dlinkclaw-openclaw 2026.10.23 → 2026.10.26

package/dist/index.js

@@ -1 +1 @@
-import{emptyPluginConfigSchema as e}from"openclaw/plugin-sdk/core";import{channelMeta as s,dlChannel as n,LOG_TAG as r}from"./src/channel.js";import{setDLLogger as t,setDLRuntime as o,isRunStopped as i}from"./src/runtime.js";import{loadPersonaBlock as a,currentPersonaAgent as l}from"./src/persona.js";const p=s;p.isDebug&&(process.env.NODE_TLS_REJECT_UNAUTHORIZED="0",process.env.NODE_ENV="dev");const c={id:p.id,name:p.label,description:p.blurb,configSchema:e(),register(e){o(e.runtime),t(e.logger,r),e.registerChannel({plugin:n}),e.on("before_tool_call",(e,s)=>{const n=p.id;if(s.channelId===n)return e.runId&&i(e.runId)?{block:!0,blockReason:"用户已点击停止，任务终止执行"}:void 0}),e.on("before_prompt_build",async(s,n)=>{const r=p.id;if(n.channel!==r&&n.channelId!==r)return;const t=["[AGENT CODE OF CONDUCT - ALWAYS FOLLOW]","1. ASK BEFORE GUESSING: If the task is incomplete or has multiple reasonable interpretations, send a one-line confirmation first. Never guess.",'2. STOP ON FAILURE: If the same problem fails 2-3 times in a row, stop and report: "I am stuck: <reason>. Please advise." Never retry endlessly.','3. ALWAYS REPORT COMPLETION: Every task must end with a completion signal. After sending media/files, always follow up with a short text confirmation (e.g. "✅ Sent 3 files: a.png / b.pdf / c.txt"). The client shows a spinner until it receives the final text reply.',"4. LANGUAGE: write your reply AND any intermediate/progress text (tool narration, status lines, preamble) in the same language as the user's latest message. Never default to English when the user writes in another language."],o=l(n.sessionKey);!o&&String(n.sessionKey??"").includes(":group:")&&e.logger.warn(`persona group scope missing: session=${n.sessionKey}`);const i=await a(n.sessionKey,o);return i&&t.push(i),{prependSystemContext:t.join("\n\n")}})}};export default c;
+import{emptyPluginConfigSchema as e}from"openclaw/plugin-sdk/core";import{channelMeta as n,dlChannel as s,LOG_TAG as r}from"./src/channel.js";import{setDLLogger as t,setDLRuntime as o,isRunStopped as i}from"./src/runtime.js";import{loadPersonaBlock as a,currentPersonaAgent as l}from"./src/persona.js";const p=n;p.isDebug&&(process.env.NODE_TLS_REJECT_UNAUTHORIZED="0",process.env.NODE_ENV="dev");const c={id:p.id,name:p.label,description:p.blurb,configSchema:e(),register(e){o(e.runtime),t(e.logger,r),e.registerChannel({plugin:s}),e.on("before_tool_call",(e,n)=>{const s=p.id;if(n.channelId===s)return e.runId&&i(e.runId)?{block:!0,blockReason:"用户已点击停止，任务终止执行"}:void 0}),e.on("before_prompt_build",async(n,s)=>{const r=p.id;if(s.channel!==r&&s.channelId!==r)return;const t=["[AGENT CODE OF CONDUCT - ALWAYS FOLLOW]","1. ASK BEFORE GUESSING: If the task is incomplete or has multiple reasonable interpretations, send a one-line confirmation first. Never guess.",'2. STOP ON FAILURE: If the same problem fails 2-3 times in a row, stop and report: "I am stuck: <reason>. Please advise." Never retry endlessly.','3. ALWAYS REPORT COMPLETION: Every task must end with a completion signal. After sending media/files, always follow up with a short text confirmation (e.g. "✅ Sent 3 files: a.png / b.pdf / c.txt"). The client shows a spinner until it receives the final text reply.',"4. LANGUAGE: write your reply, any intermediate/progress text (tool narration, status lines, preamble), AND your reasoning/thinking in the same language as the user's latest message. Never default to English when the user writes in another language."],o=l(s.sessionKey);!o&&String(s.sessionKey??"").includes(":group:")&&e.logger.warn(`persona group scope missing: session=${s.sessionKey}`);const i=await a(s.sessionKey,o);return i&&t.push(i),{prependSystemContext:t.join("\n\n")}})}};export default c;

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "dlinkclaw-openclaw",
-    "version": "2026.10.23",
+    "version": "2026.10.26",
     "description": "DLinkClaw OpenClaw channel plugin — 朵联 OpenClaw 接入通道",
     "keywords": [
         "DLinkClaw",

package/dist/src/approval-native.d.ts

@@ -0,0 +1 @@
+export declare function createDLApprovalCapability(): any;

