memory-gateway-sync 0.11.0 → 0.13.0

package/index.js

@@ -4,21 +4,45 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import os from "node:os";
+
+function resolveIdentity(params) {
+  const testScene = process.env.MEMORY_GATEWAY_TEST_SCENE;
+  if (testScene) {
+    return {
+      scene: testScene,
+      owner_id: process.env.MEMORY_GATEWAY_TEST_OWNER_ID || "test_owner",
+      group_id: process.env.MEMORY_GATEWAY_TEST_GROUP_ID || null,
+    };
+  }
+  const ownerId = params.owner_id?.trim() || "";
+  const groupId = params.group_id?.trim() || null;
+  if (!ownerId) {
+    console.warn(
+      "[identity] owner_id is empty — owner queries will be skipped to prevent cross-user leak."
+    );
+  }
+  if (groupId) {
+    return { scene: "group", owner_id: ownerId, group_id: groupId };
+  }
+  return { scene: "owner", owner_id: ownerId, group_id: null };
+}
+
 var registered = false;
 var index_default = definePluginEntry({
   id: "memory-gateway-sync",
   name: "Memory Gateway Sync",
-  description: "fs.watch \u76D1\u542C\u591A workspace \u7684 MEMORY \u6587\u4EF6\u53D8\u5316\uFF0C\u53CC\u5199\u5230\u5916\u90E8 Gateway\uFF08\u652F\u6301 peers/groups/knowledge \u5B50\u76EE\u5F55\uFF09",
+  description: "fs.watch 监听多 workspace 的 MEMORY 文件变化，双写到外部 Gateway（支持 peers/groups/knowledge 子目录）",
   kind: "generic",
   register(api) {
     if (registered) {
-      api.logger.info("memory-gateway-sync: \u5DF2\u6CE8\u518C\uFF0C\u8DF3\u8FC7\u91CD\u590D\u52A0\u8F7D");
+      api.logger.info("memory-gateway-sync: 已注册，跳过重复加载");
       return;
     }
     registered = true;
     const cfg = api.pluginConfig ?? {};
     const gatewayUrl = cfg.gatewayUrl || process.env.MEMORY_SYNC_GATEWAY_URL || "";
     const gatewayToken = cfg.gatewayToken || process.env.MEMORY_SYNC_GATEWAY_TOKEN || "";
+    const tenantsDir = cfg.tenantsDir || process.env.MEMORY_SYNC_TENANTS_DIR || "";
     const debounceMs = cfg.debounceMs ?? 1500;
     const defaultAgentId = cfg.agentId ?? "default";
     const ownerClawUserId = (() => {
@@ -29,7 +53,7 @@ var index_default = definePluginEntry({
     const podReleaseName = process.env.botID ?? null;
     if (!gatewayUrl || !gatewayToken) {
       api.logger.warn(
-        "memory-gateway-sync: gatewayUrl \u6216 gatewayToken \u672A\u914D\u7F6E\uFF0C\u63D2\u4EF6\u4E0D\u542F\u52A8"
+        "memory-gateway-sync: gatewayUrl 或 gatewayToken 未配置，插件不启动"
       );
       return;
     }
@@ -69,7 +93,7 @@ var index_default = definePluginEntry({
           const ws = findWorkspace(absPath);
           if (!ws) {
             api.logger.warn(
-              `memory-gateway-sync: \u627E\u4E0D\u5230\u6240\u5C5E workspace: ${absPath}`
+              `memory-gateway-sync: 找不到所属 workspace: ${absPath}`
             );
             return;
           }
@@ -78,7 +102,7 @@ var index_default = definePluginEntry({
             content = await fs.promises.readFile(absPath, "utf-8");
           } catch (err) {
             api.logger.warn(
-              `memory-gateway-sync: \u8BFB\u53D6\u6587\u4EF6\u5931\u8D25 ${absPath}: ${String(err)}`
+              `memory-gateway-sync: 读取文件失败 ${absPath}: ${String(err)}`
             );
             return;
           }
@@ -98,19 +122,23 @@ var index_default = definePluginEntry({
               );
             }
           }
-          let userId = null;
+          let owner_id = ws.userId ?? ownerClawUserId ?? undefined;
+          let group_id;
           const parts = relativePath.replace(/\\/g, "/").split("/");
-          if (relativePath === "MEMORY.md" || parts[0] === "memory" && parts[1] === "owner") {
-            userId = ownerClawUserId;
-          } else if (parts[0] === "memory" && parts[1] === "peers" && parts.length >= 3) {
-            userId = parts[2];
+          if (parts[0] === "memory" && parts[1] === "peers" && parts.length >= 3) {
