fix(skills): cover inline dispatch policy gaps

eleqtrizit · eleqtrizit · commit f0105aab6f82 · 2026-05-06T16:23:39.000Z
diff --git a/src/auto-reply/reply/get-reply-inline-actions.skip-when-config-empty.test.ts b/src/auto-reply/reply/get-reply-inline-actions.skip-when-config-empty.test.ts
@@ -1,3 +1,6 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { SkillCommandSpec } from "../../agents/skills.js";
 import type { SessionEntry } from "../../config/sessions.js";
@@ -47,6 +50,16 @@ const createTypingController = (): TypingController => ({
   cleanup: vi.fn(),
 });
 
+async function writeSessionStore(
+  storeTemplate: string,
+  agentId: string,
+  entries: Record<string, unknown>,
+) {
+  const storePath = storeTemplate.replaceAll("{agentId}", agentId);
+  await fs.mkdir(path.dirname(storePath), { recursive: true });
+  await fs.writeFile(storePath, JSON.stringify(entries, null, 2), "utf-8");
+}
+
 const createHandleInlineActionsInput = (params: {
   ctx: ReturnType<typeof buildTestCtx>;
   typing: TypingController;
@@ -807,4 +820,144 @@ describe("handleInlineActions", () => {
     expect(messageExecute).not.toHaveBeenCalled();
     expect(sessionsExecute).not.toHaveBeenCalled();
   });
+
+  it("applies subagent policy to ACP envelope inline dispatch sessions", async () => {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-inline-acp-policy-"));
+    try {
+      const storeTemplate = path.join(tmpDir, "sessions-{agentId}.json");
+      await writeSessionStore(storeTemplate, "main", {
+        "agent:main:acp:leaf": {
+          sessionId: "session-acp-leaf",
+          updatedAt: Date.now(),
+          spawnedBy: "agent:main:subagent:parent",
+          spawnDepth: 2,
+          subagentRole: "leaf",
+          subagentControlScope: "none",
+        },
+      });
+
+      const typing = createTypingController();
+      const toolExecute = vi.fn(async () => ({ content: "spawned" }));
+      createOpenClawToolsMock.mockReturnValue([
+        {
+          name: "sessions_spawn",
+          execute: toolExecute,
+        },
+      ]);
+
+      const ctx = buildTestCtx({
+        Body: "/spawn_subagent investigate",
+        CommandBody: "/spawn_subagent investigate",
+      });
+      const skillCommands: SkillCommandSpec[] = [
+        {
+          name: "spawn_subagent",
+          skillName: "spawn-subagent",
+          description: "Spawn a subagent",
+          dispatch: {
+            kind: "tool",
+            toolName: "sessions_spawn",
+            argMode: "raw",
+          },
+          sourceFilePath: "/tmp/plugin/commands/spawn-subagent.md",
+        },
+      ];
+
+      const result = await handleInlineActions(
+        createHandleInlineActionsInput({
+          ctx,
+          typing,
+          cleanedBody: "/spawn_subagent investigate",
+          command: {
+            isAuthorizedSender: true,
+            senderId: "sender-1",
+            senderIsOwner: true,
+            abortKey: "sender-1",
+            rawBodyNormalized: "/spawn_subagent investigate",
+            commandBodyNormalized: "/spawn_subagent investigate",
+          },
+          overrides: {
+            cfg: {
+              commands: { text: true },
+              session: { store: storeTemplate },
+              agents: { defaults: { subagents: { maxSpawnDepth: 2 } } },
+            },
+            sessionKey: "agent:main:acp:leaf",
+            allowTextCommands: true,
+            skillCommands,
+          },
+        }),
+      );
+
+      expect(result).toEqual({
+        kind: "reply",
+        reply: { text: "❌ Tool not available: sessions_spawn" },
+      });
+      expect(toolExecute).not.toHaveBeenCalled();
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("passes sandboxed runtime state into inline tool construction", async () => {
+    const typing = createTypingController();
+    const toolExecute = vi.fn(async () => ({ content: "listed" }));
+    createOpenClawToolsMock.mockReturnValue([
+      {
+        name: "sessions_list",
+        execute: toolExecute,
+      },
+    ]);
+
+    const ctx = buildTestCtx({
+      Body: "/list_sessions now",
+      CommandBody: "/list_sessions now",
+    });
+    const skillCommands: SkillCommandSpec[] = [
+      {
+        name: "list_sessions",
+        skillName: "list-sessions",
+        description: "List sessions",
+        dispatch: {
+          kind: "tool",
+          toolName: "sessions_list",
+          argMode: "raw",
+        },
+        sourceFilePath: "/tmp/plugin/commands/list-sessions.md",
+      },
+    ];
+
+    const result = await handleInlineActions(
+      createHandleInlineActionsInput({
+        ctx,
+        typing,
+        cleanedBody: "/list_sessions now",
+        command: {
+          isAuthorizedSender: true,
+          senderId: "sender-1",
+          senderIsOwner: true,
+          abortKey: "sender-1",
+          rawBodyNormalized: "/list_sessions now",
+          commandBodyNormalized: "/list_sessions now",
+        },
+        overrides: {
+          cfg: {
+            commands: { text: true },
+            agents: { defaults: { sandbox: { mode: "all" } } },
+          },
+          sessionKey: "agent:main:thread",
+          allowTextCommands: true,
+          skillCommands,
+        },
+      }),
+    );
+
+    expect(result).toEqual({ kind: "reply", reply: { text: "✅ Done." } });
+    expect(createOpenClawToolsMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sandboxed: true,
+      }),
+    );
+    expect(toolExecute).toHaveBeenCalled();
+  });
 });
diff --git a/src/auto-reply/reply/skill-tool-dispatch.runtime.ts b/src/auto-reply/reply/skill-tool-dispatch.runtime.ts
@@ -6,6 +6,10 @@ import {
 } from "../../agents/pi-tools.policy.js";
 import type { AnyAgentTool } from "../../agents/pi-tools.types.js";
 import { resolveSandboxRuntimeStatus } from "../../agents/sandbox/runtime-status.js";
+import {
+  isSubagentEnvelopeSession,
+  resolveSubagentCapabilityStore,
+} from "../../agents/subagent-capabilities.js";
 import {
   applyToolPolicyPipeline,
   buildDefaultToolPolicyPipelineSteps,
@@ -21,11 +25,15 @@ import type { SessionEntry } from "../../config/sessions.js";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
 import { logVerbose } from "../../globals.js";
 import { getPluginToolMeta } from "../../plugins/tools.js";
-import { isSubagentSessionKey } from "../../routing/session-key.js";
 import { resolveGatewayMessageChannel } from "../../utils/message-channel.js";
 import type { MsgContext } from "../templating.js";
 import { extractExplicitGroupId } from "./group-id.js";
 
