create-principles-disciple 1.82.0 → 1.83.0

package/pd-cli/dist/utils/production-workspace-guard.js

@@ -0,0 +1,170 @@
+/**
+ * Production Workspace Guard
+ *
+ * Prevents UAT/runtime test commands from writing to production workspaces.
+ *
+ * Production workspaces are:
+ * - D:\.openclaw\workspace
+ * - C:\Users\Administrator\.openclaw\workspace
+ * - And the default workspace resolved by OpenClaw configuration
+ *
+ * This module follows ERR-030 (path prefix matching must use segment boundaries)
+ * and EP-03/EP-04 (fail loud with structured reason and nextAction).
+ */
+import * as path from 'path';
+import * as os from 'os';
+import { existsSync } from 'fs';
+// ── Production workspace paths ─────────────────────────────────────────────────
+/**
+ * List of production workspace paths that should be protected from UAT/test writes.
+ * These are the default paths where PD is typically installed and used for real work.
+ */
+const PRODUCTION_WORKSPACE_PATHS = [
+    // Windows default
+    path.resolve('D:\\.openclaw\\workspace'),
+    path.resolve('C:\\.openclaw\\workspace'),
+    path.resolve('C:\\Users\\Administrator\\.openclaw\\workspace'),
+    path.resolve('C:\\Users\\Admin\\.openclaw\\workspace'),
+    // Unix-like defaults
+    path.resolve(path.join(os.homedir(), '.openclaw', 'workspace')),
+    // macOS-specific
+    path.resolve(path.join(os.homedir(), '.openclaw', 'workspace')),
+];
+// ── Resolution helpers ───────────────────────────────────────────────────────
+/**
+ * Resolve the workspace path from environment variable or current directory.
+ */
+export function resolveWorkspacePath(inputPath) {
+    if (!inputPath) {
+        // Default to current directory
+        return path.resolve(process.cwd());
+    }
+    return path.resolve(inputPath);
+}
+/**
+ * Check if a path is a production workspace.
+ *
+ * This follows ERR-030: path matching must use segment boundaries (path.sep)
+ * to avoid false positives on sibling directories like "workspace-backup".
+ *
+ * @param resolvedPath - The absolute, normalized workspace path to check
+ * @returns true if the path is a production workspace
+ */
+export function isProductionWorkspace(resolvedPath) {
+    const normalized = resolvedPath.toLowerCase();
+    for (const prodPath of PRODUCTION_WORKSPACE_PATHS) {
+        const normalizedProd = prodPath.toLowerCase();
+        // Exact match
+        if (normalized === normalizedProd) {
+            return true;
+        }
+        // Descendant match: must have path separator after prefix
+        // ERR-030: "startsWith" without separator matches sibling directories
+        if (normalized.startsWith(normalizedProd + path.sep)) {
+            return true;
+        }
+        // Handle Windows path variations
+        // D:\.openclaw\workspace should not match D:\.openclaw\workspace-backup
+        // Use case-insensitive comparison (already normalized)
+        if (path.sep === '\\') {
+            // Windows: check both forward and backslash
+            if (normalized.startsWith(normalizedProd + '/')) {
+                return true;
+            }
+            if (normalized.startsWith(normalizedProd.replace(/\\/g, '/') + '/')) {
+                return true;
+            }
+            if (normalized.startsWith(normalizedProd.replace(/\\/g, '/') + '\\')) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Check if a workspace is protected from UAT/test writes.
+ *
+ * This is the main guard function for UAT/runtime test commands.
+ * It returns a structured result following EP-03/EP-04 requirements.
+ *
+ * @param inputPath - The workspace path to check (optional, resolves to cwd if not provided)
+ * @param commandContext - Context string for the error message (e.g., "pd runtime uat")
+ * @returns GuardResult indicating if the operation is allowed or refused
+ */
+export function guardUatWorkspace(inputPath, _commandContext) {
+    const resolved = resolveWorkspacePath(inputPath);
+    // PRI-334: Guard check should happen BEFORE file existence check
+    // This prevents production workspace writes even if directory doesn't exist yet
+    if (isProductionWorkspace(resolved)) {
+        return {
+            refused: true,
+            workspace: resolved,
+            isProduction: true,
+            reason: `UAT/runtime test commands are not allowed to write to the production workspace (${resolved}). This prevents test/synthetic data from polluting your real PD state.`,
+            nextAction: `Use a temporary workspace for testing (recommended: ${os.tmpdir()}/pd-uat-workspace) or explicitly confirm you understand the risk by using --allow-production-workspace-for-uat (not recommended).`,
+        };
+    }
+    if (!existsSync(resolved)) {
+        // Non-existent workspace is safe to use (will be created)
+        return {
+            refused: false,
+            workspace: resolved,
+            isProduction: false,
+        };
+    }
+    return {
+        refused: false,
+        workspace: resolved,
+        isProduction: false,
+    };
+}
+/**
+ * Get a safe UAT workspace path in the system temp directory.
+ *
+ * This follows the safe execution path requirement from PRI-334.
+ */
+export function getSafeUatWorkspacePath() {
+    const tempDir = os.tmpdir();
+    // Create a unique but deterministic path for UAT workspaces
+    const uatWorkspace = path.join(tempDir, 'pd-uat-workspace');
+    return uatWorkspace;
+}
+/**
+ * Check if --allow-production-workspace-for-uat flag is set.
+ *
+ * This is the escape hatch for cases where the operator explicitly wants to run UAT on production.
+ * The flag must be very explicit in both name and output (as required by PRI-334).
+ */
+export function isProductionWorkspaceAllowed() {
+    // Check if the flag was parsed and passed through opts
+    // This will be called from command handlers after Commander parses flags
+    return false; // Placeholder; actual check depends on Commander opts
+}
+/**
+ * Format guard refusal for console output.
+ *
+ * Follows EP-03/EP-04: structured reason + nextAction.
+ */
+export function formatGuardRefusal(refusal, commandContext, jsonMode = false) {
+    if (jsonMode) {
+        // JSON mode: output exactly one JSON object with reason and nextAction
+        return JSON.stringify({
+            status: 'refused',
+            reason: refusal.reason,
+            nextAction: refusal.nextAction,
+            workspace: refusal.workspace,
+            isProduction: refusal.isProduction,
+        }, null, 2);
+    }
+    // Text mode: human-readable structured output
+    return [
+        `[pd-cli] ERROR: ${commandContext} - workspace guard triggered`,
+        '',
+        `Reason: ${refusal.reason}`,
+        `Next Action: ${refusal.nextAction}`,
+        `Workspace: ${refusal.workspace}`,
+        '',
+        'This guard prevents UAT/runtime test data from polluting your production workspace.',
+    ].join('\n');
+}
+//# sourceMappingURL=production-workspace-guard.js.map

