feat(skillinject): manage per-tool plugins on the 15-min reconcile

Adds two new managed surfaces alongside the existing skill-copy +
heartbeat-marker rows: plugin-file (source code on disk) and
plugin-allowlist (JSON-merge into the tool's plugin config so the
plugin id is trusted + enabled).

Today only openclaw exercises this — the manifest will ship a
`plugin: { id, installPath, files[], allowList }` block under the
openclaw tool entry. The plugin itself is a ~80-line ESM module
registering openclaw's `before_prompt_build` hook, returning
`prependSystemContext` with the pilot directive on every turn. That
hook is the only per-prompt injection surface in openclaw (SKILL.md
loads on tool startup, HEARTBEAT.md loads only on the heartbeat
lifecycle — neither fires per-turn).

Reconcile semantics mirror the existing skill+marker pattern:
- classifyPluginFile: SHA-256 vs canonical → Identical / Drifted /
  Absent. Same noop / create / rewrite vocabulary.
- classifyPluginAllowList: walks plugins.allow + plugins.entries.<id>
  dotted JSON paths and flags drift unless both contain our id and
  enabled=true. Missing config file is treated as Drifted (will be
  created on next write) rather than Absent (which would skip).
- mergePluginAllowList: read-parse-merge-write via .tmp + rename.
  Refuses to overwrite a malformed config (user mid-edit). Idempotent
  by design — running it twice produces byte-identical output.

State surfaces via `pilotctl skills` with two new row labels: "plugin
file:" and "plugin allow-list:". Width widened from 17→19 to
accommodate the longest label.

Tests (10 new in zz_plugin_allowlist_test.go):
- 4 classify states (missing config, both present, id missing from
  allow, entry disabled)
- 5 merge properties (creates file, preserves other keys, idempotent,
  refuses malformed config, creates nested paths via walkObject)
- 1 read-only walk bail-out

No production-side wiring of an actual plugin yet — that ships
alongside the inject-manifest.json update in the pilot-skills repo.
This change adds the daemon-side capability and exits without effect
until the manifest declares a plugin block. Older daemons silently
ignore the new field (encoding/json unknown-field default).

Author: teovl

cmd/pilotctl/skills.go

@@ -112,14 +112,21 @@ func cmdSkillsStatus(_ []string) {
 	for _, tool := range tools {
 		fmt.Printf("[%s]\n", tool)
 		for _, o := range byTool[tool] {
-			label := "skill copy:    "
-			if o.Kind == skillinject.KindMarker {
-				label = "heartbeat ref: "
+			label := "skill copy:        "
+			switch o.Kind {
+			case skillinject.KindMarker:
+				label = "heartbeat ref:     "
+			case skillinject.KindHelper:
+				label = "helper:            "
+			case skillinject.KindPluginFile:
+				label = "plugin file:       "
+			case skillinject.KindPluginAllowList:
+				label = "plugin allow-list: "
 			}
 			fmt.Printf("  %s%s\n", label, o.Path)
-			fmt.Printf("                 state=%s  next_action=%s\n", o.State, o.Action)
+			fmt.Printf("                     state=%s  next_action=%s\n", o.State, o.Action)
 			if o.Err != "" {
-				fmt.Printf("                 ERROR: %s\n", o.Err)
+				fmt.Printf("                     ERROR: %s\n", o.Err)
 			}
 		}
 		fmt.Println()