+/**
+ * Policy-enforcement seam for skill `command-dispatch: tool` invocations.
+ * Keep this aligned with the normal tool surfaces so GHSA-mhm4-93fw-4qr2
+ * stays closed across allow/deny, group, sandbox, and subagent policy layers.
+ */
 export function resolveSkillDispatchTools(params: {
   ctx: MsgContext;
   cfg: OpenClawConfig;
@@ -87,8 +95,16 @@ export function resolveSkillDispatchTools(params: {
     sessionKey: params.sessionKey,
   });
   const sandboxPolicy = sandboxRuntime.sandboxed ? sandboxRuntime.toolPolicy : undefined;
-  const subagentPolicy = isSubagentSessionKey(params.sessionKey)
-    ? resolveSubagentToolPolicyForSession(params.cfg, params.sessionKey)
+  const subagentStore = resolveSubagentCapabilityStore(params.sessionKey, {
+    cfg: params.cfg,
+  });
+  const subagentPolicy = isSubagentEnvelopeSession(params.sessionKey, {
+    cfg: params.cfg,
+    store: subagentStore,
+  })
+    ? resolveSubagentToolPolicyForSession(params.cfg, params.sessionKey, {
+        store: subagentStore,
+      })
     : undefined;
   const tools = createOpenClawTools({
     agentSessionKey: params.sessionKey,
@@ -104,6 +120,7 @@ export function resolveSkillDispatchTools(params: {
     workspaceDir: params.workspaceDir,
     config: params.cfg,
     allowGatewaySubagentBinding: true,
+    sandboxed: sandboxRuntime.sandboxed,
     requesterAgentIdOverride: params.agentId,
     requesterSenderId: params.senderId,
     senderIsOwner: params.senderIsOwner,