package/pd-cli/dist/utils/production-workspace-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-workspace-guard.js","sourceRoot":"","sources":["../../src/utils/production-workspace-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAEhC,kFAAkF;AAElF;;;GAGG;AACH,MAAM,0BAA0B,GAAG;IACjC,kBAAkB;IAClB,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,gDAAgD,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,wCAAwC,CAAC;IACtD,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC/D,iBAAiB;IACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;CAChE,CAAC;AAEF,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,+BAA+B;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAE9C,KAAK,MAAM,QAAQ,IAAI,0BAA0B,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE9C,cAAc;QACd,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0DAA0D;QAC1D,sEAAsE;QACtE,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iCAAiC;QACjC,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACtB,4CAA4C;YAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AA0BD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA6B,EAC7B,eAAuB;IAEvB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEjD,iEAAiE;IACjE,gFAAgF;IAChF,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,mFAAmF,QAAQ,yEAAyE;YAC5K,UAAU,EAAE,uDAAuD,EAAE,CAAC,MAAM,EAAE,mIAAmI;SAClN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,0DAA0D;QAC1D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B;IAC1C,uDAAuD;IACvD,yEAAyE;IACzE,OAAO,KAAK,CAAC,CAAC,sDAAsD;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,cAAsB,EAAE,QAAQ,GAAG,KAAK;IAChG,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,OAAO,IAAI,CAAC,SAAS,CACnB;YACE,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,OAAO;QACL,mBAAmB,cAAc,8BAA8B;QAC/D,EAAE;QACF,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,gBAAgB,OAAO,CAAC,UAAU,EAAE;QACpC,cAAc,OAAO,CAAC,SAAS,EAAE;QACjC,EAAE;QACF,qFAAqF;KACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/pd-cli/dist/utils/production-workspace-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=production-workspace-guard.test.d.ts.map

