sophhub 0.4.19 → 0.4.21

package/skills/bot-api-status/src/scripts/secret.py

@@ -1,497 +1,497 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import argparse
-import json
-import os
-from pathlib import Path
-import secrets
-import sys
-from typing import Any
-
-
-DEFAULT_CONFIG_PATH = Path(os.path.expanduser(os.environ.get("OPENCLAW_CONFIG_PATH", "~/.openclaw/openclaw.json"))).resolve()
-DEFAULT_BASE_URL_PATH = Path("/home/node/.openclaw/.base.json")
-BASEURL_FETCH_FAILED_MESSAGE = "获取BASEURL失败，刷新页面或者重新登录后重试。"
-
-
-def load_json(path: Path) -> dict[str, Any]:
-    if not path.exists():
-        raise FileNotFoundError(f"Config file not found: {path}")
-    try:
-        with path.open("r", encoding="utf-8") as f:
-            return json.load(f)
-    except json.JSONDecodeError as exc:
-        raise ValueError(f"Invalid JSON in config file: {path}") from exc
-
-
-def dump_json(path: Path, data: dict[str, Any]) -> None:
-    with path.open("w", encoding="utf-8") as f:
-        json.dump(data, f, ensure_ascii=False, indent=2)
-        f.write("\n")
-
-
-def normalize_base_url(base_url: str | None) -> str | None:
-    if not isinstance(base_url, str):
-        return None
-    normalized = base_url.strip().rstrip("/")
-    return normalized or None
-
-
-def read_base_url(base_url_path: Path = DEFAULT_BASE_URL_PATH) -> str | None:
-    try:
-        data = load_json(base_url_path)
-    except (FileNotFoundError, OSError, ValueError):
-        return None
-    return normalize_base_url(data.get("base_url"))
-
-
-def require_base_url(base_url_path: Path = DEFAULT_BASE_URL_PATH) -> str:
-    base_url = read_base_url(base_url_path)
-    if not base_url:
-        raise ValueError(BASEURL_FETCH_FAILED_MESSAGE)
-    return base_url
-
-
-def build_bot_api_url(account_id: str | None, path_suffix: str, base_url: str | None = None) -> str | None:
-    if not isinstance(account_id, str) or not account_id.strip():
-        return None
-    segment = account_id.strip()
-    path = f"/bot-api/v2/{segment}/{path_suffix}"
-    normalized = normalize_base_url(base_url)
-    if normalized:
-        return f"{normalized}{path}"
-    return None
-
-
-def openclaw_root(config_path: Path) -> Path:
-    return config_path.expanduser().resolve().parent
-
-
-def find_nearest_agent_config(start_dir: Path | None = None) -> Path | None:
-    current = (start_dir or Path.cwd()).resolve()
-    for candidate in [current, *current.parents]:
-        config_path = candidate / ".config.json"
-        if config_path.is_file():
-            return config_path
-    return None
-
-
-def read_agent_definition(config_path: Path | None) -> dict[str, Any] | None:
-    if config_path is None or not config_path.is_file():
-        return None
-    data = load_json(config_path)
-    agent_id = data.get("agent_id")
-    if not isinstance(agent_id, str) or not agent_id.strip():
-        return None
-    return data
-
-
-def read_install_state_source_agent_id(config_path: Path, openclaw_id: str) -> str | None:
-    state_path = openclaw_root(config_path) / "agents" / openclaw_id / "install-state.json"
-    if not state_path.is_file():
-        return None
-    try:
-        data = load_json(state_path)
-    except (OSError, ValueError):
-        return None
-    source_agent_id = data.get("agent_id")
-    return source_agent_id if isinstance(source_agent_id, str) else None
-
-
-def read_agent_dir_source_agent_id(agent_entry: dict[str, Any]) -> str | None:
-    agent_dir = agent_entry.get("agentDir")
-    if not isinstance(agent_dir, str) or not agent_dir.strip():
-        return None
-    config_path = Path(agent_dir).expanduser().resolve() / ".config.json"
-    if not config_path.is_file():
-        return None
-    try:
-        data = load_json(config_path)
-    except (OSError, ValueError):
-        return None
-    source_agent_id = data.get("agent_id")
-    return source_agent_id if isinstance(source_agent_id, str) else None
-
-
-def entry_matches_source_agent(config_path: Path, agent_entry: dict[str, Any], source_agent_id: str) -> bool:
-    entry_id = agent_entry.get("id")
-    if entry_id == source_agent_id:
-        return True
-    if isinstance(entry_id, str) and read_install_state_source_agent_id(config_path, entry_id) == source_agent_id:
-        return True
-    return read_agent_dir_source_agent_id(agent_entry) == source_agent_id
-
-
-def is_path_within(path_value: Path, parent_value: Path) -> bool:
-    try:
-        path_value.relative_to(parent_value)
-        return True
-    except ValueError:
