Evolution Watcher

自动监控并对比已安装插件版本，生成升级报告，支持星型记忆架构的智能进化决策。

Security Scan

The skill's stated 'read-only, no automatic upgrades' policy conflicts with included code that clones repos, analyzes diffs, generates upgrade/patch scripts and can propose or apply adapter fixes (i.e., modify other skills), so proceed cautiously and test in a safe environment.

Purpose & Capability

Name/description (monitoring and upgrade reporting) mostly aligns with code (monitor.py, diff_analyzer, report files). However, the SKILL.md repeatedly asserts '只读' and '零自动升级' while the bundle includes adapter_auto_fix, fix templates, and logic to generate/apply fix proposals and upgrade scripts — capabilities beyond pure read-only monitoring. Generating and applying code fixes to adapters is plausible for an upgrade assistant but is a broader capability than the high-level description emphasizes.

Instruction Scope

SKILL.md instructs running python scripts that call ClawHub CLI ('clawhub list', 'clawhub inspect'), and the code (diff_analyzer) will clone GitHub repos, run git commands, and analyze diffs. The README emphasizes sandboxing and user authorization for apply, but instructions are inconsistent about what is automated vs manual. The runtime instructions don't explicitly mention network cloning or potential modification of adapter files, which the code is designed to do (including producing apply_command and backups).

Install Mechanism

No install spec is provided (instruction-only). All code is included in the skill bundle; there are no external install downloads in the manifest. Risk stems from the code's runtime behavior (git cloning, subprocess calls), not from any installer fetching remote binaries.

Credentials

The skill declares no required env vars, yet config/monitor_sources.json contains a github.token field (empty) and the DiffAnalyzer accepts an optional GitHub token. The skill can interact with ClawHub CLI and local plugin directories (/root/.openclaw/workspace/skills) and may read .git/config from plugin dirs. Not requesting creds is reasonable for public-repo monitoring, but if you enable GitHub support or private repos you may need to supply a token — which grants access to repo content. The skill can also be configured to send notifications (webhook_url) in config, which could be used to transmit data if misconfigured.

Persistence & Privilege

The skill is not 'always:true' and is user-invocable, but it contains code to generate and (with authorization) apply fixes to adapter files across the workspace (scopes include '**/*_adapter.py' etc). That means it can modify other skills' code (potentially persistent and privileged changes) if used to apply patches. SKILL.md claims apply only after user confirmation, but the artifact includes tools to write/checkout/patch code and to generate upgrade scripts — a powerful capability that warrants caution.

What to consider before installing

This skill mostly does what it says (monitor plugins and produce upgrade reports) but includes powerful code-modification features (adapter_auto_fix, diff analysis, upgrade script generation). Before installing or running it: 1) Do not run it on production — follow its own warning and test in an isolated environment or VM. 2) Inspect adapter_auto_fix and any 'apply' code paths to ensure no unexpected automatic writes; keep DRY_RUN enabled and require explicit confirmation before any apply. 3) If enabling GitHub monitoring, supply a minimal-scope token only if needed and understand it allows repo access; prefer public repos where possible. 4) Ensure ClawHub CLI and git subprocesses run with least privilege (avoid running as root). 5) Back up workspace/skills before allowing any repairs, and review generated upgrade/patch scripts (cat upgrade_script.sh) before execution. 6) Consider disabling notifications/webhook_url or verifying endpoints to avoid accidental data exfiltration. If you want me to, I can point to the exact places in the code where repo cloning, file modifications, and apply commands are prepared so you can review them line-by-line.

evolution-watcher - 星型架构智能进化监控器

⚠️ 重要警告

此插件为开发测试版本，尚未准备好用于生产环境。

请勿在生产环境安装此插件，因为它仍在积极开发中，API 和功能可能发生重大变化。此版本发布主要用于内部测试和架构审查。

如需使用稳定的监控功能，请等待正式版发布。

概述

evolution-watcher 是星型记忆架构的智能监控插件，负责自动发现、分析插件更新，为系统自我进化提供决策支持。它是实现"辅助自我进化系统"的第一阶段核心组件。

功能特性

MVP 阶段 (v0.6.0)

• ✅ 自动监控：定期检查 ClawHub 上已安装插件的新版本
• ✅ 版本对比：识别当前版本与最新版本的差异
• ✅ 报告生成：生成可读性强的升级报告（控制台 + Markdown）
• ✅ 安全设计：仅读取信息，不执行任何自动升级操作

第二阶段增强 (v0.6.2)