package/pd-cli/dist/utils/production-workspace-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-workspace-guard.test.d.ts","sourceRoot":"","sources":["../../src/utils/production-workspace-guard.test.ts"],"names":[],"mappings":""}

package/pd-cli/dist/utils/production-workspace-guard.test.js

@@ -0,0 +1,95 @@
+import { describe, it, expect } from 'vitest';
+import * as path from 'path';
+import * as os from 'os';
+import { isProductionWorkspace, guardUatWorkspace, getSafeUatWorkspacePath, formatGuardRefusal, } from './production-workspace-guard.js';
+const PRODUCTION_PATHS = [
+    'D:\\.openclaw\\workspace',
+    'C:\\.openclaw\\workspace',
+    'C:\\Users\\Administrator\\.openclaw\\workspace',
+    path.join(os.homedir(), '.openclaw', 'workspace'),
+];
+const SAFE_PATHS = [
+    'D:\\.openclaw\\workspace-test',
+    'D:\\.openclaw\\workspace-backup',
+    path.join(os.tmpdir(), 'pd-uat-workspace'),
+    path.join(os.tmpdir(), 'pd-test-any'),
+    'C:\\completely-unrelated\\work',
+];
+describe('isProductionWorkspace', () => {
+    it.each(PRODUCTION_PATHS)('detects production: %s', (prodPath) => {
+        expect(isProductionWorkspace(path.resolve(prodPath))).toBe(true);
+    });
+    it.each(SAFE_PATHS)('allows safe: %s', (safePath) => {
+        expect(isProductionWorkspace(path.resolve(safePath))).toBe(false);
+    });
+    it('detects descendant', () => {
+        expect(isProductionWorkspace(path.resolve('D:\\.openclaw\\workspace\\sub\\child'))).toBe(true);
+    });
+    it('rejects sibling workspace-test (ERR-030)', () => {
+        expect(isProductionWorkspace(path.resolve('D:\\.openclaw\\workspace-test'))).toBe(false);
+    });
+    it('rejects sibling workspace-backup (ERR-030)', () => {
+        expect(isProductionWorkspace(path.resolve('D:\\.openclaw\\workspace-backup'))).toBe(false);
+    });
+});
+describe('guardUatWorkspace', () => {
+    describe('refused', () => {
+        it.each(PRODUCTION_PATHS)('refuses production: %s', (prodPath) => {
+            const r = guardUatWorkspace(prodPath, 'test');
+            expect(r.refused).toBe(true);
+            if (r.refused) {
+                expect(r.reason).toContain('UAT/runtime test commands are not allowed');
+                expect(r.nextAction).toContain('temporary workspace');
+            }
+        });
+        it('refuses descendant', () => {
+            expect(guardUatWorkspace('D:\\.openclaw\\workspace\\subdir', 'test').refused).toBe(true);
+        });
+    });
+    describe('allowed', () => {
+        it.each(SAFE_PATHS)('allows safe: %s', (safePath) => {
+            const r = guardUatWorkspace(safePath, 'test');
+            expect(r.refused).toBe(false);
+        });
+        it.each(['D:\\.openclaw\\workspace-test', 'D:\\.openclaw\\workspace-backup'])('allows sibling: %s (ERR-030)', (p) => {
+            expect(guardUatWorkspace(p, 'test').refused).toBe(false);
+        });
+    });
+});
+describe('JSON output (EP-04)', () => {
+    it('outputs single object with reason and nextAction', () => {
+        const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+        const json = formatGuardRefusal(r, 'test', true);
+        const parsed = JSON.parse(json);
+        expect(parsed).toMatchObject({
+            status: 'refused', reason: expect.any(String), nextAction: expect.any(String),
+            workspace: expect.any(String), isProduction: true,
+        });
+        expect(Array.isArray(parsed)).toBe(false);
+    });
+    it('no console prefixes in JSON', () => {
+        const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+        const json = formatGuardRefusal(r, 'test', true);
+        expect(json).not.toContain('[pd-cli]');
+        expect(json).not.toContain('ERROR:');
+        expect(json.trim().startsWith('{')).toBe(true);
+    });
+});
+describe('text output (EP-03)', () => {
+    it('includes reason and nextAction', () => {
+        const r = guardUatWorkspace('D:\\.openclaw\\workspace', 'test');
+        const text = formatGuardRefusal(r, 'test', false);
+        expect(text).toContain('Reason:');
+        expect(text).toContain('Next Action:');
+    });
+});
+describe('getSafeUatWorkspacePath', () => {
+    it('returns deterministic temp path', () => {
+        const p1 = getSafeUatWorkspacePath();
+        const p2 = getSafeUatWorkspacePath();
+        expect(p1).toBe(p2);
+        expect(p1).toContain(os.tmpdir());
+        expect(p1).toContain('pd-uat-workspace');
+    });
+});
+//# sourceMappingURL=production-workspace-guard.test.js.map

