multiclaws 0.4.36 → 0.4.37

package/dist/service/a2a-adapter.js

@@ -2,6 +2,48 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenClawAgentExecutor = void 0;
 const gateway_client_1 = require("../infra/gateway-client");
+/* ------------------------------------------------------------------ */
+/*  Risk classification                                                */
+/* ------------------------------------------------------------------ */
+/**
+ * Heuristic risk classifier. Returns "safe" only when the task is
+ * clearly a read-only query; defaults to "risky" for anything ambiguous.
+ *
+ * This drives the permission gate: risky tasks require explicit human
+ * approval before a sub-agent is spawned to execute them.
+ */
+function classifyTaskRisk(taskText) {
+    const text = taskText.toLowerCase();
+    // Explicit risky patterns (write / modify / execute / send)
+    const riskyPatterns = [
+        // English
+        /\b(write|creat|delet|remov|modif|edit|updat|install|execut|deploy|push|commit|send|post|drop|format|rename|overwrite|reset|wipe|destroy|kill|terminat|rm\b|mkdir|touch\b|mv\b)\b/i,
+        // Chinese write-oriented verbs
+        /[写创建删除修改编辑更新安装执行运行发送提交部署重命名覆盖重置清空销毁终止]/,
+    ];
+    if (riskyPatterns.some((p) => p.test(text))) {
+        return "risky";
+    }
+    // Explicitly safe read-only patterns
+    const safePatterns = [
+        /\b(list|show|get|check|view|read|query|find|search|display|fetch|retriev|look|what|which|count|how many|summariz|describ|explain|analyz|report)\b/i,
+        /[查看获取搜索显示检查列出查询统计描述分析报告]/,
+        // Calendar / schedule queries
+        /\b(calendar|schedule|event|meeting|free|busy|availab)\b/i,
+        /[日历日程会议空闲忙碌可用时间]/,
+        // Process / system info
+        /\b(process|pid|cpu|memory|disk|uptime|version|status|running|service)\b/i,
+        /[进程内存磁盘状态运行版本服务]/,
+    ];
+    if (safePatterns.some((p) => p.test(text))) {
+        return "safe";
+    }
+    // Default: treat as risky if uncertain
+    return "risky";
+}
+/* ------------------------------------------------------------------ */
+/*  Helpers                                                            */
+/* ------------------------------------------------------------------ */
 function extractTextFromMessage(message) {
     if (!message.parts)
         return "";
@@ -15,10 +57,13 @@ function extractTextFromMessage(message) {
  *
  * When a remote agent sends a task via A2A `message/send`,
  * this executor:
- * 1. Records the task via TaskTracker
- * 2. Calls OpenClaw's `sessions_spawn` (run mode) to start execution
- * 3. Waits for the sub-agent to call back via `multiclaws_a2a_callback`
- * 4. Returns the final result as a Message
+ * 1. Classifies the task risk (safe vs risky)
+ * 2. Notifies the local human owner
+ * 3. For risky tasks: waits for explicit human approval
+ *    For safe tasks: executes immediately
+ * 4. Calls OpenClaw's `sessions_spawn` (run mode) to start execution
+ * 5. Waits for the sub-agent to call back via `multiclaws_a2a_callback`
+ * 6. Returns the final result as a Message
  */
 class OpenClawAgentExecutor {
     gatewayConfig;
@@ -27,6 +72,7 @@ class OpenClawAgentExecutor {
     logger;
     cwd;
     pendingCallbacks = new Map();
+    pendingApprovals = new Map();
     constructor(options) {
         this.gatewayConfig = options.gatewayConfig;
         this.taskTracker = options.taskTracker;
@@ -61,10 +107,49 @@ class OpenClawAgentExecutor {
             eventBus.finished();
             return;
         }
-        // Notify local user about incoming task
-        const notifyTargets = this.getNotificationTargets();
-        this.logger.info(`[a2a-adapter] task ${taskId} notifying user (${notifyTargets.size} targets)`);
-        void this.notifyUser(`📨 收到来自 **${fromAgentName}** 的委派任务：${taskText.slice(0, 200)}`);
+        // Classify risk and gate accordingly
+        const risk = classifyTaskRisk(taskText);