-        return False
-
-
-def find_agent_entry_by_workspace(config: dict[str, Any], cwd: Path) -> dict[str, Any] | None:
-    agents = config.get("agents", {}).get("list", [])
-    best_match: dict[str, Any] | None = None
-    best_len = -1
-    for agent_entry in agents:
-        if not isinstance(agent_entry, dict):
-            continue
-        workspace = agent_entry.get("workspace")
-        if not isinstance(workspace, str) or not workspace.strip():
-            continue
-        workspace_path = Path(workspace).expanduser().resolve()
-        if not is_path_within(cwd, workspace_path):
-            continue
-        workspace_len = len(str(workspace_path))
-        if workspace_len > best_len:
-            best_match = agent_entry
-            best_len = workspace_len
-    return best_match
-
-
-def resolve_current_agent(config_path: Path, cwd: Path | None = None) -> dict[str, Any]:
-    current_dir = (cwd or Path.cwd()).resolve()
-    local_config_path = find_nearest_agent_config(current_dir)
-    agent_def = read_agent_definition(local_config_path)
-    source_agent_id = agent_def.get("agent_id") if agent_def else None
-    config = load_json(config_path)
-    agents = config.get("agents", {}).get("list", [])
-
-    entry: dict[str, Any] | None = None
-    if isinstance(source_agent_id, str) and source_agent_id:
-        for agent_entry in agents:
-            if isinstance(agent_entry, dict) and entry_matches_source_agent(config_path, agent_entry, source_agent_id):
-                entry = agent_entry
-                break
-    if entry is None:
-        entry = find_agent_entry_by_workspace(config, current_dir)
-
-    if entry is None:
-        raise ValueError("无法识别当前 Agent，请在已安装 Agent 的 workspace 中执行。")
-
-    openclaw_id = entry.get("id")
-    if not isinstance(openclaw_id, str) or not openclaw_id.strip():
-        raise ValueError("当前 Agent 在 openclaw.json 中缺少 id。")
-
-    workspace = entry.get("workspace")
-    if not isinstance(workspace, str) or not workspace.strip():
-        raise ValueError("当前 Agent 在 openclaw.json 中缺少 workspace。")
-
-    account_ids = find_account_ids_by_agent_id(config, openclaw_id)
-    display_name = (
-        entry.get("name")
-        or entry.get("identity", {}).get("name")
-        or (agent_def or {}).get("description")
-        or openclaw_id
-    )
-    if not isinstance(display_name, str) or not display_name.strip():
-        display_name = openclaw_id
-
-    return {
-        "config": config,
-        "config_path": config_path,
-        "local_config_path": local_config_path,
-        "agent_definition": agent_def,
-        "source_agent_id": source_agent_id or openclaw_id,
-        "openclaw_id": openclaw_id,
-        "workspace": workspace,
-        "display_name": display_name.strip(),
-        "account_ids": account_ids,
-    }
-
-
-def find_account_ids_by_agent_id(config: dict[str, Any], agent_id: str) -> list[str]:
-    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
-    result: list[str] = []
-    for account_id, account in accounts.items():
-        if isinstance(account, dict) and account.get("agentId") == agent_id:
-            result.append(account_id)
-    return sorted(result)
-
-
-def get_primary_account(config: dict[str, Any], account_ids: list[str]) -> tuple[str | None, dict[str, Any] | None]:
-    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
-    for account_id in account_ids:
-        account = accounts.get(account_id)
-        if isinstance(account, dict):
-            return account_id, account
-    return None, None
-
-
-def get_plugin_enabled(config: dict[str, Any]) -> bool:
-    allow = config.get("plugins", {}).get("allow", [])
-    entries = config.get("plugins", {}).get("entries", {})
-    allow_enabled = isinstance(allow, list) and "bot-api" in allow
-    entry_enabled = isinstance(entries, dict) and isinstance(entries.get("bot-api"), dict) and entries["bot-api"].get("enabled") is True
-    return allow_enabled and entry_enabled
-
-
-def set_local_bot_api_enabled(local_config_path: Path | None, enabled: bool) -> bool:
-    if local_config_path is None or not local_config_path.is_file():
-        return False
-    data = load_json(local_config_path)
-    data["bot_api_enabled"] = enabled
-    dump_json(local_config_path, data)
-    return True
-
-
-def build_status(context: dict[str, Any]) -> dict[str, Any]:
-    config = context["config"]
-    account_id, account = get_primary_account(config, context["account_ids"])
-    local_agent_def = context.get("agent_definition") or {}
