jishushell 0.6.5 → 0.7.3

package/dist/services/integrations/jishukb/integration.d.ts

@@ -0,0 +1,24 @@
+import type { AppIntegration, AppIntegrationHooks, AppIntegrationManifest, CapabilityProfile, InstanceConfigMeta, ConfigDocument, PairingApproveInput, RuntimeSpec, RuntimeVersionInfo } from "../types.js";
+import type { RuntimeContribution } from "../../runtime/workload-types.js";
+export declare function ensureDefaultKb(baseUrl: string, authToken?: string): Promise<void>;
+declare class JishuKbIntegration implements AppIntegration {
+    readonly kind: "jishukb";
+    readonly displayName = "JishuShell KB";
+    readonly defaultCapabilities: CapabilityProfile;
+    readonly preferredHostPort = 18095;
+    readonly nomadJobPrefix = "";
+    readonly nomadTaskName = "jishukb";
+    readonly manifest: AppIntegrationManifest;
+    readonly hooks: AppIntegrationHooks;
+    buildRuntime(instanceId: string): Promise<RuntimeSpec>;
+    getPersistedRuntimeSpec(instanceId: string): Promise<RuntimeSpec>;
+    getRuntimeVersion(_instanceId: string): Promise<RuntimeVersionInfo>;
+    buildRuntimeContribution(instanceId: string): Promise<RuntimeContribution>;
+    getConfigMeta(_instanceId: string): Promise<InstanceConfigMeta>;
+    readConfig(_instanceId: string): Promise<ConfigDocument>;
+    writeConfig(_instanceId: string, _doc: ConfigDocument): Promise<ConfigDocument>;
+    buildPairingListCommand(_instanceId: string): Promise<string[]>;
+    buildPairingApproveCommand(_instanceId: string, _input: PairingApproveInput): Promise<string[]>;
+}
+export declare const jishuKbIntegration: JishuKbIntegration;
+export {};

package/dist/services/integrations/jishukb/integration.js

@@ -0,0 +1,300 @@
+import { randomBytes } from "crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { JISHUSHELL_HOME } from "../../../config.js";
+import { getHostForAppPort, getInstance, getPrimaryHostPort, parseEnvFile, updateInstanceMeta, updateEnvFile, urlHost, } from "../../instances/manager.js";
+import { buildCanonicalRuntimeFromSpec } from "../../app-common/runtime-facts.js";
+import { readCanonicalSpecForInstance } from "../../app-common/instance-store.js";
+import { resolveAppDir } from "../../app-common/paths.js";
+import { registerIntegration } from "../registry.js";
+const JISHUKB_IMAGE = "ghcr.io/x-aijishu/jishu-kb:0.1.2";
+const JISHUKB_FRAME_ANCESTORS = "*";
+const JISHUKB_PROVIDER_ID = "jishu-kb-container";
+const DEFAULT_KB_ID = "default";
+const REMOTE_MCP_SECRET_ENV_FILENAME = "secret.env";
+const REMOTE_MCP_AUTH_ENV = "JISHU_KB_AUTH_TOKEN";
+const REMOTE_MCP_TEMPLATE_DEST = "secrets/jishukb.env";
+const DEFAULT_CAPABILITIES = {
+    ui: { http: true, websocket: false, chatPanel: "none" },
+    pairing: { list: false, approve: false, revoke: false, clearPending: false },
+    configEditor: "custom",
+    configSchema: false,
+    customProvider: false,
+    pluginInstall: false,
+    skills: false,
+    mcp: false,
+    memory: false,
+    backupRestore: false,
+    usageStats: true,
+    restartlessReload: false,
+    messagingPlatforms: [],
+};
+function dataDir(instanceId) {
+    return join(resolveAppDir(instanceId), "data");
+}
+function providerCredentialsFile() {
+    return join(JISHUSHELL_HOME, "provider-credentials", JISHUKB_PROVIDER_ID, "credentials.json");
+}
+function remoteMcpSecretEnvFile(instanceId) {
+    return join(resolveAppDir(instanceId), REMOTE_MCP_SECRET_ENV_FILENAME);
+}
+function ensurePrivateDirs(instanceId) {
+    mkdirSync(dataDir(instanceId), { recursive: true });
+    mkdirSync(dirname(providerCredentialsFile()), { recursive: true });
+}
+function getRuntimeSpec(instanceId) {
+    const spec = readCanonicalSpecForInstance(instanceId);
+    if (!spec) {
+        throw new Error(`Jishu KB instance '${instanceId}' is missing its resolved AppSpec`);
+    }
+    return buildCanonicalRuntimeFromSpec(spec, instanceId);
+}
+function patchRuntimeFrameAncestors(instanceId) {
+    const meta = getInstance(instanceId);
+    const runtime = meta?.runtime && typeof meta.runtime === "object"
+        ? { ...meta.runtime }
+        : {};
+    const env = runtime.env && typeof runtime.env === "object"
+        ? { ...runtime.env }
+        : {};