package/dist/src/approval-native.js

@@ -0,0 +1,80 @@
+import { DEFAULT_ACCOUNT_ID } from 'openclaw/plugin-sdk/core';
+import { getDLClient } from './client/client-manager.js';
+import { getDLLogger } from './runtime.js';
+function firstString(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'string' && v.length > 0) {
+            return v;
+        }
+    }
+    return '';
+}
+function pickRequest(ctx) {
+    const req = ctx?.request ?? {};
+    const view = ctx?.view ?? {};
+    const payload = ctx?.pendingPayload ?? {};
+    return {
+        approvalId: firstString(payload.approvalId, req.id, req.approvalId),
+        kind: firstString(ctx?.approvalKind, req.kind, 'exec'),
+        agentId: firstString(req.agentId, view.agentId, req.sessionKey ? '' : ''),
+        sessionKey: firstString(req.sessionKey, view.sessionKey),
+        command: firstString(payload.command, view.command, req.command, req.payload?.command),
+        cwd: firstString(payload.cwd, view.cwd, req.cwd),
+        expiresAtMs: Number(payload.expiresAtMs ?? view.expiresAtMs ?? req.expiresAtMs ?? 0)
+    };
+}
+export function createDLApprovalCapability() {
+    return {
+        availability: {
+            // dlink 是唯一通道；账号已配置即可承接审批
+            isConfigured: () => true,
+            shouldHandle: () => true
+        },
+        presentation: {
+            buildPendingPayload: (ctx) => {
+                const info = pickRequest(ctx);
+                return {
+                    ...info,
+                    text: firstString(ctx?.view?.summary, info.command)
+                };
+            },
+            buildResolvedResult: () => ({ kind: 'leave' }),
+            buildExpiredResult: () => ({ kind: 'leave' })
+        },
+        transport: {
+            prepareTarget: (ctx) => ctx?.plannedTarget ?? null,
+            deliverPending: async (ctx) => {
+                const logger = getDLLogger();
+                const info = pickRequest(ctx);
+                if (!info.approvalId) {
+                    logger.warn?.('approval deliver skipped: no approvalId');
+                    return null;
+                }
+                const dlClient = getDLClient(ctx?.accountId || DEFAULT_ACCOUNT_ID);
+                if (!dlClient) {
+                    logger.warn?.('approval deliver skipped: no dlink client');
+                    return null;
+                }
+                try {
+                    await dlClient.pushApprovalEvent({
+                        approvalId: info.approvalId,
+                        kind: info.kind,
+                        agentId: info.agentId,
+                        sessionKey: info.sessionKey,
+                        command: info.command,
+                        cwd: info.cwd,
+                        expiresAtMs: info.expiresAtMs
+                    });
+                    logger.info?.(`approval forwarded to relay: id=${info.approvalId} agent=${info.agentId} kind=${info.kind}`);
+                }
+                catch (e) {
+                    logger.warn?.(`approval forward failed: ${String(e)}`);
+                }
+                return { approvalId: info.approvalId, deliveredAt: Date.now() };
+            },
+            updateEntry: async () => { },
+            deleteEntry: async () => { }
+        },
+        interactions: {}
+    };
+}

package/dist/src/channel.js

@@ -4,6 +4,7 @@ import { checkConfigured, deleteDLAccount, listDLConfiguredAccountIds, resolveDe
 import { formatPairingApproveHint } from "openclaw/plugin-sdk/core";
 import { getDLLogger } from "./runtime.js";
 import { dlOutbound, dlPairing } from "./outbound.js";
+import { createDLApprovalCapability } from "./approval-native.js";
 export const channelMeta = pkg.openclaw.channel;
 export const LOG_TAG = channelMeta.selectionLabel;
 const channelId = channelMeta.id;
@@ -142,6 +143,8 @@ export const dlChannel = {
     },
     pairing: dlPairing(channelId),
     outbound: dlOutbound(),
+    // 2026-10-27 原生审批投递：core 把请求交给插件，插件转交中继扇出
+    approvalCapability: createDLApprovalCapability(),
     gateway: {
         startAccount: async (ctx) => {
             ctx.setStatus({

package/dist/src/client/const.d.ts

@@ -25,6 +25,7 @@ export declare const REPLY_SEND_TIMEOUT_MS = 15000;
  */
 export declare const AUTO_RELAY_API = "/guest/relayBot/sendNotification";
 export declare const AUTO_RELAY_PERSONA = "/guest/relayBot/persona";
+export declare const AUTO_RELAY_APPROVAL_EVENT = "/guest/relayBot/approvalEvent";
 export declare const AUTO_RELAY_UPLOAD = "/guest/relayBot/uploadMediaFiles";
 export declare const FILE_LIMITS: {
     image: {

package/dist/src/client/const.js

@@ -26,6 +26,7 @@ export const REPLY_SEND_TIMEOUT_MS = 15_000;
 export const AUTO_RELAY_API = '/guest/relayBot/sendNotification';
 // 2026-10-26 人设注入：按 sessionKey 拉取 agent 人格与生效约定
 export const AUTO_RELAY_PERSONA = '/guest/relayBot/persona';
+export const AUTO_RELAY_APPROVAL_EVENT = '/guest/relayBot/approvalEvent';
 export const AUTO_RELAY_UPLOAD = "/guest/relayBot/uploadMediaFiles";
 // ====== 上传文件配置常量（根据服务器性能调整）=======
 export const FILE_LIMITS = {

package/dist/src/client/dl-client.d.ts

@@ -53,6 +53,8 @@ export declare class DLClient extends EventEmitter {
      * 失败返回 null，调用方降级为不注入，不影响正常对话。
      */
     fetchPersona(sessionKey: string, agentId?: string): Promise<any | null>;
+    /** 2026-10-27 把审批请求交给中继（由中继扇出给最多三人） */
+    pushApprovalEvent(payload: Record<string, unknown>): Promise<any>;
     private fetchConfig;
     private changeConnectStatus;
     private connect;

