@clawos-dev/clawd 0.2.127 → 0.2.128-beta.255.69495b2

package/dist/cli.cjs

@@ -195,6 +195,10 @@ var init_methods = __esm({
       //   updateProjectPort: 校验新端口段内 + 未被别的 project 占 + 重启 dev server
       //   setProdUrl: 发布上线后 assistant 调一次写入 .clawd-project.json.prodUrl（取代 prod marker）
       "appBuilder:listProjects",
+      // getProject：按 sessionId 取单个绑定 project（含 status）。people/mirror 跨 daemon 场景：
+      // 本机 owner 在远端是 guest，listProjects 被 per-user 隔离拿不到别人的 project；getProject
+      // 按 session 可见性授权（ensureSessionAccess read）放行。本地也复用（省掉拉全量再 find）。
+      "appBuilder:getProject",
       "appBuilder:createProject",
       "appBuilder:deleteProject",
       "appBuilder:updateProjectPort",
@@ -4566,7 +4570,7 @@ var init_persona_schemas = __esm({
 });
 
 // ../protocol/src/schemas.ts
-var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, PeerSessionUpsertArgs, PeerSessionUpsertResponseSchema, PeerSessionRemoveArgs, PeerSessionRemoveResponseSchema, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelReadyEventSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema, PROJECT_PORT_MIN, PROJECT_PORT_MAX, projectNameRegex, DEFAULT_DEV_COMMAND, ProjectMetadataSchema, PROJECT_STAGE_VALUES, ProjectStageSchema, ProjectWithStatusSchema, ListProjectsArgsSchema, ListProjectsResultSchema, CreateProjectArgsSchema, CreateProjectResultSchema, DeleteProjectArgsSchema, DeleteProjectResultSchema, UpdateProjectPortArgsSchema, UpdateProjectPortResultSchema, SetProdUrlArgsSchema, SetProdUrlResultSchema, StartDevServerArgsSchema, StartDevServerResultSchema, ASSISTANT_REPORTABLE_STAGES, ReportStageArgsSchema, ReportStageResultSchema, StopDevServerArgsSchema, StopDevServerResultSchema, AppBuilderProjectUpdatedEventSchema, PublishArgsSchema, PublishResultSchema, DismissPublishJobArgsSchema, DismissPublishJobResultSchema, AppBuilderPublishProgressEventSchema, AppBuilderPublishFailedEventSchema;
+var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, PeerSessionUpsertArgs, PeerSessionUpsertResponseSchema, PeerSessionRemoveArgs, PeerSessionRemoveResponseSchema, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelReadyEventSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema, PROJECT_PORT_MIN, PROJECT_PORT_MAX, projectNameRegex, DEFAULT_DEV_COMMAND, ProjectMetadataSchema, PROJECT_STAGE_VALUES, ProjectStageSchema, ProjectWithStatusSchema, ListProjectsArgsSchema, ListProjectsResultSchema, GetProjectArgsSchema, GetProjectResultSchema, CreateProjectArgsSchema, CreateProjectResultSchema, DeleteProjectArgsSchema, DeleteProjectResultSchema, UpdateProjectPortArgsSchema, UpdateProjectPortResultSchema, SetProdUrlArgsSchema, SetProdUrlResultSchema, StartDevServerArgsSchema, StartDevServerResultSchema, ASSISTANT_REPORTABLE_STAGES, ReportStageArgsSchema, ReportStageResultSchema, StopDevServerArgsSchema, StopDevServerResultSchema, AppBuilderProjectUpdatedEventSchema, PublishArgsSchema, PublishResultSchema, DismissPublishJobArgsSchema, DismissPublishJobResultSchema, AppBuilderPublishProgressEventSchema, AppBuilderPublishFailedEventSchema;
 var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
@@ -5202,7 +5206,7 @@ var init_schemas = __esm({
       httpToken: external_exports.string().optional()
     });
     PROJECT_PORT_MIN = 6173;
-    PROJECT_PORT_MAX = 6182;
+    PROJECT_PORT_MAX = 6272;
     projectNameRegex = /^[a-z][a-z0-9-]{0,39}$/;
     DEFAULT_DEV_COMMAND = "cd server && pnpm dev";
     ProjectMetadataSchema = external_exports.object({
@@ -5289,6 +5293,13 @@ var init_schemas = __esm({
     ListProjectsResultSchema = external_exports.object({
       projects: external_exports.array(ProjectWithStatusSchema)
     }).strict();
+    GetProjectArgsSchema = external_exports.object({
+      sessionId: external_exports.string().min(1)
+    }).strict();
+    GetProjectResultSchema = external_exports.object({
+      /** session 未绑 project / project 不存在时为 null（UI 走单栏 / 折叠） */
+      project: ProjectWithStatusSchema.nullable()
+    }).strict();
     CreateProjectArgsSchema = external_exports.object({
       /** 必填：caller session，daemon 自动绑过去（spec 2026-06-02 §3 invariant 1 Session ↔ 1 Project） */
       sessionId: external_exports.string().min(1),
@@ -7082,7 +7093,7 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs49 = require("fs");
+    var fs50 = require("fs");
     var EventEmitter3 = require("events");
     var inherits = require("util").inherits;
     var path60 = require("path");
@@ -7139,20 +7150,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs49.mkdirSync(path60.dirname(file), { recursive: true });
-          const fd = fs49.openSync(file, flags, mode);
+          if (sonic.mkdir) fs50.mkdirSync(path60.dirname(file), { recursive: true });
+          const fd = fs50.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs49.mkdir(path60.dirname(file), { recursive: true }, (err) => {
+        fs50.mkdir(path60.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs49.open(file, flags, mode, fileOpened);
+          fs50.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs49.open(file, flags, mode, fileOpened);
+        fs50.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -7193,8 +7204,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs49.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs49.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs50.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs50.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -7203,15 +7214,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs49.writeSync(this.fd, this._writingBuf);
+            return fs50.writeSync(this.fd, this._writingBuf);
           }
-          return fs49.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs50.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs49.write(this.fd, this._writingBuf, this.release);
+            return fs50.write(this.fd, this._writingBuf, this.release);
           }
-          return fs49.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs50.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -7268,7 +7279,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs49.fsyncSync(this.fd);
+          fs50.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -7382,7 +7393,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs49.fsync(this.fd, (err) => {
+            fs50.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -7484,7 +7495,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs49.close(fd, (err) => {
+          fs50.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -7533,7 +7544,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs49.writeSync(this.fd, buf) : fs49.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs50.writeSync(this.fd, buf) : fs50.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -7549,7 +7560,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs49.fsyncSync(this.fd);
+        fs50.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -7570,7 +7581,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs49.writeSync(this.fd, buf);
+          const n = fs50.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -7598,13 +7609,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs49.writeSync(this.fd, this._writingBuf) : fs49.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs50.writeSync(this.fd, this._writingBuf) : fs50.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs49.write(this.fd, this._writingBuf, release);
+        fs50.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7613,7 +7624,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs49.writeSync(this.fd, this._writingBuf);
+          const written = fs50.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7622,7 +7633,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs49.write(this.fd, this._writingBuf, release);
+        fs50.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7638,12 +7649,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs49.fsync(sonic.fd, closeWrapped);
+        fs50.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs49.close(sonic.fd, done);
+          fs50.close(sonic.fd, done);
         } else {
           done();
         }
@@ -8322,7 +8333,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join15, isAbsolute: isAbsolute2, sep: sep3 } = require("path");
+    var { join: join15, isAbsolute: isAbsolute2, sep: sep2 } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -8430,7 +8441,7 @@ var require_transport = __commonJS({
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep3 : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -10850,7 +10861,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join4(chars) {
+      join: function join5(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -11705,27 +11716,6 @@ var init_claude_history = __esm({
   }
 });
 
-// src/tools/sandbox.ts
-function shouldSandbox(cwd, personaRoot) {
-  if (!personaRoot) return false;
-  const sep3 = personaRoot.endsWith(path13.sep) ? "" : path13.sep;
-  return cwd.startsWith(personaRoot + sep3) && cwd !== personaRoot;
-}