+    if (!env.JISHU_KB_FRAME_ANCESTORS || env.JISHU_KB_FRAME_ANCESTORS === "'self'") {
+        env.JISHU_KB_FRAME_ANCESTORS = JISHUKB_FRAME_ANCESTORS;
+        updateInstanceMeta(instanceId, { runtime: { ...runtime, env } });
+    }
+}
+function ensureRuntimeEnvFile(runtime, envFile) {
+    if (Array.isArray(runtime.env_files)) {
+        if (runtime.env_files.includes(envFile))
+            return false;
+        runtime.env_files = [envFile, ...runtime.env_files];
+        return true;
+    }
+    if (Array.isArray(runtime.envFiles)) {
+        if (runtime.envFiles.includes(envFile))
+            return false;
+        runtime.envFiles = [envFile, ...runtime.envFiles];
+        return true;
+    }
+    runtime.envFiles = [envFile];
+    return true;
+}
+function remoteMcpRuntimeEnv() {
+    return {
+        JISHU_KB_MCP_HTTP: "1",
+        JISHU_KB_MCP_ENDPOINT: "/mcp",
+        JISHU_KB_MCP_PROFILE: "openclaw",
+        JISHU_KB_MCP_PATH_UPLOAD: "0",
+        JISHU_KB_MCP_MAX_UPLOAD_BYTES: String(30 * 1024 * 1024),
+        JISHU_KB_MCP_MAX_RAW_CHARS: "12000",
+    };
+}
+function ensureRemoteMcpRuntime(instanceId) {
+    ensurePrivateDirs(instanceId);
+    const meta = getInstance(instanceId);
+    const runtime = meta?.runtime && typeof meta.runtime === "object"
+        ? { ...meta.runtime }
+        : {};
+    const env = runtime.env && typeof runtime.env === "object"
+        ? { ...runtime.env }
+        : {};
+    const secretEnv = remoteMcpSecretEnvFile(instanceId);
+    const existingSecret = parseEnvFile(secretEnv);
+    const migratedEnvToken = typeof env[REMOTE_MCP_AUTH_ENV] === "string"
+        ? env[REMOTE_MCP_AUTH_ENV].trim()
+        : "";
+    const token = existingSecret[REMOTE_MCP_AUTH_ENV]?.trim()
+        || migratedEnvToken
+        || randomBytes(32).toString("base64url");
+    updateEnvFile(secretEnv, { [REMOTE_MCP_AUTH_ENV]: token });
+    try {
+        chmodSync(secretEnv, 0o600);
+    }
+    catch { /* best effort; updateEnvFile already writes secret mode */ }
+    let changed = false;
+    const setEnv = (key, value) => {
+        if (env[key] !== value) {
+            env[key] = value;
+            changed = true;
+        }
+    };
+    for (const [key, value] of Object.entries(remoteMcpRuntimeEnv())) {
+        setEnv(key, value);
+    }
+    if (REMOTE_MCP_AUTH_ENV in env) {
+        delete env[REMOTE_MCP_AUTH_ENV];
+        changed = true;
+    }
+    runtime.env = env;
+    if (ensureRuntimeEnvFile(runtime, secretEnv)) {
+        changed = true;
+    }
+    if (changed) {
+        updateInstanceMeta(instanceId, { runtime });
+    }
+    return token;
+}
+async function baseUrlForInstance(instanceId) {
+    const port = getPrimaryHostPort(instanceId);
+    const host = await getHostForAppPort(instanceId, port);
+    return `http://${urlHost(host)}:${port}`;
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function waitForHealth(resolveBaseUrl) {
+    let lastError = "";
+    for (let attempt = 1; attempt <= 60; attempt += 1) {
+        const baseUrl = await resolveBaseUrl();
+        try {
+            const response = await fetch(`${baseUrl}/health`, { signal: AbortSignal.timeout(5_000) });
+            if (response.ok)
+                return baseUrl;
+            lastError = `HTTP ${response.status}`;
+        }
+        catch (error) {
+            lastError = error?.message ?? String(error);
+        }
+        await sleep(2_000);
+    }
+    throw new Error(`Jishu KB health check did not become ready: ${lastError || "timeout"}`);
+}
+async function readResponsePreview(response) {
+    return (await response.text()).slice(0, 400);
+}
+function httpErrorDetail(response, detail) {
+    return `HTTP ${response.status}${detail ? `: ${detail}` : ""}`;
+}
+function bearerHeaders(authToken) {
+    const token = authToken.trim();
+    return token ? { authorization: `Bearer ${token}` } : {};
+}
+export async function ensureDefaultKb(baseUrl, authToken = "") {
+    const response = await fetch(`${baseUrl}/api/kb`, {
+        method: "POST",
+        headers: { "content-type": "application/json", ...bearerHeaders(authToken) },
+        body: JSON.stringify({ id: DEFAULT_KB_ID, name: "默认知识库" }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    const createDetail = response.ok ? "" : await readResponsePreview(response);