+        this.logger.info(`[a2a-adapter] task ${taskId} risk=${risk}`);
+        if (risk === "risky") {
+            // Notify with approval request and wait
+            const approvalTimeoutMs = 5 * 60 * 1000; // 5 minutes
+            const approvalPromise = this.createApprovalCallback(taskId, approvalTimeoutMs);
+            this.logger.info(`[a2a-adapter] task ${taskId} requesting human approval (timeout=${approvalTimeoutMs / 1000}s)`);
+            void this.notifyUser(buildApprovalRequest(taskId, fromAgentName, taskText));
+            let approved;
+            try {
+                approved = await approvalPromise;
+            }
+            catch (err) {
+                const isCanceled = err instanceof Error && err.message === "canceled";
+                if (isCanceled) {
+                    // Task was explicitly canceled — use the canonical "canceled" message
+                    this.logger.info(`[a2a-adapter] task ${taskId} canceled during approval wait`);
+                    this.taskTracker.update(taskId, { status: "failed", error: "canceled" });
+                    this.publishMessage(eventBus, "Task was canceled.");
+                    eventBus.finished();
+                    return;
+                }
+                // Approval timed out → auto-reject
+                approved = false;
+                this.logger.warn(`[a2a-adapter] task ${taskId} approval timed out — auto-rejected`);
+            }
+            if (!approved) {
+                const reason = "用户拒绝或未在超时时间内授权。";
+                this.logger.info(`[a2a-adapter] task ${taskId} rejected`);
+                this.taskTracker.update(taskId, { status: "failed", error: reason });
+                this.publishMessage(eventBus, `任务已被拒绝：${reason}`);
+                eventBus.finished();
+                return;
+            }
+            this.logger.info(`[a2a-adapter] task ${taskId} approved by user`);
+            void this.notifyUser(`✅ 已授权，开始执行来自 **${fromAgentName}** 的任务…`);
+        }
+        else {
+            // Safe task: notify but auto-execute
+            this.logger.info(`[a2a-adapter] task ${taskId} safe query — auto-executing`);
+            void this.notifyUser(`📨 收到来自 **${fromAgentName}** 的查询任务（安全，自动执行）：\n\n${taskText.slice(0, 300)}`);
+        }
         try {
             // Create a promise that resolves when sub-agent calls multiclaws_a2a_callback
             const timeoutMs = 180_000;
@@ -88,15 +173,17 @@ class OpenClawAgentExecutor {
             this.logger.info(`[a2a-adapter] task ${taskId} waiting for callback from sub-agent...`);
             // Wait for the sub-agent to call back
             const output = await resultPromise;
-            // Return result
+            // Return result and notify user
             this.taskTracker.update(taskId, { status: "completed", result: output });
             this.logger.info(`[a2a-adapter] ✓ task ${taskId} completed — resultLen=${output.length}, preview=${output.slice(0, 120)}`);
+            void this.notifyUser(`✅ **来自 ${fromAgentName} 的任务已完成**\n\n${output.slice(0, 800)}`);
             this.publishMessage(eventBus, output || "Task completed with no output.");
         }
         catch (err) {
             const errorMsg = err instanceof Error ? err.message : String(err);
             this.logger.error(`[a2a-adapter] ✗ task ${taskId} failed: ${errorMsg}`);
             this.taskTracker.update(taskId, { status: "failed", error: errorMsg });
+            void this.notifyUser(`❌ 来自 **${fromAgentName}** 的任务执行失败：${errorMsg}`);
             this.publishMessage(eventBus, `Error: ${errorMsg}`);
         }
         this.logger.info(`[a2a-adapter] task ${taskId} eventBus.finished()`);
@@ -118,8 +205,32 @@ class OpenClawAgentExecutor {
         pending.resolve(result);
         return true;
     }
+    /**
+     * Called when the local human owner approves or rejects a pending risky task.
