From 226135f25dceda4e7f7473e955b2410828bd3d3f Mon Sep 17 00:00:00 2001 From: Ziyang Guo <121015044+RerankerGuo@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:27:28 +0800 Subject: [PATCH] fix(manager): emit runnable template install commands --- changelog/current.md | 1 + .../references/import-worker-template.md | 7 +- .../scripts/install-worker-template.sh | 15 +-- manager/tests/test-install-worker-template.sh | 98 +++++++++++++++++++ 4 files changed, 104 insertions(+), 17 deletions(-) create mode 100755 manager/tests/test-install-worker-template.sh diff --git a/changelog/current.md b/changelog/current.md index f3ae6b4eb..86a344004 100644 --- a/changelog/current.md +++ b/changelog/current.md @@ -27,6 +27,7 @@ Record image-affecting changes to `manager/`, `worker/`, `copaw/`, `openclaw-bas **Bug Fixes** +- **Worker template install CLI contract**: Nacos template imports now emit only flags supported by `hiclaw apply worker`; dry-run previews remain runnable, and unsupported command-line MCP overrides are no longer advertised. - **Legacy Team channel policy**: Legacy Team reconciliation now writes final Matrix channel allow-lists to member runtime config and re-adds the Team Leader to the Manager allow-list so controller integration tests observe durable policy state. - **Sandbox worker-deps hardening**: Sandbox-backed Workers now prepare controller-owned worker-deps env/token/data material before claim creation, recycle stale SandboxClaims and bound Sandboxes on runtime-affecting changes, and use bounded ServiceAccount token projection for built-in SandboxClaim mounts. - **CLI AgentTeams auth env**: The `hiclaw` CLI now discovers `AGENTTEAMS_CONTROLLER_URL`, `AGENTTEAMS_AUTH_TOKEN`, `AGENTTEAMS_AUTH_TOKEN_FILE`, and `AGENTTEAMS_CLUSTER_ID` while preserving legacy `HICLAW_*` fallbacks, so Manager and Worker containers can use the terminal env names for controller calls. diff --git a/manager/agent/skills/hiclaw-find-worker/references/import-worker-template.md b/manager/agent/skills/hiclaw-find-worker/references/import-worker-template.md index a1bfcb559..673eba202 100644 --- a/manager/agent/skills/hiclaw-find-worker/references/import-worker-template.md +++ b/manager/agent/skills/hiclaw-find-worker/references/import-worker-template.md @@ -79,12 +79,13 @@ bash /opt/hiclaw/agent/skills/hiclaw-find-worker/scripts/install-worker-template --template \ --worker-name \ --model \ - --runtime openclaw|copaw \ - --skills s1,s2 \ - --mcp-servers m1,m2 + --runtime openclaw|copaw|hermes|openhuman \ + --skills s1,s2 ``` This script delegates to `hiclaw apply worker --package nacos://...`. +The current CLI cannot override `mcpServers` from command-line parameters; +use the servers already defined by the confirmed template package. If the install command fails: diff --git a/manager/agent/skills/hiclaw-find-worker/scripts/install-worker-template.sh b/manager/agent/skills/hiclaw-find-worker/scripts/install-worker-template.sh index 544ab287d..a7d897aa7 100755 --- a/manager/agent/skills/hiclaw-find-worker/scripts/install-worker-template.sh +++ b/manager/agent/skills/hiclaw-find-worker/scripts/install-worker-template.sh @@ -14,7 +14,6 @@ PACKAGE_URI="" VERSION="" MODEL="" SKILLS="" -MCP_SERVERS="" RUNTIME="" DRY_RUN=false NACOS_REGISTRY_URI="${AGENTTEAMS_NACOS_REGISTRY_URI:-nacos://market.agentteams.io:80/public}" @@ -23,7 +22,7 @@ NACOS_PORT="" NACOS_NAMESPACE="" usage() { - echo "Usage: $0 (--template | --package-uri ) --worker-name [--version ] [--model ] [--skills s1,s2] [--mcp-servers m1,m2] [--runtime openclaw|copaw] [--dry-run]" >&2 + echo "Usage: $0 (--template | --package-uri ) --worker-name [--version ] [--model ] [--skills s1,s2] [--runtime openclaw|copaw|hermes|openhuman] [--dry-run]" >&2 exit 1 } @@ -53,10 +52,6 @@ while [[ $# -gt 0 ]]; do SKILLS="${2:-}" shift 2 ;; - --mcp-servers) - MCP_SERVERS="${2:-}" - shift 2 - ;; --runtime) RUNTIME="${2:-}" shift 2 @@ -128,15 +123,9 @@ fi if [[ -n "$SKILLS" ]]; then AGENTTEAMS_ARGS+=(--skills "$SKILLS") fi -if [[ -n "$MCP_SERVERS" ]]; then - AGENTTEAMS_ARGS+=(--mcp-servers "$MCP_SERVERS") -fi if [[ -n "$RUNTIME" ]]; then AGENTTEAMS_ARGS+=(--runtime "$RUNTIME") fi -if [[ "$DRY_RUN" == true ]]; then - AGENTTEAMS_ARGS+=(--dry-run) -fi if [[ "$DRY_RUN" == true ]]; then jq -n \ @@ -145,7 +134,6 @@ if [[ "$DRY_RUN" == true ]]; then --arg package_uri "$PACKAGE_URI" \ --arg model "$MODEL" \ --arg skills "$SKILLS" \ - --arg mcp_servers "$MCP_SERVERS" \ --arg runtime "$RUNTIME" \ --argjson hiclaw_args "$(printf '%s\n' "${AGENTTEAMS_ARGS[@]}" | jq -R . | jq -s .)" \ '{ @@ -155,7 +143,6 @@ if [[ "$DRY_RUN" == true ]]; then overrides: { model: (if $model == "" then null else $model end), skills: (if $skills == "" then null else ($skills | split(",")) end), - mcp_servers: (if $mcp_servers == "" then null else ($mcp_servers | split(",")) end), runtime: (if $runtime == "" then null else $runtime end) }, hiclaw_args: $hiclaw_args diff --git a/manager/tests/test-install-worker-template.sh b/manager/tests/test-install-worker-template.sh new file mode 100755 index 000000000..a2eaf6a64 --- /dev/null +++ b/manager/tests/test-install-worker-template.sh @@ -0,0 +1,98 @@ +#!/bin/bash +# Regression tests for the Nacos Worker template installer CLI contract. + +set -uo pipefail + +PASS=0 +FAIL=0 +TMPDIR_ROOT=$(mktemp -d) +trap 'rm -rf "${TMPDIR_ROOT}"' EXIT + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)" +INSTALL_SCRIPT="${PROJECT_ROOT}/manager/agent/skills/hiclaw-find-worker/scripts/install-worker-template.sh" + +pass() { + echo " PASS: $1" + PASS=$((PASS + 1)) +} + +fail() { + echo " FAIL: $1" + echo " expected: $2" + echo " got: $3" + FAIL=$((FAIL + 1)) +} + +assert_eq() { + local description="$1" expected="$2" actual="$3" + if [ "${expected}" = "${actual}" ]; then + pass "${description}" + else + fail "${description}" "${expected}" "${actual}" + fi +} + +echo "=== Dry-run output contains a runnable hiclaw command ===" +DRY_RUN_OUTPUT=$(bash "${INSTALL_SCRIPT}" \ + --package-uri nacos://registry.example:8848/public/reviewer \ + --worker-name alice \ + --model qwen3.6-plus \ + --skills github-operations \ + --runtime hermes \ + --dry-run) + +EXPECTED_ARGS='["apply","worker","--name","alice","--package","nacos://registry.example:8848/public/reviewer","--model","qwen3.6-plus","--skills","github-operations","--runtime","hermes"]' +assert_eq "dry-run reports only supported apply worker flags" \ + "${EXPECTED_ARGS}" \ + "$(printf '%s\n' "${DRY_RUN_OUTPUT}" | jq -c '.hiclaw_args')" + +echo "=== Removed MCP override fails before invoking hiclaw ===" +if MCP_OUTPUT=$(bash "${INSTALL_SCRIPT}" \ + --package-uri nacos://registry.example:8848/public/reviewer \ + --worker-name alice \ + --mcp-servers github 2>&1); then + fail "unsupported MCP override is rejected" "non-zero exit" "exit 0" +elif printf '%s\n' "${MCP_OUTPUT}" | grep -qF 'Unknown option: --mcp-servers'; then + pass "unsupported MCP override is rejected" +else + fail "unsupported MCP override explains the invalid option" \ + "Unknown option: --mcp-servers" "${MCP_OUTPUT}" +fi + +echo "=== Normal install forwards supported flags unchanged ===" +MOCK_BIN="${TMPDIR_ROOT}/bin" +HICLAW_LOG="${TMPDIR_ROOT}/hiclaw.log" +mkdir -p "${MOCK_BIN}" +cat > "${MOCK_BIN}/hiclaw" <<'EOF' +#!/bin/sh +printf '%s\n' "$@" > "${TEST_HICLAW_LOG:?}" +EOF +chmod +x "${MOCK_BIN}/hiclaw" + +PATH="${MOCK_BIN}:${PATH}" \ +TEST_HICLAW_LOG="${HICLAW_LOG}" \ +AGENTTEAMS_NACOS_REGISTRY_URI="nacos://registry.example:8848/team" \ +bash "${INSTALL_SCRIPT}" \ + --template reviewer \ + --version v1 \ + --worker-name bob \ + --model qwen3.6-plus \ + --skills git-delegation \ + --runtime openhuman + +EXPECTED_LOG=$(printf '%s\n' \ + apply worker \ + --name bob \ + --package nacos://registry.example:8848/team/reviewer/v1 \ + --model qwen3.6-plus \ + --skills git-delegation \ + --runtime openhuman) +assert_eq "normal install forwards the supported CLI contract" \ + "${EXPECTED_LOG}" "$(cat "${HICLAW_LOG}")" + +echo "" +echo "Results: ${PASS} passed, ${FAIL} failed" +if [ "${FAIL}" -gt 0 ]; then + exit 1 +fi