-function inferSandboxSettingsPath(cwd, personaRoot) {
-  if (!shouldSandbox(cwd, personaRoot)) return null;
-  const rel = path13.relative(personaRoot, cwd);
-  const personaId = rel.split(path13.sep)[0];
-  if (!personaId) return null;
-  return path13.join(personaRoot, personaId, ".clawd", "sandbox-settings.json");
-}
-var path13;
-var init_sandbox = __esm({
-  "src/tools/sandbox.ts"() {
-    "use strict";
-    path13 = __toESM(require("path"), 1);
-  }
-});
-
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
@@ -11790,9 +11780,11 @@ function buildSpawnArgs(ctx) {
       throw new Error(`unexpected personaMode: ${String(_exhaustive)}`);
     }
   }
-  const sandboxSettings = ctx.extraSettings ?? inferSandboxSettingsPath(ctx.cwd, ctx.personaRoot);
-  if (sandboxSettings) args.push("--settings", sandboxSettings);
+  if (ctx.extraSettings) args.push("--settings", ctx.extraSettings);
   if (ctx.extraSystemPrompt) args.push("--append-system-prompt", ctx.extraSystemPrompt);
+  if (ctx.addDirs) {
+    for (const dir of ctx.addDirs) args.push("--add-dir", dir);
+  }
   if (ctx.effort) args.push("--effort", ctx.effort);
   if (ctx.toolSessionId) args.push("--resume", ctx.toolSessionId);
   return args;
@@ -12191,7 +12183,6 @@ var init_claude = __esm({
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
-    init_sandbox();
     ATTACHMENT_SILENT_SUBTYPES2 = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -30745,8 +30736,8 @@ function startRunCaseRecorder(opts) {
   });
   const ensureStream = () => {
     if (stream) return stream;
-    import_node_fs32.default.mkdirSync(dir, { recursive: true });
-    stream = import_node_fs32.default.createWriteStream(opts.recordPath, { flags: "a" });
+    import_node_fs33.default.mkdirSync(dir, { recursive: true });
+    stream = import_node_fs33.default.createWriteStream(opts.recordPath, { flags: "a" });
     stream.on("close", () => closedResolve());
     return stream;
   };
@@ -30771,11 +30762,11 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs32, import_node_path48;
+var import_node_fs33, import_node_path48;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
-    import_node_fs32 = __toESM(require("fs"), 1);
+    import_node_fs33 = __toESM(require("fs"), 1);
     import_node_path48 = __toESM(require("path"), 1);
   }
 });
@@ -30819,7 +30810,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs33.mkdtempSync)(import_node_path49.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs34.mkdtempSync)(import_node_path49.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -30980,17 +30971,17 @@ async function runController(opts) {
   if (sigintHandler) process.off("SIGINT", sigintHandler);
   if (ownsCwd) {
     try {
-      (0, import_node_fs33.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_node_fs34.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   }
   return exitCode ?? 0;
 }
-var import_node_fs33, import_node_os19, import_node_path49;
+var import_node_fs34, import_node_os19, import_node_path49;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
-    import_node_fs33 = require("fs");
+    import_node_fs34 = require("fs");
     import_node_os19 = __toESM(require("os"), 1);
     import_node_path49 = __toESM(require("path"), 1);
     init_claude();
@@ -31228,7 +31219,7 @@ Env (advanced):
 
 // src/index.ts
 var import_node_path47 = __toESM(require("path"), 1);
-var import_node_fs31 = __toESM(require("fs"), 1);
+var import_node_fs32 = __toESM(require("fs"), 1);
 
 // src/logger.ts
 var import_node_fs2 = __toESM(require("fs"), 1);
@@ -31266,7 +31257,7 @@ function createLogger(opts = {}) {
 }
 
 // src/session/store-factory.ts
-var path5 = __toESM(require("path"), 1);
+var path6 = __toESM(require("path"), 1);
 
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
@@ -31275,6 +31266,22 @@ init_protocol();
 
 // src/session/scope.ts
 var import_node_path3 = __toESM(require("path"), 1);
+
+// src/session/user-workdir.ts
+var path3 = __toESM(require("path"), 1);
+function safeUserId(userId) {
+  const base = userId.replace(/[^a-zA-Z0-9_\-.]/g, "_");
+  const cleaned = base.replace(/^\.+/, (dots) => "_".repeat(dots.length));
+  if (!cleaned) throw new Error(`deriveUserWorkDir: invalid userId: ${userId}`);
+  return cleaned.replace(/\.\./g, "__");
+}
+function deriveUserWorkDir(userId, usersRoot) {
+  if (!userId) throw new Error("deriveUserWorkDir: userId required");
+  if (!usersRoot) throw new Error("deriveUserWorkDir: usersRoot required");
+  return path3.join(usersRoot, safeUserId(userId));
+}
+
+// src/session/scope.ts
 function scopeKey(scope) {
   if (scope.kind === "default") return "default";
   if (scope.mode === "guest") return `persona:${scope.personaId}:guest:${scope.capId}`;
@@ -31285,15 +31292,18 @@ function scopeSubPath(scope) {
   if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
   return [scope.personaId, scope.mode];
 }
-function metaFromScope(scope, personaRoot) {
+function metaFromScope(scope, personaRoot, usersRoot) {
   if (scope.kind === "default") return void 0;
   if (scope.mode === "owner") {
     return { idleKillEnabled: false, personaMode: "owner" };
   }
+  const userWorkDir = deriveUserWorkDir(scope.capId, usersRoot);
   return {
     idleKillEnabled: true,
     personaMode: "guest",
-    extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json")
+    extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json"),
+    userWorkDir,
+    addDirs: [userWorkDir]
   };
 }
 function scopeForFile(file, ownerPrincipalId) {
@@ -31403,10 +31413,10 @@ var SessionStoreFactory = class {
   }
   // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
   bareRoot() {
-    return path5.join(this.dataDir, "sessions");
+    return path6.join(this.dataDir, "sessions");
   }
   vmOwnerRoot(personaId) {
-    return path5.join(
+    return path6.join(
       this.dataDir,
       "personas",
       safeFileName(personaId),
@@ -31416,7 +31426,7 @@ var SessionStoreFactory = class {
     );
   }
   vmGuestRoot(personaId, capId) {
-    return path5.join(
+    return path6.join(
       this.dataDir,
       "personas",
       safeFileName(personaId),
@@ -31550,7 +31560,12 @@ var LISTENER_TEMPLATE = `# \u8FDE\u63A5\u4E0A\u4E0B\u6587
 \u81EA\u6211\u4ECB\u7ECD\u65F6\u4F7F\u7528\u7B2C\u4E09\u4EBA\u79F0\u6307\u4EE3 owner\uFF0C\u4F8B\u5982\u300C\u6211\u662F {ownerLabel} \u7684 xxx \u52A9\u624B\uFF0C\u4F60\u53EF\u4EE5\u901A\u8FC7\u6211\u770B\u5230\u4ED6\u7684 xxx\u300D\u3002\u4E0D\u8981\u628A\u5BF9\u65B9\u5F53\u6210 owner\uFF0C\u4E0D\u8981\u66FF owner \u505A\u51FA\u627F\u8BFA\u3002`;
 function buildConnectionPrompt(args) {
   const template = args.mode === "owner" ? OWNER_TEMPLATE : LISTENER_TEMPLATE;
-  return template.replace(/\{ownerLabel\}/g, args.ownerLabel);
+  let result = template.replace(/\{ownerLabel\}/g, args.ownerLabel);
+  if (args.workDir) {
+    result += `
+\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u6240\u6709\u6587\u4EF6\u8BFB\u5199\u90FD\u653E\u5728\u8FD9\u4E2A\u76EE\u5F55\u4E0B\u3002persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002`;
+  }
+  return result;
 }
 
 // src/session/reducer.ts
@@ -31647,12 +31662,16 @@ function buildSpawnContext(state, deps) {
     ctx.personaMode = meta.personaMode;
     ctx.extraSystemPrompt = buildConnectionPrompt({
       mode: meta.personaMode,
-      ownerLabel: deps.ownerDisplayName
+      ownerLabel: deps.ownerDisplayName,
+      workDir: meta.userWorkDir
     });
   }
   if (meta?.extraSettings) {
     ctx.extraSettings = meta.extraSettings;
   }
+  if (meta?.addDirs && meta.addDirs.length > 0) {
+    ctx.addDirs = meta.addDirs;
+  }
   return ctx;
 }
 function sessionInfoFrame(file) {
@@ -33097,7 +33116,7 @@ var SessionManager = class {
   newRunner(file, scope) {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
-    const subSessionMeta = metaFromScope(scope, this.deps.personaRoot ?? "");
+    const subSessionMeta = metaFromScope(scope, this.deps.personaRoot ?? "", this.deps.usersRoot ?? "");
     const attachmentGroup = this.deps.attachmentGroup;
     const runner = new SessionRunner(makeInitialState(file, subSessionMeta), {
       broadcastFrame: (frame, target) => this.routeFromRunner(frame, target),
@@ -34294,28 +34313,24 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs7 = __toESM(require("fs"), 1);
-var path9 = __toESM(require("path"), 1);
+var path10 = __toESM(require("path"), 1);
 init_protocol();
-var DEFAULT_SETTINGS = {
-  permissions: {
-    // silent-deny for tools accessing outside cwd — no permission prompt shown to persona
-    defaultMode: "dontAsk"
-  },
-  sandbox: {
-    enabled: true,
-    // sandboxed Bash auto-runs without prompting the user
-    autoAllowBashIfSandboxed: true,
-    // prevents CC from retrying denied commands with dangerouslyDisableSandbox: true
-    allowUnsandboxedCommands: false,
-    filesystem: {
-      // deny home dir explicitly; default sandbox allows all reads, only limits writes to cwd
-      denyRead: ["~/"],
-      allowRead: ["."],
-      denyWrite: ["~/"],
-      allowWrite: ["."]