package/pd-cli/dist/utils/production-workspace-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-workspace-guard.test.js","sourceRoot":"","sources":["../../src/utils/production-workspace-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,GAEnB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,gBAAgB,GAAG;IACvB,0BAA0B;IAC1B,0BAA0B;IAC1B,gDAAgD;IAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC;CAClD,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,+BAA+B;IAC/B,iCAAiC;IACjC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC;IACrC,gCAAgC;CACjC,CAAC;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC/D,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE;QAClD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC/D,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;gBACxE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,iBAAiB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE;YAClD,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,CAAC,+BAA+B,EAAE,iCAAiC,CAAC,CAAC,CAC3E,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,MAAM,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,iBAAiB,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI;SAClD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,iBAAiB,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,iBAAiB,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,GAAG,uBAAuB,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,uBAAuB,EAAE,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/pd-cli/package.json

@@ -23,7 +23,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.6.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.8"
   },
   "license": "MIT",
   "repository": {

package/plugin/dist/commands/pain.js

@@ -4,6 +4,7 @@ import { normalizeCommandArgs } from '../utils/io.js';
 import { resolvePluginCommandWorkspaceDir } from '../utils/workspace-resolver.js';
 import { computeHash } from '../utils/hashing.js';
 import { PainToPrincipleService, PrincipleTreeLedgerAdapter } from '@principles/core/runtime-v2';
+import { loadPdConfigForPlugin } from '../core/pd-config-loader.js';
 /**
  * Creates a visual progress bar (e.g., [██████░░░░])
  */
@@ -263,12 +264,16 @@ export async function handlePainReportCommand(ctx) {
     };
     try {
         const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: wctx.stateDir });
+        // PRI-306: Load .pd/config.yaml for config-driven runtime binding
+        const configResult = loadPdConfigForPlugin(wctx.workspaceDir);
         const service = new PainToPrincipleService({
             workspaceDir: wctx.workspaceDir,
             stateDir: wctx.stateDir,
             ledgerAdapter,
             owner: 'openclaw-plugin',
             autoIntakeEnabled: true,
+            effectiveConfig: configResult.effective,
+            getEnvVar: (name) => process.env[name],
         });
         const result = await service.recordPain({
             painId: painData.painId,
@@ -293,10 +298,30 @@ export async function handlePainReportCommand(ctx) {
                     : `✅ Pain recorded (context-bound)\n\n📋 **Pain ID**: ${painId}\n📝 **Reason**: ${args}\n🔗 **Provenance**: openclaw_context_bound\n📌 **Session**: ${sessionId}\n\nThe system will diagnose using current session context.`,
             };
         }
+        if (result.status === 'retried') {
+            const errorInfo = result.failureCategory
+                ? (isZh ? `\n⚠️ **错误类别**: ${result.failureCategory}` : `\n⚠️ **Error category**: ${result.failureCategory}`)
+                : '';
+            const messageInfo = result.message
+                ? (isZh ? `\n📝 **详情**: ${result.message}` : `\n📝 **Detail**: ${result.message}`)
+                : '';
+            return {
+                text: isZh
+                    ? `✅ Pain 已记录，诊断任务已进入重试\n\n📋 **Pain ID**: ${result.painId}\n🔧 **Task ID**: ${result.taskId}${errorInfo}${messageInfo}\n\n诊断任务将在后台自动重试。使用 \`/pd-status\` 查看任务状态。`
+                    : `✅ Pain recorded, diagnosis task entered retry\n\n📋 **Pain ID**: ${result.painId}\n🔧 **Task ID**: ${result.taskId}${errorInfo}${messageInfo}\n\nThe diagnosis task will retry automatically in the background. Use \`/pd-status\` to check task status.`,
+            };
+        }
+        // status === 'failed' | 'skipped' | 'degraded' — pain was NOT accepted
+        const reasonInfo = result.failureCategory
+            ? (isZh ? `\n⚠️ **原因**: ${result.failureCategory}` : `\n⚠️ **Reason**: ${result.failureCategory}`)
+            : '';
+        const messageInfo = result.message
+            ? (isZh ? `\n📝 **详情**: ${result.message}` : `\n📝 **Detail**: ${result.message}`)
+            : '';
         return {
             text: isZh
-                ? `⚠️ Pain 记录未成功 (status: ${result.status})。请检查系统日志或使用 \`/pd-status\` 查看状态。`
-                : `⚠️ Pain recording not accepted (status: ${result.status}). Check system logs or use \`/pd-status\` for status.`,
+                ? `❌ Pain 记录未成功 (status: ${result.status})${reasonInfo}${messageInfo}\n\n请检查系统日志或使用 \`/pd-status\` 查看状态。`
+                : `❌ Pain recording not accepted (status: ${result.status})${reasonInfo}${messageInfo}\n\nCheck system logs or use \`/pd-status\` for status.`,
         };
     }
     catch (err) {