package/dist/src/client/dl-client.js

@@ -3,7 +3,7 @@ import { buildDLReplyMessage, messagePreviewHandler } from './message.js';
 import mqtt from 'mqtt';
 import { DLHttp } from './dl-http.js';
 import { decryptAesEcbPkcs5 } from './crypto.js';
-import { AUTO_RELAY_API, AUTO_RELAY_PERSONA, AUTO_RELAY_UPLOAD } from './const.js';
+import { AUTO_RELAY_API, AUTO_RELAY_PERSONA, AUTO_RELAY_APPROVAL_EVENT, AUTO_RELAY_UPLOAD } from './const.js';
 import { createCmdHandler } from '../services/index.js';
 import { uuidStr } from '../utils.js';
 export class DLClient extends EventEmitter {
@@ -66,6 +66,17 @@ export class DLClient extends EventEmitter {
             return null;
         }
     }
+    /** 2026-10-27 把审批请求交给中继（由中继扇出给最多三人） */
+    async pushApprovalEvent(payload) {
+        try {
+            const data = await this.http.post(AUTO_RELAY_APPROVAL_EVENT, payload);
+            return data ?? null;
+        }
+        catch (e) {
+            this.logger.warn(`pushApprovalEvent failed: ${e}`);
+            return null;
+        }
+    }
     async fetchConfig() {
         const url = `/guest/mqtt/getConfig/${this.ctx.account.config.apiKey}`;
         const res = await this.http.get(url);

package/dist/src/client/message.js

@@ -946,16 +946,57 @@ export async function routeAndDispatchMessage(ctx) {
             kind: 'in_process'
         });
     }
+    // 2026-10-27 terminal guard: hoisted so the finally block can always settle the stream
+    const mediaFiles = [];
+    // 2026-10-27 terminal guard: normal end, empty reply, abort and error must all send finish=true exactly once.
+    // Otherwise client runState.status.finish stays false and the UI spins forever.
+    let terminalSent = false;
+    let scopeEnded = false;
+    let personaScopeKey = '';
+    const endScopeOnce = () => {
+        if (scopeEnded) {
+            return;
+        }
+        scopeEnded = true;
+        if (personaAgentId) {
+            endPersonaScope(personaScopeKey, personaAgentId);
+        }
+    };
+    // send terminal state once; tag_status_completed is parsed as a state message, not a chat bubble
+    const settleOnce = async (content, kind = 'block') => {
+        if (terminalSent) {
+            return;
+        }
+        terminalSent = true;
+        try {
+            await client.publishProcessingState({
+                streamId,
+                content: '[tag_status_completed]',
+                status: 'read',
+                kind: 'in_process'
+            });
+        }
+        catch (e) {
+            logger.warn?.(`account[${accountId}] publish terminal status failed: ${String(e)}`);
+        }
+        try {
+            if (messageAccumulators.has(streamId)) {
+                await client.publishToServer({ streamId, content, finish: true, kind, mediaFiles }, chatOpts);
+            }
+        }
+        catch (e) {
+            logger.error(`account[${accountId}] publish terminal reply failed: ${String(e)}`);
+        }
+    };
     try {
         const ctx = await ctxPayload;
         // 2026-10-26 群聊人设作用域：分发期间绑定被 @ 的 agent，整轮（含工具循环）都能读到正确值
         // 2026-10-26 OpenClaw 的消息上下文字段名是 SessionKey（大写），兼容两种写法
-        const personaScopeKey = ((ctx.SessionKey ?? ctx.sessionKey) || '');
+        personaScopeKey = ((ctx.SessionKey ?? ctx.sessionKey) || '');
         logger.debug?.(`persona scope: session=${personaScopeKey} agent=${personaAgentId ?? '-'}`);
         if (personaAgentId) {
             beginPersonaScope(personaScopeKey, personaAgentId);
         }
-        const mediaFiles = [];
         await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
             ctx,
             cfg,
@@ -997,9 +1038,7 @@ export async function routeAndDispatchMessage(ctx) {
                     }
                 },
                 onSettled: async () => {
-                    if (personaAgentId) {
-                        endPersonaScope(personaScopeKey, personaAgentId);
-                    }
+                    endScopeOnce();
                     if ((accStatus.accumulatedPayload && accStatus.accumulatedPayload.length > 0) || mediaFiles.length > 0) {
                         //发送结束状态
                         await client.publishProcessingState({
@@ -1009,6 +1048,7 @@ export async function routeAndDispatchMessage(ctx) {
                             kind: 'in_process'
                         });
                         //处理完成整体回复
+                        terminalSent = true;
                         await client.publishToServer({
                             streamId,
                             content: accStatus.accumulatedPayload,
@@ -1017,11 +1057,13 @@ export async function routeAndDispatchMessage(ctx) {
                             mediaFiles
                         }, chatOpts);
                     }
+                    else {
+                        // 2026-10-27 空回复（含被中止、模型未产出正文）也必须收尾，否则客户端一直转圈
+                        await settleOnce('[tag_status_completed]');
+                    }
                 },
                 onError: async (err, info) => {
-                    if (personaAgentId) {
-                        endPersonaScope(personaScopeKey, personaAgentId);
-                    }
+                    endScopeOnce();
                     const errorStr = String(err);
                     await client.publishProcessingState({
                         streamId,
@@ -1029,7 +1071,10 @@ export async function routeAndDispatchMessage(ctx) {
                         status: 'read',
                         kind: 'in_process'
                     });
-                    client.publishToServer({
+                    if (info.kind === 'final') {
+                        terminalSent = true;
+                    }
+                    await client.publishToServer({
                         streamId,
                         content: `[tag_error_pross]\n${errorStr}`,
                         finish: info.kind === 'final',
@@ -1113,10 +1158,13 @@ export async function routeAndDispatchMessage(ctx) {
                     }
                 },
                 async onItemEvent(payload) {
-                    const kind = payload.kind;
+                    let kind = payload.kind;
                     if (!kind) {
                         return;
                     }
+                    if (kind === 'preamble') {
+                        kind = 'commentary'; //适配前端中间文本气泡显示
+                    }
                     const content = [];
                     if (payload.name) {
                         content.push(payload.name);
@@ -1130,18 +1178,28 @@ export async function routeAndDispatchMessage(ctx) {
                     if (payload.summary) {
                         content.push(payload.summary);
                     }
-                    const messages = [
-                        `[tag_status_call_${kind}]`,
-                        `[tag_status_phase_${payload.phase}]`,
-                        `[tag_status_${payload.status}]`,
-                        ...content
-                    ];
-                    await client.publishProcessingState({
-                        streamId,
-                        content: messages.join('>'),
-                        status: 'read',
-                        kind: kind
-                    });
+                    if (kind === 'commentary') {
+                        await client.publishProcessingState({
+                            streamId,
+                            content: content.join('<br/>'),
+                            status: 'read',
+                            kind: kind
+                        });
+                    }
+                    else {
+                        const messages = [
+                            `[tag_status_call_${kind}]`,
+                            `[tag_status_phase_${payload.phase}]`,
+                            `[tag_status_${payload.status}]`,
+                            ...content
+                        ];
+                        await client.publishProcessingState({
+                            streamId,
+                            content: messages.join('>'),
+                            status: 'read',
+                            kind: kind
+                        });
+                    }
                     logger.info(`onItemEvent >>> kind=${payload.kind}, phase=${payload.phase}, status =${payload.status}, content=${content.join('>')}`);
                 },
                 onCommandOutput: async (payload) => {
@@ -1227,4 +1285,11 @@ export async function routeAndDispatchMessage(ctx) {
             kind: 'block'
         }, chatOpts);
     }
+    finally {
+        // 2026-10-27 abort 兜底：dispatch 正常返回但没走 onSettled，或异常被上层吞掉，都补发一次终态
+        endScopeOnce();
+        if (!terminalSent) {
+            await settleOnce('[tag_status_completed]');
+        }
+    }
 }