-    }
-  }
-};
+
+// src/tools/guest-settings.ts
+function buildGuestSettingsV1(paths) {
+  const p2 = (dir) => dir.replace(/^\//, "");
+  return {
+    permissions: {
+      defaultMode: "dontAsk",
+      allow: ["Bash"],
+      deny: [`Edit(//${p2(paths.personaDir)}/**)`, `Read(//${p2(paths.personaDir)}/.clawd/**)`]
+    },
+    // 先不加 OS 沙箱（见文件头说明）；目录隔离靠 user-dir 分配 + --add-dir + RPC 守卫。
+    sandbox: { enabled: false }
+  };
+}
+
+// src/persona/store.ts
 var PersonaStore = class {
   constructor(root) {
     this.root = root;
@@ -34323,13 +34338,13 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path9.join(this.root, safeFileName(personaId));
+    return path10.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path9.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path10.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path9.join(this.personaDir(personaId), "CLAUDE.md");
+    return path10.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
    * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
@@ -34339,15 +34354,15 @@ var PersonaStore = class {
    * 加载 persona 人格，只有 listener 多一层 OS sandbox。
    */
   sandboxSettingsPath(personaId) {
-    return path9.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path10.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs7.mkdirSync(path9.join(dir, ".clawd"), { recursive: true });
+    fs7.mkdirSync(path10.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
-      JSON.stringify(DEFAULT_SETTINGS, null, 2)
+      JSON.stringify(buildGuestSettingsV1({ personaDir: dir }), null, 2)
     );
     this.atomicWrite(this.metaPath(persona.personaId), JSON.stringify(persona, null, 2));
   }
@@ -34402,14 +34417,14 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path9.join(this.personaDir(personaId), ".claude", "skills");
+    return path10.join(this.personaDir(personaId), ".claude", "skills");
   }
   /**
    * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
    * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
    */
   claudeSettingsPath(personaId) {
-    return path9.join(this.personaDir(personaId), ".claude", "settings.json");
+    return path10.join(this.personaDir(personaId), ".claude", "settings.json");
   }
   /**
    * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
@@ -34443,7 +34458,7 @@ var PersonaStore = class {
   list() {
     if (!fs7.existsSync(this.root)) return [];
     return fs7.readdirSync(this.root).filter((name) => {
-      return fs7.existsSync(path9.join(this.root, name, ".clawd", "persona.json"));
+      return fs7.existsSync(path10.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -34873,7 +34888,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs9 = __toESM(require("fs"), 1);
-var path11 = __toESM(require("path"), 1);
+var path12 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -34913,14 +34928,9 @@ var DEFAULT_PERSONAS = [
     label: "App Builder",
     model: "opus",
     iconKey: "assist",
-    public: false,
-    // 默认关 sandbox：FC 部署链路（aliyun CLI + ossutil）/ pnpm install / curl daemon RPC
-    // 都需要走 sandbox 之外的能力。assistant 在 sandboxed Bash 下会被 silent-deny 一堆操作，
-    // 影响正常工作流；老板明确说 app-builder 不要 sandbox。
-    sandboxOverride: {
-      permissions: { defaultMode: "dontAsk" },
-      sandbox: { enabled: false }
-    }
+    public: false
+    // 不设 sandboxOverride：owner 不注入 sandbox（天然不沙箱，部署/pnpm/curl 都 freedom），
+    // guest 走 sandbox-settings.json 的 guest 沙箱配置（store.write 默认生成）。
   },
   {
     personaId: "persona-developer",
@@ -34940,14 +34950,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path11.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path11.resolve(here, "defaults"));
-    candidates.push(path11.resolve(here, "persona-defaults"));
+    const here = path12.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path12.resolve(here, "defaults"));
+    candidates.push(path12.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path11.dirname(process.argv[1]);
-    candidates.push(path11.resolve(argvDir, "persona-defaults"));
+    const argvDir = path12.dirname(process.argv[1]);
+    candidates.push(path12.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -34964,7 +34974,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path11.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path12.join(args.defaultsRoot, entry.personaId);
     if (!fs9.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -34973,7 +34983,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path11.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path12.join(bundleDir, "CLAUDE.md");
     if (!fs9.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -35005,8 +35015,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs9.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path11.join(srcDir, entry.name);
-    const dstPath = path11.join(dstDir, entry.name);
+    const srcPath = path12.join(srcDir, entry.name);
+    const dstPath = path12.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs9.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -35018,14 +35028,14 @@ var DAEMON_MANAGED_PATHS = ["extension-kit", "CLAUDE.md", ".mcp.json"];
 function refreshDaemonManagedDirs(args) {
   const entries = args.entries ?? DEFAULT_PERSONAS;
   for (const entry of entries) {
-    const bundleDir = path11.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path12.join(args.defaultsRoot, entry.personaId);
     if (!fs9.existsSync(bundleDir)) continue;
     const personaDir = args.store.personaDirPath(entry.personaId);
     if (!fs9.existsSync(personaDir)) continue;
     for (const relPath of DAEMON_MANAGED_PATHS) {
-      const srcPath = path11.join(bundleDir, relPath);
+      const srcPath = path12.join(bundleDir, relPath);
       if (!fs9.existsSync(srcPath)) continue;
-      const dstPath = path11.join(personaDir, relPath);
+      const dstPath = path12.join(personaDir, relPath);
       try {
         fs9.cpSync(srcPath, dstPath, { recursive: true, force: true, dereference: true });
         args.logger.info("persona.refresh.synced", {
@@ -40259,7 +40269,8 @@ function buildSessionHandlers(deps) {
     ensureSessionAccess(ctx, args.sessionId, "send");
     const sessionFile = manager.findOwnedSession(args.sessionId);
     const projectName = sessionFile?.appBuilderProject ?? null;
-    if (projectName && deps.devServerLifecycle && deps.appBuilderStore) {
+    const projectStore = (sessionFile?.creatorPrincipalId ? deps.getProjectStore?.(sessionFile.creatorPrincipalId) : void 0) ?? deps.appBuilderStore;
+    if (projectName && deps.devServerLifecycle && projectStore) {
       try {
         await deps.devServerLifecycle.stopForProject(projectName);
       } catch (err) {
@@ -40270,7 +40281,7 @@ function buildSessionHandlers(deps) {
         });
       }
       try {
-        await deps.appBuilderStore.delete(projectName);
+        await projectStore.delete(projectName);
       } catch (err) {
         deps.logger?.warn("session-delete.delete-project-failed", {
           sessionId: args.sessionId,
@@ -40555,11 +40566,16 @@ function getAllowedPersonaIds(grants, action) {
   }
   return ids;
 }
-function isGuestPathAllowed(grants, absPath, personaRoot, action = "read") {
-  const root = path41.resolve(personaRoot);
+function isGuestPathAllowed(grants, absPath, personaRoot, action = "read", userWorkDir) {
   const target = path41.resolve(absPath);
-  const sep3 = root.endsWith(path41.sep) ? "" : path41.sep;
-  if (!target.startsWith(root + sep3)) return false;
+  if (userWorkDir) {
+    const u = path41.resolve(userWorkDir);
+    const usep = u.endsWith(path41.sep) ? "" : path41.sep;
+    if (target === u || target.startsWith(u + usep)) return true;
+  }
+  const root = path41.resolve(personaRoot);
+  const sep2 = root.endsWith(path41.sep) ? "" : path41.sep;
+  if (!target.startsWith(root + sep2)) return false;
   const rel = path41.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
   const personaId = rel.split(path41.sep)[0];
@@ -40571,8 +40587,8 @@ function isGuestPathAllowed(grants, absPath, personaRoot, action = "read") {