package/plugin/dist/core/pain-diagnostic-gate.d.ts

@@ -26,5 +26,11 @@ export interface PainDiagnosticGateDecision {
     detail: string;
 }
 export declare function resetPainDiagnosticGateForTest(): void;
+/**
+ * Check whether cooldown is currently active for a given episode.
+ * Used by the trigger controller (PEAT-B2) to align its cooldown decision
+ * with the PainDiagnosticGate's cooldown state.
+ */
+export declare function isCooldownActiveForEpisode(source: string, sessionId: string | undefined, errorHash: string | undefined, cooldownMs?: number): boolean;
 export declare function evaluatePainDiagnosticGate(input: PainDiagnosticGateInput): PainDiagnosticGateDecision;
 export {};

package/plugin/dist/core/pain-diagnostic-gate.js

@@ -40,6 +40,15 @@ function markDiagnosed(input, episodeKey) {
 export function resetPainDiagnosticGateForTest() {
     lastDiagnosedAtByEpisode.clear();
 }
+/**
+ * Check whether cooldown is currently active for a given episode.
+ * Used by the trigger controller (PEAT-B2) to align its cooldown decision
+ * with the PainDiagnosticGate's cooldown state.
+ */
+export function isCooldownActiveForEpisode(source, sessionId, errorHash, cooldownMs) {
+    const episodeKey = buildEpisodeKey({ source, sessionId, errorHash });
+    return withinCooldown({ source, sessionId, errorHash, cooldownMs }, episodeKey);
+}
 export function evaluatePainDiagnosticGate(input) {
     const source = normalizedSource(input.source);
     const episodeKey = buildEpisodeKey(input);