+            owner_id = parts[2];
+          } else if (parts[0] === "memory" && parts[1] === "groups" && parts.length >= 3) {
+            group_id = parts[2];
           }
+          const identity = resolveIdentity({ owner_id, group_id });
           const payload = {
             path: relativePath,
             content,
             release_name: parseReleaseName(content) ?? podReleaseName,
             agentId: ws.agentId,
-            userId,
+            userId: identity.owner_id,
+            scene: identity.scene,
+            group_id: identity.group_id,
             workspaceDir: ws.dir,
             eventType,
             syncedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -133,17 +161,17 @@ var index_default = definePluginEntry({
               syncOk = true;
               lastSyncedHash.set(absPath, contentHash);
               api.logger.info?.(
-                `memory-gateway-sync: [${ws.agentId}] \u540C\u6B65\u6210\u529F ${relativePath} (${content.length} chars)`
+                `memory-gateway-sync: [${ws.agentId}] 同步成功 ${relativePath} (${content.length} chars)`
               );
             } else {
               const body = await res.text().catch(() => "");
               api.logger.warn(
-                `memory-gateway-sync: [${ws.agentId}] Gateway \u8FD4\u56DE ${res.status} for ${relativePath}: ${body}`
+                `memory-gateway-sync: [${ws.agentId}] Gateway 返回 ${res.status} for ${relativePath}: ${body}`
               );
             }
           } catch (err) {
             api.logger.warn(
-              `memory-gateway-sync: [${ws.agentId}] POST \u5931\u8D25 ${relativePath}: ${String(err)}`
+              `memory-gateway-sync: [${ws.agentId}] POST 失败 ${relativePath}: ${String(err)}`
             );
           }
           if (relativePath === "MEMORY.md" && content.trim().length > 0) {
@@ -153,11 +181,11 @@ var index_default = definePluginEntry({
               const backupPath = syncOk ? absPath + ".bak" : absPath + ".failed";
               await fs.promises.appendFile(backupPath, section, "utf-8");
               api.logger.info?.(
-                `memory-gateway-sync: [${ws.agentId}] MEMORY.md \u5DF2\u5907\u4EFD\u5230 ${syncOk ? ".bak" : ".failed"}`
+                `memory-gateway-sync: [${ws.agentId}] MEMORY.md 已备份到 ${syncOk ? ".bak" : ".failed"}`
               );
             } catch (err) {
               api.logger.warn(
-                `memory-gateway-sync: [${ws.agentId}] \u5907\u4EFD/\u6E05\u7A7A MEMORY.md \u5931\u8D25: ${String(err)}`
+                `memory-gateway-sync: [${ws.agentId}] 备份 MEMORY.md 失败: ${String(err)}`
               );
             }
           }
@@ -173,11 +201,11 @@ var index_default = definePluginEntry({
             }, debounceMs)
           );
         };
-        const registerWorkspace = async (wsDir, wsAgentId) => {
+        const registerWorkspace = async (wsDir, wsAgentId, wsUserId) => {
           const realDir = await fs.promises.realpath(wsDir).catch(() => wsDir);
           if (registeredRealPaths.has(realDir)) return;
           registeredRealPaths.add(realDir);
-          registeredWorkspaces.set(realDir, { dir: realDir, agentId: wsAgentId });
+          registeredWorkspaces.set(realDir, { dir: realDir, agentId: wsAgentId, userId: wsUserId });
           const memoryMdPath = path.join(realDir, "MEMORY.md");
           try {
             await fs.promises.writeFile(memoryMdPath, "", { flag: "a" });
@@ -185,16 +213,16 @@ var index_default = definePluginEntry({
               scheduleSync(memoryMdPath, eventType ?? "change");
             });
             api.logger.info?.(
-              `memory-gateway-sync: [${wsAgentId}] \u5F00\u59CB\u76D1\u542C MEMORY.md`
+              `memory-gateway-sync: [${wsAgentId}] 开始监听 MEMORY.md`
             );
