@zeyiy/openclaw-channel 0.3.6 → 0.3.8

package/dist/portal.js

@@ -5,8 +5,14 @@
  * Handles requests from portal to manage local openclaw agents, files, and models.
  * Lifecycle is tied to the OpenIM account: starts/stops alongside the account.
  */
-import { readFile, writeFile, stat, mkdir } from "node:fs/promises";
-import { resolve, join, dirname } from "node:path";
+import { readFile, writeFile, stat, mkdir, unlink, rm } from "node:fs/promises";
+import { readdirSync, realpathSync, existsSync, readFileSync, statSync } from "node:fs";
+import { resolve, join, dirname, basename } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+import { normalizeAgentId, resolveDefaultAgentId, resolveUserPath, resolveAgentWorkspaceDir, isPathSafe, resolveStateDir, resolveOpenClawConfigPath, hasBinarySync, resolveBundledSkillsDir, resolveCronStorePath, resolveClawHubBaseUrl, loadFullConfig, clearDiskConfigCache, isEnvSatisfied, } from "./paths";
+import { fetchClawHub, downloadArchive, extractTarGz } from "./network";
 const bridges = new Map();
 const RECONNECT_BASE_MS = 2000;
 const RECONNECT_MAX_MS = 60000;
@@ -31,50 +37,6 @@ function portalLog(api, level, msg) {
 function getConfig(api) {
     return api.config ?? globalThis.__openimGatewayConfig ?? {};
 }
-function normalizeAgentId(value) {
-    const trimmed = (value ?? "").trim();
-    if (!trimmed)
-        return "main";
-    return trimmed.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+/, "").replace(/-+$/, "").slice(0, 64) || "main";
-}
-function resolveDefaultAgentId(cfg) {
-    const agents = Array.isArray(cfg.agents?.list) ? cfg.agents.list : [];
-    if (agents.length === 0)
-        return "main";
-    const defaults = agents.filter((a) => a?.default);
-    const chosen = (defaults[0] ?? agents[0])?.id?.trim();
-    return normalizeAgentId(chosen || "main");
-}
-/** Expand leading ~ to $HOME, then resolve to absolute path. */
-function resolveUserPath(p) {
-    const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-    if (p.startsWith("~/") || p === "~") {
-        return resolve(home, p.slice(2));
-    }
-    return resolve(p);
-}
-function resolveAgentWorkspaceDir(cfg, agentId) {
-    const id = normalizeAgentId(agentId);
-    const agents = Array.isArray(cfg.agents?.list) ? cfg.agents.list : [];
-    const entry = agents.find((a) => a?.id && normalizeAgentId(a.id) === id);
-    if (entry?.workspace?.trim())
-        return resolveUserPath(entry.workspace.trim());
-    const fallback = cfg.agents?.defaults?.workspace?.trim();
-    const defaultId = resolveDefaultAgentId(cfg);
-    const home = process.env.HOME ?? process.cwd();
-    if (id === defaultId) {
-        if (fallback)
-            return resolveUserPath(fallback);
-        return resolve(home, ".openclaw", "workspace");
-    }
-    if (fallback)
-        return join(resolveUserPath(fallback), id);
-    return resolve(home, ".openclaw", `workspace-${id}`);
-}
-function isPathSafe(workspaceRoot, targetPath) {
-    const resolved = resolve(workspaceRoot, targetPath);
-    return resolved.startsWith(workspaceRoot + "/") || resolved === workspaceRoot;
-}
 async function statFileSafely(filePath) {
     try {
         const s = await stat(filePath);
@@ -119,12 +81,13 @@ function handleModelsList(api, params) {
             }
         }
     }
-    // Resolve active model for the requested agent
+    // Resolve active model for the requested agent (read from disk for latest state)
     const rawAgentId = String(params.agentId ?? "").trim();
     let activeModelId;
     if (rawAgentId) {
+        const fullCfg = loadFullConfig();
         const agentId = normalizeAgentId(rawAgentId);
-        const agents = Array.isArray(cfg.agents?.list) ? cfg.agents.list : [];
+        const agents = Array.isArray(fullCfg.agents?.list) ? fullCfg.agents.list : [];
         const entry = agents.find((a) => a?.id && normalizeAgentId(a.id) === agentId);
         if (entry?.model) {
             // model can be a string like "deepminer/claude-sonnet-4-6" or an object { primary: "..." }
@@ -375,150 +338,999 @@ function handleBotAgentGet(api, accountId) {
     return { agentId: defaultId, ...(defaultEntry?.name ? { name: defaultEntry.name } : {}) };
 }
 /**
- * tools.catalog — return the runtime tool catalog from config.
- * Reads tools from agents' TOOLS.md references and registered plugin tools.
+ * tools.catalog — relay to gateway for the live runtime tool catalog.
+ *
+ * Gateway returns: { agentId, profiles, groups: [{ id, label, source, tools: [...] }] }
+ */
+// ---------------------------------------------------------------------------
+// tools.catalog: static core tool definitions (mirrors gateway's CORE_TOOL_DEFINITIONS)
+// ---------------------------------------------------------------------------
+const CORE_TOOL_SECTION_ORDER = [
+    { id: "fs", label: "Files" },
+    { id: "runtime", label: "Runtime" },
+    { id: "web", label: "Web" },
+    { id: "memory", label: "Memory" },
+    { id: "sessions", label: "Sessions" },
+    { id: "ui", label: "UI" },
+    { id: "messaging", label: "Messaging" },
+    { id: "automation", label: "Automation" },
+    { id: "nodes", label: "Nodes" },
+    { id: "agents", label: "Agents" },
+    { id: "media", label: "Media" },
+];
+const CORE_TOOL_DEFINITIONS = [
+    { id: "read", label: "read", description: "Read file contents", sectionId: "fs", profiles: ["coding"] },
+    { id: "write", label: "write", description: "Create or overwrite files", sectionId: "fs", profiles: ["coding"] },
+    { id: "edit", label: "edit", description: "Make precise edits", sectionId: "fs", profiles: ["coding"] },
+    { id: "apply_patch", label: "apply_patch", description: "Patch files", sectionId: "fs", profiles: ["coding"] },
+    { id: "exec", label: "exec", description: "Run shell commands", sectionId: "runtime", profiles: ["coding"] },
+    { id: "process", label: "process", description: "Manage processes", sectionId: "runtime", profiles: ["coding"] },
+    { id: "code_execution", label: "code_execution", description: "Run sandboxed remote analysis", sectionId: "runtime", profiles: ["coding"] },
+    { id: "web_search", label: "web_search", description: "Search the web", sectionId: "web", profiles: ["coding"] },
+    { id: "web_fetch", label: "web_fetch", description: "Fetch web content", sectionId: "web", profiles: ["coding"] },
+    { id: "x_search", label: "x_search", description: "Search X posts", sectionId: "web", profiles: ["coding"] },
+    { id: "memory_search", label: "memory_search", description: "Semantic search", sectionId: "memory", profiles: ["coding"] },
+    { id: "memory_get", label: "memory_get", description: "Read memory files", sectionId: "memory", profiles: ["coding"] },
