@clawos-dev/clawd 0.2.128 → 0.2.129

package/dist/cli.cjs

@@ -720,8 +720,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path60, errorMaps, issueData } = params;
-      const fullPath = [...path60, ...issueData.path || []];
+      const { data, path: path59, errorMaps, issueData } = params;
+      const fullPath = [...path59, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1032,11 +1032,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path60, key) {
+      constructor(parent, value, path59, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path60;
+        this._path = path59;
         this._key = key;
       }
       get path() {
@@ -4523,7 +4523,11 @@ var init_persona_schemas = __esm({
     });
     PersonaSandboxSettingsSchema = external_exports.object({
       permissions: external_exports.object({
-        defaultMode: external_exports.string().optional()
+        defaultMode: external_exports.string().optional(),
+        // CC 工具 allowlist（'Bash'/'Read'/...）。per-persona profile 在最严格 base 上追加放开。
+        allow: external_exports.array(external_exports.string()).optional(),
+        // deny 优先级最高；强制底座（persona 私密区）由 daemon compose 强制 union，owner 删不掉。
+        deny: external_exports.array(external_exports.string()).optional()
       }).optional(),
       sandbox: external_exports.object({
         enabled: external_exports.boolean().optional(),
@@ -4534,6 +4538,11 @@ var init_persona_schemas = __esm({
           allowRead: external_exports.array(external_exports.string()).optional(),
           denyWrite: external_exports.array(external_exports.string()).optional(),
           allowWrite: external_exports.array(external_exports.string()).optional()
+        }).optional(),
+        // 出站网络 + 本机端口。base 不放（空），profile 按需追加域名（app-builder = ['*']）。
+        network: external_exports.object({
+          allowedDomains: external_exports.array(external_exports.string()).optional(),
+          allowLocalBinding: external_exports.boolean().optional()
         }).optional()
       }).optional()
     });
@@ -6181,8 +6190,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path60 = req.path;
-        _req.url = typeof path60 === "string" ? path60 : req.url ? req.url.path || req.url : void 0;
+        const path59 = req.path;
+        _req.url = typeof path59 === "string" ? path59 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -6347,14 +6356,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path60) {
+    function parsePath(path59) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path60.length; i++) {
-        const char = path60[i];
+      for (let i = 0; i < path59.length; i++) {
+        const char = path59[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -6485,10 +6494,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path60 of paths) {
-        const parts = parsePath(path60);
+      for (const path59 of paths) {
+        const parts = parsePath(path59);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path60, remove);
+          redactWildcardPath(obj, parts, censor, path59, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -6573,8 +6582,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path60) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path60];
+            const wrappedCensor = typeof censor === "function" ? (value, path59) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path59];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -6609,8 +6618,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path60 of pathsToClone) {
-        const parts = parsePath(path60);
+      for (const path59 of pathsToClone) {
+        const parts = parsePath(path59);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6662,24 +6671,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path60) {
-      if (typeof path60 !== "string") {
+    function validatePath(path59) {
+      if (typeof path59 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path60 === "") {
+      if (path59 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path60.includes("..")) {
-        throw new Error(`Invalid redaction path (${path60})`);
+      if (path59.includes("..")) {
+        throw new Error(`Invalid redaction path (${path59})`);
       }
-      if (path60.includes(",")) {
-        throw new Error(`Invalid redaction path (${path60})`);
+      if (path59.includes(",")) {
+        throw new Error(`Invalid redaction path (${path59})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path60.length; i++) {
-        const char = path60[i];
+      for (let i = 0; i < path59.length; i++) {
+        const char = path59[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6693,20 +6702,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path60})`);
+            throw new Error(`Invalid redaction path (${path59})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path60})`);
+        throw new Error(`Invalid redaction path (${path59})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path60 of paths) {
-        validatePath(path60);
+      for (const path59 of paths) {
+        validatePath(path59);
       }
     }
     function slowRedact(options = {}) {
@@ -6874,8 +6883,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path60) => {
-            return censor(value, [k2, ...path60]);
+          const wrappedCensor = typeof censor === "function" ? (value, path59) => {
+            return censor(value, [k2, ...path59]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -7096,7 +7105,7 @@ var require_sonic_boom = __commonJS({
     var fs50 = require("fs");
     var EventEmitter3 = require("events");
     var inherits = require("util").inherits;
-    var path60 = require("path");
+    var path59 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -7150,7 +7159,7 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs50.mkdirSync(path60.dirname(file), { recursive: true });
+          if (sonic.mkdir) fs50.mkdirSync(path59.dirname(file), { recursive: true });
           const fd = fs50.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
@@ -7158,7 +7167,7 @@ var require_sonic_boom = __commonJS({
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs50.mkdir(path60.dirname(file), { recursive: true }, (err) => {
+        fs50.mkdir(path59.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
           fs50.open(file, flags, mode, fileOpened);
         });
@@ -10789,11 +10798,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path60, added, removed, oldPosInc, options) {
-        var last = path60.lastComponent;
+      addToPath: function addToPath(path59, added, removed, oldPosInc, options) {
+        var last = path59.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path60.oldPos + oldPosInc,
+            oldPos: path59.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -10803,7 +10812,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path60.oldPos + oldPosInc,
+            oldPos: path59.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -11249,10 +11258,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path60 = typeof rec.path === "string" ? rec.path : null;
+      const path59 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path60 || content == null) return null;
-      const entry = { path: path60, content };
+      if (!path59 || content == null) return null;
+      const entry = { path: path59, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11289,7 +11298,7 @@ function readBackupContent(fileHistoryRoot, toolSessionId, backupFileName) {
   if (backupFileName === null) return null;
   try {
     return import_node_fs8.default.readFileSync(
-      import_node_path9.default.join(fileHistoryRoot, toolSessionId, backupFileName),
+      import_node_path8.default.join(fileHistoryRoot, toolSessionId, backupFileName),
       "utf8"
     );
   } catch {
@@ -11304,13 +11313,13 @@ function readCurrentContent(filePath) {
     return null;
   }
 }
-var import_node_fs8, import_node_os3, import_node_path9, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
+var import_node_fs8, import_node_os3, import_node_path8, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
 var init_claude_history = __esm({
   "src/tools/claude-history.ts"() {
     "use strict";
     import_node_fs8 = __toESM(require("fs"), 1);
     import_node_os3 = __toESM(require("os"), 1);
-    import_node_path9 = __toESM(require("path"), 1);
+    import_node_path8 = __toESM(require("path"), 1);
     init_lib();
     init_tool_result_extra();
     TASK_NOTIFICATION_RE = /<task-notification\b[\s\S]*?<\/task-notification>/i;
@@ -11334,9 +11343,9 @@ var init_claude_history = __esm({
       // 每次 user 提交前 trackEdit 拷一份，作为 rewind 回退目标
       fileHistoryRoot;
       constructor(opts = {}) {
-        const base = opts.baseDir ?? import_node_path9.default.join(import_node_os3.default.homedir(), ".claude");
-        this.projectsRoot = import_node_path9.default.join(base, "projects");
-        this.fileHistoryRoot = import_node_path9.default.join(base, "file-history");
+        const base = opts.baseDir ?? import_node_path8.default.join(import_node_os3.default.homedir(), ".claude");
+        this.projectsRoot = import_node_path8.default.join(base, "projects");
+        this.fileHistoryRoot = import_node_path8.default.join(base, "file-history");
       }
       async listProjects() {
         let entries;
@@ -11349,9 +11358,9 @@ var init_claude_history = __esm({
         const out = [];
         for (const ent of entries) {
           if (!ent.isDirectory()) continue;
-          const dir = import_node_path9.default.join(this.projectsRoot, ent.name);
+          const dir = import_node_path8.default.join(this.projectsRoot, ent.name);
           const files = import_node_fs8.default.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
-          const updatedAtMs = files.reduce((m2, f) => Math.max(m2, safeStatMtime(import_node_path9.default.join(dir, f))), 0);
+          const updatedAtMs = files.reduce((m2, f) => Math.max(m2, safeStatMtime(import_node_path8.default.join(dir, f))), 0);
           out.push({
             projectPath: hashDirToCwd(ent.name),
             hashDir: ent.name,
@@ -11363,7 +11372,7 @@ var init_claude_history = __esm({
         return out;
       }
       async listSessions(args) {
-        const dir = import_node_path9.default.join(this.projectsRoot, cwdToHashDir(args.projectPath));
+        const dir = import_node_path8.default.join(this.projectsRoot, cwdToHashDir(args.projectPath));
         let files;
         try {
           files = import_node_fs8.default.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
@@ -11373,7 +11382,7 @@ var init_claude_history = __esm({
         }
         const out = [];
         for (const f of files) {
-          const full = import_node_path9.default.join(dir, f);
+          const full = import_node_path8.default.join(dir, f);
           const toolSessionId = f.slice(0, -".jsonl".length);
           const lines = readJsonlLines(full);
           let summary = "";
@@ -11428,7 +11437,7 @@ var init_claude_history = __esm({
         return out;
       }
       async read(args) {
-        const file = import_node_path9.default.join(
+        const file = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(args.cwd),
           `${args.toolSessionId}.jsonl`
@@ -11465,7 +11474,7 @@ var init_claude_history = __esm({
       // 独立目录路径：<projectsRoot>/<cwdHash>/<toolSessionId>/subagents/*.jsonl
       // 返回 null 表示目录不存在（调用方回退旧实现）；返回空数组表示目录存在但无 jsonl
       listSubagentsFromDirectory(cwd, toolSessionId) {
-        const dir = import_node_path9.default.join(
+        const dir = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(cwd),
           toolSessionId,
@@ -11483,7 +11492,7 @@ var init_claude_history = __esm({
           if (!e.isFile()) continue;
           if (!e.name.startsWith("agent-") || !e.name.endsWith(".jsonl")) continue;
           const subagentId = e.name.slice("agent-".length, -".jsonl".length);
-          const filePath = import_node_path9.default.join(dir, e.name);
+          const filePath = import_node_path8.default.join(dir, e.name);
           const lines = readJsonlLines(filePath);
           let firstText = "";
           let messageCount = 0;
@@ -11500,7 +11509,7 @@ var init_claude_history = __esm({
         return out;
       }
       listSubagentsFromMainJsonl(cwd, toolSessionId) {
-        const file = import_node_path9.default.join(
+        const file = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(cwd),
           `${toolSessionId}.jsonl`
@@ -11535,7 +11544,7 @@ var init_claude_history = __esm({
       }
       // 独立文件路径：agent-<subagentId>.jsonl；文件不存在返回 null 让调用方回退旧实现
       readSubagentFromFile(cwd, toolSessionId, subagentId) {
-        const file = import_node_path9.default.join(
+        const file = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(cwd),
           toolSessionId,
@@ -11563,7 +11572,7 @@ var init_claude_history = __esm({
        * "那一刻每个 tracked 文件对应的 backup 文件名"
        */
       readFileHistorySnapshots(args) {
-        const file = import_node_path9.default.join(
+        const file = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(args.cwd),
           `${args.toolSessionId}.jsonl`
@@ -11608,7 +11617,7 @@ var init_claude_history = __esm({
         for (const [anchorId, target] of snapshots) {
           let hasAny = false;
           for (const [rawPath, backup] of Object.entries(target)) {
-            const absPath = import_node_path9.default.isAbsolute(rawPath) ? rawPath : import_node_path9.default.join(args.cwd, rawPath);
+            const absPath = import_node_path8.default.isAbsolute(rawPath) ? rawPath : import_node_path8.default.join(args.cwd, rawPath);
             const backupContent = readBackupContent(
               this.fileHistoryRoot,
               args.toolSessionId,
@@ -11648,7 +11657,7 @@ var init_claude_history = __esm({
         let totalInsertions = 0;
         let totalDeletions = 0;
         for (const [rawPath, backup] of Object.entries(target)) {
-          const absPath = import_node_path9.default.isAbsolute(rawPath) ? rawPath : import_node_path9.default.join(args.cwd, rawPath);
+          const absPath = import_node_path8.default.isAbsolute(rawPath) ? rawPath : import_node_path8.default.join(args.cwd, rawPath);
           const backupContent = readBackupContent(
             this.fileHistoryRoot,
             args.toolSessionId,
@@ -11695,7 +11704,7 @@ var init_claude_history = __esm({
         };
       }
       readSubagentFromMainJsonl(cwd, toolSessionId, subagentId) {
-        const file = import_node_path9.default.join(
+        const file = import_node_path8.default.join(
           this.projectsRoot,
           cwdToHashDir(cwd),
           `${toolSessionId}.jsonl`
@@ -11719,7 +11728,7 @@ var init_claude_history = __esm({
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
-    import_node_path10.default.join(home, "Applications", "Claude.app", "Contents", "Resources", "app.asar.unpacked", "node_modules", "@anthropic-ai", "claude-code", "cli.js"),
+    import_node_path9.default.join(home, "Applications", "Claude.app", "Contents", "Resources", "app.asar.unpacked", "node_modules", "@anthropic-ai", "claude-code", "cli.js"),
     "/Applications/Claude.app/Contents/Resources/app.asar.unpacked/node_modules/@anthropic-ai/claude-code/cli.js"
   ];
 }
@@ -12064,10 +12073,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path60 = typeof rec.path === "string" ? rec.path : null;
+      const path59 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path60 || content == null) return null;
-      const out = { path: path60, content };
+      if (!path59 || content == null) return null;
+      const out = { path: path59, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -12171,7 +12180,7 @@ function encodeClaudeStdin(text) {
   };
   return JSON.stringify(frame) + "\n";
 }
-var import_node_child_process, import_node_child_process2, import_node_fs9, import_node_os4, import_node_path10, ATTACHMENT_SILENT_SUBTYPES2, unknownTypeHandler, ATTACHMENT_RE, IMAGE_EXT_MIME, CLAUDE_MODELS, CLAUDE_PERMISSION_MODES, CLAUDE_CAPABILITIES, ClaudeAdapter;
+var import_node_child_process, import_node_child_process2, import_node_fs9, import_node_os4, import_node_path9, ATTACHMENT_SILENT_SUBTYPES2, unknownTypeHandler, ATTACHMENT_RE, IMAGE_EXT_MIME, CLAUDE_MODELS, CLAUDE_PERMISSION_MODES, CLAUDE_CAPABILITIES, ClaudeAdapter;
 var init_claude = __esm({
   "src/tools/claude.ts"() {
     "use strict";
@@ -12179,7 +12188,7 @@ var init_claude = __esm({
     import_node_child_process2 = require("child_process");
     import_node_fs9 = __toESM(require("fs"), 1);
     import_node_os4 = __toESM(require("os"), 1);
-    import_node_path10 = __toESM(require("path"), 1);
+    import_node_path9 = __toESM(require("path"), 1);
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
@@ -23855,8 +23864,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path60) {
-      var parts = path60.split("/");
+    exports2.resolve = function(path59) {
+      var parts = path59.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -29709,18 +29718,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path60) {
-      if (path60.slice(-1) === "/") {
-        path60 = path60.substring(0, path60.length - 1);
+    var parentFolder = function(path59) {
+      if (path59.slice(-1) === "/") {
+        path59 = path59.substring(0, path59.length - 1);
       }
-      var lastSlash = path60.lastIndexOf("/");
-      return lastSlash > 0 ? path60.substring(0, lastSlash) : "";
+      var lastSlash = path59.lastIndexOf("/");
+      return lastSlash > 0 ? path59.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path60) {
-      if (path60.slice(-1) !== "/") {
-        path60 += "/";
+    var forceTrailingSlash = function(path59) {
+      if (path59.slice(-1) !== "/") {
+        path59 += "/";
       }
-      return path60;
+      return path59;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -30722,7 +30731,7 @@ var require_lib3 = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path48.default.dirname(opts.recordPath);
+  const dir = import_node_path47.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -30762,12 +30771,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs33, import_node_path48;
+var import_node_fs33, import_node_path47;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
     import_node_fs33 = __toESM(require("fs"), 1);
-    import_node_path48 = __toESM(require("path"), 1);
+    import_node_path47 = __toESM(require("path"), 1);
   }
 });
 