             scheduleSync(memoryMdPath, "startup");
           } catch (err) {
             api.logger.warn(
-              `memory-gateway-sync: [${wsAgentId}] \u65E0\u6CD5\u76D1\u542C MEMORY.md: ${String(err)}`
+              `memory-gateway-sync: [${wsAgentId}] 无法监听 MEMORY.md: ${String(err)}`
             );
           }
           api.logger.info(
-            `memory-gateway-sync: [${wsAgentId}] workspace \u6CE8\u518C\u5B8C\u6210 \u2192 ${wsDir}`
+            `memory-gateway-sync: [${wsAgentId}] workspace 注册完成 → ${wsDir}`
           );
         };
         const scanWorkspaces = async () => {
@@ -218,11 +246,11 @@ var index_default = definePluginEntry({
                 }
               }
               const wsAgentId = resolveAgentId(name);
-              await registerWorkspace(wsDir, wsAgentId);
+              await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
             }
           } catch (err) {
             api.logger.warn(
-              `memory-gateway-sync: \u626B\u63CF workspace \u5931\u8D25: ${String(err)}`
+              `memory-gateway-sync: 扫描 workspace 失败: ${String(err)}`
             );
           }
           for (const dataDir of discoveredDataDirs) {
@@ -237,11 +265,11 @@ var index_default = definePluginEntry({
                 if (name !== "workspace" && !name.startsWith("workspace-")) continue;
                 const wsDir = path.join(dataDir, name);
                 const wsAgentId = resolveAgentId(name);
-                await registerWorkspace(wsDir, wsAgentId);
+                await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
               }
             } catch (err) {
               api.logger.warn(
-                `memory-gateway-sync: \u626B\u63CF\u6570\u636E\u76EE\u5F55 ${dataDir} \u5931\u8D25: ${String(err)}`
+                `memory-gateway-sync: 扫描数据目录 ${dataDir} 失败: ${String(err)}`
               );
             }
           }
@@ -261,9 +289,9 @@ var index_default = definePluginEntry({
                 if (registeredRealPaths.has(realDir)) return;
                 const wsAgentId = resolveAgentId(filename);
                 api.logger.info(
-                  `memory-gateway-sync: \u53D1\u73B0\u65B0 workspace \u2192 ${filename} (agentId=${wsAgentId}) in ${dir}`
+                  `memory-gateway-sync: 发现新 workspace → ${filename} (agentId=${wsAgentId}) in ${dir}`
                 );
-                await registerWorkspace(wsDir, wsAgentId);
+                await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
                 const parentDir = path.dirname(realDir);
                 if (!discoveredDataDirs.has(parentDir) && parentDir !== openclawDir) {
                   discoveredDataDirs.add(parentDir);
@@ -274,10 +302,90 @@ var index_default = definePluginEntry({
             });
           } catch (err) {
             api.logger.warn(
-              `memory-gateway-sync: \u65E0\u6CD5\u76D1\u542C ${dir}: ${String(err)}`
+              `memory-gateway-sync: 无法监听 ${dir}: ${String(err)}`
             );
           }
         };
+
+        // ── Tenants 模式 ──
+
+        const scanTenantWorkspaces = async (tenantDir, userId) => {
+          const workspacesDir = path.join(tenantDir, "workspaces");
+          try {
+            const entries = await fs.promises.readdir(workspacesDir, { withFileTypes: true });
+            for (const entry of entries) {
+              if (!entry.isDirectory()) continue;
+              const agentId = entry.name;
+              const wsDir = path.join(workspacesDir, agentId);
+              await registerWorkspace(wsDir, agentId, userId);
+            }
+          } catch {
+          }
+        };
+        const watchTenantWorkspacesDir = (tenantDir, userId) => {
+          const workspacesDir = path.join(tenantDir, "workspaces");
+          try {
+            fs.watch(workspacesDir, async (_eventType, filename) => {
+              if (!filename) return;
+              const wsDir = path.join(workspacesDir, filename);
+              try {
+                const stat = await fs.promises.stat(wsDir);
+                if (!stat.isDirectory()) return;
+                const realDir = await fs.promises.realpath(wsDir).catch(() => wsDir);
+                if (registeredRealPaths.has(realDir)) return;
+                api.logger.info(
+                  `memory-gateway-sync: [tenants] 发现新 workspace → ${userId}/${filename}`
+                );
+                await registerWorkspace(wsDir, filename, userId);
+              } catch {
+              }
+            });
+          } catch {
+          }
+        };
+        const scanTenants = async () => {
+          try {
+            const entries = await fs.promises.readdir(tenantsDir, { withFileTypes: true });
+            for (const entry of entries) {
+              if (!entry.isDirectory()) continue;
+              const userId = entry.name;
+              const tenantDir = path.join(tenantsDir, userId);
+              await scanTenantWorkspaces(tenantDir, userId);
+              watchTenantWorkspacesDir(tenantDir, userId);
+            }
+          } catch (err) {
+            api.logger.warn(
+              `memory-gateway-sync: [tenants] 扫描 ${tenantsDir} 失败: ${String(err)}`
+            );
+          }
+        };
+        const watchTenantsDir = () => {
+          try {
+            fs.watch(tenantsDir, async (_eventType, filename) => {
+              if (!filename) return;
+              const tenantDir = path.join(tenantsDir, filename);
+              try {
+                const stat = await fs.promises.stat(tenantDir);
+                if (!stat.isDirectory()) return;
+                const userId = filename;
+                api.logger.info(
+                  `memory-gateway-sync: [tenants] 发现新 tenant → ${userId}`
+                );
+                await scanTenantWorkspaces(tenantDir, userId);
+                watchTenantWorkspacesDir(tenantDir, userId);
+              } catch {
+              }
+            });
+          } catch (err) {
+            api.logger.warn(
+              `memory-gateway-sync: [tenants] 无法监听 ${tenantsDir}: ${String(err)}`
+            );
+          }
+        };
+
+        // ── 启动 ──
+
+        // 旧模式
         watchDirForWorkspaces(openclawDir);
         await scanWorkspaces();
         for (const dataDir of discoveredDataDirs) {
@@ -285,14 +393,24 @@ var index_default = definePluginEntry({
             watchDirForWorkspaces(dataDir);
           }
         }
+
+        // Tenants 模式
+        if (tenantsDir) {
+          watchTenantsDir();
+          await scanTenants();
+          api.logger.info(
+            `memory-gateway-sync: [tenants] 扫描完成 → ${tenantsDir}`
+          );
+        }
+
         const wsCount = registeredWorkspaces.size;
-        const wsIds = Array.from(registeredWorkspaces.values()).map((w) => w.agentId).join(", ");
+        const wsIds = Array.from(registeredWorkspaces.values()).map((w) => `${w.agentId}(${w.userId ?? "?"})`).join(", ");
         api.logger.info(
-          `memory-gateway-sync: \u542F\u52A8\u5B8C\u6210 \u2192 ${gatewayUrl} (\u9632\u6296 ${debounceMs}ms, ${wsCount} \u4E2A workspace: ${wsIds})`
+          `memory-gateway-sync: 启动完成 → ${gatewayUrl} (防抖 ${debounceMs}ms, ${wsCount} 个 workspace: ${wsIds})`
         );
       },
       stop: () => {
-        api.logger.info("memory-gateway-sync: \u505C\u6B62");
+        api.logger.info("memory-gateway-sync: 停止");
       }
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-gateway-sync",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Memory 双写插件：fs.watch 感知变化后同步到外部 Gateway",
   "type": "module",
   "main": "index.js",

package/src/identity.ts

@@ -0,0 +1,48 @@
+/**
+ * 身份解析模块
+ *
+ * group_id 有值 → scene = "group"
+ * group_id 无值 → scene = "owner"
+ *
+ * owner_id 用于 SQL 数据隔离。
+ */
+
+export type Scene = "owner" | "group" | "knowledge";
+
+export interface ResolvedIdentity {
+  scene: Scene;
+  owner_id: string;
+  group_id: string | null;
+}
+
+export interface IdentityParams {
+  owner_id?: string;
+  group_id?: string;
+}
+
+export function resolveIdentity(params: IdentityParams): ResolvedIdentity {
+  const testScene = process.env.MEMORY_GATEWAY_TEST_SCENE as Scene | undefined;
+  if (testScene) {
+    return {
+      scene: testScene,
+      owner_id: process.env.MEMORY_GATEWAY_TEST_OWNER_ID || "test_owner",
+      group_id: process.env.MEMORY_GATEWAY_TEST_GROUP_ID || null,
+    };
+  }
+
+  const ownerId = params.owner_id?.trim() || "";
+  const groupId = params.group_id?.trim() || null;
+
+  if (!ownerId) {
+    console.warn(
+      "[identity] owner_id is empty — " +
+        "owner queries will be skipped to prevent cross-user leak."
+    );
+  }
+
+  if (groupId) {
+    return { scene: "group", owner_id: ownerId, group_id: groupId };
+  }
+
+  return { scene: "owner", owner_id: ownerId, group_id: null };
+}

package/src/index.ts

@@ -3,12 +3,14 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import os from "node:os";
+import { resolveIdentity, type ResolvedIdentity } from "./identity";
 
 // ── 类型 ──────────────────────────────────��───────────────────────────────────
 
 interface PluginConfig {
   gatewayUrl: string;
   gatewayToken: string;
+  tenantsDir?: string;
   debounceMs?: number;
   agentId?: string;
 }
@@ -18,7 +20,9 @@ interface IngestPayload {
   content: string;
   release_name: string | null;
   agentId: string;
-  userId: string | null;
+  userId: string;
+  scene: string;
+  group_id: string | null;
   workspaceDir: string;
   eventType: string;
   syncedAt: string;
@@ -27,6 +31,7 @@ interface IngestPayload {
 interface WorkspaceContext {
   dir: string;
   agentId: string;
+  userId: string | null;
 }
 
 // ── 防重复加载 ───────────────────────────────────────────────────────────────
@@ -50,6 +55,7 @@ export default definePluginEntry({
     const cfg = (api.pluginConfig ?? {}) as Partial<PluginConfig>;
     const gatewayUrl = cfg.gatewayUrl || process.env.MEMORY_SYNC_GATEWAY_URL || "";
     const gatewayToken = cfg.gatewayToken || process.env.MEMORY_SYNC_GATEWAY_TOKEN || "";
+    const tenantsDir = cfg.tenantsDir || process.env.MEMORY_SYNC_TENANTS_DIR || "";
     const debounceMs = cfg.debounceMs ?? 1500;
     const defaultAgentId = cfg.agentId ?? "default";
     const ownerClawUserId = (() => {
@@ -163,24 +169,28 @@ export default definePluginEntry({
             }
           }
 
-          // 根据路径解析 userId
-          // MEMORY.md / memory/owner/* → 环境变量 owner_claw_user_id
-          // memory/peers/{peerId}/*    → 路径中的 peerId
-          // 其他                       → null
-          let userId: string | null = null;
+          // 身份解析：优先使用 workspace 注册时的 userId（tenants 模式从路径获取，旧模式为 ownerClawUserId）
+          // memory/peers/{peerId}/*   → 覆盖 owner_id
+          // memory/groups/{groupId}/* → 设置 group_id
+          let owner_id: string | undefined = ws.userId ?? ownerClawUserId ?? undefined;
+          let group_id: string | undefined;
           const parts = relativePath.replace(/\\/g, "/").split("/");
-          if (relativePath === "MEMORY.md" || parts[0] === "memory" && parts[1] === "owner") {
-            userId = ownerClawUserId;
-          } else if (parts[0] === "memory" && parts[1] === "peers" && parts.length >= 3) {
-            userId = parts[2];
+          if (parts[0] === "memory" && parts[1] === "peers" && parts.length >= 3) {
+            owner_id = parts[2];
+          } else if (parts[0] === "memory" && parts[1] === "groups" && parts.length >= 3) {
+            group_id = parts[2];
           }
 
+          const identity = resolveIdentity({ owner_id, group_id });
+
           const payload: IngestPayload = {
             path: relativePath,
             content,
             release_name: parseReleaseName(content) ?? podReleaseName,
             agentId: ws.agentId,
-            userId,
+            userId: identity.owner_id,
+            scene: identity.scene,
+            group_id: identity.group_id,
             workspaceDir: ws.dir,
             eventType,
             syncedAt: new Date().toISOString(),
@@ -255,12 +265,12 @@ export default definePluginEntry({
 
         // ── 注册单个 workspace ───────────────────────────────────────────
 
-        const registerWorkspace = async (wsDir: string, wsAgentId: string): Promise<void> => {
+        const registerWorkspace = async (wsDir: string, wsAgentId: string, wsUserId: string | null): Promise<void> => {
           const realDir = await fs.promises.realpath(wsDir).catch(() => wsDir);
           if (registeredRealPaths.has(realDir)) return;
           registeredRealPaths.add(realDir);
 
-          registeredWorkspaces.set(realDir, { dir: realDir, agentId: wsAgentId });
+          registeredWorkspaces.set(realDir, { dir: realDir, agentId: wsAgentId, userId: wsUserId });
 
           // 监听 MEMORY.md（使用真实路径，确保 symlink 场景下 fs.watch 正常工作）
           const memoryMdPath = path.join(realDir, "MEMORY.md");
@@ -312,7 +322,7 @@ export default definePluginEntry({
               }
 
               const wsAgentId = resolveAgentId(name);
-              await registerWorkspace(wsDir, wsAgentId);
+              await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
             }
           } catch (err) {
             api.logger.warn(
@@ -334,7 +344,7 @@ export default definePluginEntry({
 
                 const wsDir = path.join(dataDir, name);
                 const wsAgentId = resolveAgentId(name);
-                await registerWorkspace(wsDir, wsAgentId);
+                await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
               }
             } catch (err) {
               api.logger.warn(
@@ -370,7 +380,7 @@ export default definePluginEntry({
                 api.logger.info(
                   `memory-gateway-sync: 发现新 workspace → ${filename} (agentId=${wsAgentId}) in ${dir}`
                 );
-                await registerWorkspace(wsDir, wsAgentId);
+                await registerWorkspace(wsDir, wsAgentId, ownerClawUserId);
 
                 // 如果是 symlink，也发现其数据目录并监听
                 const parentDir = path.dirname(realDir);
@@ -389,23 +399,112 @@ export default definePluginEntry({
           }
         };
 
-        // 监听 openclawDir（在 scan 之前注册，不会遗漏 scan 期间创建的目录）
-        watchDirForWorkspaces(openclawDir);
+        // ── Tenants 模式：扫描 {tenantsDir}/{userId}/workspaces/{agentId}/ ──
 
-        // ── 启动：扫描所有已有 workspace ─────────────────────────────────
+        const scanTenantWorkspaces = async (tenantDir: string, userId: string): Promise<void> => {
+          const workspacesDir = path.join(tenantDir, "workspaces");
+          try {
+            const entries = await fs.promises.readdir(workspacesDir, { withFileTypes: true });
+            for (const entry of entries) {
+              if (!entry.isDirectory()) continue;
+              const agentId = entry.name;
+              const wsDir = path.join(workspacesDir, agentId);
+              await registerWorkspace(wsDir, agentId, userId);
+            }
+          } catch {
+            // workspaces 目录不存在，跳过
+          }
+        };
 
-        await scanWorkspaces();
+        const watchTenantWorkspacesDir = (tenantDir: string, userId: string): void => {
+          const workspacesDir = path.join(tenantDir, "workspaces");
+          try {
+            fs.watch(workspacesDir, async (_eventType, filename) => {
+              if (!filename) return;
+              const wsDir = path.join(workspacesDir, filename);
+              try {
+                const stat = await fs.promises.stat(wsDir);
+                if (!stat.isDirectory()) return;
+                const realDir = await fs.promises.realpath(wsDir).catch(() => wsDir);
+                if (registeredRealPaths.has(realDir)) return;
+                api.logger.info(
+                  `memory-gateway-sync: [tenants] 发现新 workspace → ${userId}/${filename}`
+                );
+                await registerWorkspace(wsDir, filename, userId);
+              } catch {
+                // 目录不存在或已删除
+              }
+            });
+          } catch {
+            // workspaces 目录不存在，无法监听
+          }
+        };
 
-        // 监听从 symlink 发现的数据目录（scan 之后才有 discoveredDataDirs）
+        const scanTenants = async (): Promise<void> => {
+          try {
+            const entries = await fs.promises.readdir(tenantsDir, { withFileTypes: true });
+            for (const entry of entries) {
+              if (!entry.isDirectory()) continue;
+              const userId = entry.name;
+              const tenantDir = path.join(tenantsDir, userId);
+              await scanTenantWorkspaces(tenantDir, userId);
+              watchTenantWorkspacesDir(tenantDir, userId);
+            }
+          } catch (err) {
+            api.logger.warn(
+              `memory-gateway-sync: [tenants] 扫描 ${tenantsDir} 失败: ${String(err)}`
+            );
+          }
+        };
+
+        const watchTenantsDir = (): void => {
+          try {
+            fs.watch(tenantsDir, async (_eventType, filename) => {
+              if (!filename) return;
+              const tenantDir = path.join(tenantsDir, filename);
+              try {
+                const stat = await fs.promises.stat(tenantDir);
+                if (!stat.isDirectory()) return;
+                const userId = filename;
+                api.logger.info(
+                  `memory-gateway-sync: [tenants] 发现新 tenant → ${userId}`
+                );
+                await scanTenantWorkspaces(tenantDir, userId);
+                watchTenantWorkspacesDir(tenantDir, userId);
+              } catch {
+                // 目录不存在或已删除
+              }
+            });
+          } catch (err) {
+            api.logger.warn(
+              `memory-gateway-sync: [tenants] 无法监听 ${tenantsDir}: ${String(err)}`
+            );
+          }
+        };
+
+        // ── 启动 ─────────────────────────────────────────────────────────
+
+        // 旧模式：~/.openclaw/workspace*
+        watchDirForWorkspaces(openclawDir);
+        await scanWorkspaces();
         for (const dataDir of discoveredDataDirs) {
           if (dataDir !== openclawDir) {
             watchDirForWorkspaces(dataDir);
           }
         }
 
+        // Tenants 模式
+        if (tenantsDir) {
+          watchTenantsDir();
+          await scanTenants();
+          api.logger.info(
+            `memory-gateway-sync: [tenants] 扫描完成 → ${tenantsDir}`
+          );
+        }
+
         const wsCount = registeredWorkspaces.size;
         const wsIds = Array.from(registeredWorkspaces.values())
-          .map((w) => w.agentId)
+          .map((w) => `${w.agentId}(${w.userId ?? "?"})`)
           .join(", ");
         api.logger.info(
           `memory-gateway-sync: 启动完成 → ${gatewayUrl} (防抖 ${debounceMs}ms, ${wsCount} 个 workspace: ${wsIds})`