internal/skillinject/manifest.go

@@ -55,13 +55,67 @@ type ManifestHelper struct {
 
 // ManifestTool is one tool target row.
 type ManifestTool struct {
-	Name              string `json:"name"`
-	RootDir           string `json:"rootDir"`
-	SkillsDir         string `json:"skillsDir"`
-	HeartbeatPath     string `json:"heartbeatPath,omitempty"`
-	HeartbeatTemplate string `json:"heartbeatTemplate,omitempty"`
-	SkillNaming       string `json:"skillNaming,omitempty"` // "" = "directory" (default), "flat" = single-file
-	SelfHeartbeat     bool   `json:"selfHeartbeat,omitempty"`
+	Name              string          `json:"name"`
+	RootDir           string          `json:"rootDir"`
+	SkillsDir         string          `json:"skillsDir"`
+	HeartbeatPath     string          `json:"heartbeatPath,omitempty"`
+	HeartbeatTemplate string          `json:"heartbeatTemplate,omitempty"`
+	SkillNaming       string          `json:"skillNaming,omitempty"` // "" = "directory" (default), "flat" = single-file
+	SelfHeartbeat     bool            `json:"selfHeartbeat,omitempty"`
+	Plugin            *ManifestPlugin `json:"plugin,omitempty"`
+}
+
+// ManifestPlugin describes a per-tool plugin that the daemon writes
+// onto disk (alongside the heartbeat + skill copy) and tracks in the
+// tool's own plugin allow-list. Today this is openclaw-only — the
+// plugin registers a `before_prompt_build` hook that prepends the
+// pilot directive into the system prompt on every turn. SKILL.md and
+// the heartbeat file are loaded by their tools' own lifecycles
+// (workspace bootstrap / periodic), neither fires per-turn, so the
+// plugin is the only reliable per-prompt injection surface.
+type ManifestPlugin struct {
+	// ID matches openclaw.plugin.json's "id" field. Used as the
+	// allow-list key + directory name.
+	ID string `json:"id"`
+	// InstallPath is where the plugin directory is written
+	// (e.g. "~/.openclaw/extensions/pilotprotocol-prompt-injector").
+	InstallPath string `json:"installPath"`
+	// Files lists the plugin source files the daemon copies in.
+	// Order doesn't matter — each file is reconciled independently.
+	Files []ManifestPluginFile `json:"files"`
+	// AllowList, if set, tells the daemon to ensure the plugin id
+	// appears in the tool's plugin allow-list + entries map. Nil
+	// disables the JSON-merge step (e.g. for tools without an
+	// explicit allow-list concept).
+	AllowList *ManifestPluginAllowList `json:"allowList,omitempty"`
+}
+
+// ManifestPluginFile is one file the daemon writes into the plugin
+// install directory. Mirrors ManifestHelper but scoped to a plugin.
+type ManifestPluginFile struct {
+	// Name is the filename relative to InstallPath (e.g.
+	// "openclaw.plugin.json", "index.mjs").
+	Name string `json:"name"`
+	// Src is a repo-relative path fetched via fetchRepoFile
+	// (e.g. "workflow-injection/openclaw-plugin/index.mjs").
+	Src string `json:"src"`
+}
+
+// ManifestPluginAllowList describes how the daemon merges its plugin id
+// into a tool's configuration to mark the plugin as trusted/enabled.
+// Today targets openclaw.json with paths `plugins.allow` (string array)
+// and `plugins.entries.<id>.enabled` (bool).
+type ManifestPluginAllowList struct {
+	// ConfigPath is the JSON file the daemon merges into
+	// (e.g. "~/.openclaw/openclaw.json").
+	ConfigPath string `json:"configPath"`
+	// AllowListJsonPath is a dotted path to the trust array. Created
+	// if absent. Daemon appends the plugin id iff not already present.
+	AllowListJsonPath string `json:"allowListJsonPath"`
+	// EntriesJsonPath is a dotted path to the per-plugin entries
+	// object (e.g. "plugins.entries"). The daemon ensures
+	// `entries.<id>.enabled` is `true`.
+	EntriesJsonPath string `json:"entriesJsonPath"`
 }
 