 function personaIdFromPath(absPath, personaRoot) {
   const root = path41.resolve(personaRoot);
   const target = path41.resolve(absPath);
-  const sep3 = root.endsWith(path41.sep) ? "" : path41.sep;
-  if (!target.startsWith(root + sep3)) return null;
+  const sep2 = root.endsWith(path41.sep) ? "" : path41.sep;
+  if (!target.startsWith(root + sep2)) return null;
   const rel = path41.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
   const id = rel.split(path41.sep)[0];
@@ -40581,9 +40597,10 @@ function personaIdFromPath(absPath, personaRoot) {
 
 // src/handlers/history.ts
 init_protocol();
-function assertGuestPath(ctx, absPath, personaRoot, method) {
+function assertGuestPath(ctx, absPath, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
-  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+  const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
@@ -40591,10 +40608,11 @@ function assertGuestPath(ctx, absPath, personaRoot, method) {
   }
 }
 function buildHistoryHandlers(deps) {
-  const { manager, history, store, personaRoot } = deps;
+  const { manager, history, store, personaRoot, usersRoot } = deps;
   const projects = async (_frame, _client, ctx) => {
     const list2 = await history.listProjects();
     if (ctx?.principal.kind === "guest" && personaRoot) {
+      const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = list2.filter((p2) => {
         const pid = personaIdFromPath(p2.projectPath, personaRoot);
         if (!pid) return false;
@@ -40602,7 +40620,8 @@ function buildHistoryHandlers(deps) {
           ctx.grants,
           path42.join(personaRoot, pid),
           personaRoot,
-          "read"
+          "read",
+          userWorkDir
         );
       });
       return { response: { type: "history:projects", projects: filtered } };
@@ -40643,21 +40662,22 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagents");
+    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagent-read");
+    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
   const recentDirs = async (_frame, _client, ctx) => {
     const dirs = listRecentDirs(store);
     if (ctx?.principal.kind === "guest" && personaRoot) {
+      const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path42.resolve(d.cwd), personaRoot, "read")
+        (d) => isGuestPathAllowed(ctx.grants, path42.resolve(d.cwd), personaRoot, "read", userWorkDir)
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -40700,9 +40720,10 @@ function filterGuestAgents(list, enabledPluginNames) {
     return false;
   });
 }
-function assertGuestPath2(ctx, absPath, personaRoot, method) {
+function assertGuestPath2(ctx, absPath, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
-  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+  const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
@@ -40710,28 +40731,28 @@ function assertGuestPath2(ctx, absPath, personaRoot, method) {
   }
 }
 function buildWorkspaceHandlers(deps) {
-  const { workspace, skills, agents, personaRoot, personaManager } = deps;
+  const { workspace, skills, agents, personaRoot, personaManager, usersRoot } = deps;
   const list = async (frame, _client, ctx) => {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os15.homedir();
     const resolvedCwd = path43.resolve(args.cwd ?? fallbackCwd);
     const target = args.path ? path43.resolve(resolvedCwd, args.path) : resolvedCwd;
-    assertGuestPath2(ctx, target, personaRoot, "workspace:list");
+    assertGuestPath2(ctx, target, personaRoot, "workspace:list", usersRoot);
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
     const target = path43.isAbsolute(args.path) ? path43.resolve(args.path) : path43.resolve(args.cwd, args.path);
-    assertGuestPath2(ctx, target, personaRoot, "workspace:read");
+    assertGuestPath2(ctx, target, personaRoot, "workspace:read", usersRoot);
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
     const cwdAbs = path43.resolve(args.cwd);
-    assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list");
+    assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list", usersRoot);
     const list2 = skills.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const personaId = personaIdFromPath(cwdAbs, personaRoot);
@@ -40743,7 +40764,7 @@ function buildWorkspaceHandlers(deps) {
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
     const cwdAbs = path43.resolve(args.cwd);
-    assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list");
+    assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list", usersRoot);
     const list2 = agents.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const personaId = personaIdFromPath(cwdAbs, personaRoot);
@@ -40845,9 +40866,10 @@ async function listGitBranches(cwd) {
 }
 
 // src/handlers/git.ts
-function assertGuestCwd(ctx, cwd, personaRoot, method) {
+function assertGuestCwd(ctx, cwd, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
-  if (!isGuestPathAllowed(ctx.grants, path45.resolve(cwd), personaRoot, "read")) {
+  const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
+  if (!isGuestPathAllowed(ctx.grants, path45.resolve(cwd), personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -40855,22 +40877,22 @@ function assertGuestCwd(ctx, cwd, personaRoot, method) {
   }
 }
 function buildGitHandlers(deps) {
-  const { personaRoot } = deps;
+  const { personaRoot, usersRoot } = deps;
   const root = async (frame, _client, ctx) => {
     const args = GitRootArgs.parse(frame);
-    assertGuestCwd(ctx, args.cwd, personaRoot, "git:root");
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:root", usersRoot);
     const res = await getGitRoot(args.cwd);
     return { response: { type: "git:root", ...res } };
   };
   const branch = async (frame, _client, ctx) => {
     const args = GitBranchArgs.parse(frame);
-    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branch");
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branch", usersRoot);
     const res = await readGitBranch(args.cwd);
     return { response: { type: "git:branch", ...res } };
   };
   const branches = async (frame, _client, ctx) => {
     const args = GitBranchesArgs.parse(frame);
-    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branches");
+    assertGuestCwd(ctx, args.cwd, personaRoot, "git:branches", usersRoot);
     const res = await listGitBranches(args.cwd);
     return { response: { type: "git:branches", ...res } };
   };
@@ -41364,9 +41386,10 @@ var import_node_path33 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
-function assertGuestAttachmentPath(ctx, absPath, personaRoot, method) {
+function assertGuestAttachmentPath(ctx, absPath, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
-  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read")) {
+  const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
+  if (!isGuestPathAllowed(ctx.grants, absPath, personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} path ${absPath}`
@@ -41416,7 +41439,7 @@ function buildAttachmentHandlers(deps) {
     }
     const cwdAbs = import_node_path33.default.resolve(sessionFile.cwd);
     const candidateAbs = import_node_path33.default.isAbsolute(args.relPath) ? import_node_path33.default.resolve(args.relPath) : import_node_path33.default.resolve(cwdAbs, args.relPath);
-    assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl");
+    assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl", deps.usersRoot);
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
       const storedAbs = import_node_path33.default.isAbsolute(e.relPath) ? import_node_path33.default.resolve(e.relPath) : import_node_path33.default.resolve(cwdAbs, e.relPath);
@@ -41443,7 +41466,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path33.default.resolve(f.cwd), deps.personaRoot, method);
+    assertGuestAttachmentPath(ctx, import_node_path33.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -42603,6 +42626,8 @@ async function recoverInterruptedJobs(deps) {
 // src/handlers/app-builder.ts
 init_protocol();
 var import_node_path40 = require("path");
+var import_node_fs30 = require("fs");
