,0 +1,50 @@
+// CSPL Hook 配置管理
+// uid 和 apiKey 复用 XYChannelConfig，skillId 写死在常量中
+import { resolveXYConfig } from "../config.js";
+import { CSPL_STATIC_CONFIG, API_URL_SUFFIX, ENV_FILE_PATH } from "./constants.js";
+import fs from "node:fs";
+import { logger } from "../utils/logger.js";
+let cachedConfig = null;
+function readServiceUrl() {
+    if (!fs.existsSync(ENV_FILE_PATH)) {
+        throw new Error(`[CSPL] Environment file not found: ${ENV_FILE_PATH}`);
+    }
+    const envData = fs.readFileSync(ENV_FILE_PATH, "utf-8");
+    for (const line of envData.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const eqIdx = trimmed.indexOf("=");
+        if (eqIdx === -1)
+            continue;
+        const key = trimmed.substring(0, eqIdx).trim();
+        const value = trimmed.substring(eqIdx + 1).trim();
+        if (key === "SERVICE_URL" && value)
+            return value;
+    }
+    throw new Error("[CSPL] Missing SERVICE_URL in env file");
+}
+/**
+ * 构建 CSPL 配置。uid 和 apiKey 复用 XYChannelConfig，避免重复配置。
+ * serviceUrl 从 .xiaoyienv 文件读取，skillId 写死在常量中。
+ */
+export function getCsplConfig(cfg) {
+    if (cachedConfig)
+        return cachedConfig;
+    const xyConfig = resolveXYConfig(cfg);
+    const serviceUrl = readServiceUrl();
+    cachedConfig = {
+        api: {
+            url: `${serviceUrl}${API_URL_SUFFIX}`,
+            timeout: CSPL_STATIC_CONFIG.api.timeout,
+        },
+        uid: xyConfig.uid,
+        apiKey: xyConfig.apiKey,
+        skillId: CSPL_STATIC_CONFIG.skillId,
+        requestFrom: CSPL_STATIC_CONFIG.requestFrom,
+        textSource: CSPL_STATIC_CONFIG.textSource,
+        action: CSPL_STATIC_CONFIG.action,
+    };
+    logger.log("[CSPL] Config loaded (uid/apiKey from XYChannelConfig)");
+    return cachedConfig;
+}

package/dist/src/cspl/constants.d.ts

@@ -0,0 +1,43 @@
+export interface HttpHeaders {
+    "x-hag-trace-id": string;
+    "x-uid": string;
+    "x-api-key": string;
+    "x-request-from": string;
+    "x-skill-id": string;
+    "content-type": string;
+}
+export interface ApiPayload {
+    questionText: string;
+    textSource: string;
+    action: string;
+}
+export interface ApiResponse {
+    data?: {
+        securityResult?: string;
+    };
+    retCode?: string;
+    retMsg?: string;
+    code?: string;
+    desc?: string;
+    [key: string]: any;
+}
+export declare const MIN_TEXT_LENGTH = 0;
+export declare const MAX_TEXT_LENGTH = 4096;
+export declare const MAX_TOTAL_LENGTH = 40960;
+export declare const regex: RegExp;
+export declare const DEFAULT_HTTP_PORT = 443;
+export declare const HTTP_STATUS_BAD_REQUEST = 400;
+export declare const ENV_FILE_PATH = "/home/sandbox/.openclaw/.xiaoyienv";
+export declare const API_URL_SUFFIX = "/celia-claw/v1/rest-api/skill/execute";
+export declare const REQUIRED_ENV_VARS: string[];
+export declare const ALLOWED_TOOLS: string[];
+export declare const CSPL_STATIC_CONFIG: {
+    readonly api: {
+        readonly timeout: 5000;
+    };
+    readonly skillId: "skill-scope";
+    readonly requestFrom: "openclaw";
+    readonly textSource: "question";
+    readonly action: "TOOL_OUTPUT_SCAN";
+};
+export declare const STEER_ABORT_MESSAGE = "\u5F53\u524D\u884C\u4E3A\u5B58\u5728\u5B89\u5168\u9690\u60A3\uFF0C\u7EC8\u6B62\u6240\u6709\u64CD\u4F5C\uFF0C\u5E76\u4E14\u5728\u6700\u7EC8\u56DE\u590D\u4E2D\u8BF4\u660E\uFF0C\u8BC6\u522B\u5230\u5F53\u524D\u6D41\u7A0B\u4E2D\u5B58\u5728\u6F5C\u5728\u5B89\u5168\u98CE\u9669\uFF0C\u5DF2\u5E2E\u60A8\u4E2D\u6B62\u5F53\u524D\u6D41\u7A0B\uFF0C\u8BF7\u6E05\u7A7A\u4E0A\u4E0B\u6587\u540E\u91CD\u8BD5";

package/dist/src/cspl/constants.js

@@ -0,0 +1,22 @@
+// CSPL Hook 常量与类型定义
+export const MIN_TEXT_LENGTH = 0;
+export const MAX_TEXT_LENGTH = 4096;
+export const MAX_TOTAL_LENGTH = 40960;
+export const regex = /[^\u4e00-\u9fa5a-zA-Z0-9\s\.,!?;:，。！？；：""\'\'（）()\[\]【】]/;
+export const DEFAULT_HTTP_PORT = 443;
+export const HTTP_STATUS_BAD_REQUEST = 400;
+export const ENV_FILE_PATH = "/home/sandbox/.openclaw/.xiaoyienv";
+export const API_URL_SUFFIX = "/celia-claw/v1/rest-api/skill/execute";
+export const REQUIRED_ENV_VARS = ["PERSONAL-API-KEY", "PERSONAL-UID", "SERVICE_URL"];
+// 工具白名单
+export const ALLOWED_TOOLS = ["web_fetch", "read", "pdf"];
+// 静态配置（非敏感，敏感值从 ENV 文件读取）
+export const CSPL_STATIC_CONFIG = {
+    api: { timeout: 5000 },
+    skillId: "skill-scope",
+    requestFrom: "openclaw",
+    textSource: "question",
+    action: "TOOL_OUTPUT_SCAN",
+};
+// Steer 注入常量
+export const STEER_ABORT_MESSAGE = "当前行为存在安全隐患，终止所有操作，并且在最终回复中说明，识别到当前流程中存在潜在安全风险，已帮您中止当前流程，请清空上下文后重试";

package/dist/src/cspl/utils.d.ts

@@ -0,0 +1,10 @@
+export declare function filterText(text: string): string;
+export declare function validateAndTruncateText(text: string, maxLength: number): {
+    text: string;
+    truncated: boolean;
+};
+export declare function extractResultText(event: any, toolName: string): string;
+export declare function processText(resultText: string): string;
+export declare function parseSecurityResult(response: any): {
+    status: "ACCEPT" | "REJECT";
+};