@@ -30810,7 +30819,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs34.mkdtempSync)(import_node_path49.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs34.mkdtempSync)(import_node_path48.default.join(import_node_os19.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -30977,13 +30986,13 @@ async function runController(opts) {
   }
   return exitCode ?? 0;
 }
-var import_node_fs34, import_node_os19, import_node_path49;
+var import_node_fs34, import_node_os19, import_node_path48;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
     import_node_fs34 = require("fs");
     import_node_os19 = __toESM(require("os"), 1);
-    import_node_path49 = __toESM(require("path"), 1);
+    import_node_path48 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -31218,7 +31227,7 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var import_node_fs32 = __toESM(require("fs"), 1);
 
 // src/logger.ts
@@ -31257,15 +31266,12 @@ function createLogger(opts = {}) {
 }
 
 // src/session/store-factory.ts
-var path6 = __toESM(require("path"), 1);
+var path5 = __toESM(require("path"), 1);
 
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
-var import_node_path4 = __toESM(require("path"), 1);
-init_protocol();
-
-// src/session/scope.ts
 var import_node_path3 = __toESM(require("path"), 1);
+init_protocol();
 
 // src/session/user-workdir.ts
 var path3 = __toESM(require("path"), 1);
@@ -31301,7 +31307,6 @@ function metaFromScope(scope, personaRoot, usersRoot) {
   return {
     idleKillEnabled: true,
     personaMode: "guest",
-    extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json"),
     userWorkDir,
     addDirs: [userWorkDir]
   };
@@ -31331,7 +31336,7 @@ var SessionStore = class {
       this.root = opts.root;
     } else {
       const scope = opts.scope ?? { kind: "default" };
-      this.root = import_node_path4.default.join(
+      this.root = import_node_path3.default.join(
         opts.dataDir,
         "sessions",
         ...scopeSubPath(scope).map(safeFileName)
@@ -31339,7 +31344,7 @@ var SessionStore = class {
     }
   }
   filePath(sessionId) {
-    return import_node_path4.default.join(this.root, `${safeFileName(sessionId)}.json`);
+    return import_node_path3.default.join(this.root, `${safeFileName(sessionId)}.json`);
   }
   ensureDir() {
     import_node_fs3.default.mkdirSync(this.root, { recursive: true });
@@ -31387,7 +31392,7 @@ var SessionStore = class {
     for (const name of entries) {
       if (!name.endsWith(".json")) continue;
       if (name.includes(".tmp-")) continue;
-      const full = import_node_path4.default.join(this.root, name);
+      const full = import_node_path3.default.join(this.root, name);
       try {
         const raw = import_node_fs3.default.readFileSync(full, "utf8");
         const parsed = JSON.parse(raw);
@@ -31413,10 +31418,10 @@ var SessionStoreFactory = class {
   }
   // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
   bareRoot() {
-    return path6.join(this.dataDir, "sessions");
+    return path5.join(this.dataDir, "sessions");
   }
   vmOwnerRoot(personaId) {
-    return path6.join(
+    return path5.join(
       this.dataDir,
       "personas",
       safeFileName(personaId),
@@ -31426,7 +31431,7 @@ var SessionStoreFactory = class {
     );
   }
   vmGuestRoot(personaId, capId) {
-    return path6.join(
+    return path5.join(
       this.dataDir,
       "personas",
       safeFileName(personaId),
@@ -31463,7 +31468,7 @@ var SessionStoreFactory = class {
 
 // src/session/manager.ts
 var import_node_fs6 = __toESM(require("fs"), 1);
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
 
 // ../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/stringify.js
 var byteToHex = [];
@@ -31515,6 +31520,78 @@ var v4_default = v4;
 // src/session/manager.ts
 init_protocol();
 
+// src/tools/guest-settings.ts
+var FORCED_DENY_READ = ["~/"];
+var FORCED_TOOL_DENY = ["Edit(./**)"];
+function unionArr(a, b2) {
+  const out = [...a ?? []];
+  for (const x of b2) if (!out.includes(x)) out.push(x);
+  return out;
+}
+function isGuestSettingsLike(v2) {
+  if (!v2 || typeof v2 !== "object") return false;
+  const sb = v2.sandbox;
+  return !!sb && typeof sb === "object";
+}
+function buildGuestSettingsV1() {
+  return {
+    permissions: {
+      defaultMode: "dontAsk",
+      deny: [...FORCED_TOOL_DENY]
+      // 保留 persona 限制：挡 CC 工具改/读 persona（cwd=persona）
+    },
+    sandbox: {
+      enabled: true,
+      autoAllowBashIfSandboxed: true,
+      // Bash 自动过沙箱；文件工具 dontAsk 自动拒（最严格只 Bash）
+      allowUnsandboxedCommands: false,
+      // 关 dangerouslyDisableSandbox 逃逸口
+      filesystem: {
+        denyRead: ["~/"],
+        denyWrite: [],
+        // **不放 '~/'**（写是白名单制，home 自动不可写）；persona(cwd) 由 compose 强制 deny
+        allowRead: [],
+        // 不放 cwd(persona)；userWorkDir 由 compose 注入，profile 加工具链精确路径
+        allowWrite: []
+      }
+    }
+  };
+}
+function applyProfile(base, profile) {
+  if (profile.permissions?.defaultMode) base.permissions.defaultMode = profile.permissions.defaultMode;
+  if (profile.permissions?.allow) base.permissions.allow = unionArr(base.permissions.allow, profile.permissions.allow);
+  if (profile.permissions?.deny) base.permissions.deny = unionArr(base.permissions.deny, profile.permissions.deny);
+  const pf = profile.sandbox?.filesystem;
+  if (pf) {
+    const f = base.sandbox.filesystem ?? (base.sandbox.filesystem = {});
+    if (pf.allowRead) f.allowRead = unionArr(f.allowRead, pf.allowRead);
+    if (pf.allowWrite) f.allowWrite = unionArr(f.allowWrite, pf.allowWrite);
+    if (pf.denyRead) f.denyRead = unionArr(f.denyRead, pf.denyRead);
+    if (pf.denyWrite) f.denyWrite = unionArr(f.denyWrite, pf.denyWrite);
+  }
+  const pn = profile.sandbox?.network;
+  if (pn) {
+    const n = base.sandbox.network ?? (base.sandbox.network = {});
+    if (pn.allowedDomains) n.allowedDomains = unionArr(n.allowedDomains, pn.allowedDomains);
+    if (pn.allowLocalBinding !== void 0) n.allowLocalBinding = pn.allowLocalBinding;
+  }
+  return base;
+}
+function composeGuestSandbox(base, userWorkDir, spawnCwd) {
+  const s = isGuestSettingsLike(base) ? base : buildGuestSettingsV1();
+  s.permissions = s.permissions ?? { defaultMode: "dontAsk" };
+  const fsv = s.sandbox.filesystem ?? (s.sandbox.filesystem = {});
+  s.sandbox.enabled = true;
+  s.sandbox.autoAllowBashIfSandboxed = true;
+  s.sandbox.allowUnsandboxedCommands = false;
+  fsv.denyRead = unionArr(fsv.denyRead, FORCED_DENY_READ);
+  fsv.denyWrite = unionArr((fsv.denyWrite ?? []).filter((p2) => p2 !== "~/"), [spawnCwd]);
+  s.permissions.deny = unionArr(s.permissions.deny, FORCED_TOOL_DENY);
+  fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir]);
+  fsv.allowWrite = unionArr(fsv.allowWrite, [userWorkDir]);
+  return s;
+}
+
 // src/session/reducer.ts
 init_runtime();
 
@@ -32282,7 +32359,7 @@ init_stdout_splitter();
 
 // src/ipc-recorder.ts
 var import_node_fs4 = __toESM(require("fs"), 1);
-var import_node_path5 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 function tsForFilename(ms) {
   return new Date(ms).toISOString().replace(/[:.]/g, "-");
 }
@@ -32293,8 +32370,8 @@ function startRecorder(opts) {
     return null;
   }
   const now = opts.now ?? Date.now;
-  const dir = import_node_path5.default.join(opts.dataDir, "ipc-recordings", opts.sessionId);
-  const filePath = import_node_path5.default.join(dir, `${tsForFilename(now())}.jsonl`);
+  const dir = import_node_path4.default.join(opts.dataDir, "ipc-recordings", opts.sessionId);
+  const filePath = import_node_path4.default.join(dir, `${tsForFilename(now())}.jsonl`);
   let stream = null;
   let closedResolve;
   const closed = new Promise((resolve6) => {
@@ -32746,9 +32823,9 @@ function extractEditPath(input) {
 
