fengming 0.3.7 → 0.3.9

package/skills/skill-creator/scripts/test_package_skill.py

@@ -1,161 +0,0 @@
-#!/usr/bin/env python3
-"""
-Regression tests for skill packaging security behavior.
-"""
-
-import sys
-import tempfile
-import types
-import zipfile
-from pathlib import Path
-from unittest import TestCase, main
-from unittest.mock import patch
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-if str(SCRIPT_DIR) not in sys.path:
-    sys.path.insert(0, str(SCRIPT_DIR))
-
-
-fake_quick_validate = types.ModuleType("quick_validate")
-fake_quick_validate.validate_skill = lambda _path: (True, "Skill is valid!")
-original_quick_validate = sys.modules.get("quick_validate")
-sys.modules["quick_validate"] = fake_quick_validate
-
-import package_skill as package_skill_module
-
-package_skill = package_skill_module.package_skill
-
-if original_quick_validate is not None:
-    sys.modules["quick_validate"] = original_quick_validate
-else:
-    sys.modules.pop("quick_validate", None)
-
-
-class TestPackageSkillSecurity(TestCase):
-    def setUp(self):
-        self.temp_dir = Path(tempfile.mkdtemp(prefix="test_skill_"))
-
-    def tearDown(self):
-        import shutil
-
-        if self.temp_dir.exists():
-            shutil.rmtree(self.temp_dir)
-
-    def create_skill(self, name="test-skill"):
-        skill_dir = self.temp_dir / name
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        (skill_dir / "SKILL.md").write_text("---\nname: test-skill\ndescription: test\n---\n")
-        (skill_dir / "script.py").write_text("print('ok')\n")
-        return skill_dir
-
-    def test_packages_normal_files(self):
-        skill_dir = self.create_skill("normal-skill")
-        out_dir = self.temp_dir / "out"
-        out_dir.mkdir()
-
-        result = package_skill(str(skill_dir), str(out_dir))
-
-        self.assertIsNotNone(result)
-        skill_file = out_dir / "normal-skill.skill"
-        self.assertTrue(skill_file.exists())
-        with zipfile.ZipFile(skill_file, "r") as archive:
-            names = set(archive.namelist())
-        self.assertIn("normal-skill/SKILL.md", names)
-        self.assertIn("normal-skill/script.py", names)
-
-    def test_skips_symlink_to_external_file(self):
-        skill_dir = self.create_skill("symlink-file-skill")
-        outside = self.temp_dir / "outside-secret.txt"
-        outside.write_text("super-secret\n")
-        link = skill_dir / "loot.txt"
-        out_dir = self.temp_dir / "out"
-        out_dir.mkdir()
-
-        try:
-            link.symlink_to(outside)
-        except (OSError, NotImplementedError):
-            self.skipTest("symlink unsupported on this platform")
-
-        result = package_skill(str(skill_dir), str(out_dir))
-        self.assertIsNotNone(result)
-        skill_file = out_dir / "symlink-file-skill.skill"
-        self.assertTrue(skill_file.exists())
-        with zipfile.ZipFile(skill_file, "r") as archive:
-            names = set(archive.namelist())
-        self.assertIn("symlink-file-skill/SKILL.md", names)
-        self.assertIn("symlink-file-skill/script.py", names)
-        self.assertNotIn("symlink-file-skill/loot.txt", names)
-
-    def test_skips_symlink_directory(self):
-        skill_dir = self.create_skill("symlink-dir-skill")
-        outside_dir = self.temp_dir / "outside"
-        outside_dir.mkdir()
-        (outside_dir / "secret.txt").write_text("secret\n")
-        link = skill_dir / "docs"
-        out_dir = self.temp_dir / "out"
-        out_dir.mkdir()
-
-        try:
-            link.symlink_to(outside_dir, target_is_directory=True)
-        except (OSError, NotImplementedError):
-            self.skipTest("symlink unsupported on this platform")
-
-        result = package_skill(str(skill_dir), str(out_dir))
-        self.assertIsNotNone(result)
-        skill_file = out_dir / "symlink-dir-skill.skill"
-        with zipfile.ZipFile(skill_file, "r") as archive:
-            names = set(archive.namelist())
-        self.assertIn("symlink-dir-skill/SKILL.md", names)
-        self.assertIn("symlink-dir-skill/script.py", names)
-        self.assertNotIn("symlink-dir-skill/docs/secret.txt", names)
-
-    def test_rejects_resolved_path_outside_skill_root(self):
-        skill_dir = self.create_skill("escape-skill")
-        out_dir = self.temp_dir / "out"
-        out_dir.mkdir()
-
-        original_within = package_skill_module._is_within
-
-        def fake_is_within(path_obj: Path, root: Path):
-            if path_obj.name == "script.py":
-                return False
-            return original_within(path_obj, root)
-
-        with patch.object(package_skill_module, "_is_within", fake_is_within):
-            result = package_skill(str(skill_dir), str(out_dir))
-
-        self.assertIsNone(result)
-
-    def test_allows_nested_regular_files(self):
-        skill_dir = self.create_skill("nested-skill")
-        nested = skill_dir / "lib" / "helpers"
-        nested.mkdir(parents=True, exist_ok=True)
-        (nested / "util.py").write_text("def run():\n    return 1\n")
-        out_dir = self.temp_dir / "out"
-        out_dir.mkdir()
-
-        result = package_skill(str(skill_dir), str(out_dir))
-
-        self.assertIsNotNone(result)
-        skill_file = out_dir / "nested-skill.skill"
-        with zipfile.ZipFile(skill_file, "r") as archive:
-            names = set(archive.namelist())
-        self.assertIn("nested-skill/lib/helpers/util.py", names)
-
-    def test_skips_output_archive_when_output_dir_is_skill_dir(self):
-        skill_dir = self.create_skill("self-output-skill")
-
-        result = package_skill(str(skill_dir), str(skill_dir))
-
-        self.assertIsNotNone(result)
-        skill_file = skill_dir / "self-output-skill.skill"
-        self.assertTrue(skill_file.exists())
-        with zipfile.ZipFile(skill_file, "r") as archive:
-            names = set(archive.namelist())
-        self.assertIn("self-output-skill/SKILL.md", names)
-        self.assertIn("self-output-skill/script.py", names)
-        self.assertNotIn("self-output-skill/self-output-skill.skill", names)
-
-
-if __name__ == "__main__":
-    main()