+    { id: "sessions_list", label: "sessions_list", description: "List sessions", sectionId: "sessions", profiles: ["coding", "messaging"] },
+    { id: "sessions_history", label: "sessions_history", description: "View session history", sectionId: "sessions", profiles: ["coding", "messaging"] },
+    { id: "sessions_send", label: "sessions_send", description: "Send to session", sectionId: "sessions", profiles: ["coding", "messaging"] },
+    { id: "sessions_spawn", label: "sessions_spawn", description: "Spawn new session", sectionId: "sessions", profiles: ["coding"] },
+    { id: "sessions_yield", label: "sessions_yield", description: "End turn to receive sub-agent results", sectionId: "sessions", profiles: ["coding"] },
+    { id: "subagents", label: "subagents", description: "Manage sub-agents", sectionId: "sessions", profiles: ["coding"] },
+    { id: "session_status", label: "session_status", description: "Session status", sectionId: "sessions", profiles: ["minimal", "coding", "messaging"] },
+    { id: "browser", label: "browser", description: "Control web browser", sectionId: "ui", profiles: [] },
+    { id: "canvas", label: "canvas", description: "Control canvases", sectionId: "ui", profiles: [] },
+    { id: "message", label: "message", description: "Send messages", sectionId: "messaging", profiles: ["messaging"] },
+    { id: "cron", label: "cron", description: "Schedule cron jobs", sectionId: "automation", profiles: ["coding"] },
+    { id: "gateway", label: "gateway", description: "Gateway control", sectionId: "automation", profiles: [] },
+    { id: "nodes", label: "nodes", description: "Nodes + devices", sectionId: "nodes", profiles: [] },
+    { id: "agents_list", label: "agents_list", description: "List agents", sectionId: "agents", profiles: [] },
+    { id: "update_plan", label: "update_plan", description: "Update plan", sectionId: "agents", profiles: ["coding"] },
+    { id: "image", label: "image", description: "Image understanding", sectionId: "media", profiles: ["coding"] },
+    { id: "image_generate", label: "image_generate", description: "Image generation", sectionId: "media", profiles: ["coding"] },
+    { id: "music_generate", label: "music_generate", description: "Music generation", sectionId: "media", profiles: ["coding"] },
+    { id: "video_generate", label: "video_generate", description: "Video generation", sectionId: "media", profiles: ["coding"] },
+    { id: "tts", label: "tts", description: "Text-to-speech conversion", sectionId: "media", profiles: [] },
+];
+const TOOL_CATALOG_PROFILES = [
+    { id: "minimal", label: "Minimal" },
+    { id: "coding", label: "Coding" },
+    { id: "messaging", label: "Messaging" },
+    { id: "full", label: "Full" },
+];
+/**
+ * tools.catalog — mirrors gateway's buildToolsCatalogResult.
+ *
+ * Core groups: hardcoded static CORE_TOOL_DEFINITIONS (identical to gateway source).
+ * Plugin groups: read from config.plugins.entries (enabled plugins).
+ * Note: individual plugin tool names require loading plugin factories (runtime-only),
+ * so plugin groups are listed without their tools array — matching what config can provide.
  */
-function handleToolsCatalog(api) {
+function handleToolsCatalog(api, params) {
     const cfg = getConfig(api);
-    const tools = [];
-    // Core tools from config.tools section
-    const configTools = cfg.tools;
-    if (configTools && typeof configTools === "object") {
-        for (const [name, toolCfg] of Object.entries(configTools)) {
-            if (!name || name.startsWith("_"))
+    const rawAgentId = String(params.agentId ?? "").trim();
+    const agentId = rawAgentId ? normalizeAgentId(rawAgentId) : resolveDefaultAgentId(cfg);
+    // Build core groups (identical to gateway's buildCoreGroups)
+    const coreGroups = CORE_TOOL_SECTION_ORDER.map((section) => ({
+        id: section.id,
+        label: section.label,
+        source: "core",
+        tools: CORE_TOOL_DEFINITIONS
+            .filter((tool) => tool.sectionId === section.id)
+            .map((tool) => ({
+            id: tool.id,
+            label: tool.label,
+            description: tool.description,
+            source: "core",
+            defaultProfiles: tool.profiles,
+        })),
+    })).filter((section) => section.tools.length > 0);
+    // Build plugin groups from config.plugins.entries (best-effort, no factory loading)
+    const pluginEntries = cfg.plugins?.entries;
+    const pluginGroups = [];
+    if (pluginEntries && typeof pluginEntries === "object") {
+        for (const [pluginId, entry] of Object.entries(pluginEntries)) {
+            // Skip explicitly disabled plugins
+            if (entry?.enabled === false)
                 continue;
-            tools.push({
-                name,
-                description: toolCfg?.description ?? "",
-                source: "core",
-                optional: Boolean(toolCfg?.optional),
+            pluginGroups.push({
+                id: `plugin:${pluginId}`,
+                label: pluginId,
+                source: "plugin",
+                pluginId,
+                tools: [],
             });
         }
+        pluginGroups.sort((a, b) => a.label.localeCompare(b.label));
     }
-    // Plugin-registered tools (from channel registrations)
-    const plugins = cfg.plugins;
-    if (plugins && typeof plugins === "object") {
-        for (const [pluginId, pluginCfg] of Object.entries(plugins)) {
-            if (!pluginId)
-                continue;
-            const pluginTools = pluginCfg?.tools;
-            if (Array.isArray(pluginTools)) {
-                for (const t of pluginTools) {
-                    const tName = typeof t === "string" ? t : t?.name;
-                    if (!tName)
-                        continue;
-                    tools.push({
-                        name: String(tName),
-                        description: typeof t === "object" ? t?.description ?? "" : "",
-                        source: "plugin",
-                        pluginId,
-                        optional: typeof t === "object" ? Boolean(t?.optional) : false,
-                    });
+    return {
+        agentId,
+        profiles: TOOL_CATALOG_PROFILES,
+        groups: [...coreGroups, ...pluginGroups],
+    };
+}
+// ---------------------------------------------------------------------------
+// Skills: file-based helpers (mirrors openclaw gateway internals)
+// ---------------------------------------------------------------------------
+/**
+ * Relaxed JSON5 parser: removes trailing commas before } or ].
+ * Used for SKILL.md metadata blocks which use JSON5 syntax (trailing commas,
+ * multi-line objects) but do NOT contain // or /* comments in practice.
+ *
+ * NOTE: We intentionally do NOT strip // comments here because that regex
+ * would incorrectly match URLs like "https://..." inside string values.