+var APP_BUILDER_PERSONAS = ["persona-app-builder"];
 var PUBLISH_SCRIPT_REL = "extension-kit/scripts/publish.sh";
 var DEV_SERVER_READY_TIMEOUT_MS = 3e4;
 async function recoverInterruptedPublishJobs(store, logger) {
@@ -42613,6 +42638,29 @@ async function recoverInterruptedPublishJobs(store, logger) {
 }
 function buildAppBuilderHandlers(deps) {
   const { store, devServerLifecycle, sessionManager, getTunnelUrl, broadcastProjectUpdated } = deps;
+  function resolveStore(opts) {
+    if (!deps.getStore) return store;
+    if (opts.sessionId) {
+      const s = sessionManager.findOwnedSession(opts.sessionId);
+      if (s?.creatorPrincipalId) return deps.getStore(s.creatorPrincipalId);
+    }
+    if (opts.projectName) {
+      const s = sessionManager.findOwnedSessionByAppBuilderProject(opts.projectName);
+      if (s?.creatorPrincipalId) return deps.getStore(s.creatorPrincipalId);
+    }
+    if (opts.ctx) return deps.getStore(opts.ctx.principal.id);
+    return store;
+  }
+  function ensureProjectWriteAccess(ctx, opts) {
+    if (!ctx) return;
+    const sessionId = opts.sessionId ?? (opts.projectName ? sessionManager.findOwnedSessionByAppBuilderProject(opts.projectName)?.sessionId : void 0);
+    if (!sessionId) return;
+    if (!canAccessSession(ctx, sessionId, "send", {
+      readSession: (sid) => sessionManager.findOwnedSession(sid) ?? null
+    })) {
+      throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `cannot write project of session ${sessionId}`);
+    }
+  }
   const stages = /* @__PURE__ */ new Map();
   const publishRegistry = new PublishJobRegistry();
   function withPublishJobStatus(meta) {
@@ -42629,13 +42677,13 @@ function buildAppBuilderHandlers(deps) {
     if (recorded) return recorded;
     return devServerLifecycle.isRunning(name) ? { stage: "running" } : { stage: "stopped" };
   }
-  async function setStageAndBroadcast(name, stage, reason) {
+  async function setStageAndBroadcast(name, stage, reason, s = store) {
     if (reason !== void 0) {
       stages.set(name, { stage, reason });
     } else {
       stages.set(name, { stage });
     }
-    const projects = await store.list();
+    const projects = await s.list();
     const meta = projects.find((p2) => p2.name === name);
     if (!meta) {
       deps.logger?.warn("app-builder.stage-broadcast.project-missing", { name, stage });
@@ -42657,28 +42705,54 @@ function buildAppBuilderHandlers(deps) {
       ...reason !== void 0 ? { stageReason: reason } : {}
     });
   }
-  const listProjects = async () => {
-    const projects = await store.list();
+  async function listAllUsersProjects() {
+    if (!deps.usersRoot || !deps.getStore) return [];
+    const getStore = deps.getStore;
+    const userIds = await import_node_fs30.promises.readdir(deps.usersRoot).catch(() => []);
+    const perUser = await Promise.all(
+      userIds.map((uid) => getStore(uid).list().catch(() => []))
+    );
+    return perUser.flat();
+  }
+  function toProjectWithStatus(p2) {
+    const s = getStageOf(p2.name);
     return {
-      response: {
-        projects: projects.map((p2) => {
-          const s = getStageOf(p2.name);
-          const publishJobWithStatus = withPublishJobStatus(p2);
-          return {
-            ...p2,
-            isRunning: devServerLifecycle.isRunning(p2.name),
-            boundSessionId: devServerLifecycle.boundSessionId(p2.name),
-            stage: s.stage,
-            ...s.reason !== void 0 ? { stageReason: s.reason } : {},
-            // publishJob 在 spread ...p 之后覆写：原始 ProjectMetadata.publishJob 没有 status，
-            // 这里实时拼上 status 字段；字段不存在时显式 undefined（覆盖掉 spread 的可能值）。
-            publishJob: publishJobWithStatus
-          };
-        })
-      }
-    };
+      ...p2,
+      isRunning: devServerLifecycle.isRunning(p2.name),
+      boundSessionId: devServerLifecycle.boundSessionId(p2.name),
+      stage: s.stage,
+      ...s.reason !== void 0 ? { stageReason: s.reason } : {},
+      publishJob: withPublishJobStatus(p2)
+    };
+  }
+  const listProjects = async (_frame, _client, ctx) => {
+    let metas;
+    if (ctx?.principal.kind === "owner" && deps.usersRoot && deps.getStore) {
+      metas = await listAllUsersProjects();
+    } else {
+      metas = await resolveStore({ ctx }).list();
+    }
+    return { response: { projects: metas.map(toProjectWithStatus) } };
   };
-  const createProject = async (frame) => {
+  const getProject = async (frame, _client, ctx) => {
+    const f = frame;
+    if (typeof f.sessionId !== "string" || !f.sessionId) {
+      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "getProject: sessionId required");
+    }
+    if (ctx && !canAccessSession(ctx, f.sessionId, "read", {
+      readSession: (sid) => sessionManager.findOwnedSession(sid) ?? null
+    })) {
+      throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `cannot read session ${f.sessionId}`);
+    }
+    const session = sessionManager.findOwnedSession(f.sessionId);
+    const projectName = session?.appBuilderProject ?? null;
+    if (!projectName) return { response: { project: null } };
+    const meta = (await resolveStore({ ctx, sessionId: f.sessionId }).list()).find(
+      (p2) => p2.name === projectName
+    );
+    return { response: { project: meta ? toProjectWithStatus(meta) : null } };
+  };
+  const createProject = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.sessionId !== "string" || !f.sessionId) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "createProject: sessionId required");
@@ -42690,10 +42764,10 @@ function buildAppBuilderHandlers(deps) {
     if (!session) {
       throw new ClawdError(ERROR_CODES.SESSION_NOT_FOUND, `session ${f.sessionId} not found`);
     }
-    if (session.ownerPersonaId !== "persona-app-builder") {
+    if (!APP_BUILDER_PERSONAS.includes(session.ownerPersonaId ?? "")) {
       throw new ClawdError(
         ERROR_CODES.WRONG_PERSONA,
-        `createProject only allowed in persona-app-builder sessions (got: ${session.ownerPersonaId ?? "<none>"})`
+        `createProject only allowed in app-builder persona sessions (got: ${session.ownerPersonaId ?? "<none>"})`
       );
     }
     if (session.appBuilderProject) {
@@ -42702,10 +42776,12 @@ function buildAppBuilderHandlers(deps) {
         `session ${f.sessionId} already bound to project ${session.appBuilderProject}`
       );
     }
+    const userStore = resolveStore({ ctx, sessionId: f.sessionId });
     deps.logger?.info("app-builder.create-project.start", { name: f.name, sessionId: f.sessionId });
-    const project = await store.create(f.name);
+    const reservedPorts = new Set((await listAllUsersProjects()).map((p2) => p2.port));
+    const project = await userStore.create(f.name, reservedPorts);
     try {
-      const scaffoldResult = await store.scaffold(project.name);
+      const scaffoldResult = await userStore.scaffold(project.name, void 0, deps.personaRoot);
       deps.logger?.info("app-builder.scaffold.done", {
         name: project.name,
         stdout: scaffoldResult.stdout.slice(0, 200)
@@ -42713,7 +42789,7 @@ function buildAppBuilderHandlers(deps) {
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       deps.logger?.warn("app-builder.scaffold.failed", { name: project.name, error: message });
-      await store.delete(project.name).catch((delErr) => {
+      await userStore.delete(project.name).catch((delErr) => {
         deps.logger?.warn("app-builder.scaffold.rollback-failed", {
           name: project.name,
           error: delErr instanceof Error ? delErr.message : String(delErr)
@@ -42725,46 +42801,51 @@ function buildAppBuilderHandlers(deps) {
       sessionId: f.sessionId,
       patch: { appBuilderProject: project.name }
     });
-    await setStageAndBroadcast(project.name, "install-pending");
+    await setStageAndBroadcast(project.name, "install-pending", void 0, userStore);
     deps.logger?.info("app-builder.create-project.done", {
       name: project.name,
       port: project.port,
       sessionId: f.sessionId
     });
-    return { response: { project }, broadcast };