+    if (response.status >= 500) {
+        throw new Error(`Jishu KB default KB create failed: ${httpErrorDetail(response, createDetail)}`);
+    }
+    const verifyResponse = await fetch(`${baseUrl}/api/kb/${encodeURIComponent(DEFAULT_KB_ID)}/documents`, {
+        headers: { accept: "application/json", ...bearerHeaders(authToken) },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (verifyResponse.ok)
+        return;
+    const verifyDetail = await readResponsePreview(verifyResponse);
+    const createSummary = response.ok
+        ? "create succeeded"
+        : `create returned ${httpErrorDetail(response, createDetail)}`;
+    throw new Error(`Jishu KB default KB '${DEFAULT_KB_ID}' is not usable after startup: ` +
+        `${createSummary}; documents endpoint returned ${httpErrorDetail(verifyResponse, verifyDetail)}`);
+}
+function writeProviderCredentials(instanceId, baseUrl, token = "") {
+    const path = providerCredentialsFile();
+    const mcpAuthToken = token || ensureRemoteMcpRuntime(instanceId);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({
+        baseUrl,
+        kbId: DEFAULT_KB_ID,
+        dataDir: dataDir(instanceId),
+        mcpAuthToken,
+    }, null, 2) + "\n", { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+class JishuKbIntegration {
+    kind = "jishukb";
+    displayName = "JishuShell KB";
+    defaultCapabilities = DEFAULT_CAPABILITIES;
+    preferredHostPort = 18095;
+    nomadJobPrefix = "";
+    nomadTaskName = "jishukb";
+    manifest = {
+        kind: "jishukb",
+        displayName: "JishuShell KB",
+        description: "JishuShell knowledge-base service",
+        defaultCapabilities: DEFAULT_CAPABILITIES,
+        catalogGroup: "apps",
+        catalogIcon: "knowledge",
+        defaultTab: "web-ui",
+        supportsClone: false,
+        connectionRole: "app",
+        defaultConnectionApplyMode: "openai-env",
+        requiredForSetupReady: false,
+    };
+    hooks = {
+        onCreatePrepare: async ({ instanceId }) => {
+            ensurePrivateDirs(instanceId);
+            return {
+                instanceDir: resolveAppDir(instanceId),
+                integrationHome: resolveAppDir(instanceId),
+            };
+        },
+        onBeforeStart: async ({ instanceId }) => {
+            ensurePrivateDirs(instanceId);
+            patchRuntimeFrameAncestors(instanceId);
+            ensureRemoteMcpRuntime(instanceId);
+        },
+        onAfterStart: async ({ instanceId }) => {
+            const baseUrl = await waitForHealth(() => baseUrlForInstance(instanceId));
+            const token = ensureRemoteMcpRuntime(instanceId);
+            await ensureDefaultKb(baseUrl, token);
+            writeProviderCredentials(instanceId, baseUrl, token);
+        },
+    };
+    async buildRuntime(instanceId) {
+        return getRuntimeSpec(instanceId);
+    }
+    async getPersistedRuntimeSpec(instanceId) {
+        const meta = getInstance(instanceId);
+        const runtime = meta?.runtime;
+        if (!runtime || typeof runtime !== "object") {
+            throw new Error(`Jishu KB instance '${instanceId}' has no runtime configuration`);
+        }
+        return runtime;
+    }
+    async getRuntimeVersion(_instanceId) {
+        return { integrationKind: "jishukb", ref: JISHUKB_IMAGE, mode: "baseline" };
+    }
+    async buildRuntimeContribution(instanceId) {
+        const secretEnv = remoteMcpSecretEnvFile(instanceId);
+        ensureRemoteMcpRuntime(instanceId);
+        const templates = [];
+        if (existsSync(secretEnv)) {
+            templates.push({
+                DestPath: REMOTE_MCP_TEMPLATE_DEST,
+                Envvars: true,
+                EmbeddedTmpl: readFileSync(secretEnv, "utf-8"),
+                ChangeMode: "restart",
+            });
+        }
+        return {
+            tasks: {
+                [this.nomadTaskName]: {
+                    env: remoteMcpRuntimeEnv(),
+                    ...(templates.length > 0 ? { templates } : {}),
+                },
+            },
+        };
+    }
+    async getConfigMeta(_instanceId) {
+        throw new Error("Jishu KB does not expose a Core-managed config editor");