+ */
+function parseJson5Relaxed(text) {
+    // Remove trailing commas before } or ] (the main JSON5 feature in SKILL.md)
+    const s = text.replace(/,(\s*[}\]])/g, "$1");
+    return JSON.parse(s);
+}
+/**
+ * Extract the raw YAML block between --- delimiters.
+ * Mirrors gateway's extractFrontmatterBlock.
+ */
+function extractFrontmatterBlock(content) {
+    const normalized = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    if (!normalized.startsWith("---"))
+        return undefined;
+    const endIndex = normalized.indexOf("\n---", 3);
+    if (endIndex === -1)
+        return undefined;
+    return normalized.slice(4, endIndex);
+}
+/**
+ * Parse SKILL.md frontmatter to plain string key-value pairs.
+ * Handles both single-line and multi-line (indented) values.
+ * Mirrors gateway's parseLineFrontmatter + lineFrontmatterToPlain.
+ */
+function parseSkillFrontmatter(content) {
+    const block = extractFrontmatterBlock(content);
+    if (!block)
+        return {};
+    const result = {};
+    const lines = block.split("\n");
+    let i = 0;
+    while (i < lines.length) {
+        const match = lines[i].match(/^([\w-]+):\s*(.*)$/);
+        if (!match) {
+            i++;
+            continue;
+        }
+        const key = match[1];
+        const inlineValue = match[2].trim();
+        // Handle YAML multi-line indicators (| or >) and empty inline values
+        const isMultilineIndicator = inlineValue === "|" || inlineValue === ">" || inlineValue === "|-" || inlineValue === ">-";
+        if ((!inlineValue || isMultilineIndicator) && i + 1 < lines.length) {
+            const nextLine = lines[i + 1];
+            if (nextLine.startsWith(" ") || nextLine.startsWith("\t")) {
+                // Multi-line: collect all indented lines
+                const valueLines = [];
+                let j = i + 1;
+                while (j < lines.length && (lines[j].startsWith(" ") || lines[j].startsWith("\t") || lines[j] === "")) {
+                    valueLines.push(lines[j]);
+                    j++;
                 }
+                const value = valueLines.join("\n").trim();
+                if (value)
+                    result[key] = value;
+                i = j;
+                continue;
             }
         }
+        if (inlineValue && !isMultilineIndicator) {
+            result[key] = inlineValue.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1");
+        }
+        i++;
     }
-    // Also include OpenIM channel tools registered by this plugin
-    const openimTools = ["openim_send_text", "openim_send_image", "openim_send_file", "openim_send_video"];
-    for (const name of openimTools) {
-        tools.push({ name, description: `OpenIM: ${name.replace("openim_", "")}`, source: "plugin", pluginId: "openim" });
-    }
-    return { tools };
+    return result;
 }
 /**
- * skills.status — return the visible skill list for an agent.
- * Reads installed plugins/skills from config and reports their status.
+ * Extract openclaw manifest from parsed frontmatter.
+ * The metadata field is a JSON5 object with key "openclaw".
+ * Mirrors gateway's resolveOpenClawManifestBlock + resolveOpenClawMetadata.
  */
-function handleSkillsStatus(api, params) {
-    const cfg = getConfig(api);
-    const skills = [];
-    // Plugins as skills
-    const plugins = cfg.plugins;
-    if (plugins && typeof plugins === "object") {
-        for (const [pluginId, pluginCfg] of Object.entries(plugins)) {
-            if (!pluginId)
+function resolveOpenClawManifest(frontmatter) {
+    const metadataRaw = frontmatter.metadata;
+    if (!metadataRaw)
+        return undefined;
+    let manifest;
+    try {
+        const parsed = parseJson5Relaxed(metadataRaw);
+        if (!parsed || typeof parsed !== "object")
+            return undefined;
+        // Try known openclaw manifest keys
+        manifest = parsed.openclaw ?? parsed["openclaw-agent"] ?? parsed["claude-code"];
+        if (!manifest && typeof parsed === "object") {
+            // If no known wrapper key, check if the parsed object itself looks like a manifest
+            const keys = Object.keys(parsed);
+            if (keys.some(k => ["requires", "install", "always", "emoji"].includes(k)))
+                manifest = parsed;
+        }
+        if (!manifest || typeof manifest !== "object")
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    const normalizeStrList = (v) => {
+        if (!v)
+            return [];
+        if (Array.isArray(v))
+            return v.map(String).filter(Boolean);
+        if (typeof v === "string" && v.trim())
+            return [v.trim()];
+        return [];
+    };
+    const requiresRaw = manifest.requires;
+    const requires = {};
+    if (requiresRaw && typeof requiresRaw === "object") {
+        requires.bins = normalizeStrList(requiresRaw.bins);
+        requires.anyBins = normalizeStrList(requiresRaw.anyBins);
+        requires.env = normalizeStrList(requiresRaw.env);
+        requires.config = normalizeStrList(requiresRaw.config);
+    }
+    const install = [];
+    if (Array.isArray(manifest.install)) {
+        for (const spec of manifest.install) {
+            if (!spec || typeof spec !== "object")
                 continue;
-            const enabled = pluginCfg?.enabled !== false;
-            skills.push({
-                name: pluginId,
-                description: pluginCfg?.description ?? "",
-                installed: true,
-                enabled,
-                configCheck: enabled ? "ok" : "missing",
+            install.push({
+                id: typeof spec.id === "string" ? spec.id : undefined,
+                kind: typeof spec.kind === "string" ? spec.kind : typeof spec.type === "string" ? spec.type : undefined,
+                bins: normalizeStrList(spec.bins),
+                label: typeof spec.label === "string" ? spec.label : undefined,
+                formula: typeof spec.formula === "string" ? spec.formula : undefined,
+                package: typeof spec.package === "string" ? spec.package : undefined,
+                module: typeof spec.module === "string" ? spec.module : undefined,
+                os: normalizeStrList(spec.os),
             });
         }
     }
-    // Channels as skills
-    const channels = cfg.channels;
-    if (channels && typeof channels === "object") {
-        for (const [chanId, chanCfg] of Object.entries(channels)) {
-            if (!chanId)
+    return {
+        always: typeof manifest.always === "boolean" ? manifest.always : undefined,
+        emoji: typeof manifest.emoji === "string" ? manifest.emoji : undefined,
+        homepage: typeof manifest.homepage === "string" ? manifest.homepage : undefined,
+        skillKey: typeof manifest.skillKey === "string" ? manifest.skillKey : undefined,
+        primaryEnv: typeof manifest.primaryEnv === "string" ? manifest.primaryEnv : undefined,
+        os: normalizeStrList(manifest.os),
+        requires: Object.keys(requires).length > 0 ? requires : undefined,
+        install: install.length > 0 ? install : undefined,
+    };
+}
+/**
+ * Load all skills from a directory. Each skill lives in a subdirectory with a SKILL.md file.