+    return { response: { project, projectDir: userStore.projectDir(project.name) }, broadcast };
   };
-  const deleteProject = async (frame) => {
+  const deleteProject = async (frame, _client, ctx) => {
     const name = frame.name;
     if (typeof name !== "string") throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "deleteProject: name required");
+    const userStore = resolveStore({ ctx, projectName: name });
     await devServerLifecycle.stopForProject(name);
-    await store.delete(name);
+    await userStore.delete(name);
     stages.delete(name);
     return { response: {} };
   };
-  const updateProjectPort = async (frame) => {
+  const updateProjectPort = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.name !== "string") throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "updateProjectPort: name required");
     if (typeof f.newPort !== "number") throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "updateProjectPort: newPort required");
+    const userStore = resolveStore({ ctx, projectName: f.name });
     await devServerLifecycle.stopForProject(f.name);
-    const project = await store.updatePort(f.name, f.newPort);
-    await setStageAndBroadcast(f.name, "stopped");
+    const project = await userStore.updatePort(f.name, f.newPort);
+    await setStageAndBroadcast(f.name, "stopped", void 0, userStore);
     return { response: { project } };
   };
-  const setProdUrl = async (frame) => {
+  const setProdUrl = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.name !== "string") throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "setProdUrl: name required");
     if (typeof f.url !== "string") throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "setProdUrl: url required");
-    const project = await store.setProdUrl(f.name, f.url);
+    ensureProjectWriteAccess(ctx, { projectName: f.name });
+    const userStore = resolveStore({ ctx, projectName: f.name });
+    const project = await userStore.setProdUrl(f.name, f.url);
     const current = getStageOf(f.name);
-    await setStageAndBroadcast(f.name, current.stage, current.reason);
+    await setStageAndBroadcast(f.name, current.stage, current.reason, userStore);
     return { response: { project } };
   };
-  const startDevServer = async (frame) => {
+  const startDevServer = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.sessionId !== "string" || !f.sessionId) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "startDevServer: sessionId required");
     }
     const force = f.force === true;
+    ensureProjectWriteAccess(ctx, { sessionId: f.sessionId });
     const session = sessionManager.findOwnedSession(f.sessionId);
     if (!session) throw new ClawdError(ERROR_CODES.SESSION_NOT_FOUND, `session ${f.sessionId} not found`);
     const projectName = session.appBuilderProject;
@@ -42774,7 +42855,8 @@ function buildAppBuilderHandlers(deps) {
         `session ${f.sessionId} is not bound to any project; cannot start dev server`
       );
     }
-    const projects = await store.list();
+    const userStore = resolveStore({ ctx, sessionId: f.sessionId });
+    const projects = await userStore.list();
     const meta = projects.find((p2) => p2.name === projectName);
     if (!meta) {
       throw new ClawdError(ERROR_CODES.SESSION_NOT_FOUND, `project ${projectName} not found on disk`);
@@ -42794,20 +42876,20 @@ function buildAppBuilderHandlers(deps) {
       deps.logger?.info("app-builder.start-dev-server.force-stop", { name: projectName });
       await devServerLifecycle.stopForProject(projectName);
     }
-    await setStageAndBroadcast(projectName, "starting-dev-server");
+    await setStageAndBroadcast(projectName, "starting-dev-server", void 0, userStore);
     const tunnelUrl = getTunnelUrl();
     const tunnelHost = tunnelUrl ? new URL(tunnelUrl.replace(/^wss?:\/\//i, "https://")).host : null;
     devServerLifecycle.startForSession({
       sessionId: f.sessionId,
       projectName,
-      cwd: store.projectDir(projectName),
+      cwd: userStore.projectDir(projectName),
       port: meta.port,
       tunnelHost,
       devCommand: meta.devCommand
     });
     try {
       await devServerLifecycle.awaitReady(projectName, { timeoutMs: DEV_SERVER_READY_TIMEOUT_MS });
-      await setStageAndBroadcast(projectName, "running");
+      await setStageAndBroadcast(projectName, "running", void 0, userStore);
     } catch (err) {
       const reason = err instanceof Error ? err.message : "dev server not ready";
       deps.logger?.warn("app-builder.start-dev-server.ready-failed", {
@@ -42815,11 +42897,11 @@ function buildAppBuilderHandlers(deps) {
         sessionId: f.sessionId,
         reason
       });
-      await setStageAndBroadcast(projectName, "failed", reason);
+      await setStageAndBroadcast(projectName, "failed", reason, userStore);
     }
     return { response: { project: meta } };
   };
-  const reportStage = async (frame) => {
+  const reportStage = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.sessionId !== "string" || !f.sessionId) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "reportStage: sessionId required");
@@ -42849,14 +42931,16 @@ function buildAppBuilderHandlers(deps) {
       reason,
       sessionId: f.sessionId
     });
-    await setStageAndBroadcast(projectName, f.stage, reason);
+    const userStore = resolveStore({ ctx, sessionId: f.sessionId });
+    await setStageAndBroadcast(projectName, f.stage, reason, userStore);
     return { response: { ok: true } };
   };
-  const stopDevServer = async (frame) => {
+  const stopDevServer = async (frame, _client, ctx) => {
     const f = frame;
     if (typeof f.sessionId !== "string" || !f.sessionId) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, "stopDevServer: sessionId required");
     }
+    ensureProjectWriteAccess(ctx, { sessionId: f.sessionId });
     const session = sessionManager.findOwnedSession(f.sessionId);
     if (!session) {
       throw new ClawdError(ERROR_CODES.SESSION_NOT_FOUND, `session ${f.sessionId} not found`);
@@ -42868,6 +42952,7 @@ function buildAppBuilderHandlers(deps) {
         `session ${f.sessionId} is not bound to any project; cannot stop dev server`
       );
     }
+    const userStore = resolveStore({ ctx, sessionId: f.sessionId });
     deps.logger?.info("app-builder.stop-dev-server.called", {
       name: projectName,
       sessionId: f.sessionId,
@@ -42877,7 +42962,7 @@ function buildAppBuilderHandlers(deps) {
       await devServerLifecycle.stopForProject(projectName);
     }
     try {
-      const projects = await store.list();
+      const projects = await userStore.list();
       const meta = projects.find((p2) => p2.name === projectName);
       if (meta) {
         await killPortOccupants(meta.port, devServerLifecycle.getOwnedPids(), deps.logger);
@@ -42888,12 +42973,14 @@ function buildAppBuilderHandlers(deps) {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    await setStageAndBroadcast(projectName, "stopped");
+    await setStageAndBroadcast(projectName, "stopped", void 0, userStore);
     return { response: { ok: true } };
   };
-  const publish = async (frame) => {
+  const publish = async (frame, _client, ctx) => {
     const args = PublishArgsSchema.parse(frame);
-    const projects = await store.list();
+    ensureProjectWriteAccess(ctx, { projectName: args.name });
+    const userStore = resolveStore({ ctx, projectName: args.name });
+    const projects = await userStore.list();
     const project = projects.find((p2) => p2.name === args.name);
     if (!project) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `publish: project "${args.name}" not found`);
@@ -42911,7 +42998,7 @@ function buildAppBuilderHandlers(deps) {
         previousJobId: project.publishJob.jobId,
         previousStage: project.publishJob.stage
       });
-      await store.clearPublishJob(args.name);
+      await userStore.clearPublishJob(args.name);
     }
     const scriptPath = (0, import_node_path40.join)(deps.personaRoot, PUBLISH_SCRIPT_REL);
     deps.logger?.info("app-builder.publish.start", {