+     * Returns true if a pending approval was found.
+     */
+    resolveApproval(taskId, approved) {
+        const pending = this.pendingApprovals.get(taskId);
+        if (!pending) {
+            this.logger.warn(`[a2a-adapter] resolveApproval: no pending approval for taskId=${taskId}`);
+            return false;
+        }
+        clearTimeout(pending.timer);
+        this.pendingApprovals.delete(taskId);
+        this.logger.info(`[a2a-adapter] resolveApproval: taskId=${taskId} approved=${approved}`);
+        pending.resolve(approved);
+        return true;
+    }
     async cancelTask(taskId, eventBus) {
         this.logger.info(`[a2a-adapter] cancelTask(taskId=${taskId})`);
+        // Reject pending approval if any — distinct from user-rejection, uses Error("canceled")
+        const approval = this.pendingApprovals.get(taskId);
+        if (approval) {
+            clearTimeout(approval.timer);
+            this.pendingApprovals.delete(taskId);
+            approval.reject(new Error("canceled"));
+            this.logger.info(`[a2a-adapter] cancelTask: pending approval canceled for taskId=${taskId}`);
+        }
         // Reject pending callback if any
         const pending = this.pendingCallbacks.get(taskId);
         if (pending) {
@@ -149,6 +260,20 @@ class OpenClawAgentExecutor {
             this.pendingCallbacks.set(taskId, { resolve, reject, timer });
         });
     }
+    /**
+     * Create a pending approval that resolves when the human owner responds,
+     * or rejects on timeout or cancellation.
+     */
+    createApprovalCallback(taskId, timeoutMs) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pendingApprovals.delete(taskId);
+                this.logger.warn(`[a2a-adapter] task ${taskId} approval timed out after ${timeoutMs / 1000}s`);
+                reject(new Error(`approval timed out after ${timeoutMs / 1000}s`));
+            }, timeoutMs);
+            this.pendingApprovals.set(taskId, { resolve, reject, timer });
+        });
+    }
     /** Send a notification to all known targets. Individual failures are silently ignored. */
     async notifyUser(message) {
         const targets = this.getNotificationTargets();
@@ -167,8 +292,10 @@ class OpenClawAgentExecutor {
                         timeoutMs: 5_000,
                     })
                     : (0, gateway_client_1.invokeGatewayTool)({
+                        // sessions_send injects a message into the session so the AI
+                        // can relay it to the human (correct tool; was "chat.send" before)
                         gateway: this.gatewayConfig,
-                        tool: "chat.send",
+                        tool: "sessions_send",
                         args: { sessionKey: target.sessionKey, message },
                         timeoutMs: 5_000,
                     }));
@@ -194,28 +321,50 @@ class OpenClawAgentExecutor {
     }
 }
 exports.OpenClawAgentExecutor = OpenClawAgentExecutor;
+/* ------------------------------------------------------------------ */
+/*  Prompt builders                                                    */
+/* ------------------------------------------------------------------ */
+/**
+ * Build the approval request message injected into the human's active session.
+ * The AI in that session will relay it and handle the human's approve/reject response.
+ */
+function buildApprovalRequest(taskId, fromAgentName, taskText) {
+    const preview = taskText.length > 600 ? taskText.slice(0, 600) + "…" : taskText;
+    return `[MultiClaws] 收到来自 **${fromAgentName}** 的委派任务，需要授权
+
+**任务内容：**
+${preview}
+
+⚠️ 该任务涉及写操作或高风险操作，需要您授权才能执行。
+
+请询问用户是否同意执行，并根据回复调用对应工具：
+- 同意：\`multiclaws_task_respond(taskId="${taskId}", approved=true)\`
+- 拒绝：\`multiclaws_task_respond(taskId="${taskId}", approved=false)\`
+
+授权等待时间：5 分钟，超时自动拒绝。`;
+}
 /**
  * Build the prompt for the sub-agent that handles an incoming A2A task.