 // src/debug/pty-probe.ts
 var import_node_fs5 = __toESM(require("fs"), 1);
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 var PROBE_DIR = "/tmp/clawd-probe";
-var EVENTS_FILE = import_node_path6.default.join(PROBE_DIR, "events.jsonl");
+var EVENTS_FILE = import_node_path5.default.join(PROBE_DIR, "events.jsonl");
 var inited = false;
 function ensureDir() {
   if (inited) return true;
@@ -32771,7 +32848,7 @@ function probeEvent(event, data = {}) {
 function probeDumpReplay(sessionId, payload) {
   try {
     if (!ensureDir()) return "";
-    const file = import_node_path6.default.join(PROBE_DIR, `replay-${sessionId}-${Date.now()}.ans`);
+    const file = import_node_path5.default.join(PROBE_DIR, `replay-${sessionId}-${Date.now()}.ans`);
     import_node_fs5.default.writeFileSync(file, payload, "utf8");
     return file;
   } catch {
@@ -32863,7 +32940,7 @@ function derivePersonaSpawnCwd(file, personaRoot) {
       `derivePersonaSpawnCwd: personaRoot missing for owner session ${file.sessionId} (ownerPersonaId=${personaId})`
     );
   }
-  return import_node_path7.default.join(personaRoot, safeFileName(personaId));
+  return import_node_path6.default.join(personaRoot, safeFileName(personaId));
 }
 function makeInitialState(file, subSessionMeta) {
   return {
@@ -32980,7 +33057,7 @@ var SessionManager = class {
   // <dataDir>/sessions/ 列子目录 (排除 'default').
   listPersonaIdsOnDisk() {
     if (!this.deps.dataDir) return [];
-    const root = this.deps.storeFactory ? import_node_path7.default.join(this.deps.dataDir, "personas") : import_node_path7.default.join(this.deps.dataDir, "sessions");
+    const root = this.deps.storeFactory ? import_node_path6.default.join(this.deps.dataDir, "personas") : import_node_path6.default.join(this.deps.dataDir, "sessions");
     let entries;
     try {
       entries = import_node_fs6.default.readdirSync(root, { withFileTypes: true });
@@ -32996,7 +33073,7 @@ var SessionManager = class {
   // 只在 storeFactory 注入 (新布局) 下生效, 老布局无 guest 目录.
   listGuestCapIdsForPersona(personaId) {
     if (!this.deps.dataDir || !this.deps.storeFactory) return [];
-    const root = import_node_path7.default.join(
+    const root = import_node_path6.default.join(
       this.deps.dataDir,
       "personas",
       personaId,
@@ -33117,6 +33194,16 @@ var SessionManager = class {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
     const subSessionMeta = metaFromScope(scope, this.deps.personaRoot ?? "", this.deps.usersRoot ?? "");
+    if (scope.kind === "persona" && scope.mode === "guest") {
+      if (!this.deps.personaRoot || !subSessionMeta?.userWorkDir) {
+        throw new Error(
+          `newRunner: guest session ${file.sessionId} \u7F3A personaRoot/userWorkDir\uFF0C\u65E0\u6CD5\u7269\u5316 OS \u6C99\u7BB1\uFF08\u62D2\u7EDD\u521B\u5EFA\u65E0\u6C99\u7BB1 guest\uFF09`
+        );
+      }
+      const base = this.deps.personaStore?.readSandboxSettings(scope.personaId) ?? null;
+      const settings = composeGuestSandbox(base, subSessionMeta.userWorkDir, file.cwd);
+      subSessionMeta.extraSettings = JSON.stringify(settings);
+    }
     const attachmentGroup = this.deps.attachmentGroup;
     const runner = new SessionRunner(makeInitialState(file, subSessionMeta), {
       broadcastFrame: (frame, target) => this.routeFromRunner(frame, target),
@@ -34313,24 +34400,8 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs7 = __toESM(require("fs"), 1);
-var path10 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 init_protocol();
-
-// src/tools/guest-settings.ts
-function buildGuestSettingsV1(paths) {
-  const p2 = (dir) => dir.replace(/^\//, "");
-  return {
-    permissions: {
-      defaultMode: "dontAsk",
-      allow: ["Bash"],
-      deny: [`Edit(//${p2(paths.personaDir)}/**)`, `Read(//${p2(paths.personaDir)}/.clawd/**)`]
-    },
-    // 先不加 OS 沙箱（见文件头说明）；目录隔离靠 user-dir 分配 + --add-dir + RPC 守卫。
-    sandbox: { enabled: false }
-  };
-}
-
-// src/persona/store.ts
 var PersonaStore = class {
   constructor(root) {
     this.root = root;
@@ -34338,31 +34409,30 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path10.join(this.root, safeFileName(personaId));
+    return path9.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path10.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path9.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path10.join(this.personaDir(personaId), "CLAUDE.md");
+    return path9.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
-   * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
-   * project source 自动发现机制扫不到。owner 模式 spawn 时不会被 `--setting-sources
-   * user,project,local` 顺手带进来；listener 模式靠 `--settings <这个路径>` 显式拉回。
-   * 把 sandbox 跟 persona CLAUDE.md（仍在 `<persona>/CLAUDE.md`）解耦后，两种模式都能
-   * 加载 persona 人格，只有 listener 多一层 OS sandbox。
+   * persona 级 sandbox 模板落盘路径 —— 故意放 `.clawd/` 而非 `.claude/`，让 CC 的 project
+   * source 自动发现扫不到（owner `--setting-sources user,project,local` 不会顺手带进来）。
+   * 这份是 **UI 展示用模板**（readSandboxSettings）；guest 真正加载的沙箱文件由 manager 在
+   * spawn 前 per-guest 动态拼到各自 session 目录（含本 guest userWorkDir carve），不是这份。
    */
   sandboxSettingsPath(personaId) {
-    return path10.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path9.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs7.mkdirSync(path10.join(dir, ".clawd"), { recursive: true });
+    fs7.mkdirSync(path9.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
-      JSON.stringify(buildGuestSettingsV1({ personaDir: dir }), null, 2)
+      JSON.stringify(buildGuestSettingsV1(), null, 2)
     );
     this.atomicWrite(this.metaPath(persona.personaId), JSON.stringify(persona, null, 2));
   }
@@ -34370,10 +34440,9 @@ var PersonaStore = class {
     this.atomicWrite(this.claudeMdPath(personaId), personality);
   }
   /**
-   * 覆盖式写 sandbox-settings.json。preinstalled persona seed 时按需调用（如
-   * persona-app-builder 默认关 sandbox：FC 部署 / pnpm install / curl daemon RPC 都要 freedom，
-   * 默认 enabled=true 会拦住老板正常工作流）。已存在 persona 不主动覆盖 —— 老板手改了的不打扰；
-   * 想同步默认值，老板手动 cat 写一次即可。
+   * 覆盖式写 persona 级 sandbox 配置（seed 给有 profile 的 persona 写 base⊕profile；owner 之后可手编）。
+   * 这份是 guest 沙箱的 **base 真源**：manager spawn 时 composeGuestSandbox 读它 + 叠强制底座
+   * （enabled/denyRead/persona-deny owner 削弱不了）+ 注入本 guest userWorkDir → 写 per-guest 文件给 CC。
    */
   writeSandboxSettings(personaId, settings) {
     this.atomicWrite(
@@ -34417,14 +34486,14 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path10.join(this.personaDir(personaId), ".claude", "skills");
+    return path9.join(this.personaDir(personaId), ".claude", "skills");
   }
   /**
    * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
    * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
    */
   claudeSettingsPath(personaId) {
-    return path10.join(this.personaDir(personaId), ".claude", "settings.json");
+    return path9.join(this.personaDir(personaId), ".claude", "settings.json");
   }
   /**
    * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
@@ -34458,7 +34527,7 @@ var PersonaStore = class {
   list() {
     if (!fs7.existsSync(this.root)) return [];
     return fs7.readdirSync(this.root).filter((name) => {
-      return fs7.existsSync(path10.join(this.root, name, ".clawd", "persona.json"));
+      return fs7.existsSync(path9.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -34519,7 +34588,7 @@ var import_node_crypto3 = __toESM(require("crypto"), 1);
 // src/skills/scanner.ts
 var import_node_fs7 = __toESM(require("fs"), 1);
 var import_node_os2 = __toESM(require("os"), 1);
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 
 // src/skills/frontmatter.ts
 var STRIP_QUOTES = /^["']|["']$/g;
@@ -34641,14 +34710,14 @@ function scanSkillDir(dir, source, seen, out, pluginName) {
     return;
   }
   for (const ent of entries) {
-    const entryPath = import_node_path8.default.join(dir, ent.name);
+    const entryPath = import_node_path7.default.join(dir, ent.name);
     if (!ent.isDirectory() && !(ent.isSymbolicLink() && isDirLikeSync(entryPath))) continue;
     let content;
     try {
-      content = import_node_fs7.default.readFileSync(import_node_path8.default.join(entryPath, "SKILL.md"), "utf8");
+      content = import_node_fs7.default.readFileSync(import_node_path7.default.join(entryPath, "SKILL.md"), "utf8");
     } catch {
       try {
-        content = import_node_fs7.default.readFileSync(import_node_path8.default.join(entryPath, "skill.md"), "utf8");
+        content = import_node_fs7.default.readFileSync(import_node_path7.default.join(entryPath, "skill.md"), "utf8");
       } catch {
         continue;
       }
@@ -34677,7 +34746,7 @@ function scanCommandDir(dir, source, seen, out, pluginName) {
     return;
   }
   for (const ent of entries) {
-    const entryPath = import_node_path8.default.join(dir, ent.name);
+    const entryPath = import_node_path7.default.join(dir, ent.name);
     if (ent.isDirectory() || ent.isSymbolicLink() && isDirLikeSync(entryPath)) {
       const ns = ent.name;
       let subEntries;
@@ -34688,7 +34757,7 @@ function scanCommandDir(dir, source, seen, out, pluginName) {
       }
       for (const se of subEntries) {
         if (!se.name.endsWith(".md")) continue;
-        const sePath = import_node_path8.default.join(entryPath, se.name);
+        const sePath = import_node_path7.default.join(entryPath, se.name);
         let content;
         try {
           content = import_node_fs7.default.readFileSync(sePath, "utf8");
@@ -34724,7 +34793,7 @@ function scanCommandDir(dir, source, seen, out, pluginName) {
   }
 }
 function readInstalledPlugins(home) {
-  const file = import_node_path8.default.join(home, ".claude", "plugins", "installed_plugins.json");
+  const file = import_node_path7.default.join(home, ".claude", "plugins", "installed_plugins.json");
   let raw;
   try {
     raw = import_node_fs7.default.readFileSync(file, "utf8");
@@ -34775,14 +34844,14 @@ var SkillsScanner = class {
       });
     }
     const fsBlock = [];
-    scanSkillDir(import_node_path8.default.join(this.home, ".claude", "skills"), "global", seen, fsBlock);
-    scanCommandDir(import_node_path8.default.join(this.home, ".claude", "commands"), "global", seen, fsBlock);
-    scanSkillDir(import_node_path8.default.join(args.cwd, ".claude", "skills"), "project", seen, fsBlock);
-    scanCommandDir(import_node_path8.default.join(args.cwd, ".claude", "commands"), "project", seen, fsBlock);
+    scanSkillDir(import_node_path7.default.join(this.home, ".claude", "skills"), "global", seen, fsBlock);
+    scanCommandDir(import_node_path7.default.join(this.home, ".claude", "commands"), "global", seen, fsBlock);
+    scanSkillDir(import_node_path7.default.join(args.cwd, ".claude", "skills"), "project", seen, fsBlock);
+    scanCommandDir(import_node_path7.default.join(args.cwd, ".claude", "commands"), "project", seen, fsBlock);
     const plugins = [...readInstalledPlugins(this.home), ...this.extraPluginRoots];
     for (const { name, root } of plugins) {
-      scanSkillDir(import_node_path8.default.join(root, "skills"), "plugin", seen, fsBlock, name);
-      scanCommandDir(import_node_path8.default.join(root, "commands"), "plugin", seen, fsBlock, name);
+      scanSkillDir(import_node_path7.default.join(root, "skills"), "plugin", seen, fsBlock, name);
+      scanCommandDir(import_node_path7.default.join(root, "commands"), "plugin", seen, fsBlock, name);
     }
     fsBlock.sort((a, b2) => a.name < b2.name ? -1 : a.name > b2.name ? 1 : 0);
     return [...builtinBlock, ...fsBlock];
@@ -34888,7 +34957,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs9 = __toESM(require("fs"), 1);
-var path12 = __toESM(require("path"), 1);
+var path11 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -34928,9 +34997,37 @@ var DEFAULT_PERSONAS = [
     label: "App Builder",
     model: "opus",
     iconKey: "assist",
-    public: false
-    // 不设 sandboxOverride：owner 不注入 sandbox（天然不沙箱，部署/pnpm/curl 都 freedom），
-    // guest 走 sandbox-settings.json 的 guest 沙箱配置（store.write 默认生成）。
+    public: false,
+    // 开发型 profile：在最严格 base（已含 Bash+文件工具）上追加 web 工具 + node/pnpm 工具链精确路径
+    // + 出站全放。工具链只列精确目录（~/.nvm / pnpm store / ~/.npm），**不放宽 dot 目录**（~/.config 含
+    // gh/gcloud 凭证、~/.local/bin 在 PATH 可被植入），避免 secrets 暴露 + 提权。mac/linux 两套 pnpm store 都列。
+    sandboxProfile: {
+      // base 只 Bash，开发型在此放开文件工具 + web 工具（OS 沙箱 carve 兜底文件边界）。
+      // .secrets 只 app-builder 有 → 这里加 deny（其余 persona base 不默认带 .secrets）。
+      // defaultMode bypassPermissions：开发流频繁用工具，免逐次审批；deny 规则仍生效、OS 沙箱照管（已验证）。
+      permissions: {
+        defaultMode: "bypassPermissions",
+        allow: ["Read", "Edit", "Write", "Glob", "Grep", "WebFetch", "WebSearch"],
+        deny: ["Read(./.secrets/**)"]
+      },
+      sandbox: {
+        filesystem: {
+          // ~/.npmrc：registry 认证配置（私有源 token），不读会 pnpm install 403；单文件精确放行。
+          // ~/Library/Preferences/pnpm：mac 上 pnpm 全局 rc 目录（env-paths config），不读会 WARN EPERM。
+          allowRead: ["~/.npmrc", "~/Library/Preferences/pnpm", "~/.nvm", "~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store"],
+          allowWrite: ["~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store"]
+        },
+        // 网络：CC 沙箱出站强制走它自管的 MITM proxy 按 allowedDomains 过滤，**没有全开档**——'*' 或空白名单
+        // 都被全拦（matcher JL8：plain 域名只精确匹配，'*.xxx' 是 host.endsWith('.xxx')，且对裸 IP 返回 false）。
+        // 用一组常见顶级域通配近似"全放行"，几乎零维护即可覆盖 npm/pnpm/git 全生态（registry.npmjs.org→*.org、
+        // npm.jsr.io→*.io、github/githubusercontent→*.com…）。代价：仍挡掉直连 IP 外联（正常包安装都走域名，
+        // 反而是一道防裸 IP 外泄的兜底）。需要别的 TLD 往这里加。allowLocalBinding 控本机 bind，与出站正交。
+        network: {
+          allowedDomains: ["*.com", "*.org", "*.io", "*.net", "*.dev", "*.app", "*.cn", "*.co", "*.chat", "*.ai"],
+          allowLocalBinding: true
+        }
+      }
+    }
   },
   {
     personaId: "persona-developer",
@@ -34950,14 +35047,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path12.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path12.resolve(here, "defaults"));
-    candidates.push(path12.resolve(here, "persona-defaults"));
+    const here = path11.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path11.resolve(here, "defaults"));
+    candidates.push(path11.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path12.dirname(process.argv[1]);
-    candidates.push(path12.resolve(argvDir, "persona-defaults"));
+    const argvDir = path11.dirname(process.argv[1]);
+    candidates.push(path11.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -34974,7 +35071,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path12.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path11.join(args.defaultsRoot, entry.personaId);
     if (!fs9.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -34983,7 +35080,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path12.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path11.join(bundleDir, "CLAUDE.md");
     if (!fs9.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -35004,9 +35101,10 @@ function seedDefaultPersonas(args) {
       updatedAt: now
     };
     args.store.write(persona, personality);
-    if (entry.sandboxOverride) {
-      args.store.writeSandboxSettings(entry.personaId, entry.sandboxOverride);
-      args.logger.info("persona.seed.sandbox-override", { personaId: entry.personaId });
+    if (entry.sandboxProfile) {
+      const settings = applyProfile(buildGuestSettingsV1(), entry.sandboxProfile);
+      args.store.writeSandboxSettings(entry.personaId, settings);
+      args.logger.info("persona.seed.sandbox-profile", { personaId: entry.personaId });
     }
     copyBundleExtras(bundleDir, args.store.personaDirPath(entry.personaId));
     args.logger.info("persona.seed.created", { personaId: entry.personaId });
@@ -35015,8 +35113,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs9.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path12.join(srcDir, entry.name);
-    const dstPath = path12.join(dstDir, entry.name);
+    const srcPath = path11.join(srcDir, entry.name);
+    const dstPath = path11.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs9.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -35028,14 +35126,14 @@ var DAEMON_MANAGED_PATHS = ["extension-kit", "CLAUDE.md", ".mcp.json"];
 function refreshDaemonManagedDirs(args) {
   const entries = args.entries ?? DEFAULT_PERSONAS;
   for (const entry of entries) {
-    const bundleDir = path12.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path11.join(args.defaultsRoot, entry.personaId);
     if (!fs9.existsSync(bundleDir)) continue;
     const personaDir = args.store.personaDirPath(entry.personaId);
     if (!fs9.existsSync(personaDir)) continue;
     for (const relPath of DAEMON_MANAGED_PATHS) {
-      const srcPath = path12.join(bundleDir, relPath);
+      const srcPath = path11.join(bundleDir, relPath);
       if (!fs9.existsSync(srcPath)) continue;
-      const dstPath = path12.join(personaDir, relPath);
+      const dstPath = path11.join(personaDir, relPath);
       try {
         fs9.cpSync(srcPath, dstPath, { recursive: true, force: true, dereference: true });
         args.logger.info("persona.refresh.synced", {
@@ -35059,7 +35157,7 @@ init_claude();
 // src/tools/claude-tui.ts
 var import_node_fs10 = __toESM(require("fs"), 1);
 var import_node_os5 = __toESM(require("os"), 1);
-var import_node_path11 = __toESM(require("path"), 1);
+var import_node_path10 = __toESM(require("path"), 1);
 var import_headless = __toESM(require_xterm_headless(), 1);
 