@@ -42923,19 +43010,19 @@ function buildAppBuilderHandlers(deps) {
       {
         registry: publishRegistry,
         setPublishJob: async (name, job) => {
-          await store.setPublishJob(name, job);
+          await userStore.setPublishJob(name, job);
           const current = getStageOf(name);
-          await setStageAndBroadcast(name, current.stage, current.reason);
+          await setStageAndBroadcast(name, current.stage, current.reason, userStore);
         },
         clearPublishJob: async (name) => {
-          await store.clearPublishJob(name);
+          await userStore.clearPublishJob(name);
           const current = getStageOf(name);
-          await setStageAndBroadcast(name, current.stage, current.reason);
+          await setStageAndBroadcast(name, current.stage, current.reason, userStore);
         },
         setProdUrl: async (name, url) => {
-          await store.setProdUrl(name, url);
+          await userStore.setProdUrl(name, url);
           const current = getStageOf(name);
-          await setStageAndBroadcast(name, current.stage, current.reason);
+          await setStageAndBroadcast(name, current.stage, current.reason, userStore);
         },
         broadcast: (f) => {
           broadcastProjectUpdated(f);
@@ -42946,7 +43033,7 @@ function buildAppBuilderHandlers(deps) {
             deps.broadcastSessionFrame(entry.frame, entry.target);
           }
         },
-        projectDir: (name) => store.projectDir(name),
+        projectDir: (name) => userStore.projectDir(name),
         logger: deps.logger
       },
       {
@@ -42957,9 +43044,11 @@ function buildAppBuilderHandlers(deps) {
     );
     return { response: { ...result } };
   };
-  const dismissPublishJob = async (frame) => {
+  const dismissPublishJob = async (frame, _client, ctx) => {
     const args = DismissPublishJobArgsSchema.parse(frame);
-    const projects = await store.list();
+    ensureProjectWriteAccess(ctx, { projectName: args.name });
+    const userStore = resolveStore({ ctx, projectName: args.name });
+    const projects = await userStore.list();
     const project = projects.find((p2) => p2.name === args.name);
     if (!project) {
       throw new ClawdError(
@@ -42982,14 +43071,15 @@ function buildAppBuilderHandlers(deps) {
         jobId: project.publishJob.jobId,
         stage: project.publishJob.stage
       });
-      await store.clearPublishJob(args.name);
+      await userStore.clearPublishJob(args.name);
       const current = getStageOf(args.name);
-      await setStageAndBroadcast(args.name, current.stage, current.reason);
+      await setStageAndBroadcast(args.name, current.stage, current.reason, userStore);
     }
     return { response: { ok: true } };
   };
   return {
     "appBuilder:listProjects": listProjects,
+    "appBuilder:getProject": getProject,
     "appBuilder:createProject": createProject,
     "appBuilder:deleteProject": deleteProject,
     "appBuilder:updateProjectPort": updateProjectPort,
@@ -43094,6 +43184,7 @@ function buildMethodHandlers(deps) {
       ...deps,
       devServerLifecycle: deps.devServerLifecycle,
       appBuilderStore: deps.appBuilderStore,
+      getProjectStore: deps.getProjectStore,
       getTunnelUrl: deps.getTunnelUrl,
       logger: deps.logger
     }),
@@ -43138,6 +43229,8 @@ function buildMethodHandlers(deps) {
     }),
     ...buildAppBuilderHandlers({
       store: deps.appBuilderStore,
+      getStore: deps.getProjectStore,
+      usersRoot: deps.usersRoot,
       devServerLifecycle: deps.devServerLifecycle,
       sessionManager: deps.manager,
       getTunnelUrl: deps.getTunnelUrl,
@@ -43153,7 +43246,7 @@ function buildMethodHandlers(deps) {
 }
 
 // src/app-builder/project-store.ts
-var import_node_fs30 = require("fs");
+var import_node_fs31 = require("fs");
 var import_node_child_process9 = require("child_process");
 var import_node_path43 = require("path");
 init_protocol();
@@ -43163,11 +43256,11 @@ var SCAFFOLD_SCRIPT_REL = "extension-kit/scripts/new-extension.sh";
 var DEFAULT_TEMPLATE = "nestjs-react";
 var SCAFFOLD_TIMEOUT_MS = 3e4;
 var ProjectStore = class {
-  /** @param personaRoot persona 目录，例如 `~/.clawd/personas/persona-app-builder/` */
-  constructor(personaRoot) {
-    this.personaRoot = personaRoot;
+  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/`（v2 per-user） */
+  constructor(root) {
+    this.root = root;
   }
-  personaRoot;
+  root;
   /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
     return (0, import_node_path43.join)(this.projectsRoot(), name, META_FILE);
@@ -43177,12 +43270,12 @@ var ProjectStore = class {
     return (0, import_node_path43.join)(this.projectsRoot(), name);
   }
   projectsRoot() {
-    return (0, import_node_path43.join)(this.personaRoot, PROJECTS_DIR);
+    return (0, import_node_path43.join)(this.root, PROJECTS_DIR);
   }
   async list() {
     let entries;
     try {
-      entries = await import_node_fs30.promises.readdir(this.projectsRoot());
+      entries = await import_node_fs31.promises.readdir(this.projectsRoot());
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
@@ -43190,7 +43283,7 @@ var ProjectStore = class {
     const out = [];
     for (const name of entries) {
       try {
-        const raw = await import_node_fs30.promises.readFile(this.metaPath(name), "utf8");
+        const raw = await import_node_fs31.promises.readFile(this.metaPath(name), "utf8");
         const json = JSON.parse(raw);
         let migrated = false;
         if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
@@ -43201,7 +43294,7 @@ var ProjectStore = class {
         if (parsed.success) {
           out.push(parsed.data);
           if (migrated) {
-            void import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
+            void import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
             });
           }
         }
@@ -43210,12 +43303,18 @@ var ProjectStore = class {
     }
     return out.sort((a, b2) => a.name.localeCompare(b2.name));
   }
-  async create(name) {
+  /**
+   * @param reservedPorts 其它 user 已占端口（v2 per-user：端口必须全局唯一，所有 user 的
+   *   dev server 同机跑；per-user store 各自只 list 自己，靠 handler 收集全局端口传进来，
+   *   否则不同 user 的首个项目都从 PROJECT_PORT_MIN 起 → 全撞 6173）。
+   */
+  async create(name, reservedPorts) {
     const existing = await this.list();
     if (existing.some((p2) => p2.name === name)) {
       throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728`);
     }
     const usedPorts = new Set(existing.map((p2) => p2.port));
+    if (reservedPorts) for (const p2 of reservedPorts) usedPorts.add(p2);
     let port = -1;
     for (let p2 = PROJECT_PORT_MIN; p2 <= PROJECT_PORT_MAX; p2++) {
       if (!usedPorts.has(p2)) {
@@ -43239,8 +43338,8 @@ var ProjectStore = class {
       throw new Error(`invalid name "${name}": ${validated.error.message}`);
     }
     const dir = this.projectDir(name);
-    await import_node_fs30.promises.mkdir(dir, { recursive: true });
-    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+    await import_node_fs31.promises.mkdir(dir, { recursive: true });
+    await import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
     return meta;
   }
   /**
@@ -43251,11 +43350,12 @@ var ProjectStore = class {
    * spec 2026-06-02 §5.6.3：scaffold 对 assistant 不可见，避免 assistant 被诱导去"读 example
    * 代码再参考"。assistant 进 project 时目录已是完整模板，直接 pnpm install 即可。
    */
-  async scaffold(name, template = DEFAULT_TEMPLATE) {
-    const scriptPath = (0, import_node_path43.join)(this.personaRoot, SCAFFOLD_SCRIPT_REL);
+  async scaffold(name, template = DEFAULT_TEMPLATE, personaRoot = this.root) {
+    const scriptPath = (0, import_node_path43.join)(personaRoot, SCAFFOLD_SCRIPT_REL);
+    const destDir = this.projectDir(name);
     return await new Promise((resolve6, reject) => {
-      const child = (0, import_node_child_process9.spawn)("bash", [scriptPath, name, template], {
-        cwd: this.personaRoot,
+      const child = (0, import_node_child_process9.spawn)("bash", [scriptPath, name, template, destDir], {
+        cwd: personaRoot,
         env: { ...process.env, PATH: process.env.PATH ?? "" },