+ * Mirrors gateway's loadSkillsFromDirSafe.
+ */
+function loadSkillsFromDir(dir, source) {
+    let rootReal;
+    try {
+        rootReal = realpathSync(resolve(dir));
+    }
+    catch {
+        return [];
+    }
+    let subdirs;
+    try {
+        subdirs = readdirSync(dir, { withFileTypes: true })
+            .filter(e => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules")
+            .map(e => join(dir, e.name))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+    const entries = [];
+    for (const skillDir of subdirs) {
+        const skillMdPath = join(skillDir, "SKILL.md");
+        if (!existsSync(skillMdPath))
+            continue;
+        let content;
+        try {
+            content = readFileSync(skillMdPath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const frontmatter = parseSkillFrontmatter(content);
+        const name = (frontmatter.name ?? "").trim() || basename(skillDir);
+        const description = (frontmatter.description ?? "").trim();
+        if (!name || !description)
+            continue;
+        entries.push({
+            name,
+            description,
+            filePath: resolve(skillMdPath),
+            baseDir: resolve(skillDir),
+            source,
+            frontmatter,
+            metadata: resolveOpenClawManifest(frontmatter),
+        });
+    }
+    return entries;
+}
+/**
+ * Resolve skill directories registered by enabled plugins.
+ * Each plugin's openclaw.plugin.json may declare "skills": ["./skills"]
+ * relative to the plugin's root directory.
+ *
+ * Only plugins explicitly listed in config.plugins.entries with enabled !== false
+ * are considered. Unlisted plugins are NOT loaded.
+ */
+function resolvePluginSkillDirs(cfg) {
+    const dirs = [];
+    const pluginEntries = cfg?.plugins?.entries;
+    if (!pluginEntries || typeof pluginEntries !== "object")
+        return dirs;
+    // Collect explicitly enabled plugin IDs
+    const enabledPluginIds = new Set();
+    for (const [pluginId, entry] of Object.entries(pluginEntries)) {
+        if (entry?.enabled !== false)
+            enabledPluginIds.add(pluginId);
+    }
+    if (enabledPluginIds.size === 0)
+        return dirs;
+    /** Read skills paths from a plugin manifest file */
+    const readManifestSkills = (manifestPath) => {
+        try {
+            if (!existsSync(manifestPath))
+                return [];
+            const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+            if (!Array.isArray(manifest?.skills))
+                return [];
+            const result = [];
+            for (const s of manifest.skills) {
+                const rel = String(s ?? "").trim();
+                if (!rel)
+                    continue;
+                const candidate = resolve(dirname(manifestPath), rel);
+                if (existsSync(candidate))
+                    result.push(candidate);
+            }
+            return result;
+        }
+        catch {
+            return [];
+        }
+    };
+    // 1. User-installed plugins (plugins.installs)
+    const pluginInstalls = cfg?.plugins?.installs;
+    if (pluginInstalls && typeof pluginInstalls === "object") {
+        for (const [pluginId, install] of Object.entries(pluginInstalls)) {
+            if (!enabledPluginIds.has(pluginId))
                 continue;
-            skills.push({
-                name: `channel:${chanId}`,
-                description: `Channel: ${chanId}`,
-                installed: true,
-                enabled: chanCfg?.enabled !== false,
-                configCheck: "ok",
-            });
+            const installPath = String(install?.installPath ?? "").trim();
+            if (!installPath)
+                continue;
+            dirs.push(...readManifestSkills(join(resolveUserPath(installPath), "openclaw.plugin.json")));
         }
     }
-    return { skills };
+    // 2. Bundled extensions (only for enabled plugins)
+    const bundledDir = resolveBundledSkillsDir();
+    if (bundledDir) {
+        const extensionsDir = resolve(bundledDir, "..", "dist", "extensions");
+        try {
+            if (existsSync(extensionsDir)) {
+                for (const pluginId of enabledPluginIds) {
+                    const extManifest = join(extensionsDir, pluginId, "openclaw.plugin.json");
+                    dirs.push(...readManifestSkills(extManifest));
+                }
+            }
+        }
+        catch { /* skip */ }
+    }
+    return dirs;
 }
 /**
- * skills.search — search ClawHub for discoverable skills.
- * Currently returns an empty list (ClawHub integration not yet implemented locally).
+ * Load all skill entries visible in a workspace.
+ * Sources (later overrides earlier):
+ *   extra (config extraDirs + plugin skills) → bundled → installed → workspace
  */
-function handleSkillsSearch(_api, params) {
-    // ClawHub discovery requires network access to the registry — placeholder for now
-    return { skills: [] };
+function loadAllSkillEntries(workspaceDir, cfg) {
+    const stateDir = resolveStateDir();
+    const merged = new Map();
+    const addAll = (entries) => { for (const e of entries)
+        merged.set(e.name, e); };
+    // 1. Extra dirs: config extraDirs + plugin-registered skill dirs
+    const extraDirs = [];
+    if (Array.isArray(cfg?.skills?.load?.extraDirs)) {
+        for (const d of cfg.skills.load.extraDirs) {
+            const s = String(d ?? "").trim();
+            if (s)
+                extraDirs.push(resolveUserPath(s));
+        }
+    }
+    const pluginSkillDirs = resolvePluginSkillDirs(cfg);
+    for (const dir of [...extraDirs, ...pluginSkillDirs])
+        addAll(loadSkillsFromDir(dir, "extra"));
+    // 2. Bundled (openclaw package built-in)
+    const bundledDir = resolveBundledSkillsDir();
+    if (bundledDir)
+        addAll(loadSkillsFromDir(bundledDir, "builtin"));
+    // 3. Installed (~/.openclaw/skills/)
+    addAll(loadSkillsFromDir(join(stateDir, "skills"), "installed"));
+    // 4. Workspace skills ({workspace}/skills/) — highest priority
+    addAll(loadSkillsFromDir(join(resolve(workspaceDir), "skills"), "workspace"));
+    return Array.from(merged.values());
 }
 /**
- * skills.detail — get detail for a specific skill from ClawHub.
- * Placeholder: returns basic info from local config if the skill is installed.
+ * Build runtime status for a single skill entry.