package/dist/src/exec-policy.d.ts

@@ -0,0 +1,6 @@
+/**
+ * 2026-10-27 读取生效执行策略，把「预设」解析成实际档位。
+ * 直接读网关配置文件，避免依赖 exec.approvals.get RPC（该调用在插件里会静默失败）。
+ */
+export type ExecPresetId = 'read-only' | 'guarded' | 'workspace' | 'full';
+export declare function readEffectiveExecPreset(): ExecPresetId | undefined;

package/dist/src/exec-policy.js

@@ -0,0 +1,39 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+function mapMode(mode) {
+    switch (mode) {
+        case 'full': return 'full';
+        case 'deny': return 'read-only';
+        case 'ask': return 'guarded';
+        case 'auto': return 'workspace';
+        case 'allowlist': return 'read-only';
+        default: return undefined;
+    }
+}
+export function readEffectiveExecPreset() {
+    try {
+        const file = process.env.OPENCLAW_CONFIG_PATH
+            || path.join(os.homedir(), '.openclaw', 'openclaw.json');
+        const cfg = JSON.parse(fs.readFileSync(file, 'utf8'));
+        const exec = (cfg && cfg.tools && cfg.tools.exec) || {};
+        const byMode = mapMode(exec.mode);
+        if (byMode) {
+            return byMode;
+        }
+        const security = exec.security;
+        const ask = exec.ask;
+        if (security === 'full')
+            return 'full';
+        if (security === 'deny')
+            return 'read-only';
+        if (security === 'allowlist') {
+            return ask === 'on-miss' ? 'guarded' : 'read-only';
+        }
+        // OpenClaw 未配置时默认 full（与 openclaw approvals get 的 effective 一致）
+        return 'full';
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/services/index.js

@@ -24,6 +24,9 @@ export class CmdHandler {
         }, (payload) => {
             // 2026-10-22：用量上报走服务端事件，由中继落库
             void this.dlClient.publishEventToServer(payload, 'onUsage', '1');
+        }, (payload) => {
+            // 2026-10-27 审批待审推送：插件发现新条目即上报中继，中继再推审批人
+            void this.dlClient.publishEventToServer(payload, 'onApproval', '1');
         });
     }
     log(msg, type) {