 // ../node_modules/.pnpm/@xterm+addon-serialize@0.14.0/node_modules/@xterm/addon-serialize/lib/addon-serialize.mjs
@@ -36039,7 +36137,7 @@ function buildTuiSpawnArgs(ctx, isResume = false) {
 function jsonlExistsForCtx(ctx) {
   if (!ctx.toolSessionId) return false;
   const home = import_node_os5.default.homedir();
-  const file = import_node_path11.default.join(home, ".claude", "projects", cwdToHashDir(ctx.cwd), `${ctx.toolSessionId}.jsonl`);
+  const file = import_node_path10.default.join(home, ".claude", "projects", cwdToHashDir(ctx.cwd), `${ctx.toolSessionId}.jsonl`);
   try {
     return import_node_fs10.default.statSync(file).isFile();
   } catch {
@@ -36053,14 +36151,14 @@ init_claude_history();
 // src/workspace/browser.ts
 var import_node_fs11 = __toESM(require("fs"), 1);
 var import_node_os6 = __toESM(require("os"), 1);
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 init_protocol();
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 function resolveInsideCwd(cwd, subpath) {
-  const absCwd = import_node_path12.default.resolve(cwd);
-  const joined = import_node_path12.default.resolve(absCwd, subpath ?? ".");
-  const rel = import_node_path12.default.relative(absCwd, joined);
-  if (rel.startsWith("..") || import_node_path12.default.isAbsolute(rel)) {
+  const absCwd = import_node_path11.default.resolve(cwd);
+  const joined = import_node_path11.default.resolve(absCwd, subpath ?? ".");
+  const rel = import_node_path11.default.relative(absCwd, joined);
+  if (rel.startsWith("..") || import_node_path11.default.isAbsolute(rel)) {
     throw new ClawdError(ERROR_CODES.INVALID_PATH, `path escapes cwd: ${subpath}`);
   }
   return joined;
@@ -36091,7 +36189,7 @@ var WorkspaceBrowser = class {
         mtime: ""
       };
       try {
-        const st = import_node_fs11.default.statSync(import_node_path12.default.join(full, d.name));
+        const st = import_node_fs11.default.statSync(import_node_path11.default.join(full, d.name));
         entry.mtime = new Date(st.mtimeMs).toISOString();
         if (d.isFile()) entry.size = st.size;
       } catch {
@@ -36138,7 +36236,7 @@ var WorkspaceBrowser = class {
 // src/skills/agents-scanner.ts
 var import_node_fs12 = __toESM(require("fs"), 1);
 var import_node_os7 = __toESM(require("os"), 1);
-var import_node_path13 = __toESM(require("path"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
 var DEFAULT_POLICY_DIR_DARWIN = "/Library/Application Support/ClaudeCode/.claude/agents";
 function isDirLikeSync2(p2) {
   try {
@@ -36176,10 +36274,10 @@ function scanAgentsDir(dir, source, seen, out) {
   }
   for (const ent of entries) {
     if (!ent.name.endsWith(".md")) continue;
-    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path13.default.join(dir, ent.name)))) {
+    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path12.default.join(dir, ent.name)))) {
       continue;
     }
-    const filePath = import_node_path13.default.join(dir, ent.name);
+    const filePath = import_node_path12.default.join(dir, ent.name);
     const baseName = ent.name.replace(/\.md$/, "");
     if (seen.has(baseName)) continue;
     seen.add(baseName);
@@ -36202,7 +36300,7 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
       return;
     }
     for (const ent of entries) {
-      const childPath = import_node_path13.default.join(dir, ent.name);
+      const childPath = import_node_path12.default.join(dir, ent.name);
       if (ent.isDirectory() || ent.isSymbolicLink() && isDirLikeSync2(childPath)) {
         walk2(childPath, [...namespaces, ent.name]);
         continue;
@@ -36227,9 +36325,9 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
   walk2(root, []);
 }
 function readInstalledPlugins2(home) {
-  const pluginsDir = import_node_path13.default.join(home, ".claude", "plugins");
-  const v2 = import_node_path13.default.join(pluginsDir, "installed_plugins_v2.json");
-  const v1 = import_node_path13.default.join(pluginsDir, "installed_plugins.json");
+  const pluginsDir = import_node_path12.default.join(home, ".claude", "plugins");
+  const v2 = import_node_path12.default.join(pluginsDir, "installed_plugins_v2.json");
+  const v1 = import_node_path12.default.join(pluginsDir, "installed_plugins.json");
   let raw = null;
   for (const candidate of [v2, v1]) {
     try {
@@ -36258,19 +36356,19 @@ function readInstalledPlugins2(home) {
   return out;
 }
 function walkUpProjectAgentsDirs(startCwd, home, seen, out) {
-  let cur = import_node_path13.default.resolve(startCwd);
-  const fsRoot = import_node_path13.default.parse(cur).root;
+  let cur = import_node_path12.default.resolve(startCwd);
+  const fsRoot = import_node_path12.default.parse(cur).root;
   while (true) {
-    scanAgentsDir(import_node_path13.default.join(cur, ".claude", "agents"), "project", seen, out);
+    scanAgentsDir(import_node_path12.default.join(cur, ".claude", "agents"), "project", seen, out);
     let hasGit = false;
     try {
-      hasGit = import_node_fs12.default.existsSync(import_node_path13.default.join(cur, ".git"));
+      hasGit = import_node_fs12.default.existsSync(import_node_path12.default.join(cur, ".git"));
     } catch {
     }
     if (hasGit) return;
     if (cur === home) return;
     if (cur === fsRoot) return;
-    const parent = import_node_path13.default.dirname(cur);
+    const parent = import_node_path12.default.dirname(cur);
     if (parent === cur) return;
     cur = parent;
   }
@@ -36305,7 +36403,7 @@ var AgentsScanner = class {
     }
     const fsBlock = [];
     scanAgentsDir(
-      import_node_path13.default.join(this.home, ".claude", "agents"),
+      import_node_path12.default.join(this.home, ".claude", "agents"),
       "global",
       seen,
       fsBlock
@@ -36319,7 +36417,7 @@ var AgentsScanner = class {
       ...this.extraPluginRoots
     ];
     for (const { name, root } of plugins) {
-      const agentsRoot = import_node_path13.default.join(root, "agents");
+      const agentsRoot = import_node_path12.default.join(root, "agents");
       scanPluginAgentsTree(agentsRoot, name, seen, fsBlock);
     }
     return [...builtinBlock, ...fsBlock];
@@ -36329,13 +36427,13 @@ var AgentsScanner = class {
 // src/observer/session-observer.ts
 var import_node_fs14 = __toESM(require("fs"), 1);
 var import_node_os9 = __toESM(require("os"), 1);
-var import_node_path15 = __toESM(require("path"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
 init_claude_history();
 
 // src/observer/subagent-meta-observer.ts
 var import_node_fs13 = __toESM(require("fs"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
 init_claude_history();
 var META_RE = /^agent-([A-Za-z0-9_-]+)\.meta\.json$/;
 var SubagentMetaObserver = class {
@@ -36348,7 +36446,7 @@ var SubagentMetaObserver = class {
   watches = /* @__PURE__ */ new Map();
   // public for spec only：测试直接拼路径写假 meta.json；生产 start() 内部自己解析
   resolveSubagentDir(cwd, toolSessionId) {
-    return import_node_path14.default.join(
+    return import_node_path13.default.join(
       this.home,
       ".claude",
       "projects",
@@ -36404,7 +36502,7 @@ var SubagentMetaObserver = class {
     if (!m2) return;
     const agentId = m2[1];
     if (w2.emitted.has(agentId)) return;
-    const file = import_node_path14.default.join(w2.dirPath, name);
+    const file = import_node_path13.default.join(w2.dirPath, name);
     let raw;
     try {
       raw = import_node_fs13.default.readFileSync(file, "utf8");
@@ -36464,7 +36562,7 @@ var SessionObserver = class {
   metaObserver;
   resolveJsonlPath(cwd, toolSessionId, override) {
     if (override) return override;
-    return import_node_path15.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
+    return import_node_path14.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
   }
   start(args) {
     this.stop(args.sessionId);
@@ -36485,10 +36583,10 @@ var SessionObserver = class {
       prevIsRejectSentinel: false
     };
     try {
-      import_node_fs14.default.mkdirSync(import_node_path15.default.dirname(filePath), { recursive: true });
+      import_node_fs14.default.mkdirSync(import_node_path14.default.dirname(filePath), { recursive: true });
     } catch {
     }
-    w2.watcher = import_node_fs14.default.watch(import_node_path15.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
+    w2.watcher = import_node_fs14.default.watch(import_node_path14.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
       if (!changedName || !filePath.endsWith(changedName)) return;
       this.poll(w2);
     });
@@ -37295,7 +37393,7 @@ async function authenticate(token, deps) {
 
 // src/permission/capability-store.ts
 var fs17 = __toESM(require("fs"), 1);
-var path20 = __toESM(require("path"), 1);
+var path19 = __toESM(require("path"), 1);
 var CAPABILITIES_FILE_NAME = "capabilities.json";
 var FILE_VERSION = 1;
 var CapabilityStore = class {
@@ -37325,7 +37423,7 @@ var CapabilityStore = class {
     this.flush();
   }
   filePath() {
-    return path20.join(this.dataDir, CAPABILITIES_FILE_NAME);
+    return path19.join(this.dataDir, CAPABILITIES_FILE_NAME);
   }
   readFromDisk() {
     const file = this.filePath();
@@ -37472,7 +37570,7 @@ function cleanupGuestSessionsForCapability(cap, factory) {
 