+    }
+    async readConfig(_instanceId) {
+        throw new Error("Jishu KB does not expose a Core-managed config editor");
+    }
+    async writeConfig(_instanceId, _doc) {
+        throw new Error("Jishu KB does not expose a Core-managed config editor");
+    }
+    async buildPairingListCommand(_instanceId) {
+        return [];
+    }
+    async buildPairingApproveCommand(_instanceId, _input) {
+        return [];
+    }
+}
+export const jishuKbIntegration = new JishuKbIntegration();
+registerIntegration(jishuKbIntegration);
+//# sourceMappingURL=integration.js.map

package/dist/services/integrations/jishukb/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../../../src/services/integrations/jishukb/integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,OAAO,GACR,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAY1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,8BAA8B,GAAG,YAAY,CAAC;AACpD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD,MAAM,oBAAoB,GAAsB;IAC9C,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;IACvD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE;IAC5E,YAAY,EAAE,QAAQ;IACtB,YAAY,EAAE,KAAK;IACnB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,KAAK;IACpB,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,KAAK;IACb,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,IAAI;IAChB,iBAAiB,EAAE,KAAK;IACxB,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,CAAC,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB;IAChD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,8BAA8B,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,IAAI,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sBAAsB,UAAU,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,6BAA6B,CAAC,IAAI,EAAE,UAAU,CAAgB,CAAC;AACxE,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAA+B,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC/D,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QACxD,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,wBAAwB,KAAK,QAAQ,EAAE,CAAC;QAC/E,GAAG,CAAC,wBAAwB,GAAG,uBAAuB,CAAC;QACvD,kBAAkB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4B,EAAE,OAAe;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO;QACL,iBAAiB,EAAE,GAAG;QACtB,qBAAqB,EAAE,MAAM;QAC7B,oBAAoB,EAAE,UAAU;QAChC,wBAAwB,EAAE,GAAG;QAC7B,6BAA6B,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACvD,0BAA0B,EAAE,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB;IAChD,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAA+B,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC/D,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,OAA+B,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QACxD,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QACnE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,cAAc,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE;WACpD,gBAAgB;WAChB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3C,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IAE1G,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,mBAAmB,IAAI,GAAG,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAClB,IAAI,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,cAAqC;IAChE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAChC,SAAS,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,SAAS,GAAG,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB;IACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,QAAkB,EAAE,MAAc;IACzD,OAAO,QAAQ,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,SAAS,GAAG,EAAE;IACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,EAAE;QAC5E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,kBAAkB,CAAC,aAAa,CAAC,YAAY,EAAE;QACrG,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,EAAE;QACpE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,EAAE;QAAE,OAAO;IAE9B,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE;QAC/B,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,mBAAmB,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,KAAK,CACb,wBAAwB,aAAa,iCAAiC;QACtE,GAAG,aAAa,iCAAiC,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB,EAAE,OAAe,EAAE,KAAK,GAAG,EAAE;IAC/E,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,KAAK,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC;QACb,OAAO;QACP,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC;QAC5B,YAAY;KACb,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAClB,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,kBAAkB;IACb,IAAI,GAAG,SAAkB,CAAC;IAC1B,WAAW,GAAG,eAAe,CAAC;IAC9B,mBAAmB,GAAG,oBAAoB,CAAC;IAC3C,iBAAiB,GAAG,KAAK,CAAC;IAC1B,cAAc,GAAG,EAAE,CAAC;IACpB,aAAa,GAAG,SAAS,CAAC;IAC1B,QAAQ,GAA2B;QAC1C,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,mCAAmC;QAChD,mBAAmB,EAAE,oBAAoB;QACzC,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,0BAA0B,EAAE,YAAY;QACxC,qBAAqB,EAAE,KAAK;KAC7B,CAAC;IAEO,KAAK,GAAwB;QACpC,eAAe,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACxC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC9B,OAAO;gBACL,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC;gBACtC,eAAe,EAAE,aAAa,CAAC,UAAU,CAAC;aAC3C,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACtC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC9B,0BAA0B,CAAC,UAAU,CAAC,CAAC;YACvC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,wBAAwB,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;IAEF,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,UAAkB;QAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAA+B,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sBAAsB,UAAU,gCAAgC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,OAAsB,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,UAAkB;QAC/C,MAAM,SAAS,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACrD,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEnC,MAAM,SAAS,GAAmC,EAAE,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,wBAAwB;gBAClC,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;gBAC9C,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE;gBACL,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;oBACpB,GAAG,EAAE,mBAAmB,EAAE;oBAC1B,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,IAAoB;QACzD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,WAAmB,EAAE,MAA2B;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAC3D,mBAAmB,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/services/integrations/openclaw/anythingllm-shim.d.ts

@@ -0,0 +1,46 @@
+/**
+ * AnythingLLM MCP shim — exposes the user's installed AnythingLLM
+ * workspace as a single `kb_search(query)` MCP tool to the agent
+ * inside the OpenClaw container.
+ *
+ * Why a shim, not direct MCP:
+ *   AnythingLLM speaks HTTP REST (`/api/v1/workspace/{slug}/chat`),
+ *   not MCP. The shim translates one MCP tool call into one
+ *   workspace-chat HTTP call and packages the textResponse + sources
+ *   array as a text content block for the agent.
+ *
+ * Wiring: the OpenClaw integration writes this shim into
+ * `__mcp_shims__/anythingllm/anythingllm-shim.js` per instance and
+ * registers it in mcporter.json under the `kb` server name.
+ * Non-secret config (baseUrl + workspace) is baked into the source by
+ * `substituteAnythingllmShimPlaceholders` because OpenClaw scrubs
+ * env when spawning MCP subprocesses (verified via the drive shim
+ * regression on pi2 2026-05-11). The API key is NOT baked into the
+ * source — it lives in a sibling `secret.json` file written with
+ * mode 0o600 so the readable-to-world shim source stays free of
+ * secrets and mcporter.json (mode 0o644) does too. Env fallbacks are
+ * kept only for hand-running during development.
+ *
+ * Stdio framing: NDJSON JSON-RPC 2.0 (MCP standard). Pure Node
+ * builtins, no npm install needed inside the runtime image.
+ */
+export declare const ANYTHINGLLM_MCP_SHIM_VERSION = "0.2.0";
+/** Filename for the sibling 0o600 secret file (path resolved at runtime). */
+export declare const ANYTHINGLLM_SHIM_SECRET_FILENAME = "secret.json";
+export declare const ANYTHINGLLM_MCP_SHIM_SOURCE: string;
+/**
+ * Substitute baked-in NON-SECRET values into the shim source.
+ * Same pattern as substituteDriveShimPlaceholders — done at install
+ * time because OpenClaw scrubs env on MCP subprocess spawn, so the
+ * env-fallback inside the template is unreliable in production.
+ *
+ * The API key is intentionally NOT baked in. Write it to a sibling
+ * file named `ANYTHINGLLM_SHIM_SECRET_FILENAME` (mode 0o600) and the
+ * shim will load it at startup.
