feat(adr-013): Phase 0b — submodule bump + dev preset bundles

[samxu01]

Summary

ADR-013 Phase 0b + Phase 1 — wires the gateway-side and preset-side so dev agents can produce DOCX/XLSX/PPTX/PDF deliverables and attach them to chat today, with no follow-up PR needed for officecli.

Depends on Team-Commonly/openclaw#2 — submodule pointer references the feature-branch SHA.

What ships

1. Submodule bump → _external/clawdbot

Moves to feat/commonly-attach-file which adds:

• commonly_attach_file extension tool — kernel verb, uploads + posts [[upload:...]] directive
• uploadFile() client method — multipart POST to /api/agents/runtime/pods/:podId/uploads
• toRelativeWorkspacePath exported from plugin-sdk — path-traversal protection
• OPENCLAW_INSTALL_DOC_TOOLCHAIN build arg — opt-in ~170MB toolchain (pinned OfficeCLI + pandoc + texlive + markitdown + pypdf)

2. defaultSkills bundles for the four production dev presets

Preset	Bundle
dev-pm (Theo)	github, officecli, pandic-office, markdown-converter, pdf
backend-engineer (Nova)	github, tmux, officecli, pandic-office, markdown-converter, pdf
frontend-engineer (Pixel)	github, tmux, officecli, pandic-office, markdown-converter, pdf
devops-engineer (Ops)	github, tmux, officecli, pandic-office, markdown-converter, pdf

3. Auto-import — making defaultSkills actually do something

The fix to a real gap. Before this commit, defaultSkills was metadata-only — consumed by presets-router.ts to display readiness in the install UI, but never read by provision/reprovision. So those bundle declarations would have been inert.

This commit adds backend/services/presetSkillsAutoImport.ts (new helper, ~210 lines) and wires it into provision.ts + reprovision.ts. The flow:

1. provisionAgentRuntime returns
2. NEW: applyPresetDefaultSkills resolves each defaultSkills[i].id to SKILL.md content (local bundle first, then catalog) and upserts each as a PodAsset via the existing PodAssetService.upsertImportedSkillAsset
3. syncOpenClawSkills queries those PodAsset rows and writes their SKILL.md files to /workspace/<accountId>/skills/<id>/ on the gateway PVC

Pure reuse, zero new plumbing: same path the manual POST /api/skills/import route uses. Same skillKey upsert pattern means re-running provision is idempotent. Same gateway sync runs unchanged. The only new thing is the lookup-and-call helper.

4. Local skill bundles → commonly-bundled-skills/

New top-level directory for skills shipped with this repo that aren't in the upstream catalog yet. The auto-importer checks here before falling back to the catalog index.

Today's bundle: officecli (Apache-2.0, 20KB SKILL.md + LICENSE) — bundled because the upstream awesome-agent-skills catalog was last synced 2026-02-05 and OfficeCLI was created 2026-03-15. commonly-bundled-skills/README.md documents the convention so future skills follow the same pattern. When upstream gains the skill, the local bundle can be deleted.

Why this matters

Before this PR, even with the docs and infrastructure shipped, agents would still have no DOCX/XLSX/PPTX capability — officecli wouldn't be in any catalog and the preset declarations would be inert. After this PR (+ openclaw#2 + the workflow build-arg flip), the full loop works end-to-end:

1. Deploy Dev rebuilds gateway with toolchain
2. Reprovision-all imports preset defaultSkills into PodAssets, syncs SKILL.md to PVC
3. Theo/Nova/Pixel/Ops each have officecli + pandic-office + ... in their workspace
4. Agent calls commonly_attach_file({podId, filePath: 'deck.pptx', message: 'Stakeholder deck.'})
5. Pill renders with preview in chat

Workflow change — separate sibling PR

Companion one-liner change to .github/workflows/deploy-dev.yml adds --build-arg OPENCLAW_INSTALL_DOC_TOOLCHAIN=1. Needs separate auth (workflow scope). Trivial to apply:

   docker build _external/clawdbot \
     --build-arg OPENCLAW_EXTENSIONS=acpx \
     --build-arg OPENCLAW_INSTALL_GH_CLI=1 \
+    --build-arg OPENCLAW_INSTALL_DOC_TOOLCHAIN=1 \
     -t "$REPO:$TAG"

Without that flag the toolchain isn't installed and officecli / pandoc won't be on the gateway image. The submodule bump + presets + auto-import are all still useful — commonly_attach_file (the kernel verb) works regardless. Agents just won't have the binaries to produce files until the workflow flag flips.

Verification path

After merge + Deploy Dev + reprovision-all on dev:

• kubectl exec -n commonly-dev deployment/clawdbot-gateway -- officecli --version → 1.0.70
• kubectl exec -n commonly-dev deployment/clawdbot-gateway -- ls /workspace/theo/skills/ → shows officecli pandic-office pdf markdown-converter github
• Hand-test: agent drops a fixture PDF in workspace, calls commonly_attach_file, file appears in chat with preview pill
• Hand-test: path-traversal attempt rejected
• Hand-test: Theo produces a 1-page PDF brief and attaches it (full skill loop)
• Hand-test: Theo creates a PPTX deck via officecli and attaches it (DOCX/XLSX/PPTX capability)

Companion

• ADR-013 #287 (merged) — design doc.
• Phase 0a findings #291 — closes Q1/11/12/13.
• openclaw#2 — extension tool + Dockerfile build-arg in the openclaw fork.

🤖 Generated with Claude Code