package/dist/src/services/services.d.ts

@@ -18,8 +18,13 @@ export declare class ClawServices extends EventEmitter {
     private readonly terminalManager;
     /** 2026-10-22：token 用量上报（中继落库，按同事聚合） */
     private readonly usagePublisher?;
+    private readonly approvalPublisher?;
+    private approvalTimer;
+    private readonly approvalSeen;
     private usageTimer;
-    constructor(options: ClawServiceOptions, logger: PluginLogger, terminalSink?: TerminalDataSink, usagePublisher?: (payload: Record<string, unknown>) => void);
+    constructor(options: ClawServiceOptions, logger: PluginLogger, terminalSink?: TerminalDataSink, usagePublisher?: (payload: Record<string, unknown>) => void, approvalPublisher?: (payload: Record<string, unknown>) => void);
+    /** 2026-10-27 每 10 秒本地查一次审批队列，出现新条目才推中继（推模式，非中继拉取） */
+    private startApprovalWatcher;
     /** 2026-10-22：每 60 秒把最近一天的 token 用量上报中继（幂等 upsert） */
     private startUsageReporter;
     log(msg: string, type: 'info' | 'warn' | 'error' | 'debug'): void;
@@ -127,6 +132,16 @@ export declare class ClawServices extends EventEmitter {
      * 新增 cmd 通道 agent.stop 指令
      */
     private handleStopAgent;
+    /** 2026-10-27 能力协议：声明本品牌支持的能力，客户端/中继据此渲染，不硬编码品牌 */
+    private handleAgentCapabilities;
+    /** 档位 id → 品牌真实取值；default 用 null 表示清除会话级覆盖 */
+    private static readonly PERMISSION_PRESETS;
+    private handlePermissionsGet;
+    private handlePermissionsSet;
+    /** 2026-10-27 审批待办（只读）：三类审批合并，归一化为品牌无关结构 */
+    private handleApprovalsPending;
+    /** 2026-10-27 审批决议：品牌无关入口，内部映射到网关 approval.resolve */
+    private handleApprovalsResolve;
     private handleSessionsAbort;
     private handlChatAbout;
     /**