 // src/inbox/inbox-store.ts
 var fs19 = __toESM(require("fs"), 1);
-var path21 = __toESM(require("path"), 1);
+var path20 = __toESM(require("path"), 1);
 var INBOX_SUBDIR = "inbox";
 var InboxStore = class {
   constructor(dataDir) {
@@ -37570,10 +37668,10 @@ var InboxStore = class {
     }
   }
   dirPath() {
-    return path21.join(this.dataDir, INBOX_SUBDIR);
+    return path20.join(this.dataDir, INBOX_SUBDIR);
   }
   filePath(peerDeviceId) {
-    return path21.join(this.dirPath(), `${peerDeviceId}.jsonl`);
+    return path20.join(this.dirPath(), `${peerDeviceId}.jsonl`);
   }
 };
 function parseAllLines(raw) {
@@ -37661,7 +37759,7 @@ var InboxManager = class {
 
 // src/state/contact-store.ts
 var fs20 = __toESM(require("fs"), 1);
-var path22 = __toESM(require("path"), 1);
+var path21 = __toESM(require("path"), 1);
 var FILE_NAME = "contacts.json";
 var ContactStore = class {
   constructor(dataDir) {
@@ -37671,7 +37769,7 @@ var ContactStore = class {
   contacts = /* @__PURE__ */ new Map();
   load() {
     this.contacts.clear();
-    const file = path22.join(this.dataDir, FILE_NAME);
+    const file = path21.join(this.dataDir, FILE_NAME);
     let raw;
     try {
       raw = fs20.readFileSync(file, "utf8");
@@ -37717,7 +37815,7 @@ var ContactStore = class {
     return existed;
   }
   flush() {
-    const file = path22.join(this.dataDir, FILE_NAME);
+    const file = path21.join(this.dataDir, FILE_NAME);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
     const content = JSON.stringify(
       { contacts: Array.from(this.contacts.values()) },
@@ -37866,52 +37964,52 @@ async function autoReverseContact(args) {
 
 // src/migrations/2026-05-20-flatten-sessions.ts
 var fs21 = __toESM(require("fs"), 1);
-var path23 = __toESM(require("path"), 1);
+var path22 = __toESM(require("path"), 1);
 var MIGRATION_FLAG_NAME = ".migration.v1.done";
 function migrateFlattenSessions(opts) {
   const dataDir = opts.dataDir;
   const now = opts.now ?? Date.now;
-  const sessionsDir = path23.join(dataDir, "sessions");
-  const flagPath = path23.join(sessionsDir, MIGRATION_FLAG_NAME);
+  const sessionsDir = path22.join(dataDir, "sessions");
+  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
   if (existsSync3(flagPath)) {
     return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
   }
   let movedBare = 0;
   let movedVmOwner = 0;
   let archivedListener = 0;
-  const defaultDir = path23.join(sessionsDir, "default");
+  const defaultDir = path22.join(sessionsDir, "default");
   if (existsSync3(defaultDir)) {
     for (const entry of readdirSafe(defaultDir)) {
       if (!entry.endsWith(".json")) continue;
-      const src = path23.join(defaultDir, entry);
-      const dst = path23.join(sessionsDir, entry);
+      const src = path22.join(defaultDir, entry);
+      const dst = path22.join(sessionsDir, entry);
       fs21.renameSync(src, dst);
       movedBare += 1;
     }
     rmdirIfEmpty(defaultDir);
   }
   for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path23.join(sessionsDir, pid);
+    const personaDir = path22.join(sessionsDir, pid);
     if (!isDir(personaDir)) continue;
     if (pid === "default") continue;
-    const ownerSrc = path23.join(personaDir, "owner");
+    const ownerSrc = path22.join(personaDir, "owner");
     if (existsSync3(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path23.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
       fs21.mkdirSync(ownerDst, { recursive: true });
       for (const file of readdirSafe(ownerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs21.renameSync(path23.join(ownerSrc, file), path23.join(ownerDst, file));
+        fs21.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
         movedVmOwner += 1;
       }
       rmdirIfEmpty(ownerSrc);
     }
-    const listenerSrc = path23.join(personaDir, "listener");
+    const listenerSrc = path22.join(personaDir, "listener");
     if (existsSync3(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path23.join(dataDir, ".legacy", `listener-${pid}`);
+      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
       fs21.mkdirSync(archiveDst, { recursive: true });
       for (const file of readdirSafe(listenerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs21.renameSync(path23.join(listenerSrc, file), path23.join(archiveDst, file));
+        fs21.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
         archivedListener += 1;
       }
       rmdirIfEmpty(listenerSrc);
@@ -37959,10 +38057,10 @@ function rmdirIfEmpty(p2) {
 
 // src/transport/http-router.ts
 var import_node_fs16 = __toESM(require("fs"), 1);
-var import_node_path19 = __toESM(require("path"), 1);
+var import_node_path18 = __toESM(require("path"), 1);
 
 // src/attachment/mime.ts
-var import_node_path16 = __toESM(require("path"), 1);
+var import_node_path15 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -38069,7 +38167,7 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path16.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path15.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
@@ -38139,7 +38237,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
 
 // src/attachment/upload.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
-var import_node_path17 = __toESM(require("path"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 var import_node_crypto5 = __toESM(require("crypto"), 1);
 var import_promises = require("stream/promises");
 var UploadError = class extends Error {
@@ -38151,14 +38249,14 @@ var UploadError = class extends Error {
   code;
 };
 function assertValidFileName(fileName) {
-  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path17.default.basename(fileName)) {
+  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path16.default.basename(fileName)) {
     throw new UploadError("INVALID_FILENAME", `fileName must be a plain basename, got: ${fileName}`);
   }
 }
 var HASH_PREFIX_LEN = 16;
 async function writeUploadedAttachment(args) {
   assertValidFileName(args.fileName);
-  const attachmentsRoot = import_node_path17.default.join(args.sessionDir, ".attachments");
+  const attachmentsRoot = import_node_path16.default.join(args.sessionDir, ".attachments");
   try {
     import_node_fs15.default.mkdirSync(attachmentsRoot, { recursive: true });
   } catch (err) {
@@ -38166,7 +38264,7 @@ async function writeUploadedAttachment(args) {
   }
   const hasher = import_node_crypto5.default.createHash("sha256");
   let actualSize = 0;
-  const tmpPath = import_node_path17.default.join(
+  const tmpPath = import_node_path16.default.join(
     attachmentsRoot,
     `.upload-${process.pid}-${Date.now()}-${import_node_crypto5.default.randomBytes(4).toString("hex")}`
   );
@@ -38201,7 +38299,7 @@ async function writeUploadedAttachment(args) {
     );
   }
   const attachmentId = hasher.digest("hex").slice(0, HASH_PREFIX_LEN);
-  const hashDir = import_node_path17.default.join(attachmentsRoot, attachmentId);
+  const hashDir = import_node_path16.default.join(attachmentsRoot, attachmentId);
   let finalFileName;
   let hashDirExists = false;
   try {
@@ -38219,7 +38317,7 @@ async function writeUploadedAttachment(args) {
     try {
       import_node_fs15.default.mkdirSync(hashDir, { recursive: true });
       finalFileName = args.fileName;
-      import_node_fs15.default.renameSync(tmpPath, import_node_path17.default.join(hashDir, finalFileName));
+      import_node_fs15.default.renameSync(tmpPath, import_node_path16.default.join(hashDir, finalFileName));
     } catch (err) {
       try {
         import_node_fs15.default.unlinkSync(tmpPath);
@@ -38228,8 +38326,8 @@ async function writeUploadedAttachment(args) {
       throw new UploadError("STORAGE_ERROR", `rename failed: ${err.message}`);
     }
   }
-  const absPath = import_node_path17.default.join(hashDir, finalFileName);
-  const relPath = import_node_path17.default.relative(args.sessionDir, absPath);
+  const absPath = import_node_path16.default.join(hashDir, finalFileName);
+  const relPath = import_node_path16.default.relative(args.sessionDir, absPath);
   args.groupFileStore.upsert(args.scope, args.sessionId, {
     relPath: absPath,
     // 存绝对路径，与现有 agent 入清单的形态一致（attachment.ts:144 双形态兼容）
@@ -38243,7 +38341,7 @@ async function writeUploadedAttachment(args) {
 
 // src/extension/import.ts
 var import_promises2 = __toESM(require("fs/promises"), 1);
-var import_node_path18 = __toESM(require("path"), 1);
+var import_node_path17 = __toESM(require("path"), 1);
 var import_node_os10 = __toESM(require("os"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
 var ImportError = class extends Error {
@@ -38261,7 +38359,7 @@ async function importZip(buf, root) {
     throw new ImportError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path18.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path17.default.isAbsolute(name)) {
       throw new ImportError("ZIP_INVALID", `unsafe zip entry path: ${name}`);
     }
   }
@@ -38294,7 +38392,7 @@ async function importZip(buf, root) {
       );
     }
   }
-  const destDir = import_node_path18.default.join(root, manifest.id);
+  const destDir = import_node_path17.default.join(root, manifest.id);
   let destExists = false;
   try {
     await import_promises2.default.access(destDir);
@@ -38304,15 +38402,15 @@ async function importZip(buf, root) {
   if (destExists) {
     throw new ImportError("ALREADY_EXISTS", `extension ${manifest.id} already installed`);
   }
-  const stage = await import_promises2.default.mkdtemp(import_node_path18.default.join(import_node_os10.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
+  const stage = await import_promises2.default.mkdtemp(import_node_path17.default.join(import_node_os10.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path18.default.join(stage, name);
+      const dest = import_node_path17.default.join(stage, name);
       if (entry.dir) {
         await import_promises2.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises2.default.mkdir(import_node_path18.default.dirname(dest), { recursive: true });
+      await import_promises2.default.mkdir(import_node_path17.default.dirname(dest), { recursive: true });
       const content = await entry.async("nodebuffer");
       await import_promises2.default.writeFile(dest, content);
     }
@@ -38426,7 +38524,7 @@ function isValidUploadFileName(fileName) {
   if (fileName === "." || fileName === "..") return false;
   if (fileName.startsWith(".")) return false;
   if (fileName.includes("/") || fileName.includes("\\")) return false;
-  return fileName === import_node_path19.default.basename(fileName);
+  return fileName === import_node_path18.default.basename(fileName);
 }
 function createHttpRouter(deps) {
   return async (req, res) => {
@@ -38655,7 +38753,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path19.default.isAbsolute(pathParam)) {
+      if (import_node_path18.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -38663,7 +38761,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path19.default.join(file.cwd, pathParam);
+        absPath = import_node_path18.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -38761,7 +38859,7 @@ function streamFile(res, absPath, logger) {
     return;
   }
   const mime = lookupMime(absPath);
-  const basename = import_node_path19.default.basename(absPath);
+  const basename = import_node_path18.default.basename(absPath);
   res.writeHead(200, {
     "Content-Type": mime,
     "Content-Length": String(stat.size),
@@ -38779,7 +38877,7 @@ function streamFile(res, absPath, logger) {
 
 // src/attachment/gc.ts
 var import_node_fs17 = __toESM(require("fs"), 1);
-var import_node_path20 = __toESM(require("path"), 1);
+var import_node_path19 = __toESM(require("path"), 1);
 var DEFAULT_TTL_MS = 30 * 24 * 3600 * 1e3;
 function runAttachmentGc(args) {
   const now = (args.now ?? Date.now)();
@@ -38788,17 +38886,17 @@ function runAttachmentGc(args) {
   for (const { scope, sessionId } of args.sessionScopes) {
     for (const entry of args.groupFileStore.list(scope, sessionId)) {
       if (entry.stale) continue;
-      if (import_node_path20.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
+      if (import_node_path19.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
     }
   }
   for (const { scope, sessionId } of args.sessionScopes) {
-    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path20.default.join(
+    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path19.default.join(
       args.dataDir,
       "sessions",
       ...scopeSubPath(scope).map(safeFileName),
       safeFileName(sessionId)
     );
-    const attRoot = import_node_path20.default.join(sessionDir, ".attachments");
+    const attRoot = import_node_path19.default.join(sessionDir, ".attachments");
     let hashDirs;
     try {
       hashDirs = import_node_fs17.default.readdirSync(attRoot);
@@ -38808,7 +38906,7 @@ function runAttachmentGc(args) {
       continue;
     }
     for (const hashDir of hashDirs) {
-      const hashDirAbs = import_node_path20.default.join(attRoot, hashDir);
+      const hashDirAbs = import_node_path19.default.join(attRoot, hashDir);
       let files;
       try {
         files = import_node_fs17.default.readdirSync(hashDirAbs);
@@ -38816,7 +38914,7 @@ function runAttachmentGc(args) {
         continue;
       }
       for (const name of files) {
-        const file = import_node_path20.default.join(hashDirAbs, name);
+        const file = import_node_path19.default.join(hashDirAbs, name);
         let stat;
         try {
           stat = import_node_fs17.default.statSync(file);
@@ -38847,7 +38945,7 @@ function runAttachmentGc(args) {
 
