fix: preflight skill writes before rollback metadata

shakkernerd · shakkernerd · commit 34a1102506d8 · 2026-06-11T17:32:25.000+01:00
diff --git a/src/skills/lifecycle/workspace-skill-write.ts b/src/skills/lifecycle/workspace-skill-write.ts
@@ -13,10 +13,12 @@ type WorkspaceSkillSymlinkWritePolicy = {
   allowWrites: boolean;
   allowedTargetRealPaths: readonly string[];
 };
+type WorkspaceSkillSupportFileWrite = { path: string; content: string };
 
-type WorkspaceSkillSupportFileWrite = {
-  path: string;
-  content: string;
+type WorkspaceSkillWriteTargetParams = {
+  workspaceDir: string;
+  filePath: string;
+  symlinkPolicy: WorkspaceSkillSymlinkWritePolicy;
 };
 
 type PreviousSupportFile = { path: string; existed: boolean; previousContent?: string };
@@ -96,6 +98,12 @@ export async function readWorkspaceSupportFile(params: {
   return read.buffer.toString("utf8");
 }
 
+export async function assertWorkspaceSkillWriteTarget(
+  params: WorkspaceSkillWriteTargetParams,
+): Promise<void> {
+  await resolveWorkspaceSkillWriteTarget(params);
+}
+
 export async function writeWorkspaceSkill(params: {
   workspaceDir: string;
   skillDir: string;
@@ -106,7 +114,6 @@ export async function writeWorkspaceSkill(params: {
   symlinkPolicy: WorkspaceSkillSymlinkWritePolicy;
 }): Promise<void> {
   assertInsideWorkspace(params.workspaceDir, params.skillDir, "skill directory");
-  assertInsideWorkspace(params.workspaceDir, params.skillFile, "skill file");
   const supportFiles = normalizeSupportFiles(params.supportFiles ?? []);
   const previousSupportFiles = await prepareWorkspaceSkillWrite({
     mode: params.mode,
@@ -188,22 +195,19 @@ async function prepareWorkspaceSkillWrite(params: {
       filePath,
       symlinkPolicy: params.symlinkPolicy,
     });
-    const previousContent = await readWorkspaceSupportFile({
-      skillDir: params.skillDir,
-      relativePath: file.path,
-    });
-    if (params.mode === "create" && previousContent !== null) {
-      throw new Error(
-        `Target support file already exists: ${path.join(params.skillDir, file.path)}`,
+    if (params.mode === "update") {
+      const previousContent = await readWorkspaceSupportFile({
+        skillDir: params.skillDir,
+        relativePath: file.path,
+      });
+      previousSupportFiles.push(
+        previousContent === null
+          ? { path: file.path, existed: false }
+          : { path: file.path, existed: true, previousContent },
       );
     }
-    previousSupportFiles.push(
-      previousContent === null
-        ? { path: file.path, existed: false }
-        : { path: file.path, existed: true, previousContent },
-    );
   }
-  return params.mode === "update" ? previousSupportFiles : [];
+  return previousSupportFiles;
 }
 
 async function writeWorkspaceFile(params: {
@@ -268,11 +272,9 @@ async function restoreSupportFilesAfterFailedWrite(params: {
   );
 }
 
-async function resolveWorkspaceSkillWriteTarget(params: {
-  workspaceDir: string;
-  filePath: string;
-  symlinkPolicy: WorkspaceSkillSymlinkWritePolicy;
-}): Promise<{ rootDir: string; relativePath: string }> {
+async function resolveWorkspaceSkillWriteTarget(
+  params: WorkspaceSkillWriteTargetParams,
+): Promise<{ rootDir: string; relativePath: string }> {
   assertInsideWorkspace(params.workspaceDir, params.filePath, "skill file");
   const workspaceDir = path.resolve(params.workspaceDir);
   const filePath = path.resolve(params.filePath);
diff --git a/src/skills/workshop/service.ts b/src/skills/workshop/service.ts
@@ -1,4 +1,3 @@
-// Workshop service orchestrates skill draft creation, validation, and persistence.
 import fs from "node:fs/promises";
 import path from "node:path";
 import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";
@@ -12,6 +11,7 @@ import {
 } from "../discovery/status.js";
 import {
   assertInsideWorkspace,
+  assertWorkspaceSkillWriteTarget,
   MAX_WORKSPACE_SKILL_SUPPORT_FILE_BYTES,
   normalizeWorkspaceSkillSupportPath,
   readWorkspaceSkillFile,
@@ -538,6 +538,11 @@ export async function applySkillProposal(
         ? resolveAllowedSkillSymlinkTargetRealPaths(input.config)
         : [],
     };
+    await assertWorkspaceSkillWriteTarget({
+      workspaceDir: input.workspaceDir,
+      filePath: record.target.skillFile,
+      symlinkPolicy,
+    });
     const targetState = await readApplyTargetState(record, supportFiles);
     const rollback = createSkillProposalRollback({
       proposalId: record.id,
diff --git a/src/skills/workshop/store.ts b/src/skills/workshop/store.ts
@@ -1,4 +1,3 @@
-// Workshop store persists generated skill drafts and metadata under the workspace.
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -35,7 +34,6 @@ const MANIFEST_LOCK_REL_PATH = path.join(TARGET_LOCKS_REL_DIR, "proposals-manife
 const PROPOSAL_RECORD_FILE = "proposal.json";
 const PROPOSAL_DRAFT_FILE = "PROPOSAL.md";
 const PROPOSAL_ROLLBACK_FILE = "rollback.json";
-/** Maximum bytes accepted for a proposal draft. */
 export const MAX_PROPOSAL_BYTES = 1024 * 1024;
 export const MAX_PROPOSAL_SUPPORT_FILES = 64;
 export const MAX_PROPOSAL_SUPPORT_FILES_TOTAL_BYTES = 2 * 1024 * 1024;