package/plugin/dist/hooks/after-tool-call-helpers.d.ts

@@ -0,0 +1,90 @@
+/**
+ * After-Tool-Call Decomposition Helpers — PRI-326
+ *
+ * Extracted functions from handleAfterToolCall that implement
+ * individual pipeline stages. Each function has a focused responsibility.
+ *
+ * Pipeline order: classify → record → triage → gate → emit
+ *
+ * ERR checklist:
+ * - ERR-001: No `as` casts on untrusted runtime values.
+ * - ERR-002: Every skip/rejection includes structured reason + nextAction.
+ * - EP-01: Runtime values validated before use.
+ * - EP-03: No silent failures — every path is logged or structured.
+ */
+import { normalizeProfile } from '../core/profile.js';
+import { type SessionState } from '../core/session-tracker.js';
+import { WorkspaceContext } from '../core/workspace-context.js';
+import type { PluginHookAfterToolCallEvent } from '../openclaw-sdk.js';
+import type { ToolCallOutcome, ToolCallObservation, PainAdmissionDecision } from './after-tool-call-types.js';
+/**
+ * Classify the outcome of a tool call event.
+ *
+ * Pure function — no I/O, no side effects.
+ * Extracts exitCode logic, determines failure/success, classifies failure source.
+ */
+export declare function classifyToolCallOutcome(event: PluginHookAfterToolCallEvent): ToolCallOutcome;
+/**
+ * Build a normalized observation from the tool call event and workspace context.
+ *
+ * Combines file path normalization, risk classification, and error analysis.
+ * The profile parameter is passed in (loaded once at function scope).
+ */
+export declare function buildToolCallObservation(event: PluginHookAfterToolCallEvent, outcome: ToolCallOutcome, workspaceDir: string, profile: ReturnType<typeof normalizeProfile>): ToolCallObservation;
+/**
+ * Handle friction tracking for a tool failure.
+ *
+ * Updates GFI, records to event log and trajectory.
+ * Returns the updated session state and friction info.
+ */
+export declare function handleFrictionTrackingForFailure(sessionId: string, event: PluginHookAfterToolCallEvent, outcome: ToolCallOutcome, observation: ToolCallObservation, gfiBefore: number, workspaceDir: string, config: {
+    get: (key: string) => unknown;
+}, wctx: WorkspaceContext): SessionState;
+/**
+ * Handle friction relief and recording for a tool success.
+ *
+ * Relieves both tool_failure and dispatch_error GFI sources proportionally.
+ */
+export declare function handleFrictionTrackingForSuccess(sessionId: string, event: PluginHookAfterToolCallEvent, outcome: ToolCallOutcome, observation: ToolCallObservation, gfiBefore: number, workspaceDir: string, wctx: WorkspaceContext): SessionState;
+/**
+ * Record hygiene tracking for memory/plan persistence actions on success.
+ */
+export declare function recordHygieneTracking(event: PluginHookAfterToolCallEvent, observation: ToolCallObservation, wctx: WorkspaceContext): void;
+/**
+ * Record probation feedback for injected probation IDs.
+ *
+ * On success: positive feedback for matching principles.
+ * On failure: negative feedback for matching principles.
+ */
+export declare function handleProbationFeedback(sessionId: string, toolName: string, workspaceDir: string, wctx: WorkspaceContext, isSuccess: boolean): void;
+/**
+ * Evaluate whether a tool failure should trigger pain diagnosis.
+ *
+ * Combines:
+ * 1. Write-tool check — only write tools on failures enter this path
+ * 2. PEAT-B1 triage — if feature flag is on, check evidence triage
+ * 3. PainDiagnosticGate — cooldown + threshold check
+ *
+ * Returns a structured decision with reason and stage.
+ */
+export declare function evaluatePainAdmissionForToolCall(event: PluginHookAfterToolCallEvent, observation: ToolCallObservation, outcome: ToolCallOutcome, latestFailureState: SessionState | undefined, sessionState: SessionState | undefined, sessionId: string, workspaceDir: string, config: {
+    get: (key: string) => unknown;
+}): PainAdmissionDecision;
+/**
+ * Emit pain signal after admission.
+ *
+ * Records to trajectory, event log, evolution logger, principle value tracker,
+ * and emits the pain_detected event.
+ *
+ * Only called when the admission decision is 'admitted'.
+ */
+export declare function emitPainIfAdmitted(wctx: WorkspaceContext, event: PluginHookAfterToolCallEvent, observation: ToolCallObservation, outcome: ToolCallOutcome, admission: PainAdmissionDecision, sessionId: string, agentId: string | undefined, workspaceDir: string, emitPainDetectedEvent: (wctx: WorkspaceContext, event: import('../core/evolution-types.js').EvolutionLoopEvent) => Promise<void>): void;
+export { buildTrajectoryEvidence } from './trajectory-evidence.js';
+/**
+ * Classify tool failure source.
+ *
+ * Pure function — no I/O, no side effects.
+ * Determines whether a tool failure is a dispatch error (tool not found)
+ * or a regular tool execution failure.
+ */
+export declare function classifyToolFailureSource(toolName: string | undefined, error: unknown): 'dispatch_error' | 'tool_failure';