  */
-function handleSkillsDetail(api, params) {
-    const name = String(params.name ?? "").trim();
-    if (!name)
-        throw { code: 400, message: "name is required" };
+function buildSkillStatus(entry, cfg) {
+    // Read skills config from disk to ensure we have skills.entries
+    const fullCfg = loadFullConfig();
+    const skillKey = entry.metadata?.skillKey ?? entry.name;
+    const skillCfg = fullCfg?.skills?.entries?.[skillKey] ?? {};
+    const disabled = skillCfg.enabled === false;
+    const always = entry.metadata?.always === true;
+    const bundled = entry.source === "builtin";
+    const requiresBins = entry.metadata?.requires?.bins ?? [];
+    const requiresAnyBins = entry.metadata?.requires?.anyBins ?? [];
+    const requiresEnv = entry.metadata?.requires?.env ?? [];
+    const requiresConfig = entry.metadata?.requires?.config ?? [];
+    const missingBins = always ? [] : requiresBins.filter(b => !hasBinarySync(b));
+    const missingAnyBins = always ? [] :
+        (requiresAnyBins.length > 0 && !requiresAnyBins.some(b => hasBinarySync(b)) ? requiresAnyBins : []);
+    const missingEnv = always ? [] : requiresEnv.filter(e => !isEnvSatisfied(e, skillCfg, entry.metadata?.primaryEnv));
+    const isConfigPathSatisfied = (configPath) => {
+        // configPath like "channels.discord.token" → check fullCfg.channels.discord.token
+        const parts = configPath.split(".");
+        let current = fullCfg;
+        for (const part of parts) {
+            if (!current || typeof current !== "object")
+                return false;
+            current = current[part];
+        }
+        return current !== undefined && current !== null && current !== "";
+    };
+    const configChecks = requiresConfig.map(p => ({ path: p, satisfied: isConfigPathSatisfied(p) }));
+    const missingConfig = always ? [] : configChecks.filter(c => !c.satisfied).map(c => c.path);
+    const requirementsSatisfied = missingBins.length === 0 && missingAnyBins.length === 0 &&
+        missingEnv.length === 0 && missingConfig.length === 0;
+    return {
+        name: entry.name,
+        description: entry.description,
+        source: entry.source,
+        bundled,
+        filePath: entry.filePath,
+        baseDir: entry.baseDir,
+        skillKey,
+        ...(entry.metadata?.primaryEnv ? { primaryEnv: entry.metadata.primaryEnv } : {}),
+        ...(entry.metadata?.emoji ? { emoji: entry.metadata.emoji } : {}),
+        ...(entry.metadata?.homepage ? { homepage: entry.metadata.homepage } : {}),
+        always,
+        disabled,
+        blockedByAllowlist: false, // simplified: bundled allowlist check omitted
+        eligible: !disabled && requirementsSatisfied,
+        requirements: { bins: requiresBins, anyBins: requiresAnyBins, env: requiresEnv, config: requiresConfig, os: entry.metadata?.os ?? [] },
+        missing: { bins: missingBins, anyBins: missingAnyBins, env: missingEnv, config: missingConfig, os: [] },
+        configChecks,
+        install: (entry.metadata?.install ?? []).map((spec, idx) => ({
+            id: spec.id ?? `${spec.kind ?? "install"}-${idx}`,
+            kind: spec.kind ?? "",
+            label: spec.label ?? `Install (${spec.kind ?? "unknown"})`,
+            bins: spec.bins ?? [],
+        })),
+    };
+}
+// ---------------------------------------------------------------------------
+// Skills method handlers (file-based, no gateway relay)
+// ---------------------------------------------------------------------------
+/**
+ * skills.status — read skill status from disk, grouped by source category.
+ *
+ * Categories:
+ *   extra     — skills.load.extraDirs     → "Extra Skills"
+ *   builtin   — openclaw 安装包内置        → "Built-in Skills"
+ *   installed — ~/.openclaw/skills/        → "Installed Skills"
+ *   workspace — {workspace}/skills/        → "Workspace Skills"
+ */
+async function handleSkillsStatus(api, params) {
     const cfg = getConfig(api);
-    const plugins = cfg.plugins;
-    if (plugins && typeof plugins === "object" && name in plugins) {
-        const p = plugins[name];
-        return {
-            skill: {
-                name,
-                description: p?.description ?? "",
-                author: p?.author ?? undefined,
-                version: p?.version ?? undefined,
-                source: "local",
-            },
-        };
+    const rawAgentId = String(params.agentId ?? "").trim();
+    const agentId = rawAgentId ? normalizeAgentId(rawAgentId) : resolveDefaultAgentId(cfg);
+    const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
+    const entries = loadAllSkillEntries(workspaceDir, cfg);
+    const categoryLabels = {
+        extra: "Extra Skills",
+        builtin: "Built-in Skills",
+        installed: "Installed Skills",
+        workspace: "Workspace Skills",
+    };
+    const grouped = {};
+    for (const e of entries) {
+        const cat = e.source;
+        if (!grouped[cat])
+            grouped[cat] = [];
+        grouped[cat].push(buildSkillStatus(e, cfg));
     }
-    return { skill: null };
+    const categories = Object.entries(grouped).map(([source, skills]) => ({
+        source,
+        label: categoryLabels[source] ?? source,
+        skills,
+    }));
+    portalLog(api, "info", `skills.status: agentId=${agentId} workspace=${workspaceDir} count=${entries.length}`);
+    return { agentId, workspaceDir, categories };
 }
 /**
- * cron.list — return configured cron jobs.
+ * Resolve agent-level skill filter (whitelist).
+ * Returns undefined if no filter is configured (all skills enabled for this agent).
+ * Returns a Set of allowed skill names if a filter is configured.
  */
-function handleCronList(api) {
+function resolveAgentSkillFilter(cfg, agentId) {
+    const normalizedId = normalizeAgentId(agentId);
+    const agentEntry = (cfg.agents?.list ?? []).find((e) => normalizeAgentId(e?.id ?? "") === normalizedId);
+    // Agent-level skills field takes precedence
+    if (agentEntry && agentEntry.skills !== undefined) {
+        const list = Array.isArray(agentEntry.skills) ? agentEntry.skills : [];
+        return new Set(list.map((s) => String(s ?? "").trim()).filter(Boolean));
+    }
+    // Fallback to defaults
+    const defaultSkills = cfg.agents?.defaults?.skills;
+    if (defaultSkills !== undefined) {
+        const list = Array.isArray(defaultSkills) ? defaultSkills : [];
+        return new Set(list.map((s) => String(s ?? "").trim()).filter(Boolean));
+    }
+    // No filter — all skills enabled for this agent
+    return undefined;
+}
+/**
+ * agent.skills.status — same as skills.status but with an additional
+ * `agent_disabled` field per skill indicating whether the skill is disabled
+ * for this specific agent (via agent-level skill filter).