• ✅ 沙盒验证 - 在临时目录中应用适配器修复并运行健康检查，确保修复安全
• ✅ 适配器自动调整建议 - 支持 9 种变更模式：函数重命名、导入路径变更、配置键变更、类重命名、参数添加/移除、方法签名变更、返回值类型变更、装饰器变更
• ✅ 用户授权流程优化 - 展示 diff、沙盒验证报告、修复方案，等待用户确认后应用（authorized=True）
• ✅ 代码变更集（Diff）解析 - 从 GitHub 仓库获取版本差异，分析变更文件、行数、破坏性变更
• ✅ 批量冲突检测 - 分析多插件升级时的依赖冲突，提供警告与解决建议
• ✅ 变更日志解析与关键变化提取（v0.6.0 已实现）
• ✅ 影响评估（兼容性、收益、风险，v0.6.0 已实现）

未来计划

• 🔄 复杂变更支持 - 参数默认值变更、函数签名重排序、多文件联动修复
• 🔄 集成测试沙盒 - 在独立 Python 进程中运行完整集成测试套件
• 🔄 适配器模板库扩展 - 更多变更模式（异常变更、依赖版本变更等）

安装与配置

安装方法

# 从 ClawHub 安装（未来）
clawhub install evolution-watcher

# 或本地开发模式
cp -r evolution-watcher /root/.openclaw/workspace/skills/

配置文件

config/monitor_sources.json：

{
  "clawhub": {
    "enabled": true,
    "check_frequency_hours": 24
  },
  "github": {
    "enabled": false,
    "repositories": [],
    "check_frequency_hours": 24
  }
}

使用方法

手动运行监控

cd /root/.openclaw/workspace/skills/evolution-watcher
python3 scripts/monitor.py --report

输出示例

🔄 evolution-watcher v0.6.0
📅 检查时间: 2026-03-17 22:00:00
📊 监控源: ClawHub (已安装 5 个插件)

📈 更新检测结果:
┌──────────────────────┬────────────┬────────────┬──────────┐
│ 插件                 │ 当前版本   │ 最新版本   │ 状态     │
├──────────────────────┼────────────┼────────────┼──────────┤
│ memory-sync-enhanced │ 2.0.0      │ 2.0.0      │ ✅ 最新   │
│ ontology            │ 1.0.4       │ 1.0.5       │ ⚠️ 可升级 │
│ self-improving      │ 1.2.16      │ 1.2.16      │ ✅ 最新   │
└──────────────────────┴────────────┴────────────┴──────────┘

📋 详细报告已保存: reports/updates_20260317_220000.md

报告文件结构

reports/
├── updates_20260317_220000.md     # 详细升级报告
├── updates_log.json               # 结构化监控日志
└── summary.json                   # 摘要统计

集成架构

在星型架构中的位置

⭐ 星型记忆架构
├── 核心: memory-sync-enhanced (MSE)
├── 插件: self-improving (SIPA)
├── 插件: ontology
├── 插件: memory-sync-protocol (MSP)
└── 新增: evolution-watcher (本插件)

数据流

1. 监控模块 → 调用 ClawHub CLI (list, inspect)
2. 分析模块 → 对比版本，生成差异分析
3. 报告模块 → 输出人类可读报告
4. 日志模块 → 记录监控历史（JSON 格式）

技术细节

监控逻辑

1. 读取 clawhub list 获取已安装插件列表
2. 对每个插件执行 clawhub inspect <slug> 获取最新版本
3. 对比 current_version (来自 list) 与 latest_version (来自 inspect)
4. 记录差异到结构化日志

安全机制

• 🔐 零自动升级：所有升级操作需手动执行
• 🔐 只读操作：仅调用信息查询命令，不修改系统
• 🔐 完整日志：所有监控操作都有审计日志
• 🔐 配置可控：监控频率、范围可配置

开发计划

v0.1.0 (MVP)

• 基础监控框架
• ClawHub 版本检测
• 报告生成

v0.2.0

• 变更日志解析
• 初步影响评估
• GitHub 监控支持

v0.3.0

• 适配器变更检测
• 升级建议排序
• 集成测试支持

注意事项

1. 网络依赖：需要互联网连接访问 ClawHub API
2. API 限制：ClawHub API 可能有速率限制，请合理配置检查频率
3. 版本准确性：依赖 ClawHub 的版本信息准确性
4. 向后兼容：未来版本将保持配置文件兼容性

贡献与反馈

• 问题报告：通过 GitHub Issues 或 ClawHub 评论
• 功能建议：欢迎提出进化监控的新需求
• 开发贡献：遵循标准插件开发流程

---

进化是一个渐进的过程，而非一次革命。

错误码

错误码	描述	解决方案
E001	未知错误	检查日志，联系开发者
E002	配置错误	验证配置文件格式
E003	依赖缺失	安装所需依赖包