package/dist/src/services/services.js

@@ -9,6 +9,7 @@ import fs from 'fs';
 import path from 'path';
 import WSClient from './ws-client.js';
 import { getOpenclawPath, getExtCapabilitiesDir } from '../utils.js';
+import { readEffectiveExecPreset } from '../exec-policy.js';
 import { applyModelOverrideToSessionEntry } from 'openclaw/plugin-sdk/model-session-runtime';
 // 2026-10-15 适配 openclaw 2026.10.3：config-runtime 子路径已被官方移除（2026-09-30 SDK owner 批准），
 // 下列符号现由 session-store-runtime 导出（同名、签名兼容：resolveStorePath/getSessionEntry/listSessionEntries 仍为同步，patchSessionEntry 为 async，调用处均已 await）
@@ -32,14 +33,66 @@ export class ClawServices extends EventEmitter {
     terminalManager;
     /** 2026-10-22：token 用量上报（中继落库，按同事聚合） */
     usagePublisher;
+    // 2026-10-27 审批事件推送（插件 → 中继），本地轮询发现新待审即上报
+    approvalPublisher;
+    approvalTimer = null;
+    approvalSeen = new Set();
     usageTimer = null;
-    constructor(options, logger, terminalSink, usagePublisher) {
+    constructor(options, logger, terminalSink, usagePublisher, approvalPublisher) {
         super();
         this.options = options;
         this.logger = logger;
         this.usagePublisher = usagePublisher;
+        this.approvalPublisher = approvalPublisher;
         this.terminalManager = new TerminalManager(terminalSink ?? (() => { }), (msg, type) => this.log(msg, type ?? 'info'));
     }
+    /** 2026-10-27 每 10 秒本地查一次审批队列，出现新条目才推中继（推模式，非中继拉取） */
+    startApprovalWatcher() {
+        if (this.approvalTimer || !this.approvalPublisher) {
+            return;
+        }
+        const tick = async () => {
+            try {
+                const publish = this.approvalPublisher;
+                if (!publish) {
+                    return;
+                }
+                if (!this.client) {
+                    return;
+                }
+                const kinds = ['exec', 'plugin', 'system-agent'];
+                for (const kind of kinds) {
+                    const res = await this.client.approvalList(kind);
+                    const list = Array.isArray(res) ? res : (res?.approvals ?? res?.items ?? []);
+                    for (const item of list) {
+                        const id = item?.id ?? item?.approvalId ?? item?.approval?.id;
+                        if (!id || this.approvalSeen.has(String(id))) {
+                            continue;
+                        }
+                        this.approvalSeen.add(String(id));
+                        publish({
+                            approvalId: String(id),
+                            kind,
+                            agentId: item?.agentId ?? item?.request?.agentId ?? '',
+                            sessionKey: item?.sessionKey ?? item?.request?.sessionKey ?? '',
+                            command: item?.command ?? item?.request?.command ?? item?.payload?.command ?? '',
+                            cwd: item?.cwd ?? item?.request?.cwd,
+                            createdAtMs: item?.createdAtMs ?? 0,
+                            expiresAtMs: item?.expiresAtMs ?? 0
+                        });
+                    }
+                }
+                if (this.approvalSeen.size > 500) {
+                    this.approvalSeen.clear();
+                }
+            }
+            catch (e) {
+                this.log(`approval watch failed: ${String(e)}`, 'warn');
+            }
+        };
+        this.approvalTimer = setInterval(() => { void tick(); }, 10000);
+        this.approvalTimer.unref?.();
+    }
     /** 2026-10-22：每 60 秒把最近一天的 token 用量上报中继（幂等 upsert） */
     startUsageReporter() {
         if (this.usageTimer || !this.usagePublisher) {
@@ -148,6 +201,7 @@ export class ClawServices extends EventEmitter {
             this.isInitialized = true;
             // 2026-10-22：启动后开始周期上报用量
             this.startUsageReporter();
+            this.startApprovalWatcher();
             return true;
         }
         catch (error) {
@@ -314,6 +368,22 @@ export class ClawServices extends EventEmitter {
                     // 2026-10-24：会话级中止，无 runId 时也能立即停止，并丢弃排队后续
                     result = await this.handleSessionsAbort(cmdMessage.params);
                     break;
+                // 2026-10-27 能力协议（品牌无关）：能力发现 + 执行档位
+                case 'agent.capabilities':
+                    result = this.handleAgentCapabilities();
+                    break;
+                case 'permissions.get':
+                    result = await this.handlePermissionsGet(cmdMessage.params ?? {});
+                    break;
+                case 'permissions.set':
+                    result = await this.handlePermissionsSet(cmdMessage.params ?? {});
+                    break;
+                case 'approvals.resolve':
+                    result = await this.handleApprovalsResolve(cmdMessage.params ?? {});
+                    break;
+                case 'approvals.pending':
+                    result = await this.handleApprovalsPending(cmdMessage.params ?? {});
+                    break;
                 // 2026-10-21：终端能力（owner-only，见 CmdHandler 校验）
                 case 'terminal.open':
                     result = await this.terminalManager.open(cmdMessage.params);
@@ -972,12 +1042,137 @@ export class ClawServices extends EventEmitter {
             sessionKey
         });
     }
-    async handleSessionsAbort(params) {
-        const { sessionKey } = params;
+    /** 2026-10-27 能力协议：声明本品牌支持的能力，客户端/中继据此渲染，不硬编码品牌 */
+    handleAgentCapabilities() {
+        return {
+            permissions: {
+                supported: true,
+                presets: [
+                    { id: 'default', label: '预设', description: '遵循代理程式已设定的执行权限', level: 1 },
+                    { id: 'read-only', label: '唯读', description: '工具可读取工作阶段根目录内的内容，但无法写入或执行命令', level: 2 },
+                    { id: 'guarded', label: '防护模式', description: '超出工作阶段根目录范围的请求由人工审查', level: 3 },
+                    { id: 'workspace', label: '工作区', description: '超出工作阶段根目录范围的请求由 AI 审查', level: 4 },
+                    { id: 'full', label: '完整存取权', description: '无需审查，档案存取与命令执行皆不受限制', level: 5, requiresAdmin: true }
+                ]
+            },
+            approvals: { supported: true, push: true, kinds: ['exec', 'plugin', 'system-agent'] },
+            audit: { supported: true }
+        };
+    }
+    /** 档位 id → 品牌真实取值；default 用 null 表示清除会话级覆盖 */
+    static PERMISSION_PRESETS = {
+        'default': null,
+        'read-only': 'read-only',
+        'guarded': 'guarded',
+        'workspace': 'workspace',
+        'full': 'full'
+    };
+    async handlePermissionsGet(params) {
+        const sessionKey = params?.sessionKey ?? params?.key;
         if (!sessionKey) {
-            throw new Error('sessions.abort 缺少 sessionKey 参数');
+            throw new Error('permissions.get 缺少 sessionKey');
+        }
+        const row = await this.client?.sessionsDescribe({ key: sessionKey });
+        const mode = row?.permissionMode ?? row?.session?.permissionMode ?? null;
+        const presetId = Object.entries(ClawServices.PERMISSION_PRESETS).find(([, v]) => v === mode)?.[0] ?? 'default';
+        // 2026-10-27 继承态：读一次生效策略，把「预设」解析成实际档位（客户端显示 预设（完整存取权））
+        let effectivePresetId = presetId;
+        // 2026-10-27 继承态：直接读网关配置解析实际档位（RPC exec.approvals.get 在插件里会静默失败）
+        if (presetId === 'default') {
+            const resolved = readEffectiveExecPreset();
+            if (resolved) {
+                effectivePresetId = resolved;
+            }
         }
-        return await this.client?.sessionsAbort({ sessionKey });
+        this.log(`permissions.get session=${sessionKey} mode=${mode} preset=${presetId} effective=${effectivePresetId}`, 'info');
+        return { presetId, inherited: !mode, effectivePresetId };
+    }
+    async handlePermissionsSet(params) {
+        const sessionKey = params?.sessionKey ?? params?.key;
+        const presetId = String(params?.presetId ?? '');
+        if (!sessionKey || !presetId) {
+            throw new Error('permissions.set 缺少 sessionKey 或 presetId');
+        }
+        if (!(presetId in ClawServices.PERMISSION_PRESETS)) {
+            throw new Error('未知档位: ' + presetId);
+        }
+        const mode = ClawServices.PERMISSION_PRESETS[presetId];
+        // 2026-10-27 写入后校验：网关可能返回 success=false 却不抛异常，也可能接受了但没落库
+        const res = await this.client?.sessionsPatch({ key: sessionKey, patch: { permissionMode: mode } });
+        if (res && res.success === false) {
+            throw new Error(`permissions.set failed: ${res.error ?? res.code ?? 'unknown'}`);
+        }
+        const row = await this.client?.sessionsDescribe({ key: sessionKey });
+        const applied = row?.permissionMode ?? row?.session?.permissionMode ?? null;
+        if (mode !== null && applied !== mode) {
+            throw new Error(`permissions.set not applied: expected=${mode} actual=${applied}`);
+        }
+        this.log(`permissions.set session=${sessionKey} preset=${presetId} mode=${mode} applied=${applied}`, 'info');
+        return { ok: true, presetId };
+    }
+    /** 2026-10-27 审批待办（只读）：三类审批合并，归一化为品牌无关结构 */
+    async handleApprovalsPending(params) {
+        const agentId = params?.agentId ? String(params.agentId) : undefined;
+        const limit = Number(params?.limit ?? 50);
+        const kinds = ['exec', 'plugin', 'system-agent'];
+        const lists = await Promise.all(kinds.map(async (kind) => {
+            try {
+                const res = await this.client?.approvalList(kind);
+                const list = Array.isArray(res) ? res : (res?.approvals ?? res?.items ?? []);
+                return list.map((it) => ({ ...it, __kind: kind }));
+            }
+            catch {
+                // 某一类审批不可用不影响其余类别
+                return [];
+            }
+        }));
+        const approvals = lists.flat()
+            .filter((it) => !agentId || it.agentId === agentId || it?.request?.agentId === agentId)
+            .slice(0, limit)
+            .map((it) => ({
+            approvalId: it.id ?? it.approvalId ?? it?.approval?.id,
+            kind: it.__kind,
+            agentId: it.agentId ?? it?.request?.agentId ?? '',
+            agentName: it.agentName ?? it?.request?.agentName,
+            sessionKey: it.sessionKey ?? it?.request?.sessionKey ?? '',
+            requesterEmpId: it.requesterEmpId ?? it?.request?.requesterEmpId ?? '',
+            command: it.command ?? it?.request?.command ?? it?.payload?.command ?? '',
+            cwd: it.cwd ?? it?.request?.cwd,
+            risk: it.risk ?? it?.request?.risk,
+            createdAtMs: it.createdAtMs ?? it?.request?.createdAtMs ?? 0,
+            expiresAtMs: it.expiresAtMs ?? it?.request?.expiresAtMs ?? 0,
+            status: it.status ?? 'pending'
+        }));
+        return { approvals };
+    }
+    /** 2026-10-27 审批决议：品牌无关入口，内部映射到网关 approval.resolve */
+    async handleApprovalsResolve(params) {
+        const id = params?.approvalId ?? params?.id;
+        const kind = params?.kind ?? 'exec';
+        const decision = params?.decision;
+        if (!id || !decision) {
+            throw new Error('approvals.resolve 缺少 approvalId 或 decision');
+        }
+        if (!['exec', 'plugin', 'system-agent'].includes(String(kind))) {
+            throw new Error('未知审批类型: ' + kind);
+        }
+        if (!['allow-once', 'allow-always', 'deny'].includes(String(decision))) {
+            throw new Error('未知决议: ' + decision);
+        }
+        const res = await this.client?.resolveApproval({ id: String(id), kind: kind, decision: decision });
+        return { ok: true, approvalId: id, decision, upstream: res ?? null };
+    }
+    async handleSessionsAbort(params) {
+        // 2026-10-27：兼容客户端 key / sessionKey 两种写法，统一按网关 schema 转发
+        const key = params?.key ?? params?.sessionKey;
+        if (!key) {
+            throw new Error('sessions.abort 缺少 key 参数');
+        }
+        return await this.client?.sessionsAbort({
+            key,
+            runId: params?.runId,
+            clearQueued: params?.clearQueued ?? true
+        });
     }
     async handlChatAbout(params) {
         const { sessionKey, runId } = params;