-    base_url = context.get("base_url")
-    account_enabled = bool(account.get("enabled")) if isinstance(account, dict) else False
-    plugin_enabled = get_plugin_enabled(config)
-    bot_api_url = build_bot_api_url(account_id, "chat", base_url)
-    bot_api_stream_url = build_bot_api_url(account_id, "chat-stream", base_url)
-    return {
-        "source_agent_id": context["source_agent_id"],
-        "openclaw_id": context["openclaw_id"],
-        "workspace": context["workspace"],
-        "display_name": context["display_name"],
-        "config_bot_api_enabled": bool(local_agent_def.get("bot_api_enabled")),
-        "plugin_enabled": plugin_enabled,
-        "account_exists": bool(account),
-        "account_id": account_id,
-        "bot_api_url": bot_api_url,
-        "bot_api_stream_url": bot_api_stream_url,
-        "enabled": bool(account) and account_enabled and plugin_enabled,
-        "account_enabled": account_enabled,
-        "api_secret": account.get("apiSecret") if isinstance(account, dict) else None,
-        "security_notice": "🔒 请勿在公开群聊、工单或截图中泄漏 api_secret。",
-    }
-
-
-def ensure_bot_api(context: dict[str, Any]) -> dict[str, Any]:
-    config = context["config"]
-    config.setdefault("plugins", {})
-    allow = config["plugins"].setdefault("allow", [])
-    if "bot-api" not in allow:
-        allow.append("bot-api")
-    entries = config["plugins"].setdefault("entries", {})
-    entries.setdefault("bot-api", {})["enabled"] = True
-
-    channels = config.setdefault("channels", {})
-    bot_api = channels.setdefault("bot-api", {})
-    accounts = bot_api.setdefault("accounts", {})
-
-    account_id, existing_account = get_primary_account(config, context["account_ids"])
-    if account_id is None:
-        account_id = context["source_agent_id"]
-
-    api_secret = None
-    if isinstance(existing_account, dict):
-        api_secret = existing_account.get("apiSecret")
-    if not isinstance(api_secret, str) or not api_secret:
-        api_secret = secrets.token_hex(32)
-
-    accounts[account_id] = {
-        "agentId": context["openclaw_id"],
-        "name": context["display_name"],
-        "apiSecret": api_secret,
-        "enabled": True,
-    }
-
-    dump_json(context["config_path"], config)
-    set_local_bot_api_enabled(context["local_config_path"], True)
-    if isinstance(context.get("agent_definition"), dict):
-        context["agent_definition"]["bot_api_enabled"] = True
-    context["account_ids"] = find_account_ids_by_agent_id(config, context["openclaw_id"])
-    return {
-        "action": "created" if existing_account is None else "updated",
-        **build_status(context),
-    }
-
-
-def delete_bot_api(context: dict[str, Any]) -> dict[str, Any]:
-    config = context["config"]
-    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
-    removed_account_ids: list[str] = []
-    for account_id in list(context["account_ids"]):
-        if account_id in accounts:
-            removed_account_ids.append(account_id)
-            del accounts[account_id]
-
-    remaining_accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
-    if not remaining_accounts:
-        config.setdefault("plugins", {})
-        allow = config.get("plugins", {}).get("allow", [])
-        if isinstance(allow, list):
-            config["plugins"]["allow"] = [item for item in allow if item != "bot-api"]
-        bot_api_entry = config.get("plugins", {}).get("entries", {}).get("bot-api")
-        if isinstance(bot_api_entry, dict):
-            bot_api_entry["enabled"] = False
-
-    dump_json(context["config_path"], config)
-    set_local_bot_api_enabled(context["local_config_path"], False)
-    if isinstance(context.get("agent_definition"), dict):
-        context["agent_definition"]["bot_api_enabled"] = False
-    context["account_ids"] = []
-    return {
-        "action": "deleted",
-        "removed_account_ids": removed_account_ids,
-        **build_status(context),
-    }
-
-
-def reset_bot_api_secret(context: dict[str, Any]) -> dict[str, Any]:
-    config = context["config"]
-    account_id, account = get_primary_account(config, context["account_ids"])
-    if account_id is None or not isinstance(account, dict):
-        raise ValueError("当前 Agent 尚未创建 bot-api，无法重置密钥。")
-
-    new_secret = secrets.token_hex(32)
-    account["apiSecret"] = new_secret
-    config["channels"]["bot-api"]["accounts"][account_id] = account
-    dump_json(context["config_path"], config)
-    return {
-        "action": "reset",
-        "new_secret": new_secret,