+ *
+ * Placeholders use `__JS_*__` so they grep cleanly.
+ */
+export declare function substituteAnythingllmShimPlaceholders(params: {
+    baseUrl: string;
+    workspace: string;
+}): string;

package/dist/services/integrations/openclaw/anythingllm-shim.js

@@ -0,0 +1,281 @@
+/**
+ * AnythingLLM MCP shim — exposes the user's installed AnythingLLM
+ * workspace as a single `kb_search(query)` MCP tool to the agent
+ * inside the OpenClaw container.
+ *
+ * Why a shim, not direct MCP:
+ *   AnythingLLM speaks HTTP REST (`/api/v1/workspace/{slug}/chat`),
+ *   not MCP. The shim translates one MCP tool call into one
+ *   workspace-chat HTTP call and packages the textResponse + sources
+ *   array as a text content block for the agent.
+ *
+ * Wiring: the OpenClaw integration writes this shim into
+ * `__mcp_shims__/anythingllm/anythingllm-shim.js` per instance and
+ * registers it in mcporter.json under the `kb` server name.
+ * Non-secret config (baseUrl + workspace) is baked into the source by
+ * `substituteAnythingllmShimPlaceholders` because OpenClaw scrubs
+ * env when spawning MCP subprocesses (verified via the drive shim
+ * regression on pi2 2026-05-11). The API key is NOT baked into the
+ * source — it lives in a sibling `secret.json` file written with
+ * mode 0o600 so the readable-to-world shim source stays free of
+ * secrets and mcporter.json (mode 0o644) does too. Env fallbacks are
+ * kept only for hand-running during development.
+ *
+ * Stdio framing: NDJSON JSON-RPC 2.0 (MCP standard). Pure Node
+ * builtins, no npm install needed inside the runtime image.
+ */
+export const ANYTHINGLLM_MCP_SHIM_VERSION = "0.2.0";
+/** Filename for the sibling 0o600 secret file (path resolved at runtime). */
+export const ANYTHINGLLM_SHIM_SECRET_FILENAME = "secret.json";
+export const ANYTHINGLLM_MCP_SHIM_SOURCE = `#!/usr/bin/env node
+// jishushell-anythingllm-shim — generated, do not edit by hand.
+// Source: src/services/integrations/openclaw/anythingllm-shim.ts
+
+const path = require("node:path");
+const fs   = require("node:fs");
+
+const BASE_URL_LIT  = "__JS_BASE_URL__";
+const WORKSPACE_LIT = "__JS_WORKSPACE__";
+
+// API key comes from a 0o600 sibling file so neither the shim source
+// (mode 0o644) nor mcporter.json (also 0o644) carries the plaintext key.
+function loadApiKey() {
+  try {
+    const secretPath = path.join(__dirname, ${JSON.stringify(ANYTHINGLLM_SHIM_SECRET_FILENAME)});
+    const raw = fs.readFileSync(secretPath, "utf-8");
+    const j = JSON.parse(raw);
+    if (j && typeof j.apiKey === "string" && j.apiKey) return j.apiKey;
+  } catch (_) { /* fall through to env fallback */ }
+  return process.env.ANYTHINGLLM_API_KEY || "";
+}
+
+const BASE_URL  = (BASE_URL_LIT.startsWith("__JS_") ? (process.env.ANYTHINGLLM_BASE_URL || "") : BASE_URL_LIT).replace(/\\/+$/, "");
+const API_KEY   = loadApiKey();
+const WORKSPACE = WORKSPACE_LIT.startsWith("__JS_") ? (process.env.ANYTHINGLLM_WORKSPACE || "default") : WORKSPACE_LIT;
+
+function envCheck() {
+  const missing = [];
+  if (!BASE_URL) missing.push("ANYTHINGLLM_BASE_URL");
+  if (!API_KEY)  missing.push("ANYTHINGLLM_API_KEY");
+  if (missing.length) {
+    throw new Error("anythingllm-shim: missing env: " + missing.join(", "));
+  }
+}
+
+async function kbSearch(query) {
+  envCheck();
+  // mode=query forces "answer only from KB" — what we want for a tool call.
+  // Workspace endpoint surfaces \`sources\` array natively for citation.
+  const r = await fetch(BASE_URL + "/api/v1/workspace/" + WORKSPACE + "/chat", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": "Bearer " + API_KEY,
+    },
+    body: JSON.stringify({ message: query, mode: "query" }),
+  });
+  if (!r.ok) {
+    const txt = await r.text();
+    throw new Error("workspace chat " + r.status + ": " + txt.slice(0, 400));
+  }
+  const j = await r.json();
+  return {
+    answer: j.textResponse || "(no answer)",
+    sources: Array.isArray(j.sources) ? j.sources : [],
+  };
+}
+
+// kb_ingest — read a host-side file and push it into AnythingLLM, then
+// embed into the workspace. The agent gets the absolute path via
+// drive_resolve_local_path, so this is a thin "upload + embed" wrapper.
+//
+// AnythingLLM endpoints used:
+//   POST /api/v1/document/upload       — multipart, returns documents[]
+//                                        with .location strings
+//   POST /api/v1/workspace/{slug}/update-embeddings
+//                                      — body: { adds: [location, ...] }
+//
+// We intentionally don't use AnythingLLM's own \`addToWorkspaces\` query
+// param on /upload — it returns success but doesn't always trigger
+// embedding on first call (verified empirically on 1.7.4); explicit
+// /update-embeddings is the reliable path.
+async function kbIngest(absPath, workspace) {
+  envCheck();
+  const fs = require("node:fs");
+  const path = require("node:path");
+  if (!absPath || typeof absPath !== "string") {
+    throw new Error("kb_ingest: missing 'path' argument");
+  }
+  if (!fs.existsSync(absPath)) throw new Error("kb_ingest: file not found: " + absPath);
+  const stat = fs.statSync(absPath);
+  if (!stat.isFile()) throw new Error("kb_ingest: not a regular file: " + absPath);
+  const ws = workspace || WORKSPACE;
+  const filename = path.basename(absPath);
+  const buf = fs.readFileSync(absPath);
+
+  // Browser-style FormData is available since Node 18 globally.
+  const fd = new FormData();
+  // Blob with simple application/octet-stream is fine — AnythingLLM sniffs
+  // type from the filename extension server-side.
+  fd.append("file", new Blob([buf]), filename);
+
+  const upRes = await fetch(BASE_URL + "/api/v1/document/upload", {
+    method: "POST",
+    headers: { "Authorization": "Bearer " + API_KEY },
+    body: fd,
+  });
+  if (!upRes.ok) {
+    const txt = await upRes.text();
+    throw new Error("upload " + upRes.status + ": " + txt.slice(0, 400));
+  }
+  const upJson = await upRes.json();
+  if (upJson.error) throw new Error("upload error: " + upJson.error);
+  const docs = Array.isArray(upJson.documents) ? upJson.documents : [];
+  if (docs.length === 0) throw new Error("upload returned no documents");
+
+  // Each doc has \`.location\` like "custom-documents/<filename>-<uuid>.json"
+  // — that is the string /update-embeddings expects in adds[].
+  const adds = docs.map((d) => d.location).filter(Boolean);
+  if (adds.length === 0) throw new Error("uploaded docs missing location field");
+
+  const embRes = await fetch(BASE_URL + "/api/v1/workspace/" + ws + "/update-embeddings", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": "Bearer " + API_KEY,
+    },
+    body: JSON.stringify({ adds, deletes: [] }),
+  });
+  if (!embRes.ok) {
+    const txt = await embRes.text();
+    throw new Error("embed " + embRes.status + ": " + txt.slice(0, 400));
+  }
+
+  return { filename, sizeBytes: stat.size, workspace: ws, locations: adds };
+}
+
+function fmtResult(res) {
+  let out = res.answer;
+  if (res.sources.length) {
+    const seen = new Set();
+    const lines = [];
+    for (const s of res.sources) {
+      const key = s.title || s.url || s.docId || "?";
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const scoreStr = s.score != null ? " [score " + Number(s.score).toFixed(2) + "]" : "";
+      lines.push("- " + key + scoreStr);
+      if (lines.length >= 5) break;
+    }
+    if (lines.length) out += "\\n\\n--- 引用 ---\\n" + lines.join("\\n");
+  }
+  return out;
+}
+
+const TOOLS = [
+  {
+    name: "kb_search",
