fix: enforce ws3 roles + node allowlist

src/gateway/server-methods/skills.ts

@@ -1,6 +1,7 @@
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agents/agent-scope.js";
 import { installSkill } from "../../agents/skills-install.js";
 import { buildWorkspaceSkillStatus } from "../../agents/skills-status.js";
+import { loadWorkspaceSkillEntries, type SkillEntry } from "../../agents/skills.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import { loadConfig, writeConfigFile } from "../../config/config.js";
 import { getRemoteSkillEligibility } from "../../infra/skills-remote.js";
@@ -8,12 +9,52 @@ import {
   ErrorCodes,
   errorShape,
   formatValidationErrors,
+  validateSkillsBinsParams,
   validateSkillsInstallParams,
   validateSkillsStatusParams,
   validateSkillsUpdateParams,
 } from "../protocol/index.js";
 import type { GatewayRequestHandlers } from "./types.js";
 
+function listWorkspaceDirs(cfg: ClawdbotConfig): string[] {
+  const dirs = new Set<string>();
+  const list = cfg.agents?.list;
+  if (Array.isArray(list)) {
+    for (const entry of list) {
+      if (entry && typeof entry === "object" && typeof entry.id === "string") {
+        dirs.add(resolveAgentWorkspaceDir(cfg, entry.id));
+      }
+    }
+  }
+  dirs.add(resolveAgentWorkspaceDir(cfg, resolveDefaultAgentId(cfg)));
+  return [...dirs];
+}
+
+function collectSkillBins(entries: SkillEntry[]): string[] {
+  const bins = new Set<string>();
+  for (const entry of entries) {
+    const required = entry.clawdbot?.requires?.bins ?? [];
+    const anyBins = entry.clawdbot?.requires?.anyBins ?? [];
+    const install = entry.clawdbot?.install ?? [];
+    for (const bin of required) {
+      const trimmed = bin.trim();
+      if (trimmed) bins.add(trimmed);
+    }
+    for (const bin of anyBins) {
+      const trimmed = bin.trim();
+      if (trimmed) bins.add(trimmed);
+    }
+    for (const spec of install) {
+      const specBins = spec?.bins ?? [];
+      for (const bin of specBins) {
+        const trimmed = String(bin).trim();
+        if (trimmed) bins.add(trimmed);
+      }
+    }
+  }
+  return [...bins].sort();
+}
+
 export const skillsHandlers: GatewayRequestHandlers = {
   "skills.status": ({ params, respond }) => {
     if (!validateSkillsStatusParams(params)) {
@@ -35,6 +76,27 @@ export const skillsHandlers: GatewayRequestHandlers = {
     });
     respond(true, report, undefined);
   },
+  "skills.bins": ({ params, respond }) => {
+    if (!validateSkillsBinsParams(params)) {
+      respond(
+        false,
+        undefined,
+        errorShape(
+          ErrorCodes.INVALID_REQUEST,
+          `invalid skills.bins params: ${formatValidationErrors(validateSkillsBinsParams.errors)}`,
+        ),
+      );
+      return;
+    }
+    const cfg = loadConfig();
+    const workspaceDirs = listWorkspaceDirs(cfg);
+    const bins = new Set<string>();
+    for (const workspaceDir of workspaceDirs) {
+      const entries = loadWorkspaceSkillEntries(workspaceDir, { config: cfg });
+      for (const bin of collectSkillBins(entries)) bins.add(bin);
+    }
+    respond(true, { bins: [...bins].sort() }, undefined);
+  },
   "skills.install": async ({ params, respond }) => {
     if (!validateSkillsInstallParams(params)) {
       respond(