 // src/attachment/group.ts
 var import_node_fs18 = __toESM(require("fs"), 1);
-var import_node_path21 = __toESM(require("path"), 1);
+var import_node_path20 = __toESM(require("path"), 1);
 var import_node_crypto6 = __toESM(require("crypto"), 1);
 init_protocol();
 var GroupFileStore = class {
@@ -38859,11 +38957,11 @@ var GroupFileStore = class {
     this.logger = opts.logger;
   }
   rootForScope(scope) {
-    return import_node_path21.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+    return import_node_path20.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
   }
   /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
   filePath(scope, sessionId) {
-    return import_node_path21.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+    return import_node_path20.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
   }
   cacheKey(scope, sessionId) {
     return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
@@ -38898,7 +38996,7 @@ var GroupFileStore = class {
   }
   writeFile(scope, sessionId, entries) {
     const file = this.filePath(scope, sessionId);
-    import_node_fs18.default.mkdirSync(import_node_path21.default.dirname(file), { recursive: true });
+    import_node_fs18.default.mkdirSync(import_node_path20.default.dirname(file), { recursive: true });
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
     import_node_fs18.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
     import_node_fs18.default.renameSync(tmp, file);
@@ -38988,9 +39086,9 @@ var GroupFileStore = class {
 
 // src/discovery/state-file.ts
 var import_node_fs19 = __toESM(require("fs"), 1);
-var import_node_path22 = __toESM(require("path"), 1);
+var import_node_path21 = __toESM(require("path"), 1);
 function defaultStateFilePath(dataDir) {
-  return import_node_path22.default.join(dataDir, "state.json");
+  return import_node_path21.default.join(dataDir, "state.json");
 }
 function isPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
@@ -39026,7 +39124,7 @@ var StateFileManager = class {
     return { status: "stale", existing };
   }
   write(state) {
-    import_node_fs19.default.mkdirSync(import_node_path22.default.dirname(this.file), { recursive: true });
+    import_node_fs19.default.mkdirSync(import_node_path21.default.dirname(this.file), { recursive: true });
     const tmp = `${this.file}.tmp.${process.pid}.${Date.now()}`;
     import_node_fs19.default.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
     import_node_fs19.default.renameSync(tmp, this.file);
@@ -39047,13 +39145,13 @@ var StateFileManager = class {
 
 // src/tunnel/tunnel-manager.ts
 var import_node_fs23 = __toESM(require("fs"), 1);
-var import_node_path26 = __toESM(require("path"), 1);
+var import_node_path25 = __toESM(require("path"), 1);
 var import_node_crypto7 = __toESM(require("crypto"), 1);
 var import_node_child_process5 = require("child_process");
 
 // src/tunnel/tunnel-store.ts
 var import_node_fs20 = __toESM(require("fs"), 1);
-var import_node_path23 = __toESM(require("path"), 1);
+var import_node_path22 = __toESM(require("path"), 1);
 var TunnelStore = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -39072,7 +39170,7 @@ var TunnelStore = class {
     }
   }
   async set(v2) {
-    const dir = import_node_path23.default.dirname(this.filePath);
+    const dir = import_node_path22.default.dirname(this.filePath);
     await import_node_fs20.default.promises.mkdir(dir, { recursive: true });
     const data = JSON.stringify(v2, null, 2);
     const tmp = `${this.filePath}.tmp.${process.pid}.${Date.now()}`;
@@ -39184,7 +39282,7 @@ function escape(v2) {
 // src/tunnel/frpc-binary.ts
 var import_node_fs21 = __toESM(require("fs"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
-var import_node_path24 = __toESM(require("path"), 1);
+var import_node_path23 = __toESM(require("path"), 1);
 var import_node_child_process3 = require("child_process");
 var import_node_stream2 = require("stream");
 var import_promises3 = require("stream/promises");
@@ -39223,13 +39321,13 @@ async function ensureFrpcBinary(opts) {
   }
   const version2 = opts.version ?? FRPC_VERSION;
   const platform = opts.platform ?? detectPlatform();
-  const binDir = import_node_path24.default.join(opts.dataDir, "bin");
+  const binDir = import_node_path23.default.join(opts.dataDir, "bin");
   import_node_fs21.default.mkdirSync(binDir, { recursive: true });
   cleanupStaleArtifacts(binDir);
-  const stableBin = import_node_path24.default.join(binDir, "frpc");
+  const stableBin = import_node_path23.default.join(binDir, "frpc");
   if (import_node_fs21.default.existsSync(stableBin)) return stableBin;
   const partialBin = `${stableBin}.partial`;
-  const tarballPath = import_node_path24.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
+  const tarballPath = import_node_path23.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
   try {
     const url = frpcDownloadUrl(version2, platform);
     await downloadToFile(url, tarballPath, opts.fetchImpl);
@@ -39255,7 +39353,7 @@ function cleanupStaleArtifacts(binDir) {
   }
   for (const name of entries) {
     if (name.endsWith(".partial") || name.startsWith("extract-")) {
-      const full = import_node_path24.default.join(binDir, name);
+      const full = import_node_path23.default.join(binDir, name);
       try {
         import_node_fs21.default.rmSync(full, { recursive: true, force: true });
       } catch {
@@ -39281,7 +39379,7 @@ async function downloadToFile(url, dest, fetchImpl) {
   await (0, import_promises3.pipeline)(nodeStream, out);
 }
 async function extractFrpcFromTarball(tarball, binDir, version2, platform, destBin) {
-  const work = import_node_path24.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
+  const work = import_node_path23.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
   import_node_fs21.default.mkdirSync(work, { recursive: true });
   try {
     await new Promise((resolve6, reject) => {
@@ -39290,7 +39388,7 @@ async function extractFrpcFromTarball(tarball, binDir, version2, platform, destB
       proc.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`tar exited ${code}`)));
     });
     const dirName = `frp_${version2}_${platform.os}_${platform.arch}`;
-    const src = import_node_path24.default.join(work, dirName, "frpc");
+    const src = import_node_path23.default.join(work, dirName, "frpc");
     if (!import_node_fs21.default.existsSync(src)) {
       throw new Error(`frpc not found inside tarball at ${src}`);
     }
@@ -39302,10 +39400,10 @@ async function extractFrpcFromTarball(tarball, binDir, version2, platform, destB
 
 // src/tunnel/frpc-process.ts
 var import_node_fs22 = __toESM(require("fs"), 1);
-var import_node_path25 = __toESM(require("path"), 1);
+var import_node_path24 = __toESM(require("path"), 1);
 var import_node_child_process4 = require("child_process");
 function frpcPidFilePath(dataDir) {
-  return import_node_path25.default.join(dataDir, "frpc.pid");
+  return import_node_path24.default.join(dataDir, "frpc.pid");
 }
 function writeFrpcPid(dataDir, pid) {
   try {
@@ -39347,7 +39445,7 @@ function defaultSleep(ms) {
 }
 async function killStaleFrpc(deps) {
   const pidFile = frpcPidFilePath(deps.dataDir);
-  const tomlPath = import_node_path25.default.join(deps.dataDir, "frpc.toml");
+  const tomlPath = import_node_path24.default.join(deps.dataDir, "frpc.toml");
   const readPidFile = deps.readPidFileImpl ?? defaultReadPidFile;
   const isAlive = deps.isPidAliveImpl ?? defaultIsPidAlive;
   const killPid = deps.killPidImpl ?? defaultKillPid;
@@ -39419,7 +39517,7 @@ var DEFAULT_TUNNEL_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var TunnelManager = class {
   constructor(deps) {
     this.deps = deps;
-    this.store = deps.store ?? new TunnelStore(import_node_path26.default.join(deps.dataDir, "tunnel.json"));
+    this.store = deps.store ?? new TunnelStore(import_node_path25.default.join(deps.dataDir, "tunnel.json"));
     this.ttlMs = deps.ttlMs ?? DEFAULT_TUNNEL_TTL_MS;
     this.startupTimeoutMs = deps.startupTimeoutMs ?? 15e3;
   }
@@ -39546,7 +39644,7 @@ var TunnelManager = class {
         dataDir: this.deps.dataDir,
         override: this.deps.frpcBinaryOverride ?? void 0
       });
-      const tomlPath = import_node_path26.default.join(this.deps.dataDir, "frpc.toml");
+      const tomlPath = import_node_path25.default.join(this.deps.dataDir, "frpc.toml");
       const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto7.default.randomBytes(3).toString("hex")}`;
       const toml = buildFrpcToml({
         serverAddr: t.frpsHost,
@@ -39561,7 +39659,7 @@ var TunnelManager = class {
       const proc = (this.deps.spawnImpl ?? import_node_child_process5.spawn)(frpcBin, ["-c", tomlPath], {
         stdio: ["ignore", "pipe", "pipe"]
       });
-      const logFilePath = import_node_path26.default.join(this.deps.dataDir, "frpc.log");
+      const logFilePath = import_node_path25.default.join(this.deps.dataDir, "frpc.log");
       const logStream = import_node_fs23.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
       logStream.on("error", () => {
       });
@@ -39645,15 +39743,15 @@ async function waitForFrpcReady(proc, timeoutMs) {
 
 // src/tunnel/device-key.ts
 var import_node_os12 = __toESM(require("os"), 1);
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path26 = __toESM(require("path"), 1);
 var import_node_crypto8 = __toESM(require("crypto"), 1);
 var DERIVE_SALT = "clawd-tunnel-device-v1";
 function deriveStableDeviceKey(opts = {}) {
   const hostname = opts.hostname ?? import_node_os12.default.hostname();
   const uid = opts.uid ?? (typeof import_node_os12.default.userInfo === "function" ? import_node_os12.default.userInfo().uid : 0);
   const home = opts.home ?? import_node_os12.default.homedir();
-  const defaultDataDir = import_node_path27.default.resolve(import_node_path27.default.join(home, ".clawd"));
-  const normalizedDataDir = opts.dataDir ? import_node_path27.default.resolve(opts.dataDir) : null;
+  const defaultDataDir = import_node_path26.default.resolve(import_node_path26.default.join(home, ".clawd"));
+  const normalizedDataDir = opts.dataDir ? import_node_path26.default.resolve(opts.dataDir) : null;
   const isDefaultDir = normalizedDataDir == null || normalizedDataDir === defaultDataDir;
   const input = isDefaultDir ? `${hostname}::${uid}` : `${hostname}::${uid}::${normalizedDataDir}`;
   return import_node_crypto8.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
@@ -39661,11 +39759,11 @@ function deriveStableDeviceKey(opts = {}) {
 
 // src/auth-store.ts
 var import_node_fs24 = __toESM(require("fs"), 1);
-var import_node_path28 = __toESM(require("path"), 1);
+var import_node_path27 = __toESM(require("path"), 1);
 var import_node_crypto9 = __toESM(require("crypto"), 1);
 var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
-  return import_node_path28.default.join(dataDir, AUTH_FILE_NAME);
+  return import_node_path27.default.join(dataDir, AUTH_FILE_NAME);
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
@@ -39718,7 +39816,7 @@ function readAuthFile(file) {
   }
 }
 function writeAuthFile(file, content) {
-  import_node_fs24.default.mkdirSync(import_node_path28.default.dirname(file), { recursive: true });
+  import_node_fs24.default.mkdirSync(import_node_path27.default.dirname(file), { recursive: true });
   import_node_fs24.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
   try {
     import_node_fs24.default.chmodSync(file, 384);
@@ -39729,11 +39827,11 @@ function writeAuthFile(file, content) {
 // src/owner-profile.ts
 var import_node_fs25 = __toESM(require("fs"), 1);
 var import_node_os13 = __toESM(require("os"), 1);
-var import_node_path29 = __toESM(require("path"), 1);
+var import_node_path28 = __toESM(require("path"), 1);
 var PROFILE_FILENAME = "profile.json";
 function loadOwnerDisplayName(dataDir) {
   const fallback = import_node_os13.default.userInfo().username;
-  const profilePath = import_node_path29.default.join(dataDir, PROFILE_FILENAME);
+  const profilePath = import_node_path28.default.join(dataDir, PROFILE_FILENAME);
   let raw;
   try {
     raw = import_node_fs25.default.readFileSync(profilePath, "utf8");
@@ -39760,12 +39858,12 @@ function loadOwnerDisplayName(dataDir) {
 
 // src/feishu-auth/owner-identity-store.ts
 var import_node_fs26 = __toESM(require("fs"), 1);
-var import_node_path30 = __toESM(require("path"), 1);
+var import_node_path29 = __toESM(require("path"), 1);
 var OWNER_IDENTITY_FILE_NAME = "owner-identity.json";
 var OwnerIdentityStore = class {
   file;
   constructor(dataDir) {
-    this.file = import_node_path30.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
+    this.file = import_node_path29.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
   }
   read() {
     let raw;
@@ -39797,7 +39895,7 @@ var OwnerIdentityStore = class {
     };
   }
   write(record) {
-    import_node_fs26.default.mkdirSync(import_node_path30.default.dirname(this.file), { recursive: true });
+    import_node_fs26.default.mkdirSync(import_node_path29.default.dirname(this.file), { recursive: true });
     import_node_fs26.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
     try {
       import_node_fs26.default.chmodSync(this.file, 384);
@@ -39925,9 +40023,9 @@ var CentralClientError = class extends Error {
   code;
   cause;
 };
-async function centralRequest(opts, path60, init) {
+async function centralRequest(opts, path59, init) {
   const f = opts.fetchImpl ?? globalThis.fetch;
-  const url = `${opts.api.replace(/\/+$/, "")}${path60}`;
+  const url = `${opts.api.replace(/\/+$/, "")}${path59}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
   let res;
@@ -40070,7 +40168,7 @@ function verifyConnectToken(args) {
 