+    description: "Search the user's knowledge base (uploaded docs / manuals / PDFs / notes) for an answer. Use whenever the user asks something likely to be answered by their uploaded documents. Returns the answer text plus up to 5 cited source files. DO NOT call for greetings, code generation, math, real-time queries, or NAS file operations (those go to drive_*).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "The user question, in their original language" },
+      },
+      required: ["query"],
+    },
+  },
+  {
+    name: "kb_ingest",
+    description: "Push a host-side file into the user's knowledge base and embed it so future kb_search calls can find it. Use when the user says \\"加进知识库 / index this / add to KB / 学习这份资料\\" about a file already on disk. Workflow: drive_resolve_local_path to get the absolute path, then kb_ingest with that path. Returns filename + size + workspace.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Absolute host path to the file (from drive_resolve_local_path)" },
+        workspace: { type: "string", description: "Optional workspace slug; defaults to the panel-wired workspace" },
+      },
+      required: ["path"],
+    },
+  },
+];
+
+function reply(id, result, error) {
+  const msg = { jsonrpc: "2.0", id };
+  if (error) msg.error = { code: -32603, message: error.message || String(error) };
+  else msg.result = result;
+  process.stdout.write(JSON.stringify(msg) + "\\n");
+}
+
+async function handle(req) {
+  const { id, method, params } = req;
+  try {
+    if (method === "initialize") {
+      reply(id, {
+        protocolVersion: "2024-11-05",
+        capabilities: { tools: {} },
+        serverInfo: { name: "anythingllm-shim", version: ${JSON.stringify(ANYTHINGLLM_MCP_SHIM_VERSION)} },
+      });
+    } else if (method === "tools/list") {
+      reply(id, { tools: TOOLS });
+    } else if (method === "tools/call") {
+      const tool = params?.name;
+      if (tool === "kb_search") {
+        const query = params?.arguments?.query;
+        if (!query) throw new Error("kb_search: missing 'query' argument");
+        const result = await kbSearch(query);
+        reply(id, { content: [{ type: "text", text: fmtResult(result) }] });
+      } else if (tool === "kb_ingest") {
+        const a = params?.arguments || {};
+        const result = await kbIngest(a.path, a.workspace);
+        reply(id, { content: [{ type: "text", text:
+          "✅ 已加入知识库: " + result.filename +
+          " (" + result.sizeBytes + " bytes, workspace=" + result.workspace + ")" +
+          "\\n   embeddings 处理中，几秒后 kb_search 即可命中。"
+        }] });
+      } else {
+        throw new Error("unknown tool: " + tool);
+      }
+    } else if (method === "notifications/initialized") {
+      // no reply for notifications
+    } else {
+      reply(id, null, new Error("method not implemented: " + method));
+    }
+  } catch (e) {
+    reply(id, null, e);
+  }
+}
+
+let inbuf = "";
+process.stdin.setEncoding("utf-8");
+process.stdin.on("data", (chunk) => {
+  inbuf += chunk;
+  let idx;
+  while ((idx = inbuf.indexOf("\\n")) >= 0) {
+    const line = inbuf.slice(0, idx).trim();
+    inbuf = inbuf.slice(idx + 1);
+    if (!line) continue;
+    let req;
+    try { req = JSON.parse(line); } catch { continue; }
+    void handle(req);
+  }
+});
+process.stdin.on("end", () => process.exit(0));
+`;
+/**
+ * Substitute baked-in NON-SECRET values into the shim source.
+ * Same pattern as substituteDriveShimPlaceholders — done at install
+ * time because OpenClaw scrubs env on MCP subprocess spawn, so the
+ * env-fallback inside the template is unreliable in production.
+ *
+ * The API key is intentionally NOT baked in. Write it to a sibling
+ * file named `ANYTHINGLLM_SHIM_SECRET_FILENAME` (mode 0o600) and the
+ * shim will load it at startup.
+ *
+ * Placeholders use `__JS_*__` so they grep cleanly.
+ */
+export function substituteAnythingllmShimPlaceholders(params) {
+    const escapeStr = (s) => s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    return ANYTHINGLLM_MCP_SHIM_SOURCE
+        .replace(/__JS_BASE_URL__/g, escapeStr(params.baseUrl))
+        .replace(/__JS_WORKSPACE__/g, escapeStr(params.workspace || "default"));
+}
+//# sourceMappingURL=anythingllm-shim.js.map