package/dist/src/services/types.d.ts

@@ -306,7 +306,7 @@ export interface CmdResult {
     timestamp: string | number;
     timezone: string;
 }
-export type CmdType = 'agent.ask' | 'agent.list' | 'agent.create' | 'agent.update' | 'agent.delete' | 'agent.get' | 'agent.stop' | 'chat.abort' | 'task.list' | 'task.create' | 'task.update' | 'task.delete' | 'task.run' | 'status.health' | 'status.system' | 'status.usage' | 'models.list' | 'sessions.list' | 'sessions.get' | 'sessions.describe' | 'sessions.resolve' | 'sessions.create' | 'sessions.archive' | 'sessions.restore' | 'sessions.delete' | 'sessions.reset' | 'sessions.patch' | 'sessions.currentModel' | 'sessions.abort' | 'terminal.open' | 'terminal.input' | 'terminal.resize' | 'terminal.close' | 'chat.history' | 'chat.trajectory' | 'skills.status' | 'skills.search' | 'skills.detail' | 'skills.install' | 'skills.update' | 'skills.securityVerdicts' | 'cancelMessage' | 'usage.cost' | 'sessions.usage' | 'sessions.usage.logs' | 'pairing.approve' | 'artifacts.list' | 'artifacts.get' | 'artifacts.download' | 'agents.files.list' | 'agents.files.get' | 'extCapabilities.status' | 'extCapabilities.check' | 'extCapabilities.install';
+export type CmdType = 'agent.ask' | 'agent.list' | 'agent.create' | 'agent.update' | 'agent.delete' | 'agent.get' | 'agent.stop' | 'chat.abort' | 'agent.capabilities' | 'permissions.get' | 'permissions.set' | 'approvals.pending' | 'approvals.resolve' | 'task.list' | 'task.create' | 'task.update' | 'task.delete' | 'task.run' | 'status.health' | 'status.system' | 'status.usage' | 'models.list' | 'sessions.list' | 'sessions.get' | 'sessions.describe' | 'sessions.resolve' | 'sessions.create' | 'sessions.archive' | 'sessions.restore' | 'sessions.delete' | 'sessions.reset' | 'sessions.patch' | 'sessions.currentModel' | 'sessions.abort' | 'terminal.open' | 'terminal.input' | 'terminal.resize' | 'terminal.close' | 'chat.history' | 'chat.trajectory' | 'skills.status' | 'skills.search' | 'skills.detail' | 'skills.install' | 'skills.update' | 'skills.securityVerdicts' | 'cancelMessage' | 'usage.cost' | 'sessions.usage' | 'sessions.usage.logs' | 'pairing.approve' | 'artifacts.list' | 'artifacts.get' | 'artifacts.download' | 'agents.files.list' | 'agents.files.get' | 'extCapabilities.status' | 'extCapabilities.check' | 'extCapabilities.install';
 export type ReadlineType = Extract<CmdType, 'chat.trajectory'>;
 export interface ClawMessage {
     type: 'res' | 'event';
@@ -316,7 +316,7 @@ export interface ClawMessage {
     payload: any;
     error?: any;
 }
-export type EventType = 'onTick' | 'onHealth' | 'onHandshaked' | 'onConnectState' | 'onError' | 'onAgentReply' | 'onAgentChat' | 'onChatTrajectory' | 'onCron' | 'onShutdown' | 'onSessionsChanged' | 'onSkillInstalled' | 'onSkillInstalling' | 'onSkillError' | 'onPairingRequest' | 'onPairingResult'
+export type EventType = 'onApproval' | 'onTick' | 'onHealth' | 'onHandshaked' | 'onConnectState' | 'onError' | 'onAgentReply' | 'onAgentChat' | 'onChatTrajectory' | 'onCron' | 'onShutdown' | 'onSessionsChanged' | 'onSkillInstalled' | 'onSkillInstalling' | 'onSkillError' | 'onPairingRequest' | 'onPairingResult'
 /** 2026-10-22：周期上报 token 用量 */
  | 'onUsage' | 'onTerminal';
 export type CmdParamsPatchSessionEntry = {

package/dist/src/services/ws-client.d.ts

@@ -143,9 +143,22 @@ export declare class WSClient extends EventEmitter {
         sessionKey: string;
         runId?: string;
     }): Promise<any>;
+    /** 2026-10-27 审批决议：放行一次 / 永久放行 / 拒绝（网关 schema: id/kind/decision） */
+    resolveApproval(params: {
+        id: string;
+        kind: 'exec' | 'plugin' | 'system-agent';
+        decision: 'allow-once' | 'allow-always' | 'deny';
+    }): Promise<any>;
+    /** 2026-10-27 读取生效执行策略：把「预设」解析成实际档位 */
+    execApprovalsGet(): Promise<any>;
+    /** 2026-10-27 审批队列（只读）：三类审批分别取列表，core 已做过期过滤 */
+    approvalList(kind: 'exec' | 'plugin' | 'system-agent'): Promise<any>;
     /** 2026-10-24：会话级中止（无 runId 时使用），同时丢弃排队后续 */
     sessionsAbort(params: {
-        sessionKey: string;
+        sessionKey?: string;
+        key?: string;
+        runId?: string;
+        clearQueued?: boolean;
     }): Promise<any>;
     getSkillSecurityVerdicts(agentId?: string): Promise<any>;
     getUsageCost(params: Record<string, unknown>): Promise<any>;

package/dist/src/services/ws-client.js

@@ -464,13 +464,36 @@ export class WSClient extends EventEmitter {
             }
         });
     }
+    /** 2026-10-27 审批决议：放行一次 / 永久放行 / 拒绝（网关 schema: id/kind/decision） */
+    async resolveApproval(params) {
+        return this.sendRequest({ type: 'req', method: 'approval.resolve', params });
+    }
+    /** 2026-10-27 读取生效执行策略：把「预设」解析成实际档位 */
+    async execApprovalsGet() {
+        return this.sendRequest({ type: 'req', method: 'exec.approvals.get', params: {} });
+    }
+    /** 2026-10-27 审批队列（只读）：三类审批分别取列表，core 已做过期过滤 */
+    async approvalList(kind) {
+        const method = kind === 'exec'
+            ? 'exec.approval.list'
+            : kind === 'plugin'
+                ? 'plugin.approval.list'
+                : 'openclaw.approval.list';
+        return this.sendRequest({ type: 'req', method, params: {} });
+    }
     /** 2026-10-24：会话级中止（无 runId 时使用），同时丢弃排队后续 */
     async sessionsAbort(params) {
-        const { sessionKey } = params;
+        // 2026-10-27 修正：sessions.abort 的参数字段是 key（不是 sessionKey），网关 schema 为 key/runId/agentId/clearQueued；
+        // clearQueued 丢弃排队后续，避免中止后不到一秒又被排队任务拉起。
+        const key = params.key ?? params.sessionKey;
         return this.sendRequest({
             type: 'req',
             method: 'sessions.abort',
-            params: { sessionKey }
+            params: {
+                key,
+                clearQueued: params.clearQueued ?? true,
+                ...(params.runId ? { runId: params.runId } : {})
+            }
         });
     }
     async getSkillSecurityVerdicts(agentId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dlinkclaw-openclaw",
-  "version": "2026.10.23",
+  "version": "2026.10.26",
   "description": "DLinkClaw OpenClaw channel plugin — 朵联 OpenClaw 接入通道",
   "keywords": [
     "DLinkClaw",