 // src/feishu-auth/server-key.ts
 var fs35 = __toESM(require("fs"), 1);
-var path39 = __toESM(require("path"), 1);
+var path38 = __toESM(require("path"), 1);
 var FILE_NAME2 = "server-signing-key.json";
 var ServerKeyStore = class {
   constructor(dataDir) {
@@ -40078,7 +40176,7 @@ var ServerKeyStore = class {
   }
   dataDir;
   filePath() {
-    return path39.join(this.dataDir, FILE_NAME2);
+    return path38.join(this.dataDir, FILE_NAME2);
   }
   /** 读缓存的公钥；无缓存 / 损坏 → null（调用方决定是否触发拉取） */
   read() {
@@ -40118,7 +40216,7 @@ init_protocol();
 // src/session/fork.ts
 var import_node_fs27 = __toESM(require("fs"), 1);
 var import_node_os14 = __toESM(require("os"), 1);
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_path30 = __toESM(require("path"), 1);
 init_claude_history();
 function readJsonlEntries(file) {
   const raw = import_node_fs27.default.readFileSync(file, "utf8");
@@ -40134,9 +40232,9 @@ function readJsonlEntries(file) {
   return out;
 }
 function forkSession(input) {
-  const baseDir = input.baseDir ?? import_node_path31.default.join(import_node_os14.default.homedir(), ".claude");
-  const projectDir = import_node_path31.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
-  const sourceFile = import_node_path31.default.join(projectDir, `${input.toolSessionId}.jsonl`);
+  const baseDir = input.baseDir ?? import_node_path30.default.join(import_node_os14.default.homedir(), ".claude");
+  const projectDir = import_node_path30.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
+  const sourceFile = import_node_path30.default.join(projectDir, `${input.toolSessionId}.jsonl`);
   if (!import_node_fs27.default.existsSync(sourceFile)) {
     throw new Error(`fork: source transcript not found: ${sourceFile}`);
   }
@@ -40167,7 +40265,7 @@ function forkSession(input) {
     }
     forkedLines.push(JSON.stringify(forked));
   }
-  const forkedFilePath = import_node_path31.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
+  const forkedFilePath = import_node_path30.default.join(projectDir, `${forkedToolSessionId}.jsonl`);
   import_node_fs27.default.mkdirSync(projectDir, { recursive: true });
   import_node_fs27.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
   return { forkedToolSessionId, forkedFilePath };
@@ -40536,7 +40634,7 @@ function buildPermissionHandlers(deps) {
 }
 
 // src/handlers/history.ts
-var path42 = __toESM(require("path"), 1);
+var path41 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/session/recent-dirs.ts
@@ -40554,7 +40652,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/permission/persona-paths.ts
-var path41 = __toESM(require("path"), 1);
+var path40 = __toESM(require("path"), 1);
 function getAllowedPersonaIds(grants, action) {
   const ids = /* @__PURE__ */ new Set();
   for (const g2 of grants) {
@@ -40567,31 +40665,31 @@ function getAllowedPersonaIds(grants, action) {
   return ids;
 }
 function isGuestPathAllowed(grants, absPath, personaRoot, action = "read", userWorkDir) {
-  const target = path41.resolve(absPath);
+  const target = path40.resolve(absPath);
   if (userWorkDir) {
-    const u = path41.resolve(userWorkDir);
-    const usep = u.endsWith(path41.sep) ? "" : path41.sep;
+    const u = path40.resolve(userWorkDir);
+    const usep = u.endsWith(path40.sep) ? "" : path40.sep;
     if (target === u || target.startsWith(u + usep)) return true;
   }
-  const root = path41.resolve(personaRoot);
-  const sep2 = root.endsWith(path41.sep) ? "" : path41.sep;
+  const root = path40.resolve(personaRoot);
+  const sep2 = root.endsWith(path40.sep) ? "" : path40.sep;
   if (!target.startsWith(root + sep2)) return false;
-  const rel = path41.relative(root, target);
+  const rel = path40.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
-  const personaId = rel.split(path41.sep)[0];
+  const personaId = rel.split(path40.sep)[0];
   if (!personaId) return false;
   const allowed = getAllowedPersonaIds(grants, action);
   if (allowed === "*") return true;
   return allowed.has(personaId);
 }
 function personaIdFromPath(absPath, personaRoot) {
-  const root = path41.resolve(personaRoot);
-  const target = path41.resolve(absPath);
-  const sep2 = root.endsWith(path41.sep) ? "" : path41.sep;
+  const root = path40.resolve(personaRoot);
+  const target = path40.resolve(absPath);
+  const sep2 = root.endsWith(path40.sep) ? "" : path40.sep;
   if (!target.startsWith(root + sep2)) return null;
-  const rel = path41.relative(root, target);
+  const rel = path40.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
-  const id = rel.split(path41.sep)[0];
+  const id = rel.split(path40.sep)[0];
   return id || null;
 }
 
@@ -40618,7 +40716,7 @@ function buildHistoryHandlers(deps) {
         if (!pid) return false;
         return isGuestPathAllowed(
           ctx.grants,
-          path42.join(personaRoot, pid),
+          path41.join(personaRoot, pid),
           personaRoot,
           "read",
           userWorkDir
@@ -40630,7 +40728,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path42.resolve(args.projectPath), personaRoot, "history:list");
+    assertGuestPath(ctx, path41.resolve(args.projectPath), personaRoot, "history:list");
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -40662,13 +40760,13 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
+    assertGuestPath(ctx, path41.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path42.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
+    assertGuestPath(ctx, path41.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
   };
@@ -40677,7 +40775,7 @@ function buildHistoryHandlers(deps) {
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path42.resolve(d.cwd), personaRoot, "read", userWorkDir)
+        (d) => isGuestPathAllowed(ctx.grants, path41.resolve(d.cwd), personaRoot, "read", userWorkDir)
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -40694,7 +40792,7 @@ function buildHistoryHandlers(deps) {
 }
 
 // src/handlers/workspace.ts
-var path43 = __toESM(require("path"), 1);
+var path42 = __toESM(require("path"), 1);
 var os15 = __toESM(require("os"), 1);
 init_protocol();
 init_protocol();
@@ -40736,22 +40834,22 @@ function buildWorkspaceHandlers(deps) {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os15.homedir();
-    const resolvedCwd = path43.resolve(args.cwd ?? fallbackCwd);
-    const target = args.path ? path43.resolve(resolvedCwd, args.path) : resolvedCwd;
+    const resolvedCwd = path42.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path42.resolve(resolvedCwd, args.path) : resolvedCwd;
     assertGuestPath2(ctx, target, personaRoot, "workspace:list", usersRoot);
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
-    const target = path43.isAbsolute(args.path) ? path43.resolve(args.path) : path43.resolve(args.cwd, args.path);
+    const target = path42.isAbsolute(args.path) ? path42.resolve(args.path) : path42.resolve(args.cwd, args.path);
     assertGuestPath2(ctx, target, personaRoot, "workspace:read", usersRoot);
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
-    const cwdAbs = path43.resolve(args.cwd);
+    const cwdAbs = path42.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list", usersRoot);
     const list2 = skills.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -40763,7 +40861,7 @@ function buildWorkspaceHandlers(deps) {
   };
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
-    const cwdAbs = path43.resolve(args.cwd);
+    const cwdAbs = path42.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list", usersRoot);
     const list2 = agents.list(args);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -40782,18 +40880,18 @@ function buildWorkspaceHandlers(deps) {
 }
 
 // src/handlers/git.ts
-var path45 = __toESM(require("path"), 1);
+var path44 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 
 // src/workspace/git.ts
 var import_node_child_process6 = require("child_process");
 var import_node_fs28 = __toESM(require("fs"), 1);
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
 var import_node_util = require("util");
 var pexec = (0, import_node_util.promisify)(import_node_child_process6.execFile);
 function normalizePath(p2) {
-  const resolved = import_node_path32.default.resolve(p2);
+  const resolved = import_node_path31.default.resolve(p2);
   try {
     return import_node_fs28.default.realpathSync(resolved);
   } catch {
@@ -40869,7 +40967,7 @@ async function listGitBranches(cwd) {
 function assertGuestCwd(ctx, cwd, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
   const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
-  if (!isGuestPathAllowed(ctx.grants, path45.resolve(cwd), personaRoot, "read", userWorkDir)) {
+  if (!isGuestPathAllowed(ctx.grants, path44.resolve(cwd), personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -41382,7 +41480,7 @@ function buildPersonaHandlers(deps) {
 }
 
 // src/handlers/attachment.ts
-var import_node_path33 = __toESM(require("path"), 1);
+var import_node_path32 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -41437,12 +41535,12 @@ function buildAttachmentHandlers(deps) {
         `session ${args.sessionId} scope unresolved`
       );
     }
-    const cwdAbs = import_node_path33.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path33.default.isAbsolute(args.relPath) ? import_node_path33.default.resolve(args.relPath) : import_node_path33.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path32.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path32.default.isAbsolute(args.relPath) ? import_node_path32.default.resolve(args.relPath) : import_node_path32.default.resolve(cwdAbs, args.relPath);
     assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl", deps.usersRoot);
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
-      const storedAbs = import_node_path33.default.isAbsolute(e.relPath) ? import_node_path33.default.resolve(e.relPath) : import_node_path33.default.resolve(cwdAbs, e.relPath);
+      const storedAbs = import_node_path32.default.isAbsolute(e.relPath) ? import_node_path32.default.resolve(e.relPath) : import_node_path32.default.resolve(cwdAbs, e.relPath);
       return storedAbs === candidateAbs && !e.stale;
     });
     if (!entry) {
@@ -41466,7 +41564,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path33.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
+    assertGuestAttachmentPath(ctx, import_node_path32.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -41538,19 +41636,19 @@ function buildAttachmentHandlers(deps) {
 
 // src/handlers/extension.ts
 var import_promises7 = __toESM(require("fs/promises"), 1);
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 init_protocol();
 
 // src/extension/bundle-zip.ts
 var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_path34 = __toESM(require("path"), 1);
+var import_node_path33 = __toESM(require("path"), 1);
 var import_node_crypto11 = __toESM(require("crypto"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
   const zip = new import_jszip2.default();
   for (const rel of entries) {
-    const abs = import_node_path34.default.join(dir, rel);
+    const abs = import_node_path33.default.join(dir, rel);
     const content = await import_promises4.default.readFile(abs);
     zip.file(rel, content, { date: FIXED_DATE });
   }
@@ -41571,7 +41669,7 @@ async function listFilesSorted(rootDir) {
   return out;
 }
 async function walk(absRoot, relPrefix, out) {
-  const dirAbs = import_node_path34.default.join(absRoot, relPrefix);
+  const dirAbs = import_node_path33.default.join(absRoot, relPrefix);
   const entries = await import_promises4.default.readdir(dirAbs, { withFileTypes: true });
   for (const e of entries) {
     if (IGNORE_BASENAMES.has(e.name)) continue;
@@ -41625,25 +41723,25 @@ function computePublishCheck(args) {
 
 // src/extension/install-flow.ts
 var import_promises5 = __toESM(require("fs/promises"), 1);
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
 var import_node_os17 = __toESM(require("os"), 1);
 var import_node_crypto12 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 
 // src/extension/paths.ts
 var import_node_os16 = __toESM(require("os"), 1);
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
 function clawdHomeRoot(override) {
-  return override ?? process.env.CLAWD_HOME ?? import_node_path35.default.join(import_node_os16.default.homedir(), ".clawd");
+  return override ?? process.env.CLAWD_HOME ?? import_node_path34.default.join(import_node_os16.default.homedir(), ".clawd");
 }
 function extensionsRoot(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extensions");
+  return import_node_path34.default.join(clawdHomeRoot(override), "extensions");
 }
 function publishedChannelsFile(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extensions-published.json");
+  return import_node_path34.default.join(clawdHomeRoot(override), "extensions-published.json");
 }
 function bundleCacheRoot(override) {
-  return import_node_path35.default.join(clawdHomeRoot(override), "extension-bundles");
+  return import_node_path34.default.join(clawdHomeRoot(override), "extension-bundles");
 }
 