+ */
+async function handleAgentSkillsStatus(api, params) {
+    const rawAgentId = String(params.agentId ?? "").trim();
+    if (!rawAgentId)
+        throw { code: 400, message: "agentId is required" };
     const cfg = getConfig(api);
-    const jobs = [];
-    const cronConfig = cfg.cron ?? cfg.automation?.cron;
-    if (Array.isArray(cronConfig)) {
-        for (const entry of cronConfig) {
-            if (!entry || typeof entry !== "object")
-                continue;
-            jobs.push({
-                id: String(entry.id ?? entry.name ?? `cron-${jobs.length}`),
-                name: entry.name ?? entry.id ?? undefined,
-                schedule: String(entry.schedule ?? entry.cron ?? ""),
-                command: entry.command ?? entry.text ?? entry.message ?? undefined,
-                enabled: entry.enabled !== false,
-                lastRun: entry.lastRun ?? undefined,
-                nextRun: entry.nextRun ?? undefined,
-            });
+    const fullCfg = loadFullConfig();
+    const agentId = normalizeAgentId(rawAgentId);
+    const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
+    const entries = loadAllSkillEntries(workspaceDir, cfg);
+    const skillFilter = resolveAgentSkillFilter(fullCfg, agentId);
+    const categoryLabels = {
+        extra: "Extra Skills",
+        builtin: "Built-in Skills",
+        installed: "Installed Skills",
+        workspace: "Workspace Skills",
+    };
+    const grouped = {};
+    for (const e of entries) {
+        const cat = e.source;
+        if (!grouped[cat])
+            grouped[cat] = [];
+        const status = buildSkillStatus(e, cfg);
+        // agent_disabled: true if a skill filter exists and this skill is NOT in the whitelist
+        const agentDisabled = skillFilter !== undefined && !skillFilter.has(e.name);
+        grouped[cat].push({ ...status, agent_disabled: agentDisabled });
+    }
+    const categories = Object.entries(grouped).map(([source, skills]) => ({
+        source,
+        label: categoryLabels[source] ?? source,
+        skills,
+    }));
+    portalLog(api, "info", `agent.skills.status: agentId=${agentId} workspace=${workspaceDir} count=${entries.length} filter=${skillFilter ? `[${skillFilter.size}]` : "none"}`);
+    return { agentId, workspaceDir, categories };
+}
+/**
+ * skills.search — search ClawHub registry directly.
+ *
+ * GET https://clawhub.ai/api/v1/search?q={query}&limit={limit}
+ * Mirrors gateway's searchSkillsFromClawHub.
+ */
+async function handleSkillsSearch(api, params) {
+    const query = String(params.query ?? "").trim();
+    if (!query)
+        return { results: [] };
+    try {
+        const searchParams = { q: query };
+        if (params.limit)
+            searchParams.limit = String(params.limit);
+        const result = await fetchClawHub(resolveClawHubBaseUrl(), "/api/v1/search", searchParams);
+        const results = result?.results ?? [];
+        portalLog(api, "info", `skills.search: query="${query}" got ${results.length} results`);
+        return { results };
+    }
+    catch (err) {
+        portalLog(api, "warn", `skills.search: ClawHub error: ${err?.message ?? String(err)}`);
+        return { results: [] };
+    }
+}
+/**
+ * skills.install — install a skill into an agent's workspace.
+ *
+ * Two modes:
+ *   source=clawhub (default): download from ClawHub by slug
+ *   source=url: download a zip from the given URL
+ *
+ * Both extract into {workspace}/skills/{skillKey}/
+ */
+async function handleSkillsInstall(api, params) {
+    const source = String(params.source ?? "clawhub").trim();
+    const cfg = getConfig(api);
+    const rawAgentId = String(params.agentId ?? "").trim();
+    const agentId = rawAgentId ? normalizeAgentId(rawAgentId) : resolveDefaultAgentId(cfg);
+    const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
+    const execFileAsync = promisify(execFile);
+    if (source === "url") {
+        // --- URL install: download zip and extract ---
+        const url = String(params.url ?? "").trim();
+        if (!url)
+            throw { code: 400, message: "url is required for source=url" };
+        const skillKey = String(params.skillKey ?? params.name ?? "").trim();
+        if (!skillKey) {
+            throw { code: 400, message: "skillKey (or name) is required — the directory name under skills/" };
+        }
+        // Download
+        let archiveBytes;
+        try {
+            archiveBytes = await downloadArchive(url);
         }
+        catch (err) {
+            throw { code: 503, message: `skills.install: download failed: ${err.message}` };
+        }
+        const targetDir = join(resolve(workspaceDir), "skills", skillKey);
+        const isZip = url.endsWith(".zip") || archiveBytes[0] === 0x50 && archiveBytes[1] === 0x4b; // PK magic
+        const tmpFile = join(tmpdir(), `openclaw-skill-${skillKey}-${Date.now()}${isZip ? ".zip" : ".tar.gz"}`);
+        try {
+            await writeFile(tmpFile, archiveBytes);
+            // Clean existing dir and recreate
+            await rm(targetDir, { recursive: true, force: true });
+            await mkdir(targetDir, { recursive: true });
+            if (isZip) {
+                await execFileAsync("unzip", ["-o", tmpFile, "-d", targetDir]);
+                // If zip contains a single root directory, move contents up
+                try {
+                    const items = readdirSync(targetDir);
+                    if (items.length === 1) {
+                        const innerDir = join(targetDir, items[0]);
+                        const innerStat = statSync(innerDir);
+                        if (innerStat.isDirectory()) {
+                            const innerItems = readdirSync(innerDir);
+                            for (const item of innerItems) {
+                                await execFileAsync("mv", [join(innerDir, item), targetDir]);
+                            }
+                            await execFileAsync("rm", ["-rf", innerDir]);
+                        }
+                    }
+                }
+                catch { /* best effort flatten */ }
+            }
+            else {
+                await extractTarGz(tmpFile, targetDir);
+            }
+        }
+        catch (err) {
+            throw { code: 500, message: `skills.install: extraction failed: ${err.message}` };
+        }
+        finally {
+            try {
+                await unlink(tmpFile);
+            }
+            catch { /* cleanup */ }
+        }
+        portalLog(api, "info", `skills.install: source=url agentId=${agentId} skillKey="${skillKey}" targetDir="${targetDir}"`);
+        return { ok: true, message: `Installed ${skillKey} from URL`, agentId, skillKey, targetDir };
     }
+    if (source === "clawhub") {
+        // --- ClawHub install: download by slug ---
+        const slug = String(params.slug ?? params.name ?? "").trim();
+        if (!slug)
+            throw { code: 400, message: "slug (or name) is required for source=clawhub" };
+        let detail;
+        try {
+            detail = await fetchClawHub(resolveClawHubBaseUrl(), `/api/v1/skills/${encodeURIComponent(slug)}`);
+        }
+        catch (err) {
+            throw { code: 503, message: `skills.install: ClawHub fetch failed: ${err.message}` };
+        }
+        if (!detail?.skill)
+            throw { code: 404, message: `Skill "${slug}" not found on ClawHub` };
+        const version = String(params.version ?? detail.latestVersion?.version ?? "").trim();
+        if (!version)
+            throw { code: 400, message: `Skill "${slug}" has no installable version` };
+        let archiveBytes;
+        try {
+            const searchParams = { version };
+            const archiveUrl = resolveClawHubBaseUrl()
+                + `/api/v1/packages/${encodeURIComponent(slug)}/download?` + new URLSearchParams(searchParams);
+            archiveBytes = await downloadArchive(archiveUrl, 60000);
+        }
+        catch (err) {
+            throw { code: 503, message: `skills.install: download failed: ${err.message}` };
+        }
+        const targetDir = join(resolve(workspaceDir), "skills", slug);
+        const tmpArchive = join(tmpdir(), `openclaw-skill-${slug}-${Date.now()}.tar.gz`);
+        try {
+            await writeFile(tmpArchive, archiveBytes);
+            // Clean existing dir and recreate
+            await rm(targetDir, { recursive: true, force: true });
+            await mkdir(targetDir, { recursive: true });
+            await extractTarGz(tmpArchive, targetDir);
+        }
+        catch (err) {
+            throw { code: 500, message: `skills.install: extraction failed: ${err.message}` };
+        }
+        finally {
+            try {
+                await unlink(tmpArchive);
+            }
+            catch { /* cleanup */ }
+        }
+        portalLog(api, "info", `skills.install: source=clawhub agentId=${agentId} slug="${slug}" version="${version}" targetDir="${targetDir}"`);
+        return { ok: true, message: `Installed ${slug}@${version}`, agentId, slug, version, targetDir };
+    }
+    throw { code: 400, message: `unsupported source: "${source}". Use "clawhub" or "url"` };
+}
+/**
+ * skills.set — set a skill's enabled/disabled state globally.