  * The sub-agent must call `multiclaws_a2a_callback` to report its result.
  */
 function buildA2ASubagentPrompt(taskId, taskText) {
-    return `你收到了一个来自远端智能体的委派任务。请完成任务并汇报结果。
-
-## 任务内容
-
-${taskText}
-
-## 完成后必做
-
-完成任务后，你**必须**调用 \`multiclaws_a2a_callback\` 工具汇报结果：
-
-\`\`\`
-multiclaws_a2a_callback(taskId="${taskId}", result="你的完整回复内容")
-\`\`\`
-
-**重要**：
-- 无论任务成功还是失败，都必须调用 \`multiclaws_a2a_callback\`
-- result 参数填写你的完整回复文本
-- 如果任务失败，在 result 中说明失败原因
+    return `你收到了一个来自远端智能体的委派任务。请完成任务并汇报结果。
+
+## 任务内容
+
+${taskText}
+
+## 完成后必做
+
+完成任务后，你**必须**调用 \`multiclaws_a2a_callback\` 工具汇报结果：
+
+\`\`\`
+multiclaws_a2a_callback(taskId="${taskId}", result="你的完整回复内容")
+\`\`\`
+
+**重要**：
+- 无论任务成功还是失败，都必须调用 \`multiclaws_a2a_callback\`
+- result 参数填写你的完整回复文本
+- 如果任务失败，在 result 中说明失败原因
 - 这是唯一的结果回传方式，不调用则结果会丢失`;
 }

package/dist/service/multiclaws-service.d.ts

@@ -133,6 +133,11 @@ export declare class MulticlawsService extends EventEmitter {
     private extractArtifactText;
     /** Fetch with up to 2 retries and exponential backoff. */
     private fetchWithRetry;
+    /**
+     * Called by the `multiclaws_task_respond` tool when the local human
+     * approves or rejects a pending risky incoming task.
+     */
+    respondToTask(taskId: string, approved: boolean): boolean;
     /** Resolve a pending A2A callback from sub-agent. */
     resolveA2ACallback(taskId: string, result: string): boolean;
     addNotificationTarget(key: string, target: NotificationTarget): void;

package/dist/service/multiclaws-service.js

@@ -30,22 +30,22 @@ function buildDelegationPrompt(agent, task) {
     const bioSnippet = agent.description
         ? `\n**智能体能力**: ${agent.description.slice(0, 500)}`
         : "";
-    return `## 委派任务
-向远端智能体发送任务并汇报结果。
-
-**目标智能体**: ${agent.name} (${agent.url})${bioSnippet}
-**任务内容**: ${task}
-
-## 执行步骤
-1. 调用 multiclaws_delegate_send(agentUrl="${agent.url}", task="${task.replace(/"/g, '\\"')}") 发送任务
-2. 收到回复后，调用 multiclaws_notify(message="结果内容") 将结果推送给用户
-3. 如果需要进一步沟通，可再次调用 multiclaws_delegate_send（最多 5 轮）
-4. 每次收到回复后立即调用 multiclaws_notify 推送进展
-
-## 规则
-- 使用 multiclaws_delegate_send（不是 multiclaws_delegate）发送任务
-- 使用 multiclaws_notify（不是 message）将结果推送给用户
-- 最多 5 轮沟通
+    return `## 委派任务
+向远端智能体发送任务并汇报结果。
+
+**目标智能体**: ${agent.name} (${agent.url})${bioSnippet}
+**任务内容**: ${task}
+
+## 执行步骤
+1. 调用 multiclaws_delegate_send(agentUrl="${agent.url}", task="${task.replace(/"/g, '\\"')}") 发送任务
+2. 收到回复后，调用 multiclaws_notify(message="结果内容") 将结果推送给用户
+3. 如果需要进一步沟通，可再次调用 multiclaws_delegate_send（最多 5 轮）
+4. 每次收到回复后立即调用 multiclaws_notify 推送进展
+
+## 规则
+- 使用 multiclaws_delegate_send（不是 multiclaws_delegate）发送任务
+- 使用 multiclaws_notify（不是 message）将结果推送给用户
+- 最多 5 轮沟通
 - 遇到错误时在 multiclaws_notify 中说明失败原因`;
 }
 /* ------------------------------------------------------------------ */
@@ -940,6 +940,20 @@ class MulticlawsService extends node_events_1.EventEmitter {
         }
         throw lastError;
     }
+    /**
+     * Called by the `multiclaws_task_respond` tool when the local human
+     * approves or rejects a pending risky incoming task.
