sophhub 0.4.64 → 0.4.65

package/agents/ai-cs-qa/.config.json

@@ -1,10 +1,68 @@
 {
-  "version": "1.0.10",
+  "version": "1.0.11",
   "agent_id": "ai-cs-qa",
   "description": "智能客服，通过 bot API 为客户提供服务",
   "bot_api_enabled": true,
   "workspace": "/home/node/.openclaw/workspace-knowledge/workspace-qa",
   "agent_dependencies": ["ai-cs-admin"],
+  "install": {
+    "bot_api": {
+      "commands": {
+        "text": false
+      },
+      "exec": {
+        "induceCommandStarters": [
+          "uv run",
+          "python",
+          "python3",
+          "node",
+          "bash",
+          "curl",
+          "kubectl",
+          "ls",
+          "env",
+          "cat",
+          "head",
+          "tail",
+          "find",
+          "grep"
+        ],
+        "commandContentDeny": [
+          "sophnet_tools",
+          "get_api_key",
+          "get-api-key",
+          "getApiKey",
+          "openclaw.json",
+          "models.providers",
+          "apiSecret",
+          "api_secret",
+          "apiKey",
+          "api_key",
+          ".base.json"
+        ],
+        "networkDenyTools": [
+          "curl",
+          "wget",
+          "ncat",
+          "nc",
+          "ssh"
+        ],
+        "networkDenyCode": [
+          "requests.",
+          "httpx",
+          "urllib",
+          "fetch(",
+          "http.client"
+        ],
+        "networkDetectUrls": true,
+        "networkAllowHosts": [
+          "sophnet.com",
+          "www.sophnet.com"
+        ],
+        "blockUnlistedNetwork": true
+      }
+    }
+  },
   "post_install": [
     {
       "name": "setup-links",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sophhub",
-  "version": "0.4.64",
+  "version": "0.4.65",
   "description": "SophHub CLI - Manage and download AI Agent skills and agents",
   "type": "module",
   "bin": {

package/skills/agent-install/skill.json

@@ -1,12 +1,19 @@
 {
   "name": "agent-install",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "types": [
     "store"
   ],
   "displayName": "Agent安装",
   "description": "安装或升级 Sophclaw Agent（含占位替换、备份、post_install 脚本与自动安装 skill）。",
   "changelog": [
+    {
+      "changes": [
+        "bot-api 账号安装透传 commands/exec，升级改 deep-merge 保留已有黑名单，修复升级清空 exec 的 BUG"
+      ],
+      "date": "2026-07-24",
+      "version": "0.1.16"
+    },
     {
       "changes": [
         "修复 update_openclaw.py 新建实例时覆盖原实例的严重 BUG：改为按目标 openclaw_id 定位条目，新建时追加、不覆盖同源原实例"
@@ -103,5 +110,5 @@
     }
   ],
   "createdAt": "2026-04-21",
-  "updatedAt": "2026-07-09"
+  "updatedAt": "2026-07-24"
 }

package/skills/agent-install/src/scripts/common.py

@@ -354,12 +354,19 @@ def build_bot_api_account(
     account_name = bot_api.get("account_name") or resolved_name or identity_name_str or agent_label_str or source_agent_id
     enabled = bot_api.get("enabled", True)
 
-    return account_id, {
+    account: dict[str, Any] = {
         "agentId": agent_id,
         "name": account_name,
         "apiSecret": existing_secret or secrets.token_hex(32),
         "enabled": enabled,
     }
+    commands = bot_api.get("commands")
+    if isinstance(commands, dict):
+        account["commands"] = commands
+    exec_config = bot_api.get("exec")
+    if isinstance(exec_config, dict):
+        account["exec"] = exec_config
+    return account_id, account
 
 
 def load_openclaw_config(config_path: Path) -> dict[str, Any]:

package/skills/agent-install/src/scripts/update_openclaw.py

@@ -141,7 +141,11 @@ def ensure_bot_api(
     bot_api = channels.setdefault("bot-api", {})
     accounts = bot_api.setdefault("accounts", {})
     action = "updated" if account_id in accounts else "created"
-    accounts[account_id] = account
+    existing_account = accounts.get(account_id, {})
+    if isinstance(existing_account, dict):
+        accounts[account_id] = deep_merge_dict(existing_account, account)
+    else:
+        accounts[account_id] = account
 
     return {
         "account_id": account_id,

package/skills/agent-install/src/tests/test_bot_api_exec.py

@@ -0,0 +1,116 @@
+"""验证 bot-api 账号的 commands/exec 黑名单能从 .config.json 透传进 openclaw.json，
+且升级时不会覆盖已有黑名单。"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+SCRIPTS = Path(__file__).resolve().parent.parent / "scripts"
+sys.path.insert(0, str(SCRIPTS))
+
+from common import build_bot_api_account, deep_merge_dict  # noqa: E402
+from update_openclaw import ensure_bot_api  # noqa: E402
+
+
+def _agent_def(bot_api: dict | None = None) -> dict:
+    d = {"agent_id": "ai-cs-qa", "bot_api_enabled": True}
+    if bot_api is not None:
+        d["install"] = {"bot_api": bot_api}
+    return d
+
+
+def test_commands_and_exec_propagated():
+    bot_api = {
+        "commands": {"text": False},
+        "exec": {"commandContentDeny": ["apiSecret", "openclaw.json"]},
+    }
+    _, account = build_bot_api_account(_agent_def(bot_api))
+    assert account["commands"] == {"text": False}
+    assert account["exec"]["commandContentDeny"] == ["apiSecret", "openclaw.json"]
+    assert {"agentId", "name", "apiSecret", "enabled", "commands", "exec"} == set(account)
+
+
+def test_omitted_commands_exec_not_added():
+    _, account = build_bot_api_account(_agent_def())
+    assert "commands" not in account
+    assert "exec" not in account
+
+
+def test_upgrade_preserves_existing_exec_not_in_config():
+    """配置里没声明 exec 时，升级不得清掉 openclaw.json 已有 exec。"""
+    config = {
+        "channels": {
+            "bot-api": {
+                "accounts": {
+                    "ai-cs-qa": {
+                        "agentId": "ai-cs-qa",
+                        "name": "ai-cs-qa",
+                        "apiSecret": "old-secret",
+                        "enabled": True,
+                        "exec": {"commandContentDeny": ["hand-added"]},
+                    }
+                }
+            }
+        }
+    }
+    ensure_bot_api(config, _agent_def(), target_agent_id="ai-cs-qa")
+    account = config["channels"]["bot-api"]["accounts"]["ai-cs-qa"]
+    assert account["exec"]["commandContentDeny"] == ["hand-added"]
+    assert account["apiSecret"] == "old-secret"  # 复用旧密钥
+
+
+def test_upgrade_exec_in_config_overrides_existing():
+    """配置里声明了 exec，则以配置为准（source of truth），替换而非追加。"""
+    config = {
+        "channels": {
+            "bot-api": {
+                "accounts": {
+                    "ai-cs-qa": {
+                        "agentId": "ai-cs-qa",
+                        "name": "old-name",
+                        "apiSecret": "old-secret",
+                        "enabled": True,
+                        "exec": {"commandContentDeny": ["hand-added"], "networkDenyTools": ["curl"]},
+                    }
+                }
+            }
+        }
+    }
+    bot_api = {"exec": {"commandContentDeny": ["apiSecret", "openclaw.json"]}}
+    ensure_bot_api(config, _agent_def(bot_api), target_agent_id="ai-cs-qa")
+    account = config["channels"]["bot-api"]["accounts"]["ai-cs-qa"]
+    # 配置声明的列表整体替换
+    assert account["exec"]["commandContentDeny"] == ["apiSecret", "openclaw.json"]
+    # 配置未声明的子键保留
+    assert account["exec"]["networkDenyTools"] == ["curl"]
+    assert account["apiSecret"] == "old-secret"
+
+
+def test_deep_merge_lists_replace():
+    assert deep_merge_dict({"a": [1, 2]}, {"a": [3]}) == {"a": [3]}
+
+
+def test_corrupt_non_dict_account_does_not_crash():
+    """旧账号被写成 null/非 dict 时，退化为整体覆盖，不崩。"""
+    for bad in (None, "x", 0):
+        config = {"channels": {"bot-api": {"accounts": {"ai-cs-qa": bad}}}}
+        ensure_bot_api(config, _agent_def(), target_agent_id="ai-cs-qa")
+        account = config["channels"]["bot-api"]["accounts"]["ai-cs-qa"]
+        assert isinstance(account, dict)
+        assert {"agentId", "name", "apiSecret", "enabled"} <= set(account)
+
+
+def test_old_agent_without_install_bot_api_unchanged_shape():
+    """没有 install.bot_api 的老 agent，账号仍只有原四字段。"""
+    config = {"channels": {"bot-api": {"accounts": {}}}}
+    ensure_bot_api(config, _agent_def(), target_agent_id="ai-cs-qa")
+    account = config["channels"]["bot-api"]["accounts"]["ai-cs-qa"]
+    assert set(account) == {"agentId", "name", "apiSecret", "enabled"}
+
+
+if __name__ == "__main__":
+    for name, fn in list(globals().items()):
+        if name.startswith("test_") and callable(fn):
+            fn()
+            print(f"ok: {name}")