+ *
+ * Only modifies the `enabled` field in skills.entries[skillKey],
+ * preserving all other fields (env, apiKey, etc.).
+ * If enabled is true, the `enabled` key is removed (default is enabled).
+ */
+async function handleSkillsSet(api, params) {
+    const skillKey = String(params.skillKey ?? params.name ?? "").trim();
+    if (!skillKey)
+        throw { code: 400, message: "skillKey (or name) is required" };
+    if (typeof params.enabled !== "boolean") {
+        throw { code: 400, message: "enabled (boolean) is required" };
+    }
+    const enabled = params.enabled;
+    const configPath = resolveOpenClawConfigPath();
+    // Read existing config
+    let cfg = {};
+    try {
+        const raw = await readFile(configPath, "utf-8");
+        cfg = JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw { code: 500, message: `skills.set: failed to read config: ${err.message}` };
+        }
+    }
+    // Ensure skills.entries structure exists
+    if (!cfg.skills || typeof cfg.skills !== "object")
+        cfg.skills = {};
+    if (!cfg.skills.entries || typeof cfg.skills.entries !== "object")
+        cfg.skills.entries = {};
+    // Get or create the entry, preserving existing fields
+    const current = cfg.skills.entries[skillKey] && typeof cfg.skills.entries[skillKey] === "object"
+        ? { ...cfg.skills.entries[skillKey] }
+        : {};
+    if (enabled) {
+        // Enabled is the default — remove the key to keep config clean
+        delete current.enabled;
+        // If entry is now empty, remove it entirely
+        if (Object.keys(current).length === 0) {
+            delete cfg.skills.entries[skillKey];
+        }
+        else {
+            cfg.skills.entries[skillKey] = current;
+        }
+    }
+    else {
+        current.enabled = false;
+        cfg.skills.entries[skillKey] = current;
+    }
+    // Write back
+    try {
+        await mkdir(dirname(configPath), { recursive: true });
+        await writeFile(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+    }
+    catch (err) {
+        throw { code: 500, message: `skills.set: failed to write config: ${err.message}` };
+    }
+    // Invalidate disk config cache
+    clearDiskConfigCache();
+    portalLog(api, "info", `skills.set: skillKey=${skillKey} enabled=${enabled}`);
+    return { ok: true, skillKey, enabled };
+}
+/**
+ * agent.skills.set — enable or disable a skill for a specific agent.
+ *
+ * Agent skill config is a whitelist array on agents.list[].skills:
+ *   - undefined (not configured) → all skills enabled
+ *   - [] (empty array) → all skills disabled
+ *   - ["a", "b"] → only a and b enabled
+ *
+ * When disabling the first skill (no whitelist exists yet), we populate
+ * the whitelist with ALL currently available skill names minus the target.
+ * When enabling, we add the skill to the existing whitelist.
+ * When disabling, we remove it from the whitelist.
+ */
+async function handleAgentSkillsSet(api, params) {
+    const rawAgentId = String(params.agentId ?? "").trim();
+    const skillName = String(params.skillKey ?? params.name ?? "").trim();
+    if (!rawAgentId)
+        throw { code: 400, message: "agentId is required" };
+    if (!skillName)
+        throw { code: 400, message: "skillKey (or name) is required" };
+    if (typeof params.enabled !== "boolean")
+        throw { code: 400, message: "enabled (boolean) is required" };
+    const enabled = params.enabled;
+    const agentId = normalizeAgentId(rawAgentId);
+    const configPath = resolveOpenClawConfigPath();
+    // Read config from disk
+    let cfg = {};
+    try {
+        const raw = await readFile(configPath, "utf-8");
+        cfg = JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw { code: 500, message: `agent.skills.set: failed to read config: ${err.message}` };
+        }
+    }
+    // Find the agent entry in agents.list
+    if (!cfg.agents)
+        cfg.agents = {};
+    if (!Array.isArray(cfg.agents.list))
+        cfg.agents.list = [];
+    let agentEntry = cfg.agents.list.find((a) => a?.id && normalizeAgentId(a.id) === agentId);
+    if (!agentEntry) {
+        throw { code: 400, message: `agent "${agentId}" not found in config` };
+    }
+    const hasWhitelist = Array.isArray(agentEntry.skills);
+    if (enabled) {
+        // Enable the skill
+        if (!hasWhitelist) {
+            // No whitelist → all skills already enabled, nothing to do
+            portalLog(api, "info", `agent.skills.set: agentId=${agentId} skill=${skillName} already enabled (no whitelist)`);
+            return { ok: true, agentId, skillKey: skillName, enabled: true, skills: undefined };
+        }
+        // Add to whitelist if not present
+        const currentList = agentEntry.skills;
+        if (!currentList.includes(skillName)) {
+            currentList.push(skillName);
+        }
+    }
+    else {
+        // Disable the skill
+        if (!hasWhitelist) {
+            // No whitelist yet → populate with all skill names minus the target
+            const runtimeCfg = getConfig(api);
+            const workspaceDir = resolveAgentWorkspaceDir(runtimeCfg, agentId);
+            const allEntries = loadAllSkillEntries(workspaceDir, runtimeCfg);
+            const allNames = allEntries.map(e => e.name);
+            agentEntry.skills = allNames.filter(n => n !== skillName);
+        }
+        else {
+            // Remove from existing whitelist
+            agentEntry.skills = agentEntry.skills.filter((s) => s !== skillName);
+        }
+    }
+    // Write back config
+    try {
+        await mkdir(dirname(configPath), { recursive: true });
+        await writeFile(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+    }
+    catch (err) {
+        throw { code: 500, message: `agent.skills.set: failed to write config: ${err.message}` };
+    }
+    clearDiskConfigCache();
+    const resultSkills = agentEntry.skills ?? undefined;
+    portalLog(api, "info", `agent.skills.set: agentId=${agentId} skill=${skillName} enabled=${enabled} skills=${JSON.stringify(resultSkills)}`);
+    return { ok: true, agentId, skillKey: skillName, enabled, skills: resultSkills };
+}
+/**
+ * agent.model.set — switch the model for a specific agent.