+     */
+    respondToTask(taskId, approved) {
+        this.log("info", `respondToTask(taskId=${taskId}, approved=${approved})`);
+        if (!this.agentExecutor) {
+            this.log("warn", `respondToTask: no agentExecutor available for taskId=${taskId}`);
+            return false;
+        }
+        const resolved = this.agentExecutor.resolveApproval(taskId, approved);
+        this.log("info", `respondToTask: ${resolved ? "✓" : "✗"} taskId=${taskId} ${resolved ? "resolved" : "no pending approval found"}`);
+        return resolved;
+    }
     /** Resolve a pending A2A callback from sub-agent. */
     resolveA2ACallback(taskId, result) {
         this.log("info", `[a2a-callback] resolveA2ACallback(taskId=${taskId}, resultLen=${result.length})`);
@@ -980,8 +994,10 @@ class MulticlawsService extends node_events_1.EventEmitter {
                         timeoutMs: 5_000,
                     })
                     : (0, gateway_client_1.invokeGatewayTool)({
+                        // sessions_send injects a message into the session so the AI
+                        // can relay it to the human (correct tool; was "chat.send" before)
                         gateway: this.gatewayConfig,
-                        tool: "chat.send",
+                        tool: "sessions_send",
                         args: { sessionKey: target.sessionKey, message },
                         timeoutMs: 5_000,
                     }));

package/openclaw.plugin.json

@@ -1,47 +1,47 @@
-{
-  "id": "multiclaws",
-  "name": "MultiClaws",
-  "description": "MultiClaws plugin for multi-instance collaboration using A2A protocol",
-  "version": "0.3.0",
-  "skills": ["./skills/multiclaws"],
-  "configSchema": {
-    "type": "object",
-    "additionalProperties": false,
-    "properties": {
-      "port": {
-        "type": "integer",
-        "minimum": 1,
-        "maximum": 65535,
-        "default": 3100
-      },
-      "displayName": {
-        "type": "string",
-        "minLength": 1
-      },
-      "selfUrl": {
-        "type": "string",
-        "description": "Publicly reachable URL for this agent. If not set, tunnel configuration is required."
-      },
-      "tunnel": {
-        "type": "object",
-        "description": "FRP tunnel configuration for cross-network connectivity. Required if selfUrl is not set.",
-        "properties": {
-          "type":           { "type": "string", "enum": ["frp"] },
-          "serverAddr":     { "type": "string", "description": "FRP server address (IP or domain)" },
-          "serverPort":     { "type": "integer", "default": 7000, "description": "FRP server bind port" },
-          "token":          { "type": "string", "description": "FRP authentication token" },
-          "portRangeStart": { "type": "integer", "description": "Start of available remote port range" },
-          "portRangeEnd":   { "type": "integer", "description": "End of available remote port range (inclusive)" }
-        },
-        "required": ["type", "serverAddr", "serverPort", "token", "portRangeStart", "portRangeEnd"]
-      },
-      "telemetry": {
-        "type": "object",
-        "additionalProperties": false,
-        "properties": {
-          "consoleExporter": { "type": "boolean", "default": false }
-        }
-      }
-    }
-  }
-}
+{
+  "id": "multiclaws",
+  "name": "MultiClaws",
+  "description": "MultiClaws plugin for multi-instance collaboration using A2A protocol",
+  "version": "0.3.0",
+  "skills": ["./skills/multiclaws", "./skills/meeting-scheduler"],
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "port": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 65535,
+        "default": 3100
+      },
+      "displayName": {
+        "type": "string",
+        "minLength": 1
+      },
+      "selfUrl": {
+        "type": "string",
+        "description": "Publicly reachable URL for this agent. If not set, tunnel configuration is required."
+      },
+      "tunnel": {
+        "type": "object",
+        "description": "FRP tunnel configuration for cross-network connectivity. Required if selfUrl is not set.",
+        "properties": {
+          "type":           { "type": "string", "enum": ["frp"] },
+          "serverAddr":     { "type": "string", "description": "FRP server address (IP or domain)" },
+          "serverPort":     { "type": "integer", "default": 7000, "description": "FRP server bind port" },
+          "token":          { "type": "string", "description": "FRP authentication token" },
+          "portRangeStart": { "type": "integer", "description": "Start of available remote port range" },
+          "portRangeEnd":   { "type": "integer", "description": "End of available remote port range (inclusive)" }
+        },
+        "required": ["type", "serverAddr", "serverPort", "token", "portRangeStart", "portRangeEnd"]
+      },
+      "telemetry": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "consoleExporter": { "type": "boolean", "default": false }
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "multiclaws",
-  "version": "0.4.36",
-  "description": "MultiClaws plugin for OpenClaw collaboration via A2A protocol",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "openclaw": {
-    "extensions": [
-      "./dist/index.js"
-    ]
-  },
-  "files": [
-    "dist",
-    "skills",
-    "openclaw.plugin.json",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "clean": "rm -rf dist"
-  },
-  "keywords": [
-    "openclaw",
-    "plugin",
-    "multiclaws",
-    "a2a",
-    "collaboration"
-  ],
-  "author": "Eric Sun",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/EricSun0218/multiclaws.git"
-  },
-  "dependencies": {
-    "@a2a-js/sdk": "^0.3.10",
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/sdk-trace-base": "^2.6.0",
-    "@opentelemetry/sdk-trace-node": "^2.6.0",
-    "express": "^5.2.1",
-    "opossum": "^9.0.0",
-    "p-retry": "^7.1.1",
-    "proper-lockfile": "^4.1.2",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@types/express": "^5.0.6",
-    "@types/node": "^24.3.0",
-    "@types/opossum": "^8.1.9",
-    "@types/proper-lockfile": "^4.1.4",
-    "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
-  }
-}
+{
+  "name": "multiclaws",
+  "version": "0.4.37",
+  "description": "MultiClaws plugin for OpenClaw collaboration via A2A protocol",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "openclaw": {
+    "extensions": [
+      "./dist/index.js"
+    ]
+  },
+  "files": [
+    "dist",
+    "skills",
+    "openclaw.plugin.json",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  },
+  "keywords": [
+    "openclaw",
+    "plugin",
+    "multiclaws",
+    "a2a",
+    "collaboration"
+  ],
+  "author": "Eric Sun",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/EricSun0218/multiclaws.git"
+  },
+  "dependencies": {
+    "@a2a-js/sdk": "^0.3.10",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.6.0",
+    "@opentelemetry/sdk-trace-node": "^2.6.0",
+    "express": "^5.2.1",
+    "opossum": "^9.0.0",
+    "p-retry": "^7.1.1",
+    "proper-lockfile": "^4.1.2",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/node": "^24.3.0",
+    "@types/opossum": "^8.1.9",
+    "@types/proper-lockfile": "^4.1.4",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  }
+}