dsh-plugin-weapp-gateway 0.8.11 → 0.8.13

package/lib/clawbot/secure-file.mjs

@@ -0,0 +1,86 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { dirname } from 'node:path';
+import { userInfo } from 'node:os';
+import { randomBytes } from 'node:crypto';
+/** Best-effort owner-only permissions for credentials and stable identities. */
+export function tightenPrivateFile(file) {
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch { /* best effort */ }
+    if (process.platform !== 'win32')
+        return;
+    try {
+        execFileSync('icacls', [file, '/inheritance:r', '/grant:r', `${userInfo().username}:F`], {
+            timeout: 5000,
+            windowsHide: true,
+            stdio: 'ignore',
+        });
+    }
+    catch { /* best effort */ }
+}
+/**
+ * Replace a private JSON file without ever truncating the previous valid file.
+ * The temporary file lives beside the destination, so rename is same-volume.
+ */
+export function writePrivateJsonAtomic(file, value) {
+    publishPrivateJson(file, value, true);
+}
+/** Publish a fully written identity once. Concurrent first starts must read
+ * the winner, never overwrite it or observe an empty placeholder file. */
+export function createPrivateJsonAtomic(file, value) {
+    return publishPrivateJson(file, value, false);
+}
+function publishPrivateJson(file, value, replace) {
+    const parent = dirname(file);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+    try {
+        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+            flag: 'wx',
+        });
+        const fd = openSync(temporary, 'r+');
+        try {
+            // Some Windows filesystems reject fsync on ordinary user files. Rename
+            // remains atomic; durability flush is an additional best-effort barrier.
+            try {
+                fsyncSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+        finally {
+            closeSync(fd);
+        }
+        tightenPrivateFile(temporary);
+        if (replace)
+            renameSync(temporary, file);
+        else {
+            try {
+                linkSync(temporary, file);
+            }
+            catch (error) {
+                if (error.code === 'EEXIST')
+                    return false;
+                throw error; // Do not replace an existing identity on unsupported storage.
+            }
+        }
+        tightenPrivateFile(file);
+        return true;
+    }
+    finally {
+        if (existsSync(temporary)) {
+            try {
+                rmSync(temporary, { force: true });
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+export function readPrivateJson(file) {
+    const value = JSON.parse(readFileSync(file, 'utf8'));
+    tightenPrivateFile(file);
+    return value;
+}

package/lib/clawbot/service.mjs

@@ -0,0 +1,81 @@
+import { createHash } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { ClawbotRuntime } from './runtime.mjs';
+import { DshClawbotHost } from './dsh-host.mjs';
+import { FileClawbotStorage } from './storage.mjs';
+import { ClawbotError } from './contracts.mjs';
+import { ILinkError } from './ilink-types.mjs';
+
+function dshProfile(ctx) {
+  const profile = ctx?.get?.('profileContext');
+  if (profile !== undefined && profile !== null) {
+    if (!profile || typeof profile !== 'object'
+      || typeof profile.name !== 'string' || !profile.name || profile.name.length > 80
+      || /[\\/\u0000-\u001f]/.test(profile.name) || ['.', '..', 'node_modules'].includes(profile.name)
+      || typeof profile.home !== 'string' || !path.isAbsolute(profile.home) || profile.home.includes('\0')) {
+      throw new Error('DSH 运行实例信息不完整，未使用其他实例的配置');
+    }
+    return { name: profile.name, home: path.normalize(profile.home) };
+  }
+  if (process.versions.electron) throw new Error('DSH profile facts are unavailable');
+  const configured = String(process.env.DSH_HOME || '').trim();
+  const home = configured === '~' ? os.homedir()
+    : configured.startsWith('~/') || configured.startsWith('~\\')
+      ? path.join(os.homedir(), configured.slice(2))
+      : configured ? configured : path.join(os.homedir(), '.dsh');
+  const explicit = process.argv.find((value, index, argv) => argv[index - 1] === '--profile')
+    || process.argv.find(value => value.startsWith('--profile='))?.slice('--profile='.length);
+  const name = explicit || (process.argv[2] === 'web' ? 'web' : 'default');
+  return { name, home: path.resolve(home) };
+}
+
+export function clawbotStorageDirectory(ctx) {
+  const profile = dshProfile(ctx);
+  const scope = ['web', 'default'].includes(profile.name.toLowerCase()) ? 'web' : profile.name;
+  const key = createHash('sha256').update(`deepseek-harness\0${scope}`).digest('hex').slice(0, 24);
+  return path.join(profile.home, 'harness-remote', 'instances', key, 'clawbot');
+}
+
+export function createClawbotService(ctx) {
+  let storage;
+  try {
+    storage = new FileClawbotStorage(clawbotStorageDirectory(ctx));
+    const runtime = new ClawbotRuntime(storage, new DshClawbotHost(ctx));
+    return {
+      runtime,
+      error: null,
+      async control(request, signal = new AbortController().signal) {
+        try {
+          return { ok: true, value: await runtime.control(request, signal) };
+        } catch (cause) {
+          signal.throwIfAborted();
+          const known = cause instanceof ClawbotError || cause instanceof ILinkError;
+          return {
+            ok: false,
+            error: known
+              ? { code: cause.code, message: cause.message }
+              : { code: 'clawbot-operation-failed', message: '操作未完成，请刷新核对当前状态后再试。' },
+          };
+        }
+      },
+      dispose: () => runtime.dispose(),
+    };
+  } catch (error) {
+    try { storage?.close(); } catch { /* Preserve the original startup error. */ }
+    const locked = /another|另一个|管理/u.test(String(error?.message || ''));
+    return {
+      runtime: null,
+      async control() {
+        return { ok: false, error: this.error };
+      },
+      error: {
+        code: locked ? 'clawbot-owner-conflict' : 'clawbot-startup-failed',
+        message: locked
+          ? 'ClawBot 本地状态仍由旧服务占用。请先停止旧的私聊接线服务并重启 DSH，再由小程序网关接管。'
+          : 'ClawBot 本地状态无法安全读取，原记录未覆盖。请在电脑端核对后重启 DSH。',
+      },
+      dispose: async () => {},
+    };
+  }
+}

package/lib/clawbot/storage.mjs

@@ -0,0 +1,108 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { writePrivateJsonAtomic } from './secure-file.mjs';
+import { validateMedia, validatePreparedMedia, MEDIA_MAX_ITEMS } from './ilink-media.mjs';
+import { ClawbotError } from './contracts.mjs';
+import { REPLY_TEXT_MAX_BYTES, REPLY_MAX_TEXT_PARTS, REPLY_TOTAL_TEXT_MAX_BYTES, TEXT_PART_MAX_BYTES } from './reply-text.mjs';
+export const emptyClawbotData = () => ({ version: 1, revision: 0, enabled: false, credentials: null, target: null, cursor: '', receipts: [] });
+export function validateClawbotData(data) {
+    const validTarget = (target) => target === null || target && typeof target.id === 'string'
+        && target.id.length > 0 && target.id.length <= 256 && typeof target.title === 'string' && target.title.length <= 500
+        && (target.generation === undefined || Number.isSafeInteger(target.generation))
+        && (target.workspaceId === undefined || typeof target.workspaceId === 'string' && target.workspaceId.length <= 256)
+        && (target.workspaceTitle === undefined || typeof target.workspaceTitle === 'string' && target.workspaceTitle.length <= 200);
+    if (data.version !== 1 || !Number.isSafeInteger(data.revision) || data.revision < 0 || typeof data.enabled !== 'boolean'
+        || data.accessBinding !== undefined && (!data.accessBinding || ![data.accessBinding.nodeId, data.accessBinding.accountInstance]
+            .every(value => typeof value === 'string' && value.length > 0 && value.length <= 256))
+        || data.authExpired !== undefined && typeof data.authExpired !== 'boolean'
+        || typeof data.cursor !== 'string' || data.cursor.length > 65536 || !validTarget(data.target)
+        || !Array.isArray(data.receipts) || data.receipts.length > 1000 || new Set(data.receipts.map(r => r?.id)).size !== data.receipts.length
+        || data.receipts.some(r => !r || typeof r.id !== 'string' || !/^[a-f0-9]{64}$/.test(r.id) || typeof r.userId !== 'string'
+            || typeof r.contextToken !== 'string' || typeof r.input !== 'string' || r.input.length > 8000 || !validTarget(r.target)
+            || r.media !== undefined && (!Array.isArray(r.media) || !r.media.length || r.media.length > MEDIA_MAX_ITEMS || !r.media.every(validateMedia))
+            || !Number.isSafeInteger(r.createdAt) || !Number.isSafeInteger(r.revision)
+            || r.parentId !== undefined && (typeof r.parentId !== 'string' || !/^[a-f0-9]{64}$/.test(r.parentId) || r.parentId === r.id)
+            || !['pending', 'running', 'ready', 'sending', 'done', 'uncertain'].includes(r.state)
+            || r.output !== undefined && (typeof r.output !== 'string' || Buffer.byteLength(r.output) > REPLY_TEXT_MAX_BYTES)
+            || r.parts !== undefined && (!Array.isArray(r.parts) || !r.parts.length || r.parts.length > REPLY_MAX_TEXT_PARTS + MEDIA_MAX_ITEMS
+                || r.parts.some(p => typeof p === 'string' ? !p || Buffer.byteLength(p) > TEXT_PART_MAX_BYTES
+                    : !validatePreparedMedia(p) || p.userId !== r.userId || p.accountId !== data.credentials?.accountId)
+                || r.parts.reduce((bytes, p) => bytes + (typeof p === 'string' ? Buffer.byteLength(p) : 0), 0) > REPLY_TOTAL_TEXT_MAX_BYTES
+                || r.parts.filter(p => typeof p !== 'string').length > MEDIA_MAX_ITEMS
+                || !Number.isSafeInteger(r.sentParts) || r.sentParts < 0 || r.sentParts >= r.parts.length)
+            || !['done', 'uncertain'].includes(r.state) && r.parts === undefined && r.sentParts !== undefined && r.sentParts !== 0
+            || r.state === 'ready' && r.parts === undefined && (typeof r.output !== 'string' || !r.output)))
+        throw new ClawbotError('clawbot-storage-invalid', 'ClawBot 本地记录格式无效，未重置或覆盖。');
+    if (data.credentials && ![data.credentials.token, data.credentials.accountId, data.credentials.userId, data.credentials.baseUrl]
+        .every(value => typeof value === 'string' && value.length > 0 && value.length <= 8192))
+        throw new ClawbotError('clawbot-storage-invalid', 'ClawBot 登录记录不完整，请核对本地文件。');
+    if (Buffer.byteLength(JSON.stringify(data)) > 12 * 1024 * 1024)
+        throw new ClawbotError('clawbot-capacity', 'ClawBot 本地记录达到空间上限；未丢弃或覆盖待处理消息。');
+}
+/** One owner per native profile. Exact generation filenames make crashed-owner
+ * recovery safe against two contenders; no host process is stopped. */
+export class FileClawbotStorage {
+    file;
+    lock;
+    owner;
+    closed = false;
+    constructor(directory) {
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        this.file = path.join(directory, 'state.json');
+        this.lock = path.join(directory, '.owner');
+        this.owner = `owner-${process.pid}-${randomUUID()}.json`;
+        const staging = path.join(directory, `.pending-${randomUUID()}`);
+        mkdirSync(staging, { mode: 0o700 });
+        writePrivateJsonAtomic(path.join(staging, this.owner), { pid: process.pid });
+        try {
+            if (existsSync(this.lock)) {
+                const entries = readdirSync(this.lock);
+                if (entries.length !== 1 || !/^owner-\d+-[a-f0-9-]+\.json$/.test(entries[0]))
+                    throw new Error('ClawBot 状态正在被另一个实例使用');
+                const previous = path.join(this.lock, entries[0]);
+                const { pid } = JSON.parse(readFileSync(previous, 'utf8'));
+                if (!Number.isSafeInteger(pid) || pid < 1)
+                    throw new Error('ClawBot 本地锁需要核对');
+                try {
+                    process.kill(pid, 0);
+                    throw new Error('ClawBot 已由此节点的另一个实例管理');
+                }
+                catch (error) {
+                    if (error.code !== 'ESRCH')
+                        throw error;
+                }
+                rmSync(previous);
+                rmdirSync(this.lock);
+            }
+            renameSync(staging, this.lock);
+        }
+        catch (error) {
+            rmSync(path.join(staging, this.owner), { force: true });
+            rmdirSync(staging);
+            throw error;
+        }
+    }
+    read() {
+        if (!existsSync(this.file))
+            return emptyClawbotData();
+        if (statSync(this.file).size > 16 * 1024 * 1024)
+            throw new Error('ClawBot 本地记录超过上限，未覆盖原记录');
+        const data = JSON.parse(readFileSync(this.file, 'utf8'));
+        validateClawbotData(data);
+        return data;
+    }
+    write(data) {
+        if (this.closed)
+            throw new Error('ClawBot 组件已停止');
+        validateClawbotData(data);
+        writePrivateJsonAtomic(this.file, data);
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        rmSync(path.join(this.lock, this.owner));
+        rmdirSync(this.lock);
+    }
+}

package/lib/client.js

@@ -578,7 +578,13 @@ window.__ModuleLoader__.load({
               setUpdateInfo({ ...result, currentVersion: result.latestVersion, updateAvailable: false })
               setUpdateNotice(`已安装 v${result.latestVersion}，需要重启 DSH 后生效。`)
             } else if (application === 'failed' || application === 'cancelled' || application === 'refused') {
-              setUpdateNotice(`安装未完成：${application}${result.installation?.error ? `（${result.installation.error}）` : ''}`)
+              const installError = result.installation?.error
+              const detail = result.installation?.errorMessage
+                || (typeof installError === 'string' ? installError : '')
+                || (typeof installError?.message === 'string' ? installError.message : '')
+                || (typeof installError?.code === 'string' ? installError.code : '')
+                || '请在 DSH 插件管理中查看安装详情。'
+              setUpdateNotice(`安装未完成：${application}（${detail}）`)
             } else {
               setUpdateInfo({ ...result, currentVersion: result.latestVersion, updateAvailable: false })
               setUpdateNotice(`已安装 v${result.latestVersion}。如界面尚未更新，请重启 DSH。`)

package/lib/completion-notifications.mjs

@@ -7,6 +7,46 @@ function eventTurnKey(event) {
   return null
 }
 
+function finiteCount(...values) {
+  for (const value of values) {
+    if (typeof value === 'number' && Number.isFinite(value) && value >= 0) return value
+  }
+  return null
+}
+
+function addUsage(target, usage) {
+  if (!target || !usage || typeof usage !== 'object') return
+  const input = finiteCount(usage.inputTokens, usage.promptTokens)
+  const uncachedInput = finiteCount(usage.uncachedInputTokens, usage.uncached_input_tokens)
+  const output = finiteCount(usage.outputTokens, usage.completionTokens)
+  const total = finiteCount(usage.totalTokens)
+  const cacheRead = finiteCount(usage.cacheReadTokens, usage.cachedInputTokens, usage.cacheReadInputTokens)
+  if (input !== null) { target.inputTokens += input; target.hasInputTokens = true }
+  if (uncachedInput !== null) { target.uncachedInputTokens += uncachedInput; target.hasUncachedInputTokens = true }
+  if (output !== null) { target.outputTokens += output; target.hasOutputTokens = true }
+  if (total !== null) { target.totalTokens += total; target.hasTotalTokens = true }
+  if (cacheRead !== null) { target.cacheReadTokens += cacheRead; target.hasCacheReadTokens = true }
+}
+
+function turnMetrics(state, key, endedAt) {
+  const usage = state.turnUsage.get(key)
+  const start = state.turnStartedAt.get(key)
+  const result = {}
+  if (state.taskName) result.taskName = state.taskName
+  if (start !== undefined && Number.isFinite(endedAt) && endedAt >= start) result.durationMs = endedAt - start
+  if (usage && (usage.hasTotalTokens || usage.hasInputTokens || usage.hasOutputTokens)) {
+    result.tokens = usage.hasTotalTokens ? usage.totalTokens : usage.inputTokens + usage.outputTokens
+  } else if (usage?.hasUncachedInputTokens || usage?.hasCacheReadTokens || usage?.hasOutputTokens) {
+    result.tokens = usage.uncachedInputTokens + usage.cacheReadTokens + usage.outputTokens
+  }
+  if (usage?.hasCacheReadTokens && (usage.hasUncachedInputTokens || usage.hasInputTokens)) {
+    const inputBase = usage.hasUncachedInputTokens ? usage.uncachedInputTokens : usage.inputTokens
+    const denominator = inputBase + usage.cacheReadTokens
+    if (denominator > 0) result.cacheHitRate = Math.min(1, usage.cacheReadTokens / denominator)
+  }
+  return result
+}
+
 function completionUrl(baseUrl) {
   if (!baseUrl) return null
   let url
@@ -26,7 +66,10 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
   function sessionState(sessionId, create = false) {
     let value = sessions.get(sessionId)
     if (!value && create) {
-      value = { pending: [], active: new Map(), currentTurn: null, currentTurnAt: null }
+      value = {
+        pending: [], active: new Map(), currentTurn: null, currentTurnAt: null,
+        taskName: null, taskNameAt: null, turnStartedAt: new Map(), turnUsage: new Map(),
+      }
       sessions.set(sessionId, value)
     }
     return value
@@ -45,7 +88,17 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
         if (live.length) state.active.set(key, live)
         else state.active.delete(key)
       }
-      if (!state.pending.length && !state.active.size && state.currentTurn === null) sessions.delete(sessionId)
+      if (state.taskNameAt !== null && state.taskNameAt <= cutoff) {
+        state.taskName = null
+        state.taskNameAt = null
+      }
+      for (const [key, startedAt] of state.turnStartedAt) {
+        if (startedAt <= cutoff) {
+          state.turnStartedAt.delete(key)
+          state.turnUsage.delete(key)
+        }
+      }
+      if (!state.pending.length && !state.active.size && state.currentTurn === null && state.taskNameAt === null) sessions.delete(sessionId)
     }
   }
 
@@ -75,10 +128,10 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
       if (remaining.length) state.active.set(key, remaining)
       else state.active.delete(key)
     }
-    if (!state.pending.length && !state.active.size && state.currentTurn === null) sessions.delete(sessionId)
+    if (!state.pending.length && !state.active.size && state.currentTurn === null && state.taskNameAt === null) sessions.delete(sessionId)
   }
 
-  async function deliver(sessionId, records) {
+  async function deliver(sessionId, records, metrics) {
     if (!endpoint || !records.length) return
     for (const record of records) {
       let response
@@ -87,7 +140,7 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
           response = await fetchImpl(endpoint, {
             method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10000),
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ ticket: record.ticket, sessionId, status: 'completed' }),
+            body: JSON.stringify({ ticket: record.ticket, sessionId, status: 'completed', ...metrics }),
           })
           if (response.ok) break
         } catch (_) { response = null }
@@ -100,12 +153,27 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
   function onSessionEvent(sessionId, event) {
     if (!endpoint || typeof sessionId !== 'string' || !event) return
     prune()
+    if (event.type === 'session/title') {
+      const title = typeof event.data?.title === 'string' ? event.data.title.trim().slice(0, 200) : ''
+      if (title) {
+        const state = sessionState(sessionId, true)
+        state.taskName = title
+        state.taskNameAt = now()
+      }
+      return
+    }
     if (event.type === 'turn/start') {
       const state = sessionState(sessionId, true)
       const key = eventTurnKey(event) || (Number.isSafeInteger(event.seq) ? `seq:${event.seq}` : null)
       if (key === null) return
       state.currentTurn = key
       state.currentTurnAt = now()
+      state.turnStartedAt.set(key, state.currentTurnAt)
+      state.turnUsage.set(key, {
+        inputTokens: 0, uncachedInputTokens: 0, outputTokens: 0, totalTokens: 0, cacheReadTokens: 0,
+        hasInputTokens: false, hasUncachedInputTokens: false, hasOutputTokens: false,
+        hasTotalTokens: false, hasCacheReadTokens: false,
+      })
       if (!state.active.has(key)) state.active.set(key, [])
       const next = state.pending.shift()
       if (next) {
@@ -114,6 +182,12 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
       }
       return
     }
+    if (event.type === 'assistant/message') {
+      const state = sessionState(sessionId)
+      const key = eventTurnKey(event) || state?.currentTurn
+      if (state && key !== null && key !== undefined) addUsage(state.turnUsage.get(key), event.data?.usage)
+      return
+    }
     if (event.type !== 'turn/end') return
     const state = sessionState(sessionId)
     if (!state) return
@@ -121,10 +195,15 @@ export function createCompletionNotifications({ serviceUrl, fetchImpl = globalTh
     // absent on the end event, close the turn already tracked as current.
     const key = eventTurnKey(event) || state.currentTurn
     const records = key === null ? [] : state.active.get(key) || []
+    const metrics = key === null ? {} : turnMetrics(state, key, now())
     if (key !== null) state.active.delete(key)
+    if (key !== null) {
+      state.turnStartedAt.delete(key)
+      state.turnUsage.delete(key)
+    }
     if (state.currentTurn === key) { state.currentTurn = null; state.currentTurnAt = null }
-    void deliver(sessionId, records).catch(() => log(`completion notification delivery failed for session ${sessionId}`))
-    if (!state.pending.length && !state.active.size && state.currentTurn === null) sessions.delete(sessionId)
+    void deliver(sessionId, records, metrics).catch(() => log(`completion notification delivery failed for session ${sessionId}`))
+    if (!state.pending.length && !state.active.size && state.currentTurn === null && state.taskNameAt === null) sessions.delete(sessionId)
   }
 
   return { register, discard, onSessionEvent, clear() { sessions.clear() } }

package/lib/dsh-host-adapter.mjs

@@ -325,12 +325,6 @@ export function createDshHostAdapter(typertGateway) {
     permissionPresets: {
       catalog: (_payload = {}, signal) => invoke('permissionPresets', 'catalog', {}, signal),
     },
-    // This endpoint intentionally forwards only the ClawBot control DTO. It
-    // stays behind the paired gateway and the ClawBot service's own access
-    // checks; it never exposes the channel credentials to the client.
-    clawbot: {
-      control: (request, signal) => invoke('wechatClawbot', 'control', request, signal),
-    },
     schedule: {
       async catalog(_payload = {}, signal) {
         return { items: requireArray(await invoke('schedule', 'catalog', {}, signal), 'schedule/catalog') }

package/lib/index.mjs

@@ -144,6 +144,7 @@ import { createCompletionNotifications } from './completion-notifications.mjs'
 import { gatewayProbeHeader } from './gateway-probe.mjs'
 import { checkPluginUpdate, installLatestPlugin } from './plugin-updates.mjs'
 import { webRestartAvailable, prepareWebRestart } from './gateway-tools.mjs'
+import { createClawbotService } from './clawbot/service.mjs'
 import QRCode from 'qrcode'
 
 const { createRegistry } = devicesModule
@@ -1378,15 +1379,15 @@ function validClawbotId(value) {
     && !/[\u0000-\u001f]/.test(value)
 }
 
-async function handleClawbotControl(api, msg) {
+async function handleClawbotControl(clawbotService, msg) {
   const type = 'clawbot-control'
   const requestId = typeof msg.requestId === 'string' && msg.requestId.trim().length > 0
     && msg.requestId.length <= 128 ? msg.requestId.trim() : null
   const error = (code, message) => ({ kind: 'error', code, message, requestType: type, ...(requestId ? { requestId } : {}) })
   if (!requestId) return error('bad-request', 'ClawBot control requires a requestId')
   if (!CLAWBOT_ACTIONS.has(msg.action)) return error('bad-request', 'Unsupported ClawBot action')
-  if (typeof api.clawbot?.control !== 'function') {
-    return error('clawbot-unavailable', 'The gateway host adapter does not provide ClawBot control')
+  if (typeof clawbotService?.control !== 'function') {
+    return error('clawbot-unavailable', '网关内置的 ClawBot 服务尚未就绪，请检查网关状态后重试。')
   }
 
   const request = { action: msg.action }
@@ -1430,7 +1431,7 @@ async function handleClawbotControl(api, msg) {
   }
 
   try {
-    const result = await api.clawbot.control(request)
+    const result = await clawbotService.control(request)
     if (!result || typeof result !== 'object' || Array.isArray(result)) {
       return error('clawbot-unavailable', 'ClawBot returned an invalid response')
     }
@@ -1449,13 +1450,13 @@ async function handleClawbotControl(api, msg) {
   } catch (cause) {
     // Do not expose arbitrary host/plugin exception details over the mobile API.
     log(`ClawBot control unavailable: ${cause?.code || 'unknown error'}`)
-    return error('clawbot-unavailable', 'ClawBot is unavailable. Update dsh-wechat-remote and check its component status.')
+    return error('clawbot-unavailable', 'ClawBot 接入暂不可用，请检查网关本地服务状态并刷新重试。')
   }
 }
 
 // Dispatch one mobile query frame; returns the wire frame to send back.
 async function handleQuery(api, host, agentDefaultModel, msg, pluginContext) {
-  if (msg.type === 'clawbot-control') return handleClawbotControl(api, msg)
+  if (msg.type === 'clawbot-control') return handleClawbotControl(pluginContext?.clawbotService, msg)
   if (WORKSPACE_CHANGES_TYPES.has(msg.type)) return handleWorkspaceChanges(api, msg)
   if (PLUGIN_REQUEST_TYPES.has(msg.type)) return handlePluginQuery(api, msg, pluginContext)
   if (msg.type === 'session-agent-preset' || msg.type === 'select-agent-preset') {
@@ -2256,6 +2257,8 @@ const plugin = {
   apply(ctx, config) {
     const webServer = ctx.webServer
     const api = createDshHostAdapter(ctx.typertGateway)
+    const clawbotService = createClawbotService(ctx)
+    ctx.effect(() => () => clawbotService.dispose())
     // Optional lifecycle-bound service: old hosts retain all existing gateway features.
     ctx.inject(['workspaceChanges'], changesCtx => {
       api.workspaceChanges = changesCtx.workspaceChanges
@@ -3238,6 +3241,7 @@ const plugin = {
               handleQuery(api, host, agentDefaultModel, msg, {
                 onInstallStart: (requestId) => pluginInstallOwners.set(requestId, ws),
                 onInstallEnd: (requestId) => pluginInstallOwners.delete(requestId),
+                clawbotService,
               }).then((frame) => {
                 if (frame && ws.readyState === 1) ws.send(stringifyWireFrame(frame))
               })
@@ -3281,7 +3285,7 @@ const plugin = {
               'images',
               'session-create',
               'session-agent-preset',
-              'wechat-clawbot-control-v1',
+              'wechat-clawbot-control-v2',
               'commands',
               'tasks',
               'goals',

package/lib/plugin-updates.mjs

@@ -1,6 +1,37 @@
 export const PLUGIN_PACKAGE_NAME = 'dsh-plugin-weapp-gateway'
 const REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PLUGIN_PACKAGE_NAME}/latest`
 
+function errorField(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : ''
+}
+
+export function formatPluginInstallError(error, depth = 0) {
+  if (typeof error === 'string') return error.trim().slice(0, 1000)
+  if (!error || typeof error !== 'object' || depth > 4) return ''
+
+  const code = errorField(error.code)
+  const message = errorField(error.message)
+    || errorField(error.errorMessage)
+    || errorField(error.detail)
+    || errorField(error.reason)
+    || errorField(error.description)
+  if (message) return `${code && code !== message ? `${code}: ` : ''}${message}`.slice(0, 1000)
+
+  for (const nested of [error.error, error.cause, error.details]) {
+    const detail = formatPluginInstallError(nested, depth + 1)
+    if (detail) return `${code && code !== detail ? `${code}: ` : ''}${detail}`.slice(0, 1000)
+  }
+
+  try {
+    const serialized = JSON.stringify(error, (key, value) => {
+      if (/stack|authorization|cookie|password|secret|token|credential|api.?key/i.test(key)) return undefined
+      return value
+    })
+    if (serialized && serialized !== '{}') return serialized.slice(0, 1000)
+  } catch { /* use a generic message for cyclic or non-serializable errors */ }
+  return code || 'The plugin manager did not provide an error message'
+}
+
 function parseVersion(value) {
   if (typeof value !== 'string') return null
   const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value)
@@ -85,5 +116,12 @@ export async function installLatestPlugin({ api, currentVersion, fetchImpl = glo
     `${PLUGIN_PACKAGE_NAME}@${update.latestVersion}`,
     { requestId },
   )
-  return { ...update, installed: true, installation }
+  const errorMessage = formatPluginInstallError(installation?.error)
+  return {
+    ...update,
+    installed: true,
+    installation: errorMessage && installation && typeof installation === 'object'
+      ? { ...installation, errorMessage }
+      : installation,
+  }
 }