 // src/extension/install-flow.ts
@@ -41670,7 +41768,7 @@ async function installFromChannel(args, deps) {
     throw new InstallError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path36.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path35.default.isAbsolute(name)) {
       throw new InstallError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -41702,7 +41800,7 @@ async function installFromChannel(args, deps) {
     );
   }
   const localExtId = namespacedExtId(ownerSlug, channelRef.ownerPrincipalId);
-  const destDir = import_node_path36.default.join(deps.extensionsRoot, localExtId);
+  const destDir = import_node_path35.default.join(deps.extensionsRoot, localExtId);
   let destExists = false;
   try {
     await import_promises5.default.access(destDir);
@@ -41716,16 +41814,16 @@ async function installFromChannel(args, deps) {
     );
   }
   const stage = await import_promises5.default.mkdtemp(
-    import_node_path36.default.join(import_node_os17.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
+    import_node_path35.default.join(import_node_os17.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path36.default.join(stage, name);
+      const dest = import_node_path35.default.join(stage, name);
       if (entry.dir) {
         await import_promises5.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises5.default.mkdir(import_node_path36.default.dirname(dest), { recursive: true });
+      await import_promises5.default.mkdir(import_node_path35.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises5.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -41746,7 +41844,7 @@ async function installFromChannel(args, deps) {
 
 // src/extension/update-flow.ts
 var import_promises6 = __toESM(require("fs/promises"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
 var import_node_os18 = __toESM(require("os"), 1);
 var import_node_crypto13 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
@@ -41763,11 +41861,11 @@ async function updateFromChannel(args, deps) {
     channelRef.extId,
     channelRef.ownerPrincipalId
   );
-  const liveDir = import_node_path37.default.join(deps.extensionsRoot, localExtId);
+  const liveDir = import_node_path36.default.join(deps.extensionsRoot, localExtId);
   const prevDir = `${liveDir}.prev`;
   let existingVersion;
   try {
-    const raw = await import_promises6.default.readFile(import_node_path37.default.join(liveDir, "manifest.json"), "utf8");
+    const raw = await import_promises6.default.readFile(import_node_path36.default.join(liveDir, "manifest.json"), "utf8");
     const parsed2 = ExtensionManifestSchema.safeParse(JSON.parse(raw));
     if (!parsed2.success) {
       throw new UpdateError(
@@ -41800,7 +41898,7 @@ async function updateFromChannel(args, deps) {
     throw new UpdateError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path37.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path36.default.isAbsolute(name)) {
       throw new UpdateError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -41835,16 +41933,16 @@ async function updateFromChannel(args, deps) {
   await import_promises6.default.rm(prevDir, { recursive: true, force: true });
   await import_promises6.default.rename(liveDir, prevDir);
   const stage = await import_promises6.default.mkdtemp(
-    import_node_path37.default.join(import_node_os18.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
+    import_node_path36.default.join(import_node_os18.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path37.default.join(stage, name);
+      const dest = import_node_path36.default.join(stage, name);
       if (entry.dir) {
         await import_promises6.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises6.default.mkdir(import_node_path37.default.dirname(dest), { recursive: true });
+      await import_promises6.default.mkdir(import_node_path36.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises6.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -41937,7 +42035,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
       );
     }
   }
-  const manifestPath = import_node_path38.default.join(root, extId, "manifest.json");
+  const manifestPath = import_node_path37.default.join(root, extId, "manifest.json");
   const manifest = await readManifest(root, extId);
   const next = { ...manifest, version: newVersion };
   const tmp = `${manifestPath}.tmp`;
@@ -41945,7 +42043,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
   await import_promises7.default.rename(tmp, manifestPath);
 }
 async function readManifest(root, extId) {
-  const file = import_node_path38.default.join(root, extId, "manifest.json");
+  const file = import_node_path37.default.join(root, extId, "manifest.json");
   let raw;
   try {
     raw = await import_promises7.default.readFile(file, "utf8");
@@ -42036,7 +42134,7 @@ function buildExtensionHandlers(deps) {
   };
   async function buildSnapshotMeta(extId) {
     const manifest = await readManifest(deps.root, extId);
-    const { sha256, buffer } = await bundleExtensionDir(import_node_path38.default.join(deps.root, extId));
+    const { sha256, buffer } = await bundleExtensionDir(import_node_path37.default.join(deps.root, extId));
     return { manifest, contentHash: sha256, buffer };
   }
   const publish = async (frame, _client, ctx) => {
@@ -42333,7 +42431,7 @@ var PublishJobRegistry = class {
 // src/app-builder/publish-job-runner.ts
 var import_node_child_process8 = require("child_process");
 var import_node_fs29 = require("fs");
-var import_node_path39 = require("path");
+var import_node_path38 = require("path");
 
 // src/app-builder/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
@@ -42365,7 +42463,7 @@ async function startPublishJob(deps, args) {
     return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
   }
   const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path39.join)(projDir, ".publish.log");
+  const logPath = (0, import_node_path38.join)(projDir, ".publish.log");
   let logStream = null;
   try {
     logStream = (0, import_node_fs29.createWriteStream)(logPath, { flags: "w" });
@@ -42625,7 +42723,7 @@ async function recoverInterruptedJobs(deps) {
 
 // src/handlers/app-builder.ts
 init_protocol();
-var import_node_path40 = require("path");
+var import_node_path39 = require("path");
 var import_node_fs30 = require("fs");
 var APP_BUILDER_PERSONAS = ["persona-app-builder"];
 var PUBLISH_SCRIPT_REL = "extension-kit/scripts/publish.sh";
@@ -43000,7 +43098,7 @@ function buildAppBuilderHandlers(deps) {
       });
       await userStore.clearPublishJob(args.name);
     }
-    const scriptPath = (0, import_node_path40.join)(deps.personaRoot, PUBLISH_SCRIPT_REL);
+    const scriptPath = (0, import_node_path39.join)(deps.personaRoot, PUBLISH_SCRIPT_REL);
     deps.logger?.info("app-builder.publish.start", {
       name: args.name,
       sessionId: boundSession.sessionId,
@@ -43094,7 +43192,7 @@ function buildAppBuilderHandlers(deps) {
 
 // src/extension/registry.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 async function loadAll(root) {
   let entries;
   try {
@@ -43107,13 +43205,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path41.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path40.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path41.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path40.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises8.default.readFile(manifestPath, "utf8");
@@ -43158,7 +43256,7 @@ async function loadOne(dir, dirName) {
 
 // src/extension/uninstall.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -43167,7 +43265,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path42.default.join(deps.root, deps.extId);
+  const dir = import_node_path41.default.join(deps.root, deps.extId);
   try {
     await import_promises9.default.access(dir);
   } catch {
@@ -43248,7 +43346,7 @@ function buildMethodHandlers(deps) {
 // src/app-builder/project-store.ts
 var import_node_fs31 = require("fs");
 var import_node_child_process9 = require("child_process");
-var import_node_path43 = require("path");
+var import_node_path42 = require("path");
 init_protocol();
 var PROJECTS_DIR = "projects";
 var META_FILE = ".clawd-project.json";
@@ -43263,14 +43361,14 @@ var ProjectStore = class {
   root;
   /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
-    return (0, import_node_path43.join)(this.projectsRoot(), name, META_FILE);
+    return (0, import_node_path42.join)(this.projectsRoot(), name, META_FILE);
   }
   /** projects/<name>/ 目录路径（cwd 用） */
   projectDir(name) {
-    return (0, import_node_path43.join)(this.projectsRoot(), name);
+    return (0, import_node_path42.join)(this.projectsRoot(), name);
   }
   projectsRoot() {
-    return (0, import_node_path43.join)(this.root, PROJECTS_DIR);
+    return (0, import_node_path42.join)(this.root, PROJECTS_DIR);
   }
   async list() {
     let entries;
@@ -43351,7 +43449,7 @@ var ProjectStore = class {
    * 代码再参考"。assistant 进 project 时目录已是完整模板，直接 pnpm install 即可。
    */
   async scaffold(name, template = DEFAULT_TEMPLATE, personaRoot = this.root) {
-    const scriptPath = (0, import_node_path43.join)(personaRoot, SCAFFOLD_SCRIPT_REL);
+    const scriptPath = (0, import_node_path42.join)(personaRoot, SCAFFOLD_SCRIPT_REL);
     const destDir = this.projectDir(name);
     return await new Promise((resolve6, reject) => {
       const child = (0, import_node_child_process9.spawn)("bash", [scriptPath, name, template, destDir], {
@@ -43889,7 +43987,7 @@ function computeGrantForFrame(method, frame) {
 
 // src/extension/runtime.ts
 var import_node_child_process11 = require("child_process");
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
 var import_promises10 = require("timers/promises");
 
 // src/extension/port-allocator.ts
@@ -43990,7 +44088,7 @@ var Runtime = class {
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
-    const dir = import_node_path44.default.join(this.root, extId);
+    const dir = import_node_path43.default.join(this.root, extId);
     const env = {
       ...process.env,
       CLAWOS_EXT_PORT: String(port),
@@ -44102,7 +44200,7 @@ ${handle.stderrTail}`
 
 // src/extension/published-channels.ts
 var import_promises11 = __toESM(require("fs/promises"), 1);
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 init_zod();
 var PublishedChannelsError = class extends Error {
   constructor(code, message) {
@@ -44201,7 +44299,7 @@ var PublishedChannelStore = class {
       )
     };
     const tmp = `${this.filePath}.tmp`;
-    await import_promises11.default.mkdir(import_node_path45.default.dirname(this.filePath), { recursive: true });
+    await import_promises11.default.mkdir(import_node_path44.default.dirname(this.filePath), { recursive: true });
     await import_promises11.default.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
     await import_promises11.default.rename(tmp, this.filePath);
   }
@@ -44209,7 +44307,7 @@ var PublishedChannelStore = class {
 
 // src/extension/bundle-cache.ts
 var import_promises12 = __toESM(require("fs/promises"), 1);
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
 var BundleCache = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
@@ -44218,14 +44316,14 @@ var BundleCache = class {
   /** Atomic write: stage tmp → rename. Caller passes the hex sha256. */
   async write(snapshotHash, buffer) {
     await import_promises12.default.mkdir(this.rootDir, { recursive: true });
-    const file = import_node_path46.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path45.default.join(this.rootDir, `${snapshotHash}.zip`);
     const tmp = `${file}.tmp`;
     await import_promises12.default.writeFile(tmp, buffer, { mode: 384 });
     await import_promises12.default.rename(tmp, file);
   }
   /** Returns the bundle bytes, or null when the file doesn't exist. */
   async read(snapshotHash) {
-    const file = import_node_path46.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path45.default.join(this.rootDir, `${snapshotHash}.zip`);
     try {
       return await import_promises12.default.readFile(file);
     } catch (e) {
@@ -44235,7 +44333,7 @@ var BundleCache = class {
   }
   /** Idempotent — missing file is not an error. */
   async delete(snapshotHash) {
-    const file = import_node_path46.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path45.default.join(this.rootDir, `${snapshotHash}.zip`);
     await import_promises12.default.rm(file, { force: true });
   }
 };
@@ -44244,7 +44342,7 @@ var BundleCache = class {
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path47.default.join(config.dataDir, "clawd.log")
+    file: import_node_path46.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -44380,8 +44478,8 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path47.default.join(config.dataDir, "personas"));
-  const usersRoot = import_node_path47.default.join(config.dataDir, "users");
+  const personaStore = new PersonaStore(import_node_path46.default.join(config.dataDir, "personas"));
+  const usersRoot = import_node_path46.default.join(config.dataDir, "users");
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -44399,7 +44497,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path46.default.join(config.dataDir, "personas"),
     usersRoot,
     personaStore,
     ownerDisplayName,
@@ -44429,7 +44527,7 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path47.default.isAbsolute(input.relPath) ? input.relPath : import_node_path47.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path46.default.isAbsolute(input.relPath) ? input.relPath : import_node_path46.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
           size = import_node_fs32.default.statSync(absPath).size;
@@ -44614,11 +44712,11 @@ async function startDaemon(config) {
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
       // guest path guard：candidate 必须在 personaRoot 子树或调用者自己的 user-dir 下
-      personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+      personaRoot: import_node_path46.default.join(config.dataDir, "personas"),
       usersRoot
     },
     // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
-    personaRoot: import_node_path47.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path46.default.join(config.dataDir, "personas"),
     // v2 多人 persona 隔离：handler 派生 guest user-dir 放行
     usersRoot,
     // capability:list / delete handler 依赖
@@ -44707,7 +44805,7 @@ async function startDaemon(config) {
     // 发布上线脚手架化 (spec 2026-06-03 §5.2):
     // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
     // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
-    appBuilderPersonaRoot: import_node_path47.default.join(config.dataDir, "personas", "persona-app-builder"),
+    appBuilderPersonaRoot: import_node_path46.default.join(config.dataDir, "personas", "persona-app-builder"),
     // 发布上线脚手架化 (spec 2026-06-03 §5.2.2):
     // 复用 SessionManagerDeps.broadcastFrame 同款 dispatch 逻辑 —— runner 调 manager.send
     // 取回 broadcast 帧后逐帧 push 到 transport，跟 manager 自身的 deps 一致。
@@ -44955,8 +45053,8 @@ async function startDaemon(config) {
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path47.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path47.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path46.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path46.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -44969,7 +45067,7 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path47.default.join(config.dataDir, "connect.txt");
+        const connectPath = import_node_path46.default.join(config.dataDir, "connect.txt");
         import_node_fs32.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
@@ -45041,7 +45139,7 @@ ${bar}
   };
 }
 function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path47.default.join(dataDir, "persons");
+  const dir = import_node_path46.default.join(dataDir, "persons");
   try {
     import_node_fs32.default.rmSync(dir, { recursive: true, force: true });
   } catch {