@clawos-dev/clawd 0.2.143-beta.300.c2a3792 → 0.2.143-beta.301.814d293

package/dist/cli.cjs

@@ -35316,6 +35316,56 @@ function migrateCodexSandbox(args) {
   }
   if (n > 0) args.logger.info("persona.codex-sandbox.done", { migrated: n });
 }
+function findDeployKitRoot() {
+  const candidates = [];
+  try {
+    const here = path11.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path11.resolve(here, "..", "deploy-kit"));
+  } catch {
+  }
+  if (process.argv[1]) {
+    candidates.push(path11.resolve(path11.dirname(process.argv[1]), "deploy-kit"));
+  }
+  for (const c of candidates) {
+    try {
+      if (fs9.statSync(c).isDirectory()) return c;
+    } catch {
+    }
+  }
+  return null;
+}
+function seedDeployKit(args) {
+  const dst = path11.join(args.dataDir, "deploy-kit");
+  fs9.cpSync(args.deployKitBundleRoot, dst, {
+    recursive: true,
+    dereference: true,
+    force: false,
+    errorOnExist: false
+  });
+  args.logger.info("deploy-kit.seed.done", { dst });
+}
+function refreshDeployKit(args) {
+  const dst = path11.join(args.dataDir, "deploy-kit");
+  if (!fs9.existsSync(dst)) {
+    seedDeployKit(args);
+    return;
+  }
+  for (const sub of ["scripts", "contract"]) {
+    const s = path11.join(args.deployKitBundleRoot, sub);
+    if (fs9.existsSync(s)) {
+      fs9.cpSync(s, path11.join(dst, sub), { recursive: true, force: true, dereference: true });
+    }
+  }
+  const secretsSrc = path11.join(args.deployKitBundleRoot, ".secrets");
+  if (fs9.existsSync(secretsSrc)) {
+    fs9.mkdirSync(path11.join(dst, ".secrets"), { recursive: true });
+    for (const f of fs9.readdirSync(secretsSrc)) {
+      if (!f.endsWith(".example")) continue;
+      fs9.copyFileSync(path11.join(secretsSrc, f), path11.join(dst, ".secrets", f));
+    }
+  }
+  args.logger.info("deploy-kit.refresh.done", { dst });
+}
 
 // src/index.ts
 init_claude();
@@ -43253,8 +43303,218 @@ function buildExtensionHandlers(deps) {
   };
 }
 
-// src/app-builder/kill-port.ts
+// src/app-builder/project-store.ts
+var import_node_fs30 = require("fs");
 var import_node_child_process11 = require("child_process");
+var import_node_path37 = require("path");
+init_protocol();
+var PROJECTS_DIR = "projects";
+var META_FILE = ".clawd-project.json";
+var DEFAULT_TEMPLATE = "nestjs-react";
+var SCAFFOLD_TIMEOUT_MS = 3e4;
+var ProjectStore = class {
+  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/`（v2 per-user） */
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  /** projects/<name>/.clawd-project.json 路径 */
+  metaPath(name) {
+    return (0, import_node_path37.join)(this.projectsRoot(), name, META_FILE);
+  }
+  /** projects/<name>/ 目录路径（cwd 用） */
+  projectDir(name) {
+    return (0, import_node_path37.join)(this.projectsRoot(), name);
+  }
+  projectsRoot() {
+    return (0, import_node_path37.join)(this.root, PROJECTS_DIR);
+  }
+  async list() {
+    let entries;
+    try {
+      entries = await import_node_fs30.promises.readdir(this.projectsRoot());
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const out = [];
+    for (const name of entries) {
+      try {
+        const raw = await import_node_fs30.promises.readFile(this.metaPath(name), "utf8");
+        const json = JSON.parse(raw);
+        let migrated = false;
+        if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
+          json.devCommand = DEFAULT_DEV_COMMAND;
+          migrated = true;
+        }
+        const parsed = ProjectMetadataSchema.safeParse(json);
+        if (parsed.success) {
+          out.push(parsed.data);
+          if (migrated) {
+            void import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
+            });
+          }
+        }
+      } catch {
+      }
+    }
+    return out.sort((a, b2) => a.name.localeCompare(b2.name));
+  }
+  /**
+   * @param reservedPorts 其它 user 已占端口（v2 per-user：端口必须全局唯一，所有 user 的
+   *   dev server 同机跑；per-user store 各自只 list 自己，靠 handler 收集全局端口传进来，
+   *   否则不同 user 的首个项目都从 PROJECT_PORT_MIN 起 → 全撞 6173）。
+   */
+  async create(name, reservedPorts) {
+    const existing = await this.list();
+    if (existing.some((p2) => p2.name === name)) {
+      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728`);
+    }
+    const usedPorts = new Set(existing.map((p2) => p2.port));
+    if (reservedPorts) for (const p2 of reservedPorts) usedPorts.add(p2);
+    let port = -1;
+    for (let p2 = PROJECT_PORT_MIN; p2 <= PROJECT_PORT_MAX; p2++) {
+      if (!usedPorts.has(p2)) {
+        port = p2;
+        break;
+      }
+    }
+    if (port < 0) {
+      throw new Error(
+        `port pool exhausted / \u7AEF\u53E3\u6C60\u5DF2\u6EE1\uFF08${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}\uFF09\uFF0C\u5148\u5220\u4E00\u4E2A project \u91CA\u653E\u7AEF\u53E3`
+      );
+    }
+    const meta = {
+      name,
+      port,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      devCommand: DEFAULT_DEV_COMMAND
+    };
+    const validated = ProjectMetadataSchema.safeParse(meta);
+    if (!validated.success) {
+      throw new Error(`invalid name "${name}": ${validated.error.message}`);
+    }
+    const dir = this.projectDir(name);
+    await import_node_fs30.promises.mkdir(dir, { recursive: true });
+    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+    return meta;
+  }
+  /**
+   * 同步内联 scaffold：spawn `extension-kit/scripts/new-extension.sh <name>` 等 exit。
+   * 必须在 `create()` 之后调（脚本期望 projects/<name>/.clawd-project.json 已就位 = picker 模式）。
+   * 失败抛错；上层（handler）应当 catch 后回滚（删 dir + 不 mutate session）。
+   *
+   * spec 2026-06-02 §5.6.3：scaffold 对 assistant 不可见，避免 assistant 被诱导去"读 example
+   * 代码再参考"。assistant 进 project 时目录已是完整模板，直接 pnpm install 即可。
+   */
+  async scaffold(name, templateSrcDir, scaffoldScriptPath) {
+    const destDir = this.projectDir(name);
+    return await new Promise((resolve6, reject) => {
+      const child = (0, import_node_child_process11.spawn)("bash", [scaffoldScriptPath, name, templateSrcDir, destDir], {
+        env: { ...process.env, PATH: process.env.PATH ?? "" },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      child.stdout.on("data", (d) => {
+        stdout += d.toString("utf8");
+      });
+      child.stderr.on("data", (d) => {
+        stderr += d.toString("utf8");
+      });
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(new Error(`scaffold timeout (>${SCAFFOLD_TIMEOUT_MS}ms): ${scaffoldScriptPath} ${name}`));
+      }, SCAFFOLD_TIMEOUT_MS);
+      child.on("error", (err) => {
+        clearTimeout(timer);
+        reject(new Error(`scaffold spawn failed: ${err.message}`));
+      });
+      child.on("exit", (code, signal) => {
+        clearTimeout(timer);
+        if (code === 0) resolve6({ stdout, stderr });
+        else reject(new Error(`scaffold exit ${code ?? signal}: ${stderr.slice(0, 500)}`));
+      });
+    });
+  }
+  async delete(name) {
+    const dir = this.projectDir(name);
+    await import_node_fs30.promises.rm(dir, { recursive: true, force: true });
+  }
+  async updatePort(name, newPort) {
+    if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
+      throw new Error(
+        `port range invalid: must be ${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}, got ${newPort}`
+      );
+    }
+    const list = await this.list();
+    const target = list.find((p2) => p2.name === name);
+    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    const conflict = list.find((p2) => p2.name !== name && p2.port === newPort);
+    if (conflict) {
+      throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
+    }
+    const updated = { ...target, port: newPort };
+    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
+    return updated;
+  }
+  /**
+   * 单栏 refactor (spec 2026-06-02 §5.6.1)：发布上线后写公网 URL 到 .clawd-project.json.prodUrl。
+   * UI 通过 listProjects 读到 prodUrl 后切预览栏到线上 URL，取代旧 prod marker 机制。
+   * 重复调用幂等（覆盖旧 URL）。url 由 ProjectMetadataSchema 校验 url() 格式。
+   */
+  async setProdUrl(name, url) {
+    const list = await this.list();
+    const target = list.find((p2) => p2.name === name);
+    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    const updated = { ...target, prodUrl: url };
+    const validated = ProjectMetadataSchema.safeParse(updated);
+    if (!validated.success) {
+      throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
+    }
+    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    return validated.data;
+  }
+  /**
+   * 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design §5.1.4)：
+   * 写 publishJob 字段到 .clawd-project.json。仅承载 in-flight 状态 ——
+   *   - daemon 收到第一个 ::stage::build marker 时写入
+   *   - 每次 stage 切换更新 stage 字段（jobId / startedAt 不变）
+   *   - 成功 / 失败 / dismiss 时调 clearPublishJob 清掉
+   *   - 只有 daemon 崩才会留残骸
+   * 写入时保留所有其他字段（prodUrl 等不受影响）。
+   */
+  async setPublishJob(name, job) {
+    const list = await this.list();
+    const target = list.find((p2) => p2.name === name);
+    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    const updated = { ...target, publishJob: job };
+    const validated = ProjectMetadataSchema.safeParse(updated);
+    if (!validated.success) {
+      throw new Error(`invalid publishJob: ${validated.error.message}`);
+    }
+    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    return validated.data;
+  }
+  /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
+  async clearPublishJob(name) {
+    const list = await this.list();
+    const target = list.find((p2) => p2.name === name);
+    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
+    if (!target.publishJob) return target;
+    const { publishJob: _drop, ...rest } = target;
+    void _drop;
+    const validated = ProjectMetadataSchema.safeParse(rest);
+    if (!validated.success) {
+      throw new Error(`failed to clear publishJob: ${validated.error.message}`);
+    }
+    await import_node_fs30.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    return validated.data;
+  }
+};
+
+// src/app-builder/kill-port.ts
+var import_node_child_process12 = require("child_process");
 async function killPortOccupants(port, ownedPids, logger) {
   let pids;
   try {
@@ -43296,7 +43556,7 @@ async function killPortOccupants(port, ownedPids, logger) {
 }
 function listPidsOnPort(port) {
   return new Promise((resolve6, reject) => {
-    (0, import_node_child_process11.execFile)(
+    (0, import_node_child_process12.execFile)(
       "lsof",
       ["-ti", `:${port}`],
       { timeout: 3e3 },
@@ -43368,9 +43628,9 @@ var PublishJobRegistry = class {
 };
 