package/skills/skill-creator/scripts/test_quick_validate.py

@@ -1,116 +0,0 @@
-#!/usr/bin/env python3
-"""
-Regression tests for quick skill validation.
-"""
-
-import tempfile
-from pathlib import Path
-from unittest import TestCase, main
-
-import quick_validate
-
-
-class TestQuickValidate(TestCase):
-    def setUp(self):
-        self.temp_dir = Path(tempfile.mkdtemp(prefix="test_quick_validate_"))
-
-    def tearDown(self):
-        import shutil
-
-        if self.temp_dir.exists():
-            shutil.rmtree(self.temp_dir)
-
-    def test_accepts_crlf_frontmatter(self):
-        skill_dir = self.temp_dir / "crlf-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = "---\r\nname: crlf-skill\r\ndescription: ok\r\n---\r\n# Skill\r\n"
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertTrue(valid, message)
-
-    def test_rejects_missing_frontmatter_closing_fence(self):
-        skill_dir = self.temp_dir / "bad-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = "---\nname: bad-skill\ndescription: missing end\n# no closing fence\n"
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertFalse(valid)
-        self.assertEqual(message, "Invalid frontmatter format")
-
-    def test_fallback_parser_handles_multiline_frontmatter_without_pyyaml(self):
-        skill_dir = self.temp_dir / "multiline-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = """---
-name: multiline-skill
-description: Works without pyyaml
-allowed-tools:
-  - gh
-metadata: |
-  {
-    "owners": ["team-openclaw"]
-  }
----
-# Skill
-"""
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        previous_yaml = quick_validate.yaml
-        quick_validate.yaml = None
-        try:
-            valid, message = quick_validate.validate_skill(skill_dir)
-        finally:
-            quick_validate.yaml = previous_yaml
-
-        self.assertTrue(valid, message)
-
-    def test_rejects_empty_name(self):
-        skill_dir = self.temp_dir / "empty-name-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = '---\nname: ""\ndescription: a valid description\n---\n# Skill\n'
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertFalse(valid)
-        self.assertEqual(message, "Name must not be empty")
-
-    def test_rejects_whitespace_only_name(self):
-        skill_dir = self.temp_dir / "ws-name-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = "---\nname: '   '\ndescription: a valid description\n---\n# Skill\n"
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertFalse(valid)
-        self.assertEqual(message, "Name must not be empty")
-
-    def test_rejects_empty_description(self):
-        skill_dir = self.temp_dir / "empty-desc-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = '---\nname: valid-skill\ndescription: ""\n---\n# Skill\n'
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertFalse(valid)
-        self.assertEqual(message, "Description must not be empty")
-
-    def test_rejects_whitespace_only_description(self):
-        skill_dir = self.temp_dir / "ws-desc-skill"
-        skill_dir.mkdir(parents=True, exist_ok=True)
-        content = "---\nname: valid-skill\ndescription: '   '\n---\n# Skill\n"
-        (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
-
-        valid, message = quick_validate.validate_skill(skill_dir)
-
-        self.assertFalse(valid)
-        self.assertEqual(message, "Description must not be empty")
-
-
-if __name__ == "__main__":
-    main()