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -43284,7 +43384,7 @@ var ProjectStore = class {
   }
   async delete(name) {
     const dir = this.projectDir(name);
-    await import_node_fs30.promises.rm(dir, { recursive: true, force: true });
+    await import_node_fs31.promises.rm(dir, { recursive: true, force: true });
   }
   async updatePort(name, newPort) {
     if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
@@ -43300,7 +43400,7 @@ var ProjectStore = class {
       throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
     }
     const updated = { ...target, port: newPort };
-    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
+    await import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
     return updated;
   }
   /**
@@ -43317,7 +43417,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
     }
-    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /**
@@ -43338,7 +43438,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid publishJob: ${validated.error.message}`);
     }
-    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
@@ -43353,7 +43453,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`failed to clear publishJob: ${validated.error.message}`);
     }
-    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs31.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
 };
@@ -43755,22 +43855,24 @@ var METHOD_GRANT_MAP = {
   // 即使 persona-app-builder 是 PreinstalledPersona，project 管理也属本机 owner 行为，
   // 不暴露给 guest（远端接入者）。
   "appBuilder:listProjects": ADMIN_ANY,
+  // getProject 走 capability-scoped（区别于其它 appBuilder 的 owner-only ADMIN_ANY）：mirror/people
+  // 的本机 owner 在远端是 guest，需能调 getProject 拿它 mirror 的 session 的 project。dispatcher
+  // 放行后由 handler 内 canAccessSession(read) 按 session 可见性授权（防 guest 越权拿别人 project）。
+  "appBuilder:getProject": CAPABILITY_SCOPED,
   "appBuilder:createProject": ADMIN_ANY,
   "appBuilder:deleteProject": ADMIN_ANY,
   "appBuilder:updateProjectPort": ADMIN_ANY,
-  // 单栏默认 refactor (spec 2026-06-02)：发布上线后 assistant 调写公网 URL。
-  "appBuilder:setProdUrl": ADMIN_ANY,
-  // 单栏 refactor §5.6.2 stage fix：assistant scaffold + install 完成后调 startDevServer 起进程；
-  // 中间用 reportStage 上报阶段（scaffolding / installing / failed）。
-  "appBuilder:startDevServer": ADMIN_ANY,
+  // people/mirror 协同写操作（spec 2026-06-04-people-mode-app-builder-write-and-push）：以下 5 个写
+  // method 走 CAPABILITY_SCOPED（不再 owner-only ADMIN_ANY），handler 内 ensureProjectWriteAccess
+  // 按 session 可见性（canAccessSession 'send'）授权——mirror 的本机 owner 在远端是 guest，能 mirror
+  // 该 session 就能操作它绑定的 project（发布凭证是 persona 共享资产，老板决策"统一 session 授权"）。
+  "appBuilder:setProdUrl": CAPABILITY_SCOPED,
+  "appBuilder:startDevServer": CAPABILITY_SCOPED,
+  // reportStage 仍 owner-only：assistant 走 HTTP RPC 上报（不过 WS admin grant），UI 不调它。
   "appBuilder:reportStage": ADMIN_ANY,
-  // 显式控制 fix (spec 2026-06-02-app-builder-explicit-dev-server-control)：用户点"收起预览"触发停 dev server，
-  // 对称 startDevServer。同时砍了 setActiveSession（dev server 不再 follow-the-eyes）。
-  "appBuilder:stopDevServer": ADMIN_ANY,
-  // 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design):
-  // owner-only：PreviewPane「发布上线」按钮直接调 publish；UI [取消] / interrupted 恢复按钮调 dismissPublishJob。
-  "appBuilder:publish": ADMIN_ANY,
-  "appBuilder:dismissPublishJob": ADMIN_ANY
+  "appBuilder:stopDevServer": CAPABILITY_SCOPED,
+  "appBuilder:publish": CAPABILITY_SCOPED,
+  "appBuilder:dismissPublishJob": CAPABILITY_SCOPED
 };
 function computeGrantForFrame(method, frame) {
   const rule = METHOD_GRANT_MAP[method];
@@ -44279,6 +44381,7 @@ async function startDaemon(config) {
   const history = new ClaudeHistoryReader();
   let transport = null;
   const personaStore = new PersonaStore(import_node_path47.default.join(config.dataDir, "personas"));
+  const usersRoot = import_node_path47.default.join(config.dataDir, "users");
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -44297,6 +44400,7 @@ async function startDaemon(config) {
     historyReader: history,
     dataDir: config.dataDir,
     personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+    usersRoot,
     personaStore,
     ownerDisplayName,
     ownerPrincipalId,
@@ -44328,7 +44432,7 @@ async function startDaemon(config) {
         const absPath = import_node_path47.default.isAbsolute(input.relPath) ? input.relPath : import_node_path47.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
-          size = import_node_fs31.default.statSync(absPath).size;
+          size = import_node_fs32.default.statSync(absPath).size;
         } catch (err) {
           logger.warn("attachment.onFileEdit stat failed", {
             sessionId: input.sessionId,
@@ -44457,9 +44561,8 @@ async function startDaemon(config) {
     ttcAuthBase: TTC_HOSTS.auth,
     getCallbackUrl: () => `http://127.0.0.1:${config.port}/auth/callback`
   });
-  const appBuilderStore = new ProjectStore(
-    import_node_path47.default.join(config.dataDir, "personas/persona-app-builder")
-  );
+  const getProjectStore = (userId) => new ProjectStore(deriveUserWorkDir(userId, usersRoot));
+  const appBuilderStore = getProjectStore(ownerPrincipalId);
   recoverInterruptedPublishJobs(appBuilderStore, logger).catch((err) => {
     logger.warn("app-builder.publish.recover-startup-failed", {
       error: err instanceof Error ? err.message : String(err)
@@ -44510,11 +44613,14 @@ async function startDaemon(config) {
       // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
-      // guest path guard：candidate 必须在 personaRoot 子树下
-      personaRoot: import_node_path47.default.join(config.dataDir, "personas")
+      // guest path guard：candidate 必须在 personaRoot 子树或调用者自己的 user-dir 下
+      personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+      usersRoot
     },
     // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
     personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+    // v2 多人 persona 隔离：handler 派生 guest user-dir 放行
+    usersRoot,
     // capability:list / delete handler 依赖
     capabilityManager,
     // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
@@ -44582,10 +44688,22 @@ async function startDaemon(config) {
     },
     // app-builder
     appBuilderStore,
+    getProjectStore,
     devServerLifecycle: devServerSupervisor,
     // 单栏 refactor §5.6.2 stage fix：appBuilder:project-updated 帧通过 wsServer broadcast。
     // 推给所有 owner 连接（picker 可能没订阅特定 session，全局 broadcast 最稳）。
-    broadcastProjectUpdated: (event) => wsServer?.broadcastToOwners(event),
+    // people/mirror（spec 2026-06-04-people-mode-app-builder-write-and-push）：额外推给订阅该 project
+    // 绑定 session 的 client（mirror guest 经 session:observe 订阅），让远端协同者也看到 stage / 发布进度。
+    // 同一帧 owner 也走 project-updated 复用给 publish-progress/failed（app-builder.ts 内 broadcast 闭包）：
+    // name 在 event.project.name（project-updated）或 event.name（publish 帧）。owner 双栏会同时命中
+    // owner-broadcast + session-broadcast，但 UI patch 幂等（同 project 覆盖）无害。
+    broadcastProjectUpdated: (event) => {
+      const ev = event;
+      wsServer?.broadcastToOwners(ev);
+      const projectName = event.project?.name ?? event.name;
+      const boundSid = projectName ? manager.findOwnedSessionByAppBuilderProject(projectName)?.sessionId : void 0;
+      if (boundSid) wsServer?.broadcastToSession(boundSid, ev);
+    },
     // 发布上线脚手架化 (spec 2026-06-03 §5.2):
     // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
     // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
@@ -44852,7 +44970,7 @@ ${bar}
 `);
       try {
         const connectPath = import_node_path47.default.join(config.dataDir, "connect.txt");
-        import_node_fs31.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
+        import_node_fs32.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
@@ -44925,7 +45043,7 @@ ${bar}
 function migrateDropPersonsDir(dataDir) {
   const dir = import_node_path47.default.join(dataDir, "persons");
   try {
-    import_node_fs31.default.rmSync(dir, { recursive: true, force: true });
+    import_node_fs32.default.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }