plugin-agent-orchestrator 1.0.28 → 1.0.32

package/src/server/skill-hub/tasks/SkillExecutionTask.ts

@@ -1,460 +1,470 @@
-import Application from '@nocobase/server';
-import { cpSync, existsSync, readFileSync, rmSync } from 'fs';
-import { resolve, sep } from 'path';
-import { SandboxRunner } from '../../services/SandboxRunner';
-import { FileManager } from '../../services/FileManager';
-import { SkillRepositoryService } from '../../services/SkillRepositoryService';
-import { CodeValidator } from '../../services/CodeValidator';
-import { parseJsonText, stringifyJsonText } from '../utils/json-fields';
-
-/**
- * Lightweight abort controller compatible with the SandboxRunner signal interface.
- * Worker-side: subscribes to PubSub abort channel and triggers signal.
- */
-class TaskAbortController {
-  private listeners: Array<() => void> = [];
-  private _aborted = false;
-
-  get aborted() {
-    return this._aborted;
-  }
-
-  get signal() {
-    return {
-      addEventListener: (_event: string, listener: () => void) => {
-        if (this._aborted) {
-          listener();
-        } else {
-          this.listeners.push(listener);
-        }
-      },
-    };
-  }
-
-  abort() {
-    if (this._aborted) return;
-    this._aborted = true;
-    for (const listener of this.listeners) {
-      try {
-        listener();
-      } catch {
-        // ignore
-      }
-    }
-    this.listeners = [];
-  }
-}
-
-export class SkillExecutionTask {
-  constructor(
-    private execution: any,
-    private sandboxRunner: SandboxRunner,
-    private fileManager: FileManager,
-    private skillRepoService: SkillRepositoryService,
-    private app: Application,
-  ) {}
-
-  async run() {
-    const skill = this.execution.get('skill') || this.execution.skill;
-    const execId = String(this.execution.get('id'));
-
-    await this.execution.update({ status: 'running' });
-
-    // Set up abort controller — listens for cancel from main server via PubSub
-    const abortController = new TaskAbortController();
-    const abortChannel = `skill-hub.abort.${execId}`;
-    const abortCallback = async () => {
-      (this as any).app.logger.info(`[skill-hub] Task ${execId}: received abort signal`);
-      abortController.abort();
-    };
-
-    try {
-      // Subscribe to abort channel before starting execution
-      await (this as any).app.pubSubManager.subscribe(abortChannel, abortCallback);
-
-      // Render code template with input args
-      const inputArgs = parseJsonText(this.execution.get('inputArgs'), {});
-      const storageType = skill.get ? skill.get('storageType') : skill.storageType;
-
-      let rawCodeTemplate = skill.get ? skill.get('codeTemplate') : skill.codeTemplate;
-      let language = skill.get ? skill.get('language') : skill.language;
-      let timeoutSeconds = skill.get ? skill.get('timeoutSeconds') : skill.timeoutSeconds;
-      let maxOutputSizeMb = skill.get ? skill.get('maxOutputSizeMb') : skill.maxOutputSizeMb;
-      const skillName = skill.get ? skill.get('name') : skill.name;
-      const workDir = this.fileManager.createExecDir(execId);
-      let skillDir: string | undefined;
-
-      if (storageType === 'plugin') {
-        const pluginSkillName = (skill.get ? skill.get('pluginSource') : skill.pluginSource) || skillName;
-        const orchestratorPlugin = (this as any).app.pm.get('plugin-agent-orchestrator') as any;
-        const skillHub = orchestratorPlugin?.skillHub;
-        let pluginTemplate = typeof skillHub?.resolveSkillTemplate === 'function'
-          ? skillHub.resolveSkillTemplate(pluginSkillName)
-          : skillHub?.skillTemplates?.get(pluginSkillName);
-
-        // Fallback: discover dynamically if not cached (e.g. executed in worker before UI was loaded)
-        if (!pluginTemplate && skillHub) {
-          const allPlugins = (this as any).app.pm.getPlugins();
-          for (const [, pInstance] of allPlugins) {
-            if (typeof (pInstance as any).getSkillTemplates === 'function') {
-              const pluginSkills = (pInstance as any).getSkillTemplates();
-              if (Array.isArray(pluginSkills)) {
-                for (const s of pluginSkills) {
-                  if (s.name === pluginSkillName) {
-                    pluginTemplate = typeof skillHub?.hydrateSkillTemplate === 'function'
-                      ? skillHub.hydrateSkillTemplate(pInstance.name, s)
-                      : { ...s, pluginSource: s.name, pluginName: pInstance.name };
-                    skillHub.skillTemplates.set(s.name, pluginTemplate);
-                    break;
-                  }
-                }
-              }
-            }
-            if (pluginTemplate) break;
-          }
-        }
-
-        if (pluginTemplate) {
-          rawCodeTemplate = pluginTemplate.codeTemplate;
-          language = pluginTemplate.language;
-          if (pluginTemplate.timeoutSeconds) timeoutSeconds = pluginTemplate.timeoutSeconds;
-          if (pluginTemplate.maxOutputSizeMb) maxOutputSizeMb = pluginTemplate.maxOutputSizeMb;
-          const packageRoot = pluginTemplate.skillPackage?.rootDir;
-          if (packageRoot) {
-            const mountMode = pluginTemplate.skillPackage?.mountMode || 'reference';
-            if (mountMode === 'copy') {
-              skillDir = resolve(workDir, 'skill');
-              this.skillRepoService.copyDirectoryTo(packageRoot, skillDir);
-            } else {
-              skillDir = packageRoot;
-            }
-          }
-        } else {
-          throw new Error(`Plugin skill "${pluginSkillName}" not found. Is the parent plugin enabled?`);
-        }
-      }
-
-      if (!rawCodeTemplate) {
-        throw new Error(
-          `Skill "${skillName}" has no codeTemplate. Add a code file, inline codeTemplate, or bind it to an installed plugin skill.`,
-        );
-      }
-
-      if (storageType !== 'plugin') {
-        skillDir = workDir;
-      }
-
-      const code = this.renderTemplate(rawCodeTemplate, inputArgs, execId, skillDir);
-      await this.execution.update({ executedCode: code });
-
-      // Load package whitelist for import validation
-      let packageWhitelist: string[] = [];
-      try {
-        const workerConfig = await (this as any).app.db.getRepository('skillWorkerConfigs').findOne();
-        if (workerConfig) {
-          const wl = parseJsonText(
-            workerConfig.get ? workerConfig.get('packageWhitelist') : workerConfig.packageWhitelist,
-            { python: [], node: [], apt: [] },
-          );
-          if (wl) {
-            packageWhitelist = (language === 'node' ? wl.node : wl.python) || [];
-          }
-        }
-      } catch {
-        // Skip whitelist validation if config not available
-      }
-
-      // Pre-hydrate execution workspace with package contents (multi-file support)
-      const fileId = skill.get ? skill.get('fileId') : skill.fileId;
-
-      // In multi-node setups, local cache might be missing on this specific worker node. Re-download from S3 if needed.
-      if (!require('fs').existsSync(this.skillRepoService.getSkillPath(skillName)) && fileId) {
-        const fmPlugin = (this as any).app.pm.get('@nocobase/plugin-file-manager') as any;
-        const attachment = await (this as any).app.db.getRepository('attachments').findOne({ filter: { id: fileId } });
-        if (fmPlugin && attachment) {
-          const rawStorageId = attachment.get('storageId') || attachment.storageId;
-          let matchedKey = null;
-          if (rawStorageId) {
-            const strId = String(rawStorageId);
-            for (const key of fmPlugin.storagesCache.keys()) {
-              if (String(key) === strId) {
-                matchedKey = key;
-                break;
-              }
-            }
-          }
-
-          const attachmentObj = typeof attachment.toJSON === 'function' ? attachment.toJSON() : { ...attachment };
-          if (matchedKey !== null) {
-            attachmentObj.storageId = matchedKey;
-          }
-
-          try {
-            const streamData = await fmPlugin.getFileStream(attachmentObj);
-            if (streamData?.stream) {
-              const tempZipPath = require('path').resolve(require('os').tmpdir(), `skill_${Date.now()}_exec.zip`);
-              await new Promise((resolve, reject) => {
-                const writeStream = require('fs').createWriteStream(tempZipPath);
-                streamData.stream.pipe(writeStream);
-                writeStream.on('finish', resolve);
-                writeStream.on('error', reject);
-                streamData.stream.on('error', reject);
-              });
-              await this.skillRepoService.extractSkillPackage(skillName, tempZipPath);
-              require('fs').unlinkSync(tempZipPath);
-              (this as any).app.logger.info(
-                `[skill-hub] Task ${execId}: Auto-restored skill package ${skillName} from S3/Storage`,
-              );
-            }
-          } catch (fetchErr) {
-            (this as any).app.logger.warn(
-              `[skill-hub] Task ${execId}: Failed to fetch skill package ${skillName} from storage`,
-              { error: fetchErr },
-            );
-          }
-        }
-      }
-
-      if (storageType !== 'plugin') {
-        this.skillRepoService.copySkillPackageTo(skillName, workDir);
-        skillDir = workDir;
-      }
-
-      const result = await this.sandboxRunner.execute({
-        language,
-        code,
-        execId,
-        timeoutSeconds: timeoutSeconds || 60,
-        maxOutputSizeMb: maxOutputSizeMb || 50,
-        skillDir,
-        signal: abortController.signal,
-        packageWhitelist,
-        onProgress: (progress) => {
-          // Worker → PubSub → Main Server → runtime.writer → SSE → Client
-          (this as any).app.pubSubManager.publish(`skill-hub.progress.${execId}`, progress);
-        },
-      });
-
-      if (result.success) {
-        const installMessage = await this.installGeneratedSkillIfRequested(execId);
-        if (installMessage) {
-          result.stdout = [result.stdout, installMessage].filter(Boolean).join('\n');
-        }
-      }
-
-      // Determine final status
-      let status: string;
-      if (result.canceled) {
-        status = 'canceled';
-      } else if (result.timedOut) {
-        status = 'timeout';
-      } else {
-        status = result.success ? 'succeeded' : 'failed';
-      }
-
-      await this.execution.update({
-        status,
-        stdout: result.stdout,
-        stderr: result.stderr,
-        outputFiles: stringifyJsonText(result.files, []),
-        durationMs: result.durationMs,
-      });
-
-      // Notify main server: task completed
-      await (this as any).app.pubSubManager.publish(`skill-hub.done.${execId}`, {
-        status,
-        stdout: result.stdout?.slice(0, 3000),
-        stderr: result.stderr?.slice(0, 1000),
-        files: result.files,
-        durationMs: result.durationMs,
-      });
-
-      // Log execution metrics
-      (this as any).app.logger.info(
-        `[skill-hub] Execution ${execId} ${status}: ` +
-          `skill=${skill.get ? skill.get('name') : skill.name}, ` +
-          `language=${language}, ` +
-          `duration=${result.durationMs}ms, ` +
-          `files=${result.files.length}, ` +
-          `outputSize=${this.fileManager.getTotalOutputSize(execId)}bytes`,
-      );
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-
-      await this.execution.update({
-        status: 'failed',
-        stderr: errorMessage,
-      });
-
-      await (this as any).app.pubSubManager.publish(`skill-hub.done.${execId}`, {
-        status: 'failed',
-        stderr: errorMessage,
-        files: [],
-        durationMs: 0,
-      });
-
-      (this as any).app.logger.error(`[skill-hub] Execution ${execId} error: ${errorMessage}`);
-    } finally {
-      // Always cleanup abort subscription
-      try {
-        await (this as any).app.pubSubManager.unsubscribe(abortChannel, abortCallback);
-      } catch {
-        // ignore cleanup errors
-      }
-    }
-  }
-
-  private renderTemplate(template: string, args: Record<string, any>, execId: string, skillDir?: string): string {
-    let code = template;
-    for (const [key, value] of Object.entries(args)) {
-      const serialized = typeof value === 'string' ? value : JSON.stringify(value);
-      // Raw injection — use for simple scalar values (canvas_format, transition, etc.)
-      code = code.replaceAll(`{{${key}}}`, serialized);
-      // Safe base64 injection — use for fields that may contain quotes/newlines (slides_svg, title, etc.)
-      // Template placeholder: {{key_b64}}
-      const b64 = Buffer.from(serialized, 'utf-8').toString('base64');
-      code = code.replaceAll(`{{${key}_b64}}`, b64);
-    }
-    // Inject outputDir so code templates can use {{outputDir}}
-    code = code.replaceAll('{{outputDir}}', this.fileManager.getOutputDir(execId).replace(/\\/g, '/'));
-    code = code.replaceAll('{{skillDir}}', (skillDir || '').replace(/\\/g, '/'));
-    return code;
-  }
-
-  private async installGeneratedSkillIfRequested(execId: string): Promise<string | null> {
-    const manifestPath = this.fileManager.getOutputFilePath(execId, 'skill-hub-install.json');
-    if (!manifestPath) return null;
-
-    let manifest: any;
-    try {
-      manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-    } catch (error) {
-      throw new Error(`Generated skill install manifest is invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
-    }
-
-    if (!manifest?.autoInstall) return null;
-
-    const skill = manifest.skill || {};
-    const name = String(skill.name || '').trim();
-    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
-      throw new Error(`Generated skill name "${name}" is invalid. Use lowercase letters, numbers, and hyphens.`);
-    }
-
-    const language = skill.language;
-    if (language !== 'python' && language !== 'node') {
-      throw new Error(`Generated skill "${name}" has unsupported language "${language}".`);
-    }
-
-    if (!skill.codeTemplate) {
-      throw new Error(`Generated skill "${name}" is missing codeTemplate.`);
-    }
-
-    const validator = new CodeValidator();
-    validator.validate(skill.codeTemplate, language);
-    await this.validateGeneratedSkillPackages(name, language, skill.packages);
-
-    const outputDir = this.fileManager.getOutputDir(execId);
-    const outputRoot = resolve(outputDir);
-    const packageDirName = String(manifest.packageDir || name);
-    const packageDir = resolve(outputRoot, packageDirName);
-    if ((packageDir !== outputRoot && !packageDir.startsWith(outputRoot + sep)) || !existsSync(packageDir)) {
-      throw new Error(`Generated skill package directory "${packageDirName}" was not found in output.`);
-    }
-
-    if (manifest.testInput && Object.keys(manifest.testInput).length > 0) {
-      const verifyExecId = `${execId}-verify-${name}`;
-      const verifyCode = this.renderTemplate(skill.codeTemplate, manifest.testInput, verifyExecId, packageDir);
-      const verifyResult = await this.sandboxRunner.execute({
-        language,
-        code: verifyCode,
-        execId: verifyExecId,
-        timeoutSeconds: Math.min(Number(skill.timeoutSeconds || 60), 30),
-        maxOutputSizeMb: Math.min(Number(skill.maxOutputSizeMb || 50), 10),
-        skillDir: packageDir,
-      });
-
-      if (!verifyResult.success) {
-        throw new Error(
-          `Generated skill "${name}" failed smoke verification: ${verifyResult.stderr || verifyResult.stdout || 'unknown error'}`,
-        );
-      }
-    }
-
-    const skillRepoDir = this.skillRepoService.getSkillPath(name);
-    if (existsSync(skillRepoDir)) {
-      rmSync(skillRepoDir, { recursive: true, force: true });
-    }
-    cpSync(packageDir, skillRepoDir, {
-      recursive: true,
-      force: true,
-      filter: (src) => {
-        const leaf = src.split(/[\\/]/).pop();
-        return !['node_modules', '.git', '__pycache__'].includes(leaf || '') && !src.endsWith('.pyc');
-      },
-    });
-
-    const values: any = {
-      name,
-      title: skill.title || name,
-      description: skill.description || '',
-      instructions: skill.instructions || '',
-      language,
-      codeTemplate: skill.codeTemplate,
-      inputSchema: stringifyJsonText(skill.inputSchema || { type: 'object', properties: {} }),
-      packages: stringifyJsonText(skill.packages || [], []),
-      timeoutSeconds: skill.timeoutSeconds || 60,
-      maxOutputSizeMb: skill.maxOutputSizeMb || 50,
-      enabled: skill.enabled !== false,
-      toolScope: skill.toolScope || 'CUSTOM',
-      autoCall: !!skill.autoCall,
-      storageType: 'local',
-      storageUrl: `local://generated/${name}`,
-    };
-
-    if (skill.interactionSchema) {
-      values.interactionSchema = stringifyJsonText(skill.interactionSchema);
-    }
-
-    const repo = (this as any).app.db.getRepository('skillDefinitions');
-    const existing = await repo.findOne({ filter: { name } });
-    if (existing) {
-      if (manifest.overwrite === false) {
-        throw new Error(`Skill "${name}" already exists and overwrite=false.`);
-      }
-      await repo.update({ filter: { name }, values });
-      return `[skill-hub] Updated generated skill "${name}" in Skill Hub.`;
-    }
-
-    await repo.create({ values });
-    return `[skill-hub] Installed generated skill "${name}" in Skill Hub.`;
-  }
-
-  private async validateGeneratedSkillPackages(name: string, language: 'python' | 'node', packages: any) {
-    if (!Array.isArray(packages) || packages.length === 0) return;
-    if (!packages.every((pkg) => typeof pkg === 'string' && pkg.trim())) {
-      throw new Error(`Generated skill "${name}" has invalid packages. Use an array of package names.`);
-    }
-
-    const workerConfig = await (this as any).app.db.getRepository('skillWorkerConfigs').findOne();
-    if (!workerConfig) return;
-
-    const whitelist = parseJsonText(
-      workerConfig.get ? workerConfig.get('packageWhitelist') : workerConfig.packageWhitelist,
-      null,
-    );
-    const allowed = whitelist?.[language];
-    if (!Array.isArray(allowed) || allowed.length === 0) return;
-
-    const allowedSet = new Set(allowed.map((pkg: string) => pkg.toLowerCase()));
-    const missing = packages
-      .map((pkg: string) => pkg.trim())
-      .filter((pkg: string) => !allowedSet.has(pkg.toLowerCase()));
-
-    if (missing.length > 0) {
-      throw new Error(
-        `Generated skill "${name}" requires ${language} package(s) not available in the Skill Hub worker environment: ` +
-          `${missing.join(', ')}. Add them to the worker environment and refresh/init Skill Hub before installing this skill.`,
-      );
-    }
-  }
-}
+import Application from '@nocobase/server';
+import { cpSync, existsSync, readFileSync, rmSync } from 'fs';
+import { resolve, sep } from 'path';
+import { SandboxRunner } from '../../services/SandboxRunner';
+import { FileManager } from '../../services/FileManager';
+import { SkillRepositoryService } from '../../services/SkillRepositoryService';
+import { CodeValidator } from '../../services/CodeValidator';
+import { parseJsonText, stringifyJsonText } from '../utils/json-fields';
+
+/**
+ * Lightweight abort controller compatible with the SandboxRunner signal interface.
+ * Worker-side: subscribes to PubSub abort channel and triggers signal.
+ */
+class TaskAbortController {
+  private listeners: Array<() => void> = [];
+  private _aborted = false;
+
+  get aborted() {
+    return this._aborted;
+  }
+
+  get signal() {
+    return {
+      addEventListener: (_event: string, listener: () => void) => {
+        if (this._aborted) {
+          listener();
+        } else {
+          this.listeners.push(listener);
+        }
+      },
+    };
+  }
+
+  abort() {
+    if (this._aborted) return;
+    this._aborted = true;
+    for (const listener of this.listeners) {
+      try {
+        listener();
+      } catch {
+        // ignore
+      }
+    }
+    this.listeners = [];
+  }
+}
+
+export class SkillExecutionTask {
+  constructor(
+    private execution: any,
+    private sandboxRunner: SandboxRunner,
+    private fileManager: FileManager,
+    private skillRepoService: SkillRepositoryService,
+    private app: Application,
+  ) {}
+
+  async run() {
+    const skill = this.execution.get('skill') || this.execution.skill;
+    const execId = String(this.execution.get('id'));
+
+    if (this.execution.get('status') !== 'running') {
+      await this.execution.update({ status: 'running' });
+    }
+
+    // Set up abort controller — listens for cancel from main server via PubSub
+    const abortController = new TaskAbortController();
+    const abortChannel = `skill-hub.abort.${execId}`;
+    const abortCallback = async () => {
+      (this as any).app.logger.info(`[skill-hub] Task ${execId}: received abort signal`);
+      abortController.abort();
+    };
+
+    try {
+      // Subscribe to abort channel before starting execution
+      await (this as any).app.pubSubManager.subscribe(abortChannel, abortCallback);
+
+      // Render code template with input args
+      const inputArgs = parseJsonText(this.execution.get('inputArgs'), {});
+      const storageType = skill.get ? skill.get('storageType') : skill.storageType;
+
+      let rawCodeTemplate = skill.get ? skill.get('codeTemplate') : skill.codeTemplate;
+      let language = skill.get ? skill.get('language') : skill.language;
+      let timeoutSeconds = skill.get ? skill.get('timeoutSeconds') : skill.timeoutSeconds;
+      let maxOutputSizeMb = skill.get ? skill.get('maxOutputSizeMb') : skill.maxOutputSizeMb;
+      const skillName = skill.get ? skill.get('name') : skill.name;
+      const workDir = this.fileManager.createExecDir(execId);
+      let skillDir: string | undefined;
+
+      if (storageType === 'plugin') {
+        const pluginSkillName = (skill.get ? skill.get('pluginSource') : skill.pluginSource) || skillName;
+        const orchestratorPlugin = (this as any).app.pm.get('plugin-agent-orchestrator') as any;
+        const skillHub = orchestratorPlugin?.skillHub;
+        let pluginTemplate =
+          typeof skillHub?.resolveSkillTemplate === 'function'
+            ? skillHub.resolveSkillTemplate(pluginSkillName)
+            : skillHub?.skillTemplates?.get(pluginSkillName);
+
+        // Fallback: discover dynamically if not cached (e.g. executed in worker before UI was loaded)
+        if (!pluginTemplate && skillHub) {
+          const allPlugins = (this as any).app.pm.getPlugins();
+          for (const [, pInstance] of allPlugins) {
+            if (typeof (pInstance as any).getSkillTemplates === 'function') {
+              const pluginSkills = (pInstance as any).getSkillTemplates();
+              if (Array.isArray(pluginSkills)) {
+                for (const s of pluginSkills) {
+                  if (s.name === pluginSkillName) {
+                    pluginTemplate =
+                      typeof skillHub?.hydrateSkillTemplate === 'function'
+                        ? skillHub.hydrateSkillTemplate(pInstance.name, s)
+                        : { ...s, pluginSource: s.name, pluginName: pInstance.name };
+                    skillHub.skillTemplates.set(s.name, pluginTemplate);
+                    break;
+                  }
+                }
+              }
+            }
+            if (pluginTemplate) break;
+          }
+        }
+
+        if (pluginTemplate) {
+          rawCodeTemplate = pluginTemplate.codeTemplate;
+          language = pluginTemplate.language;
+          if (pluginTemplate.timeoutSeconds) timeoutSeconds = pluginTemplate.timeoutSeconds;
+          if (pluginTemplate.maxOutputSizeMb) maxOutputSizeMb = pluginTemplate.maxOutputSizeMb;
+          const packageRoot = pluginTemplate.skillPackage?.rootDir;
+          if (packageRoot) {
+            const mountMode = pluginTemplate.skillPackage?.mountMode || 'reference';
+            if (mountMode === 'copy') {
+              skillDir = resolve(workDir, 'skill');
+              this.skillRepoService.copyDirectoryTo(packageRoot, skillDir);
+            } else {
+              skillDir = packageRoot;
+            }
+          }
+        } else {
+          throw new Error(`Plugin skill "${pluginSkillName}" not found. Is the parent plugin enabled?`);
+        }
+      }
+
+      if (!rawCodeTemplate) {
+        throw new Error(
+          `Skill "${skillName}" has no codeTemplate. Add a code file, inline codeTemplate, or bind it to an installed plugin skill.`,
+        );
+      }
+
+      if (storageType !== 'plugin') {
+        skillDir = workDir;
+      }
+
+      const code = this.renderTemplate(rawCodeTemplate, inputArgs, execId, skillDir);
+      await this.execution.update({ executedCode: code });
+
+      // Load package whitelist for import validation
+      let packageWhitelist: string[] = [];
+      try {
+        const workerConfig = await (this as any).app.db.getRepository('skillWorkerConfigs').findOne();
+        if (workerConfig) {
+          const wl = parseJsonText(
+            workerConfig.get ? workerConfig.get('packageWhitelist') : workerConfig.packageWhitelist,
+            { python: [], node: [], apt: [] },
+          );
+          if (wl) {
+            packageWhitelist = (language === 'node' ? wl.node : wl.python) || [];
+          }
+        }
+      } catch {
+        // Skip whitelist validation if config not available
+      }
+
+      // Pre-hydrate execution workspace with package contents (multi-file support)
+      const fileId = skill.get ? skill.get('fileId') : skill.fileId;
+
+      // In multi-node setups, local cache might be missing on this specific worker node. Re-download from S3 if needed.
+      if (!require('fs').existsSync(this.skillRepoService.getSkillPath(skillName)) && fileId) {
+        const fmPlugin = (this as any).app.pm.get('@nocobase/plugin-file-manager') as any;
+        const attachment = await (this as any).app.db.getRepository('attachments').findOne({ filter: { id: fileId } });
+        if (fmPlugin && attachment) {
+          const rawStorageId = attachment.get('storageId') || attachment.storageId;
+          let matchedKey = null;
+          if (rawStorageId) {
+            const strId = String(rawStorageId);
+            for (const key of fmPlugin.storagesCache.keys()) {
+              if (String(key) === strId) {
+                matchedKey = key;
+                break;
+              }
+            }
+          }
+
+          const attachmentObj = typeof attachment.toJSON === 'function' ? attachment.toJSON() : { ...attachment };
+          if (matchedKey !== null) {
+            attachmentObj.storageId = matchedKey;
+          }
+
+          try {
+            const streamData = await fmPlugin.getFileStream(attachmentObj);
+            if (streamData?.stream) {
+              const tempZipPath = require('path').resolve(require('os').tmpdir(), `skill_${Date.now()}_exec.zip`);
+              await new Promise((resolve, reject) => {
+                const writeStream = require('fs').createWriteStream(tempZipPath);
+                streamData.stream.pipe(writeStream);
+                writeStream.on('finish', resolve);
+                writeStream.on('error', reject);
+                streamData.stream.on('error', reject);
+              });
+              await this.skillRepoService.extractSkillPackage(skillName, tempZipPath);
+              require('fs').unlinkSync(tempZipPath);
+              (this as any).app.logger.info(
+                `[skill-hub] Task ${execId}: Auto-restored skill package ${skillName} from S3/Storage`,
+              );
+            }
+          } catch (fetchErr) {
+            (this as any).app.logger.warn(
+              `[skill-hub] Task ${execId}: Failed to fetch skill package ${skillName} from storage`,
+              { error: fetchErr },
+            );
+          }
+        }
+      }
+
+      if (storageType !== 'plugin') {
+        this.skillRepoService.copySkillPackageTo(skillName, workDir);
+        skillDir = workDir;
+      }
+
+      const result = await this.sandboxRunner.execute({
+        language,
+        code,
+        execId,
+        timeoutSeconds: timeoutSeconds || 60,
+        maxOutputSizeMb: maxOutputSizeMb || 50,
+        skillDir,
+        signal: abortController.signal,
+        packageWhitelist,
+        onProgress: (progress) => {
+          // Worker → PubSub → Main Server → runtime.writer → SSE → Client
+          (this as any).app.pubSubManager.publish(`skill-hub.progress.${execId}`, progress);
+        },
+      });
+
+      if (result.success) {
+        const installMessage = await this.installGeneratedSkillIfRequested(execId);
+        if (installMessage) {
+          result.stdout = [result.stdout, installMessage].filter(Boolean).join('\n');
+        }
+      }
+
+      // Determine final status
+      let status: string;
+      if (result.canceled) {
+        status = 'canceled';
+      } else if (result.timedOut) {
+        status = 'timeout';
+      } else {
+        status = result.success ? 'succeeded' : 'failed';
+      }
+
+      await this.execution.update({
+        status,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        outputFiles: stringifyJsonText(result.files, []),
+        durationMs: result.durationMs,
+      });
+
+      // Notify main server: task completed
+      await (this as any).app.pubSubManager.publish(`skill-hub.done.${execId}`, {
+        status,
+        stdout: result.stdout?.slice(0, 3000),
+        stderr: result.stderr?.slice(0, 1000),
+        files: result.files,
+        durationMs: result.durationMs,
+      });
+
+      // Log execution metrics
+      (this as any).app.logger.info(
+        `[skill-hub] Execution ${execId} ${status}: ` +
+          `skill=${skill.get ? skill.get('name') : skill.name}, ` +
+          `language=${language}, ` +
+          `duration=${result.durationMs}ms, ` +
+          `files=${result.files.length}, ` +
+          `outputSize=${this.fileManager.getTotalOutputSize(execId)}bytes`,
+      );
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+
+      await this.execution.update({
+        status: 'failed',
+        stderr: errorMessage,
+      });
+
+      await (this as any).app.pubSubManager.publish(`skill-hub.done.${execId}`, {
+        status: 'failed',
+        stderr: errorMessage,
+        files: [],
+        durationMs: 0,
+      });
+
+      (this as any).app.logger.error(`[skill-hub] Execution ${execId} error: ${errorMessage}`);
+    } finally {
+      // Always cleanup abort subscription
+      try {
+        await (this as any).app.pubSubManager.unsubscribe(abortChannel, abortCallback);
+      } catch {
+        // ignore cleanup errors
+      }
+    }
+  }
+
+  private renderTemplate(template: string, args: Record<string, any>, execId: string, skillDir?: string): string {
+    let code = template;
+    for (const [key, value] of Object.entries(args)) {
+      const serialized = typeof value === 'string' ? value : JSON.stringify(value);
+      // Raw injection — use for simple scalar values (canvas_format, transition, etc.)
+      code = code.replaceAll(`{{${key}}}`, serialized);
+      // Safe base64 injection — use for fields that may contain quotes/newlines (slides_svg, title, etc.)
+      // Template placeholder: {{key_b64}}
+      const b64 = Buffer.from(serialized, 'utf-8').toString('base64');
+      code = code.replaceAll(`{{${key}_b64}}`, b64);
+    }
+    // Inject outputDir so code templates can use {{outputDir}}
+    code = code.replaceAll('{{outputDir}}', this.fileManager.getOutputDir(execId).replace(/\\/g, '/'));
+    code = code.replaceAll('{{skillDir}}', (skillDir || '').replace(/\\/g, '/'));
+    return code;
+  }
+
+  private async installGeneratedSkillIfRequested(execId: string): Promise<string | null> {
+    const manifestPath = this.fileManager.getOutputFilePath(execId, 'skill-hub-install.json');
+    if (!manifestPath) return null;
+
+    let manifest: any;
+    try {
+      manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    } catch (error) {
+      throw new Error(
+        `Generated skill install manifest is invalid JSON: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+
+    if (!manifest?.autoInstall) return null;
+
+    const skill = manifest.skill || {};
+    const name = String(skill.name || '').trim();
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
+      throw new Error(`Generated skill name "${name}" is invalid. Use lowercase letters, numbers, and hyphens.`);
+    }
+
+    const language = skill.language;
+    if (language !== 'python' && language !== 'node') {
+      throw new Error(`Generated skill "${name}" has unsupported language "${language}".`);
+    }
+
+    if (!skill.codeTemplate) {
+      throw new Error(`Generated skill "${name}" is missing codeTemplate.`);
+    }
+
+    const validator = new CodeValidator();
+    validator.validate(skill.codeTemplate, language);
