重构主控编排与运行时预热链路，统一工作区提示词/专家调度协议并补齐 wiki 记忆注入与写回闭环。

同时收敛启动与运维脚本默认行为（含 wiki worker）、更新 Admin 可观测性与相关测试，降低首轮时延并提高运行稳定性。

Made-with: Cursor

openclaw/scripts/e2e/lib/parallels-macos-common.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+
+parallels_macos_resolve_desktop_user() {
+  local vm_name="$1"
+  local user
+  user="$(prlctl exec "$vm_name" /usr/bin/stat -f '%Su' /dev/console 2>/dev/null | tr -d '\r' | tail -n 1 || true)"
+  if [[ "$user" =~ ^[A-Za-z0-9._-]+$ && "$user" != "root" && "$user" != "loginwindow" ]]; then
+    printf '%s\n' "$user"
+    return 0
+  fi
+  prlctl exec "$vm_name" /usr/bin/dscl . -list /Users NFSHomeDirectory 2>/dev/null \
+    | tr -d '\r' \
+    | awk '$2 ~ /^\/Users\// && $1 !~ /^_/ && $1 != "Shared" && $1 != ".localized" { print $1; exit }'
+}
+
+parallels_macos_resolve_desktop_home() {
+  local vm_name="$1"
+  local user="$2"
+  local home
+  home="$(
+    prlctl exec "$vm_name" /usr/bin/dscl . -read "/Users/$user" NFSHomeDirectory 2>/dev/null \
+      | tr -d '\r' \
+      | awk '/NFSHomeDirectory:/ { print $2; exit }'
+  )"
+  if [[ -n "$home" ]]; then
+    printf '%s\n' "$home"
+  else
+    printf '/Users/%s\n' "$user"
+  fi
+}
+
+parallels_macos_current_user_available() {
+  local vm_name="$1"
+  prlctl exec "$vm_name" --current-user /usr/bin/whoami >/dev/null 2>&1
+}
+
+parallels_macos_desktop_user_exec_with_secret_file() {
+  local vm_name="$1"
+  local user_flag="$2"
+  local user_name="$3"
+  local home="$4"
+  local path_value="$5"
+  local api_key_env="$6"
+  local api_key_value="$7"
+  shift 7
+
+  local secret_path
+  secret_path="/tmp/openclaw-secret-${api_key_env:-env}-$RANDOM-$RANDOM"
+
+  if [[ -n "$api_key_env" && -n "$api_key_value" ]]; then
+    if [[ "$user_flag" == "current-user" ]]; then
+      printf '%s' "$api_key_value" | /usr/bin/base64 | prlctl exec "$vm_name" \
+        --current-user /usr/bin/base64 -D -o "$secret_path"
+    else
+      printf '%s' "$api_key_value" | /usr/bin/base64 | prlctl exec "$vm_name" \
+        /usr/bin/sudo -H -u "$user_name" /usr/bin/base64 -D -o "$secret_path"
+    fi
+  fi
+
+  local wrapper
+  local wrapper_path
+  wrapper_path="/tmp/openclaw-secret-env-wrapper-$RANDOM-$RANDOM.sh"
+  wrapper='#!/bin/bash
+set -e
+cleanup() {
+  rm -f "${OPENCLAW_WRAPPER_FILE:-}"
+}
+trap cleanup EXIT
+if [ -n "${OPENCLAW_SECRET_ENV_NAME:-}" ] && [ -n "${OPENCLAW_SECRET_FILE:-}" ] && [ -f "$OPENCLAW_SECRET_FILE" ]; then
+  secret_value="$(cat "$OPENCLAW_SECRET_FILE")"
+  rm -f "$OPENCLAW_SECRET_FILE"
+  export "${OPENCLAW_SECRET_ENV_NAME}=${secret_value}"
+fi
+"$@"
+'
+
+  if [[ "$user_flag" == "current-user" ]]; then
+    printf '%s' "$wrapper" | /usr/bin/base64 | prlctl exec "$vm_name" \
+      --current-user /usr/bin/base64 -D -o "$wrapper_path"
+  else
+    printf '%s' "$wrapper" | /usr/bin/base64 | prlctl exec "$vm_name" \
+      /usr/bin/sudo -H -u "$user_name" /usr/bin/base64 -D -o "$wrapper_path"
+  fi
+
+  if [[ "$user_flag" == "current-user" ]]; then
+    prlctl exec "$vm_name" --current-user /usr/bin/env \
+      "PATH=$path_value" \
+      "OPENCLAW_SECRET_ENV_NAME=$api_key_env" \
+      "OPENCLAW_SECRET_FILE=$secret_path" \
+      "OPENCLAW_WRAPPER_FILE=$wrapper_path" \
+      /bin/bash "$wrapper_path" "$@"
+    return
+  fi
+
+  prlctl exec "$vm_name" /usr/bin/sudo -H -u "$user_name" /usr/bin/env \
+    "HOME=$home" \
+    "USER=$user_name" \
+    "LOGNAME=$user_name" \
+    "PATH=$path_value" \
+    "OPENCLAW_SECRET_ENV_NAME=$api_key_env" \
+    "OPENCLAW_SECRET_FILE=$secret_path" \
+    "OPENCLAW_WRAPPER_FILE=$wrapper_path" \
+    /bin/bash "$wrapper_path" "$@"
+}
+
+parallels_macos_desktop_user_exec() {
+  local vm_name="$1"
+  local api_key_env="$2"
+  local api_key_value="$3"
+  shift 3
+
+  if parallels_macos_current_user_available "$vm_name"; then
+    parallels_macos_desktop_user_exec_with_secret_file \
+      "$vm_name" \
+      "current-user" \
+      "" \
+      "" \
+      "/opt/homebrew/bin:/opt/homebrew/opt/node/bin:/opt/homebrew/sbin:/usr/bin:/bin:/usr/sbin:/sbin" \
+      "$api_key_env" \
+      "$api_key_value" \
+      "$@"
+    return
+  fi
+
+  local user home
+  user="$(parallels_macos_resolve_desktop_user "$vm_name")"
+  [[ -n "$user" ]] || {
+    printf 'unable to resolve macOS desktop user for sudo fallback\n' >&2
+    return 1
+  }
+  home="$(parallels_macos_resolve_desktop_home "$vm_name" "$user")"
+  printf 'warn: macOS --current-user unavailable; using root sudo fallback for %s\n' "$user" >&2
+  parallels_macos_desktop_user_exec_with_secret_file \
+    "$vm_name" \
+    "sudo" \
+    "$user" \
+    "$home" \
+    "/opt/homebrew/bin:/opt/homebrew/opt/node/bin:/opt/homebrew/sbin:/usr/bin:/bin:/usr/sbin:/sbin" \
+    "$api_key_env" \
+    "$api_key_value" \
+    "$@"
+}