package/skills/spike/SKILL.md

@@ -1,51 +0,0 @@
----
-name: spike
-description: Run throwaway prototypes to validate feasibility, compare approaches, and report a verdict.
-metadata: { "fengming": { "emoji": "🧪" } }
----
-
-# Spike
-
-Use when the user wants to test an idea before committing to a real build: "spike this", "quick prototype", "is this possible", "compare A/B", "before we build".
-
-Do not use when reading docs/code can answer the question, or when the user clearly asked for production implementation.
-
-Loop
-
-1. Question: state the concrete feasibility question.
-2. Research: read enough docs/source to choose credible approach.
-3. Build: create the smallest runnable artifact that validates or invalidates the idea.
-4. Stress: try one edge case or failure mode.
-5. Verdict: `VALIDATED`, `PARTIAL`, or `INVALIDATED`.
-
-Output shape
-
-- Default workspace: `.tmp/fengming-spikes/<slug>` unless user asks for a tracked repo-local path.
-- Repo-local option: `spikes/<NNN-slug>/` with `README.md` and minimal code.
-- Prefer runnable CLI, tiny HTML, one endpoint, or focused test.
-- Avoid package sprawl, Docker, env files, app frameworks, and production cleanup.
-
-Multi-spike ideas
-
-- Split into 2-5 independent questions.
-- Run the riskiest question first.
-- For A/B comparisons, keep inputs equal and measure the same dimensions.
-- Ask before building all variants if the work is more than a small prototype.
-
-Verdict format
-
-```markdown
-## Verdict: VALIDATED | PARTIAL | INVALIDATED
-
-Question: ...
-Evidence: exact command/output/measurement.
-What worked: ...
-What failed or surprised us: ...
-Recommendation: ship / adjust / avoid, with the next production step.
-```
-
-Rules
-
-- An invalidated spike is useful when it rules out a path with evidence.
-- Do not merge spike code into production without rewriting it normally.
-- If external dependencies are evaluated, check health: recent release/commit, docs, license, install friction.

package/skills/summarize/SKILL.md

@@ -1,87 +0,0 @@
----
-name: summarize
-description: "Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files."
-homepage: https://summarize.sh
-metadata:
-  {
-    "fengming":
-      {
-        "emoji": "🧾",
-        "requires": { "bins": ["summarize"] },
-        "install":
-          [
-            {
-              "id": "brew",
-              "kind": "brew",
-              "formula": "steipete/tap/summarize",
-              "bins": ["summarize"],
-              "label": "Install summarize (brew)",
-            },
-          ],
-      },
-  }
----
-
-# Summarize
-
-Fast CLI to summarize URLs, local files, and YouTube links.
-
-## When to use (trigger phrases)
-
-Use this skill immediately when the user asks any of:
-
-- "use summarize.sh"
-- "what's this link/video about?"
-- "summarize this URL/article"
-- "transcribe this YouTube/video" (best-effort transcript extraction; no `yt-dlp` needed)
-
-## Quick start
-
-```bash
-summarize "https://example.com"
-summarize "/path/to/file.pdf"
-summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto
-```
-
-## YouTube: summary vs transcript
-
-Best-effort transcript (URLs only):
-
-```bash
-summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto --extract
-```
-
-If the user asked for a transcript but it's huge, return a tight summary first, then ask which section/time range to expand.
-
-## Model + keys
-
-Set the API key for your chosen provider:
-
-- OpenAI: `OPENAI_API_KEY`
-- Anthropic: `ANTHROPIC_API_KEY`
-- xAI: `XAI_API_KEY`
-- Google: `GEMINI_API_KEY` (aliases: `GOOGLE_GENERATIVE_AI_API_KEY`, `GOOGLE_API_KEY`)
-
-Default model is `auto`; config may choose the provider/model.
-
-## Useful flags
-
-- `--length short|medium|long|xl|xxl|<chars>`
-- `--max-output-tokens <count>`
-- `--extract` (print extracted content, no LLM summary)
-- `--json` (machine readable)
-- `--firecrawl auto|off|always` (fallback extraction)
-- `--youtube auto` (Apify fallback if `APIFY_API_TOKEN` set)
-
-## Config
-
-Optional config file: `~/.summarize/config.json`
-
-```json
-{ "model": "openai/gpt-5.2" }
-```
-
-Optional services:
-
-- `FIRECRAWL_API_KEY` for blocked sites
-- `APIFY_API_TOKEN` for YouTube fallback

package/skills/taskflow/SKILL.md

@@ -1,149 +0,0 @@
----
-name: taskflow
-description: "Coordinate multi-step detached tasks as one durable TaskFlow job with owner context, state, waits, and child tasks."
-metadata: { "fengming": { "emoji": "🪝" } }
----
-
-# TaskFlow
-
-Use TaskFlow when a job needs to outlive one prompt or one detached run, but you still want one owner session, one return context, and one place to inspect or resume the work.
-
-## When to use it
-
-- Multi-step background work with one owner
-- Work that waits on detached ACP or subagent tasks
-- Jobs that may need to emit one clear update back to the owner
-- Jobs that need small persisted state between steps
-- Plugin or tool work that must survive restarts and revision conflicts cleanly
-
-## What TaskFlow owns
-
-- flow identity
-- owner session and requester origin
-- `currentStep`, `stateJson`, and `waitJson`
-- linked child tasks and their parent flow id
-- finish, fail, cancel, waiting, and blocked state
-- revision tracking for conflict-safe mutations
-
-It does **not** own branching or business logic. Put that in Lobster, acpx, or the calling code.
-
-## Current runtime shape
-
-Canonical plugin/runtime entrypoint:
-
-- `api.runtime.tasks.flow`
-- `api.runtime.taskFlow` still exists as an alias, but `api.runtime.tasks.flow` is the canonical shape
-
-Binding:
-
-- `api.runtime.tasks.flow.fromToolContext(ctx)` when you already have trusted tool context with `sessionKey`
-- `api.runtime.tasks.flow.bindSession({ sessionKey, requesterOrigin })` when your binding layer already resolved the session and delivery context
-
-Managed-flow lifecycle:
-
-1. `createManaged(...)`
-2. `runTask(...)`
-3. `setWaiting(...)` when waiting on a person or an external system
-4. `resume(...)` when work can continue
-5. `finish(...)` or `fail(...)`
-6. `requestCancel(...)` or `cancel(...)` when the whole job should stop
-
-## Design constraints
-
-- Use **managed** TaskFlows when your code owns the orchestration.
-- One-task **mirrored** flows are created by core runtime for detached ACP/subagent work; this skill is mainly about managed flows.
-- Treat `stateJson` as the persisted state bag. There is no separate `setFlowOutput` or `appendFlowOutput` API.
-- Every mutating method after creation is revision-checked. Carry forward the latest `flow.revision` after each successful mutation.
-- `runTask(...)` links the child task to the flow. Use it instead of manually creating detached tasks when you want parent orchestration.
-
-## Example shape
-
-```ts
-const taskFlow = api.runtime.tasks.flow.fromToolContext(ctx);
-
-const created = taskFlow.createManaged({
-  controllerId: "my-plugin/inbox-triage",
-  goal: "triage inbox",
-  currentStep: "classify",
-  stateJson: {
-    businessThreads: [],
-    personalItems: [],
-    eodSummary: [],
-  },
-});
-
-const classify = taskFlow.runTask({
-  flowId: created.flowId,
-  runtime: "acp",
-  childSessionKey: "agent:main:subagent:classifier",
-  runId: "inbox-classify-1",
-  task: "Classify inbox messages",
-  status: "running",
-  startedAt: Date.now(),
-  lastEventAt: Date.now(),
-});
-
-if (!classify.created) {
-  throw new Error(classify.reason);
-}
-
-const waiting = taskFlow.setWaiting({
-  flowId: created.flowId,
-  expectedRevision: created.revision,
-  currentStep: "await_business_reply",
-  stateJson: {
-    businessThreads: ["slack:thread-1"],
-    personalItems: [],
-    eodSummary: [],
-  },
-  waitJson: {
-    kind: "reply",
-    channel: "slack",
-    threadKey: "slack:thread-1",
-  },
-});
-
-if (!waiting.applied) {
-  throw new Error(waiting.code);
-}
-
-const resumed = taskFlow.resume({
-  flowId: waiting.flow.flowId,
-  expectedRevision: waiting.flow.revision,
-  status: "running",
-  currentStep: "finalize",
-  stateJson: waiting.flow.stateJson,
-});
-
-if (!resumed.applied) {
-  throw new Error(resumed.code);
-}
-
-taskFlow.finish({
-  flowId: resumed.flow.flowId,
-  expectedRevision: resumed.flow.revision,
-  stateJson: resumed.flow.stateJson,
-});
-```
-
-## Keep conditionals above the runtime
-
-Use the flow runtime for state and task linkage. Keep decisions in the authoring layer:
-
-- `business` -> post to Slack and wait
-- `personal` -> notify the owner now
-- `later` -> append to an end-of-day summary bucket
-
-## Operational pattern
-
-- Store only the minimum state needed to resume.
-- Put human-readable wait reasons in `blockedSummary` or structured wait metadata in `waitJson`.
-- Use `getTaskSummary(flowId)` when the orchestrator needs a compact health view of child work.
-- Use `requestCancel(...)` when a caller wants the flow to stop scheduling immediately.
-- Use `cancel(...)` when you also want active linked child tasks cancelled.
-
-## Examples
-
-- See `skills/taskflow/examples/inbox-triage.lobster`
-- See `skills/taskflow/examples/pr-intake.lobster`
-- See `skills/taskflow-inbox-triage/SKILL.md` for a concrete routing pattern

package/skills/taskflow/examples/inbox-triage.lobster

@@ -1,33 +0,0 @@
-# Illustrative Lobster authoring example for a TaskFlow-style inbox triage job.
-# Swap the placeholder commands for your own tools or scripts.
-
-name: inbox-triage
-steps:
-  - id: fetch
-    command: gog.gmail.search --query 'newer_than:1d' --max 20
-
-  - id: classify
-    command: >-
-      openclaw.invoke --tool llm-task --action json --args-json
-      '{"prompt":"Classify each inbox item as business, personal, or later. Return one JSON object per item with route and summary.","thinking":"low","schema":{"type":"object","properties":{"items":{"type":"array"}},"required":["items"],"additionalProperties":false}}'
-    stdin: $fetch.stdout
-
-  - id: post_business
-    command: slack-route --bucket business
-    stdin: $classify.stdout
-    condition: $classify.json.items[0].route == "business"
-
-  - id: wait_for_business_reply
-    command: echo '{"status":"waiting","reason":"slack_reply"}'
-    condition: $classify.json.items[0].route == "business"
-
-  - id: notify_personal
-    command: >-
-      openclaw.invoke --tool message --action send --args-json
-      '{"provider":"telegram","to":"owner-thread","content":"Personal inbox item needs attention."}'
-    condition: $classify.json.items[0].route == "personal"
-
-  - id: stash_for_eod
-    command: summary-append --bucket eod
-    stdin: $classify.stdout
-    condition: $classify.json.items[0].route == "later"

package/skills/taskflow/examples/pr-intake.lobster

@@ -1,32 +0,0 @@
-# Illustrative Lobster authoring example for a TaskFlow-style PR intake lane.
-# Replace the placeholder commands with repo-specific tooling.
-
-name: pr-intake
-steps:
-  - id: fetch
-    command: gh pr list --repo owner/repo --state open --json number,title,body,headRefName
-
-  - id: classify
-    command: >-
-      openclaw.invoke --tool llm-task --action json --args-json
-      '{"prompt":"Classify each PR as close, request_changes, refactor, or maintainer_review. Return intent and recommended next action.","thinking":"low","schema":{"type":"object","properties":{"items":{"type":"array"}},"required":["items"],"additionalProperties":false}}'
-    stdin: $fetch.stdout
-
-  - id: close_low_signal
-    command: pr-close-low-signal
-    stdin: $classify.stdout
-    condition: $classify.json.items[0].nextAction == "close"
-
-  - id: request_changes
-    command: pr-request-changes
-    stdin: $classify.stdout
-    condition: $classify.json.items[0].nextAction == "request_changes"
-
-  - id: refactor_branch
-    command: pr-refactor-branch
-    stdin: $classify.stdout
-    condition: $classify.json.items[0].nextAction == "refactor"
-
-  - id: escalate
-    command: echo '{"status":"notify","target":"maintainer"}'
-    condition: $classify.json.items[0].nextAction == "maintainer_review"