 // fetcher is a small wrapper around http.Client that returns response

internal/skillinject/plugin_allowlist.go

@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package skillinject
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// pluginAllowListState describes what the daemon would do to the tool's
+// plugin config JSON to ensure our plugin is trusted + enabled.
+//
+// Three states:
+//   - StateIdentical: allow-list contains our id AND entries.<id>.enabled
+//     is true. No write needed.
+//   - StateAbsent: config file doesn't exist on disk. Tool isn't
+//     installed → skip (caller handles this).
+//   - StateDrifted: config exists but the id is missing from allow-list
+//     OR entries.<id>.enabled isn't true. Daemon merges + rewrites.
+//
+// Same idiom as classifySkill / classifyMarker — read-only inspection
+// here, the actual mutation lives in mergePluginAllowList.
+func classifyPluginAllowList(configPath, allowJsonPath, entriesJsonPath, pluginID string) State {
+	raw, err := os.ReadFile(configPath)
+	if err != nil {
+		// Don't conflate "config file missing" with "needs writing" —
+		// if the tool isn't installed at all, the caller's dirExists
+		// check on rootDir already skipped this whole tool. A missing
+		// config file at this point means the tool installed but
+		// hasn't run yet; treat as drifted so the daemon creates it.
+		if os.IsNotExist(err) {
+			return StateDrifted
+		}
+		return StateDrifted
+	}
+	var obj map[string]any
+	if err := json.Unmarshal(raw, &obj); err != nil {
+		// Unparseable config = something the user is editing or that
+		// belongs to a future version we don't recognise. Refuse to
+		// rewrite; treat as drifted so the next tick re-checks and
+		// the caller surfaces an error in the outcome.
+		return StateDrifted
+	}
+	inAllow := allowListContains(obj, allowJsonPath, pluginID)
+	enabled := entryEnabled(obj, entriesJsonPath, pluginID)
+	if inAllow && enabled {
+		return StateIdentical
+	}
+	return StateDrifted
+}
+
+// mergePluginAllowList atomically rewrites the tool's plugin config
+// JSON so that the allow-list at allowJsonPath contains pluginID and
+// the entries map at entriesJsonPath has {pluginID: {"enabled": true}}.
+// Preserves all other keys byte-for-byte modulo Go's JSON
+// re-serialization (consistent 2-space indent, no key reordering
+// beyond what encoding/json guarantees — alphabetical for map keys).
+//
+// If the config file is missing, it is created with only the managed
+// keys. The daemon does NOT create the parent directory tree beyond
+// the file itself; the tool's own install is expected to provide it.
+//
+// Failure semantics: any read/parse/write error returns the error
+// without partial writes (uses .tmp + rename).
+func mergePluginAllowList(configPath, allowJsonPath, entriesJsonPath, pluginID string) error {
+	var obj map[string]any
+	raw, err := os.ReadFile(configPath)
+	switch {
+	case err != nil && os.IsNotExist(err):
+		obj = map[string]any{}
+	case err != nil:
+		return fmt.Errorf("read plugin config: %w", err)
+	default:
+		if uerr := json.Unmarshal(raw, &obj); uerr != nil {
+			return fmt.Errorf("parse plugin config (refusing to overwrite a malformed user config): %w", uerr)
+		}
+		if obj == nil {
+			obj = map[string]any{}
+		}
+	}
+
+	if err := ensureAllowListEntry(obj, allowJsonPath, pluginID); err != nil {
+		return err
+	}
+	if err := ensureEntryEnabled(obj, entriesJsonPath, pluginID); err != nil {
+		return err
+	}
+
+	next, err := json.MarshalIndent(obj, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal merged plugin config: %w", err)
+	}
+	next = append(next, '\n')
+
+	if err := os.MkdirAll(filepath.Dir(configPath), 0o755); err != nil {
+		return fmt.Errorf("ensure parent dir for plugin config: %w", err)
+	}
+	tmp := configPath + ".tmp"
+	if err := os.WriteFile(tmp, next, 0o644); err != nil {
+		return fmt.Errorf("write tmp plugin config: %w", err)
+	}
+	if err := os.Rename(tmp, configPath); err != nil {
+		_ = os.Remove(tmp)
+		return fmt.Errorf("rename plugin config into place: %w", err)
+	}
+	return nil
+}
+
+// walkObject traverses obj along a dotted path, materializing missing
+// nested objects when create is true. Returns the final container and
+// the leaf key. Returns nil + empty string if any intermediate node is
+// not a JSON object and create is false.
+func walkObject(obj map[string]any, jsonPath string, create bool) (map[string]any, string) {
+	parts := strings.Split(jsonPath, ".")
+	if len(parts) == 0 {
+		return nil, ""
+	}
+	cur := obj
+	for i := 0; i < len(parts)-1; i++ {
+		p := parts[i]
+		next, ok := cur[p].(map[string]any)
+		if !ok {
+			if !create {
+				return nil, ""
+			}
+			next = map[string]any{}
+			cur[p] = next
+		}
+		cur = next
+	}
+	return cur, parts[len(parts)-1]
+}
+
+func allowListContains(obj map[string]any, jsonPath, id string) bool {
+	parent, leaf := walkObject(obj, jsonPath, false)
+	if parent == nil {
+		return false
+	}
+	raw, ok := parent[leaf]
+	if !ok {
+		return false
+	}
+	// JSON arrays unmarshal as []any
+	arr, ok := raw.([]any)
+	if !ok {
+		return false
+	}
+	for _, v := range arr {
+		if s, ok := v.(string); ok && s == id {
+			return true
+		}
+	}
+	return false
+}
+
+func ensureAllowListEntry(obj map[string]any, jsonPath, id string) error {
+	parent, leaf := walkObject(obj, jsonPath, true)
+	if parent == nil {
+		return fmt.Errorf("walk allow-list path %q: parent missing", jsonPath)
+	}
+	cur, _ := parent[leaf].([]any)
+	for _, v := range cur {
+		if s, ok := v.(string); ok && s == id {
+			return nil
+		}
+	}
+	parent[leaf] = append(cur, id)
+	return nil
+}
+
+func entryEnabled(obj map[string]any, jsonPath, id string) bool {
+	parent, leaf := walkObject(obj, jsonPath, false)
+	if parent == nil {
+		return false
+	}
+	entries, ok := parent[leaf].(map[string]any)
+	if !ok {
+		return false
+	}
+	entry, ok := entries[id].(map[string]any)
+	if !ok {
+		return false
+	}
+	enabled, _ := entry["enabled"].(bool)
+	return enabled
+}
+
+func ensureEntryEnabled(obj map[string]any, jsonPath, id string) error {
+	parent, leaf := walkObject(obj, jsonPath, true)
+	if parent == nil {
+		return fmt.Errorf("walk entries path %q: parent missing", jsonPath)
+	}
+	entries, ok := parent[leaf].(map[string]any)
+	if !ok {
+		entries = map[string]any{}
+		parent[leaf] = entries
+	}
+	entry, ok := entries[id].(map[string]any)
+	if !ok {
+		entry = map[string]any{}
+		entries[id] = entry
+	}
+	entry["enabled"] = true
+	return nil
+}