+    await this.validateGeneratedSkillPackages(name, language, skill.packages);
+
+    const outputDir = this.fileManager.getOutputDir(execId);
+    const outputRoot = resolve(outputDir);
+    const packageDirName = String(manifest.packageDir || name);
+    const packageDir = resolve(outputRoot, packageDirName);
+    if ((packageDir !== outputRoot && !packageDir.startsWith(outputRoot + sep)) || !existsSync(packageDir)) {
+      throw new Error(`Generated skill package directory "${packageDirName}" was not found in output.`);
+    }
+
+    if (manifest.testInput && Object.keys(manifest.testInput).length > 0) {
+      const verifyExecId = `${execId}-verify-${name}`;
+      const verifyCode = this.renderTemplate(skill.codeTemplate, manifest.testInput, verifyExecId, packageDir);
+      const verifyResult = await this.sandboxRunner.execute({
+        language,
+        code: verifyCode,
+        execId: verifyExecId,
+        timeoutSeconds: Math.min(Number(skill.timeoutSeconds || 60), 30),
+        maxOutputSizeMb: Math.min(Number(skill.maxOutputSizeMb || 50), 10),
+        skillDir: packageDir,
+      });
+
+      if (!verifyResult.success) {
+        throw new Error(
+          `Generated skill "${name}" failed smoke verification: ${
+            verifyResult.stderr || verifyResult.stdout || 'unknown error'
+          }`,
+        );
+      }
+    }
+
+    const skillRepoDir = this.skillRepoService.getSkillPath(name);
+    if (existsSync(skillRepoDir)) {
+      rmSync(skillRepoDir, { recursive: true, force: true });
+    }
+    cpSync(packageDir, skillRepoDir, {
+      recursive: true,
+      force: true,
+      filter: (src) => {
+        const leaf = src.split(/[\\/]/).pop();
+        return !['node_modules', '.git', '__pycache__'].includes(leaf || '') && !src.endsWith('.pyc');
+      },
+    });
+
+    const values: any = {
+      name,
+      title: skill.title || name,
+      description: skill.description || '',
+      instructions: skill.instructions || '',
+      language,
+      codeTemplate: skill.codeTemplate,
+      inputSchema: stringifyJsonText(skill.inputSchema || { type: 'object', properties: {} }),
+      packages: stringifyJsonText(skill.packages || [], []),
+      timeoutSeconds: skill.timeoutSeconds || 60,
+      maxOutputSizeMb: skill.maxOutputSizeMb || 50,
+      enabled: skill.enabled !== false,
+      toolScope: skill.toolScope || 'CUSTOM',
+      autoCall: !!skill.autoCall,
+      storageType: 'local',
+      storageUrl: `local://generated/${name}`,
+    };
+
+    if (skill.interactionSchema) {
+      values.interactionSchema = stringifyJsonText(skill.interactionSchema);
+    }
+
+    const repo = (this as any).app.db.getRepository('skillDefinitions');
+    const existing = await repo.findOne({ filter: { name } });
+    if (existing) {
+      if (manifest.overwrite === false) {
+        throw new Error(`Skill "${name}" already exists and overwrite=false.`);
+      }
+      await repo.update({ filter: { name }, values });
+      return `[skill-hub] Updated generated skill "${name}" in Skill Hub.`;
+    }
+
+    await repo.create({ values });
+    return `[skill-hub] Installed generated skill "${name}" in Skill Hub.`;
+  }
+
+  private async validateGeneratedSkillPackages(name: string, language: 'python' | 'node', packages: any) {
+    if (!Array.isArray(packages) || packages.length === 0) return;
+    if (!packages.every((pkg) => typeof pkg === 'string' && pkg.trim())) {
+      throw new Error(`Generated skill "${name}" has invalid packages. Use an array of package names.`);
+    }
+
+    const workerConfig = await (this as any).app.db.getRepository('skillWorkerConfigs').findOne();
+    if (!workerConfig) return;
+
+    const whitelist = parseJsonText(
+      workerConfig.get ? workerConfig.get('packageWhitelist') : workerConfig.packageWhitelist,
+      null,
+    );
+    const allowed = whitelist?.[language];
+    if (!Array.isArray(allowed) || allowed.length === 0) return;
+
+    const allowedSet = new Set(allowed.map((pkg: string) => pkg.toLowerCase()));
+    const missing = packages
+      .map((pkg: string) => pkg.trim())
+      .filter((pkg: string) => !allowedSet.has(pkg.toLowerCase()));
+
+    if (missing.length > 0) {
+      throw new Error(
+        `Generated skill "${name}" requires ${language} package(s) not available in the Skill Hub worker environment: ` +
+          `${missing.join(
+            ', ',
+          )}. Add them to the worker environment and refresh/init Skill Hub before installing this skill.`,
+      );
+    }
+  }
+}