-        **build_status(context),
-    }
-
-
-def _fmt_secret(value: object) -> str:
-    if isinstance(value, str) and value.strip():
-        return value.strip()
-    return "📭 暂无"
-
-
-def _fmt_url(value: object) -> str:
-    if isinstance(value, str) and value.strip():
-        return value.strip()
-    return "📭 暂无"
-
-
-def _fmt_identity(value: object) -> str:
-    if isinstance(value, str) and value.strip():
-        return value.strip()
-    return "📭 暂无"
-
-
-def _print_agent_identity(display_name: object, source_agent_id: object) -> None:
-    print(f"📛 名字：{_fmt_identity(display_name)}")
-    print(f"🆔 source_agent_id：{_fmt_identity(source_agent_id)}")
-
-
-def _print_link_block(url: str, stream_url: str, baseurl_note: str) -> None:
-    if url != "📭 暂无":
-        print(f"🔗 非流式链接：{url}")
-    if stream_url != "📭 暂无":
-        print(f"🔗 流式链接：{stream_url}")
-
-
-def print_human_response(command: str, payload: dict[str, Any]) -> int:
-    """非 --json 时输出，风格与 SKILL 模板一致。"""
-    action = payload.get("action")
-    enabled = payload.get("enabled")
-    url = _fmt_url(payload.get("bot_api_url"))
-    stream_url = _fmt_url(payload.get("bot_api_stream_url"))
-    secret = _fmt_secret(payload.get("api_secret") or payload.get("new_secret"))
-
-    if command in {"get", "status"}:
-        state = "🟢 开启" if enabled else "⚪ 关闭"
-        print(f"📋 🤖 bot-api 状态：{state}")
-        print()
-        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
-        print()
-        _print_link_block(url, stream_url, "")
-        print(f"🔑 密钥：{secret}")
-        return 0
-
-    if command == "create":
-        title = "已更新" if action == "updated" else "已创建"
-        prefix = "📝" if action == "updated" else "✨"
-        print(f"{prefix} 🤖 bot-api {title}")
-        print()
-        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
-        print()
-        _print_link_block(url, stream_url, "")
-        print(f"🔑 密钥：{secret}")
-        print()
-        print("🔒 请妥善保管，勿对外转发或截图。")
-        return 0
-
-    if command == "delete":
-        print("🛑 🤖 bot-api 已关闭")
-        print()
-        print("📴 当前 Agent 不再通过 bot-api 对外提供服务。")
-        return 0
-
-    if command == "reset":
-        if not isinstance(payload.get("new_secret"), str) or not payload["new_secret"].strip():
-            print("⚠️ 当前 Agent 尚未创建 bot-api，无法重置密钥。", file=sys.stderr)
-            return 1
-        print("🔄 🤖 bot-api 密钥已更新")
-        print()
-        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
-        print()
-        _print_link_block(url, stream_url, "")
-        print(f"🔑 新密钥：{secret}")
-        print()
-        print("🔒 请妥善保管，勿对外转发或截图。")
-        return 0
-
-    print(f"❓ 未知命令：{command}", file=sys.stderr)
-    return 1
-
-
-def create_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(description="管理当前 Agent 的 bot-api 与 API Secret")
-    parser.add_argument(
-        "--config",
-        default=str(DEFAULT_CONFIG_PATH),
-        help="openclaw.json 路径",
-    )
-    parser.add_argument(
-        "--json",
-        action="store_true",
-        help="输出 JSON",
-    )
-    parser.add_argument(
-        "command",
-        choices=["status", "create", "delete", "reset", "get"],
-        help="执行的动作：status/create/delete/reset，get 为 status 的兼容别名",
-    )
-    return parser
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = create_parser()
-    args = parser.parse_args(argv)
-    config_path = Path(args.config).expanduser().resolve()
-
-    try:
-        context = resolve_current_agent(config_path)
-        if args.command in {"status", "get", "create", "reset"}:
-            context["base_url"] = require_base_url()
-        if args.command in {"status", "get"}:
-            payload = {"action": "status", **build_status(context)}
-        elif args.command == "create":
-            payload = ensure_bot_api(context)
-        elif args.command == "delete":
-            payload = delete_bot_api(context)
-        elif args.command == "reset":
-            payload = reset_bot_api_secret(context)
-        else:
-            raise ValueError(f"Unsupported command: {args.command}")
-    except Exception as exc:  # pragma: no cover - CLI fallback
-        if args.json:
-            json.dump({"ok": False, "error": str(exc)}, sys.stdout, ensure_ascii=False, indent=2)
-            sys.stdout.write("\n")
-        else:
-            print(f"⚠️ {exc}", file=sys.stderr)
-        return 1
-
-    if args.json:
-        json.dump({"ok": True, **payload}, sys.stdout, ensure_ascii=False, indent=2)
-        sys.stdout.write("\n")
-        return 0
-
-    return print_human_response(args.command, payload)
-
-
-if __name__ == "__main__":
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import secrets
+import sys
+from typing import Any
+
+
+DEFAULT_CONFIG_PATH = Path(os.path.expanduser(os.environ.get("OPENCLAW_CONFIG_PATH", "~/.openclaw/openclaw.json"))).resolve()
+DEFAULT_BASE_URL_PATH = Path("/home/node/.openclaw/.base.json")
+BASEURL_FETCH_FAILED_MESSAGE = "获取BASEURL失败，刷新页面或者重新登录后重试。"
+
+
+def load_json(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        raise FileNotFoundError(f"Config file not found: {path}")
+    try:
+        with path.open("r", encoding="utf-8") as f:
+            return json.load(f)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"Invalid JSON in config file: {path}") from exc
+
+
+def dump_json(path: Path, data: dict[str, Any]) -> None:
+    with path.open("w", encoding="utf-8") as f:
+        json.dump(data, f, ensure_ascii=False, indent=2)
+        f.write("\n")
+
+
+def normalize_base_url(base_url: str | None) -> str | None:
+    if not isinstance(base_url, str):
+        return None
+    normalized = base_url.strip().rstrip("/")
+    return normalized or None
+
+
+def read_base_url(base_url_path: Path = DEFAULT_BASE_URL_PATH) -> str | None:
+    try:
+        data = load_json(base_url_path)
+    except (FileNotFoundError, OSError, ValueError):
+        return None
+    return normalize_base_url(data.get("base_url"))
+
+
+def require_base_url(base_url_path: Path = DEFAULT_BASE_URL_PATH) -> str:
+    base_url = read_base_url(base_url_path)
+    if not base_url:
+        raise ValueError(BASEURL_FETCH_FAILED_MESSAGE)
+    return base_url
+
+
+def build_bot_api_url(account_id: str | None, path_suffix: str, base_url: str | None = None) -> str | None:
+    if not isinstance(account_id, str) or not account_id.strip():
+        return None
+    segment = account_id.strip()
+    path = f"/bot-api/v2/{segment}/{path_suffix}"
+    normalized = normalize_base_url(base_url)
+    if normalized:
+        return f"{normalized}{path}"
+    return None
+
+
+def openclaw_root(config_path: Path) -> Path:
+    return config_path.expanduser().resolve().parent
+
+
+def find_nearest_agent_config(start_dir: Path | None = None) -> Path | None:
+    current = (start_dir or Path.cwd()).resolve()
+    for candidate in [current, *current.parents]:
+        config_path = candidate / ".config.json"
+        if config_path.is_file():
+            return config_path
+    return None
+
+
+def read_agent_definition(config_path: Path | None) -> dict[str, Any] | None:
+    if config_path is None or not config_path.is_file():
+        return None
+    data = load_json(config_path)
+    agent_id = data.get("agent_id")
+    if not isinstance(agent_id, str) or not agent_id.strip():
+        return None
+    return data
+
+
+def read_install_state_source_agent_id(config_path: Path, openclaw_id: str) -> str | None:
+    state_path = openclaw_root(config_path) / "agents" / openclaw_id / "install-state.json"
+    if not state_path.is_file():
+        return None
+    try:
+        data = load_json(state_path)
+    except (OSError, ValueError):
+        return None
+    source_agent_id = data.get("agent_id")
+    return source_agent_id if isinstance(source_agent_id, str) else None
+
+
+def read_agent_dir_source_agent_id(agent_entry: dict[str, Any]) -> str | None:
+    agent_dir = agent_entry.get("agentDir")
+    if not isinstance(agent_dir, str) or not agent_dir.strip():
+        return None
+    config_path = Path(agent_dir).expanduser().resolve() / ".config.json"
+    if not config_path.is_file():
+        return None
+    try:
+        data = load_json(config_path)
+    except (OSError, ValueError):
+        return None
+    source_agent_id = data.get("agent_id")
+    return source_agent_id if isinstance(source_agent_id, str) else None
+
+
+def entry_matches_source_agent(config_path: Path, agent_entry: dict[str, Any], source_agent_id: str) -> bool:
+    entry_id = agent_entry.get("id")
+    if entry_id == source_agent_id:
+        return True
+    if isinstance(entry_id, str) and read_install_state_source_agent_id(config_path, entry_id) == source_agent_id:
+        return True
+    return read_agent_dir_source_agent_id(agent_entry) == source_agent_id
+
+
+def is_path_within(path_value: Path, parent_value: Path) -> bool:
+    try:
+        path_value.relative_to(parent_value)
+        return True
+    except ValueError:
+        return False
+
+
+def find_agent_entry_by_workspace(config: dict[str, Any], cwd: Path) -> dict[str, Any] | None:
+    agents = config.get("agents", {}).get("list", [])
+    best_match: dict[str, Any] | None = None
+    best_len = -1
+    for agent_entry in agents:
+        if not isinstance(agent_entry, dict):
+            continue
+        workspace = agent_entry.get("workspace")
+        if not isinstance(workspace, str) or not workspace.strip():
+            continue
+        workspace_path = Path(workspace).expanduser().resolve()
+        if not is_path_within(cwd, workspace_path):
+            continue
+        workspace_len = len(str(workspace_path))
+        if workspace_len > best_len:
+            best_match = agent_entry
+            best_len = workspace_len
+    return best_match
+
+
+def resolve_current_agent(config_path: Path, cwd: Path | None = None) -> dict[str, Any]:
+    current_dir = (cwd or Path.cwd()).resolve()
+    local_config_path = find_nearest_agent_config(current_dir)
+    agent_def = read_agent_definition(local_config_path)
+    source_agent_id = agent_def.get("agent_id") if agent_def else None
+    config = load_json(config_path)
+    agents = config.get("agents", {}).get("list", [])
+
+    entry: dict[str, Any] | None = None
+    if isinstance(source_agent_id, str) and source_agent_id:
+        for agent_entry in agents:
+            if isinstance(agent_entry, dict) and entry_matches_source_agent(config_path, agent_entry, source_agent_id):
+                entry = agent_entry
+                break
+    if entry is None:
+        entry = find_agent_entry_by_workspace(config, current_dir)
+
+    if entry is None:
+        raise ValueError("无法识别当前 Agent，请在已安装 Agent 的 workspace 中执行。")
+
+    openclaw_id = entry.get("id")
+    if not isinstance(openclaw_id, str) or not openclaw_id.strip():
+        raise ValueError("当前 Agent 在 openclaw.json 中缺少 id。")
+
+    workspace = entry.get("workspace")
+    if not isinstance(workspace, str) or not workspace.strip():
+        raise ValueError("当前 Agent 在 openclaw.json 中缺少 workspace。")
+
+    account_ids = find_account_ids_by_agent_id(config, openclaw_id)
+    display_name = (
+        entry.get("name")
+        or entry.get("identity", {}).get("name")
+        or (agent_def or {}).get("description")
+        or openclaw_id
+    )
+    if not isinstance(display_name, str) or not display_name.strip():
+        display_name = openclaw_id
+
+    return {
+        "config": config,
+        "config_path": config_path,
+        "local_config_path": local_config_path,
+        "agent_definition": agent_def,
+        "source_agent_id": source_agent_id or openclaw_id,
+        "openclaw_id": openclaw_id,
+        "workspace": workspace,
+        "display_name": display_name.strip(),
+        "account_ids": account_ids,
+    }
+
+
+def find_account_ids_by_agent_id(config: dict[str, Any], agent_id: str) -> list[str]:
+    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
+    result: list[str] = []
+    for account_id, account in accounts.items():
+        if isinstance(account, dict) and account.get("agentId") == agent_id:
+            result.append(account_id)
+    return sorted(result)
+
+
+def get_primary_account(config: dict[str, Any], account_ids: list[str]) -> tuple[str | None, dict[str, Any] | None]:
+    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
+    for account_id in account_ids:
+        account = accounts.get(account_id)
+        if isinstance(account, dict):
+            return account_id, account
+    return None, None
+
+
+def get_plugin_enabled(config: dict[str, Any]) -> bool:
+    allow = config.get("plugins", {}).get("allow", [])
+    entries = config.get("plugins", {}).get("entries", {})
+    allow_enabled = isinstance(allow, list) and "bot-api" in allow
+    entry_enabled = isinstance(entries, dict) and isinstance(entries.get("bot-api"), dict) and entries["bot-api"].get("enabled") is True
+    return allow_enabled and entry_enabled
+
+
+def set_local_bot_api_enabled(local_config_path: Path | None, enabled: bool) -> bool:
+    if local_config_path is None or not local_config_path.is_file():
+        return False
+    data = load_json(local_config_path)
+    data["bot_api_enabled"] = enabled
+    dump_json(local_config_path, data)
+    return True
+
+
+def build_status(context: dict[str, Any]) -> dict[str, Any]:
+    config = context["config"]
+    account_id, account = get_primary_account(config, context["account_ids"])
+    local_agent_def = context.get("agent_definition") or {}
+    base_url = context.get("base_url")
+    account_enabled = bool(account.get("enabled")) if isinstance(account, dict) else False
+    plugin_enabled = get_plugin_enabled(config)
+    bot_api_url = build_bot_api_url(account_id, "chat", base_url)
+    bot_api_stream_url = build_bot_api_url(account_id, "chat-stream", base_url)
+    return {
+        "source_agent_id": context["source_agent_id"],
+        "openclaw_id": context["openclaw_id"],
+        "workspace": context["workspace"],
+        "display_name": context["display_name"],
+        "config_bot_api_enabled": bool(local_agent_def.get("bot_api_enabled")),
+        "plugin_enabled": plugin_enabled,
+        "account_exists": bool(account),
+        "account_id": account_id,
+        "bot_api_url": bot_api_url,
+        "bot_api_stream_url": bot_api_stream_url,
+        "enabled": bool(account) and account_enabled and plugin_enabled,
+        "account_enabled": account_enabled,
+        "api_secret": account.get("apiSecret") if isinstance(account, dict) else None,
+        "security_notice": "🔒 请勿在公开群聊、工单或截图中泄漏 api_secret。",
+    }
+
+
+def ensure_bot_api(context: dict[str, Any]) -> dict[str, Any]:
+    config = context["config"]
+    config.setdefault("plugins", {})
+    allow = config["plugins"].setdefault("allow", [])
+    if "bot-api" not in allow:
+        allow.append("bot-api")
+    entries = config["plugins"].setdefault("entries", {})
+    entries.setdefault("bot-api", {})["enabled"] = True
+
+    channels = config.setdefault("channels", {})
+    bot_api = channels.setdefault("bot-api", {})
+    accounts = bot_api.setdefault("accounts", {})
+
+    account_id, existing_account = get_primary_account(config, context["account_ids"])
+    if account_id is None:
+        account_id = context["source_agent_id"]
+
+    api_secret = None
+    if isinstance(existing_account, dict):
+        api_secret = existing_account.get("apiSecret")
+    if not isinstance(api_secret, str) or not api_secret:
+        api_secret = secrets.token_hex(32)
+
+    accounts[account_id] = {
+        "agentId": context["openclaw_id"],
+        "name": context["display_name"],
+        "apiSecret": api_secret,
+        "enabled": True,
+    }
+
+    dump_json(context["config_path"], config)
+    set_local_bot_api_enabled(context["local_config_path"], True)
+    if isinstance(context.get("agent_definition"), dict):
+        context["agent_definition"]["bot_api_enabled"] = True
+    context["account_ids"] = find_account_ids_by_agent_id(config, context["openclaw_id"])
+    return {
+        "action": "created" if existing_account is None else "updated",
+        **build_status(context),
+    }
+
+
+def delete_bot_api(context: dict[str, Any]) -> dict[str, Any]:
+    config = context["config"]
+    accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
+    removed_account_ids: list[str] = []
+    for account_id in list(context["account_ids"]):
+        if account_id in accounts:
+            removed_account_ids.append(account_id)
+            del accounts[account_id]
+
+    remaining_accounts = config.get("channels", {}).get("bot-api", {}).get("accounts", {})
+    if not remaining_accounts:
+        config.setdefault("plugins", {})
+        allow = config.get("plugins", {}).get("allow", [])
+        if isinstance(allow, list):
+            config["plugins"]["allow"] = [item for item in allow if item != "bot-api"]
+        bot_api_entry = config.get("plugins", {}).get("entries", {}).get("bot-api")
+        if isinstance(bot_api_entry, dict):
+            bot_api_entry["enabled"] = False
+
+    dump_json(context["config_path"], config)
+    set_local_bot_api_enabled(context["local_config_path"], False)
+    if isinstance(context.get("agent_definition"), dict):
+        context["agent_definition"]["bot_api_enabled"] = False
+    context["account_ids"] = []
+    return {
+        "action": "deleted",
+        "removed_account_ids": removed_account_ids,
+        **build_status(context),
+    }
+
+
+def reset_bot_api_secret(context: dict[str, Any]) -> dict[str, Any]:
+    config = context["config"]
+    account_id, account = get_primary_account(config, context["account_ids"])
+    if account_id is None or not isinstance(account, dict):
+        raise ValueError("当前 Agent 尚未创建 bot-api，无法重置密钥。")
+
+    new_secret = secrets.token_hex(32)
+    account["apiSecret"] = new_secret
+    config["channels"]["bot-api"]["accounts"][account_id] = account
+    dump_json(context["config_path"], config)
+    return {
+        "action": "reset",
+        "new_secret": new_secret,
+        **build_status(context),
+    }
+
+
+def _fmt_secret(value: object) -> str:
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return "📭 暂无"
+
+
+def _fmt_url(value: object) -> str:
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return "📭 暂无"
+
+
+def _fmt_identity(value: object) -> str:
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return "📭 暂无"
+
+
+def _print_agent_identity(display_name: object, source_agent_id: object) -> None:
+    print(f"📛 名字：{_fmt_identity(display_name)}")
+    print(f"🆔 source_agent_id：{_fmt_identity(source_agent_id)}")
+
+
+def _print_link_block(url: str, stream_url: str, baseurl_note: str) -> None:
+    if url != "📭 暂无":
+        print(f"🔗 非流式链接：{url}")
+    if stream_url != "📭 暂无":
+        print(f"🔗 流式链接：{stream_url}")
+
+
+def print_human_response(command: str, payload: dict[str, Any]) -> int:
+    """非 --json 时输出，风格与 SKILL 模板一致。"""
+    action = payload.get("action")
+    enabled = payload.get("enabled")
+    url = _fmt_url(payload.get("bot_api_url"))
+    stream_url = _fmt_url(payload.get("bot_api_stream_url"))
+    secret = _fmt_secret(payload.get("api_secret") or payload.get("new_secret"))
+
+    if command in {"get", "status"}:
+        state = "🟢 开启" if enabled else "⚪ 关闭"
+        print(f"📋 🤖 bot-api 状态：{state}")
+        print()
+        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
+        print()
+        _print_link_block(url, stream_url, "")
+        print(f"🔑 密钥：{secret}")
+        return 0
+
+    if command == "create":
+        title = "已更新" if action == "updated" else "已创建"
+        prefix = "📝" if action == "updated" else "✨"
+        print(f"{prefix} 🤖 bot-api {title}")
+        print()
+        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
+        print()
+        _print_link_block(url, stream_url, "")
+        print(f"🔑 密钥：{secret}")
+        print()
+        print("🔒 请妥善保管，勿对外转发或截图。")
+        return 0
+
+    if command == "delete":
+        print("🛑 🤖 bot-api 已关闭")
+        print()
+        print("📴 当前 Agent 不再通过 bot-api 对外提供服务。")
+        return 0
+
+    if command == "reset":
+        if not isinstance(payload.get("new_secret"), str) or not payload["new_secret"].strip():
+            print("⚠️ 当前 Agent 尚未创建 bot-api，无法重置密钥。", file=sys.stderr)
+            return 1
+        print("🔄 🤖 bot-api 密钥已更新")
+        print()
+        _print_agent_identity(payload.get("display_name"), payload.get("source_agent_id"))
+        print()
+        _print_link_block(url, stream_url, "")
+        print(f"🔑 新密钥：{secret}")
+        print()
+        print("🔒 请妥善保管，勿对外转发或截图。")
+        return 0
+
+    print(f"❓ 未知命令：{command}", file=sys.stderr)
+    return 1
+
+
+def create_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="管理当前 Agent 的 bot-api 与 API Secret")
+    parser.add_argument(
+        "--config",
+        default=str(DEFAULT_CONFIG_PATH),
+        help="openclaw.json 路径",
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="输出 JSON",
+    )
+    parser.add_argument(
+        "command",
+        choices=["status", "create", "delete", "reset", "get"],
+        help="执行的动作：status/create/delete/reset，get 为 status 的兼容别名",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = create_parser()
+    args = parser.parse_args(argv)
+    config_path = Path(args.config).expanduser().resolve()
+
+    try:
+        context = resolve_current_agent(config_path)
+        if args.command in {"status", "get", "create", "reset"}:
+            context["base_url"] = require_base_url()
+        if args.command in {"status", "get"}:
+            payload = {"action": "status", **build_status(context)}
+        elif args.command == "create":
+            payload = ensure_bot_api(context)
+        elif args.command == "delete":
+            payload = delete_bot_api(context)
+        elif args.command == "reset":
+            payload = reset_bot_api_secret(context)
+        else:
+            raise ValueError(f"Unsupported command: {args.command}")
+    except Exception as exc:  # pragma: no cover - CLI fallback
+        if args.json:
+            json.dump({"ok": False, "error": str(exc)}, sys.stdout, ensure_ascii=False, indent=2)
+            sys.stdout.write("\n")
+        else:
+            print(f"⚠️ {exc}", file=sys.stderr)
+        return 1
+
+    if args.json:
+        json.dump({"ok": True, **payload}, sys.stdout, ensure_ascii=False, indent=2)
+        sys.stdout.write("\n")
+        return 0
+
+    return print_human_response(args.command, payload)
+
+
+if __name__ == "__main__":
     raise SystemExit(main())