+ *
+ * Writes the model string (e.g. "deepminer/claude-sonnet-4-6") to
+ * agents.list[agentId].model in openclaw.json.
+ */
+async function handleAgentModelSet(api, params) {
+    const rawAgentId = String(params.agentId ?? "").trim();
+    const model = String(params.model ?? "").trim();
+    if (!rawAgentId)
+        throw { code: 400, message: "agentId is required" };
+    if (!model)
+        throw { code: 400, message: "model is required" };
+    const agentId = normalizeAgentId(rawAgentId);
+    const configPath = resolveOpenClawConfigPath();
+    let cfg = {};
+    try {
+        const raw = await readFile(configPath, "utf-8");
+        cfg = JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw { code: 500, message: `agent.model.set: failed to read config: ${err.message}` };
+        }
+    }
+    if (!cfg.agents)
+        cfg.agents = {};
+    if (!Array.isArray(cfg.agents.list))
+        cfg.agents.list = [];
+    const agentEntry = cfg.agents.list.find((a) => a?.id && normalizeAgentId(a.id) === agentId);
+    if (!agentEntry) {
+        throw { code: 400, message: `agent "${agentId}" not found in config` };
+    }
+    agentEntry.model = model;
+    try {
+        await mkdir(dirname(configPath), { recursive: true });
+        await writeFile(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+    }
+    catch (err) {
+        throw { code: 500, message: `agent.model.set: failed to write config: ${err.message}` };
+    }
+    clearDiskConfigCache();
+    portalLog(api, "info", `agent.model.set: agentId=${agentId} model=${model}`);
+    return { ok: true, agentId, model };
+}
+/**
+ * cron.list — read jobs directly from the persisted cron store (jobs.json).
+ *
+ * Supports filtering by: agentId, includeDisabled, query
+ * Supports sorting: nextRunAtMs | updatedAtMs | name, asc | desc
+ * Supports pagination: offset, limit
+ */
+async function handleCronList(api, params) {
+    const storePath = resolveCronStorePath(api);
+    let raw;
+    try {
+        raw = await readFile(storePath, "utf-8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            portalLog(api, "info", `cron.list: store not found at ${storePath}`);
+            return { jobs: [] };
+        }
+        throw { code: 500, message: `cron.list: failed to read store: ${err.message}` };
+    }
+    let store;
+    try {
+        store = JSON.parse(raw);
+    }
+    catch {
+        throw { code: 500, message: "cron.list: invalid JSON in cron store" };
+    }
+    let jobs = Array.isArray(store.jobs) ? store.jobs : [];
+    // Filter: agentId
+    const agentId = String(params.agentId ?? "").trim();
+    if (agentId) {
+        jobs = jobs.filter((j) => j.agentId === agentId);
+    }
+    // Filter: enabled (default: exclude disabled)
+    const includeDisabled = params.includeDisabled === true;
+    if (!includeDisabled) {
+        jobs = jobs.filter((j) => j.enabled !== false);
+    }
+    // Filter: name query
+    const query = String(params.query ?? "").trim().toLowerCase();
+    if (query) {
+        jobs = jobs.filter((j) => j.name?.toLowerCase().includes(query));
+    }
+    // Sort
+    const sortBy = String(params.sortBy ?? "nextRunAtMs");
+    const sortDir = String(params.sortDir ?? "asc");
+    jobs = [...jobs].sort((a, b) => {
+        let av = 0;
+        let bv = 0;
+        if (sortBy === "updatedAtMs") {
+            av = a.updatedAtMs ?? 0;
+            bv = b.updatedAtMs ?? 0;
+        }
+        else if (sortBy === "name") {
+            av = a.name ?? "";
+            bv = b.name ?? "";
+        }
+        else {
+            // default: nextRunAtMs
+            av = a.state?.nextRunAtMs ?? 0;
+            bv = b.state?.nextRunAtMs ?? 0;
+        }
+        const cmp = av < bv ? -1 : av > bv ? 1 : 0;
+        return sortDir === "desc" ? -cmp : cmp;
+    });
+    // Pagination
+    const offset = Math.max(0, Number(params.offset) || 0);
+    const limit = Number(params.limit) || 0;
+    if (offset > 0)
+        jobs = jobs.slice(offset);
+    if (limit > 0)
+        jobs = jobs.slice(0, limit);
+    portalLog(api, "info", `cron.list: storePath=${storePath} agentId=${agentId || "*"} count=${jobs.length}`);
     return { jobs };
 }
 // ---------------------------------------------------------------------------
@@ -552,19 +1364,31 @@ async function handlePortalRequest(api, accountId, request) {
                 result = await handleAgentsCreate(api, params ?? {});
                 break;
             case "tools.catalog":
-                result = handleToolsCatalog(api);
+                result = await handleToolsCatalog(api, params ?? {});
                 break;
             case "skills.status":
-                result = handleSkillsStatus(api, params ?? {});
+                result = await handleSkillsStatus(api, params ?? {});
+                break;
+            case "agent.skills.status":
+                result = await handleAgentSkillsStatus(api, params ?? {});
+                break;
+            case "agent.skills.set":
+                result = await handleAgentSkillsSet(api, params ?? {});
+                break;
+            case "agent.model.set":
+                result = await handleAgentModelSet(api, params ?? {});
                 break;
             case "skills.search":
-                result = handleSkillsSearch(api, params ?? {});
+                result = await handleSkillsSearch(api, params ?? {});
+                break;
+            case "skills.install":
+                result = await handleSkillsInstall(api, params ?? {});
                 break;
-            case "skills.detail":
-                result = handleSkillsDetail(api, params ?? {});
+            case "skills.set":
+                result = await handleSkillsSet(api, params ?? {});
                 break;
             case "cron.list":
-                result = handleCronList(api);
+                result = await handleCronList(api, params ?? {});
                 break;
             case "ping":
                 result = { pong: true };