 // src/app-builder/publish-job-runner.ts
-var import_node_child_process12 = require("child_process");
-var import_node_fs30 = require("fs");
-var import_node_path37 = require("path");
+var import_node_child_process13 = require("child_process");
+var import_node_fs31 = require("fs");
+var import_node_path38 = require("path");
 
 // src/app-builder/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
@@ -43397,19 +43657,19 @@ function tailStderrLines(buf, n) {
 // src/app-builder/publish-job-runner.ts
 async function startPublishJob(deps, args) {
   const { registry: registry2, projectDir } = deps;
-  const spawn12 = deps.spawnImpl ?? import_node_child_process12.spawn;
+  const spawn12 = deps.spawnImpl ?? import_node_child_process13.spawn;
   if (registry2.has(args.name)) {
     return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
   }
   const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path37.join)(projDir, ".publish.log");
+  const logPath = (0, import_node_path38.join)(projDir, ".publish.log");
   let logStream = null;
   try {
-    logStream = (0, import_node_fs30.createWriteStream)(logPath, { flags: "w" });
+    logStream = (0, import_node_fs31.createWriteStream)(logPath, { flags: "w" });
   } catch {
     logStream = null;
   }
-  const child = spawn12("bash", [args.scriptPath, projDir], {
+  const child = spawn12("bash", [args.scriptPath, projDir, args.personaRoot ?? ""], {
     cwd: projDir,
     env: process.env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -43662,10 +43922,9 @@ async function recoverInterruptedJobs(deps) {
 
 // src/handlers/app-builder.ts
 init_protocol();
-var import_node_path38 = require("path");
-var import_node_fs31 = require("fs");
+var import_node_path39 = require("path");
+var import_node_fs32 = require("fs");
 var APP_BUILDER_PERSONAS = ["persona-app-builder", "persona-dataclaw-builder"];
-var PUBLISH_SCRIPT_REL = "extension-kit/scripts/publish.sh";
 var DEV_SERVER_READY_TIMEOUT_MS = 3e4;
 async function recoverInterruptedPublishJobs(store, logger) {
   await recoverInterruptedJobs({
@@ -43745,7 +44004,7 @@ function buildAppBuilderHandlers(deps) {
   async function listAllUsersProjects() {
     if (!deps.usersRoot || !deps.getStore) return [];
     const getStore = deps.getStore;
-    const userIds = await import_node_fs31.promises.readdir(deps.usersRoot).catch(() => []);
+    const userIds = await import_node_fs32.promises.readdir(deps.usersRoot).catch(() => []);
     const perUser = await Promise.all(
       userIds.map((uid) => getStore(uid).list().catch(() => []))
     );
@@ -43821,7 +44080,9 @@ function buildAppBuilderHandlers(deps) {
     const project = await userStore.create(f.name, reservedPorts);
     try {
       const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(session.ownerPersonaId ?? "") : deps.personaRoot;
-      const scaffoldResult = await userStore.scaffold(project.name, void 0, personaRoot);
+      const templateSrcDir = (0, import_node_path39.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
+      const scaffoldScript = (0, import_node_path39.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
+      const scaffoldResult = await userStore.scaffold(project.name, templateSrcDir, scaffoldScript);
       deps.logger?.info("app-builder.scaffold.done", {
         name: project.name,
         stdout: scaffoldResult.stdout.slice(0, 200)
@@ -44040,11 +44301,13 @@ function buildAppBuilderHandlers(deps) {
       });
       await userStore.clearPublishJob(args.name);
     }
-    const scriptPath = (0, import_node_path38.join)(deps.personaRoot, PUBLISH_SCRIPT_REL);
+    const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(boundSession.ownerPersonaId ?? "") : deps.personaRoot;
+    const scriptPath = (0, import_node_path39.join)(deps.deployKitRoot, "scripts", "publish.sh");
     deps.logger?.info("app-builder.publish.start", {
       name: args.name,
       sessionId: boundSession.sessionId,
-      scriptPath
+      scriptPath,
+      personaRoot
     });
     const result = await startPublishJob(
       {
@@ -44079,7 +44342,8 @@ function buildAppBuilderHandlers(deps) {
       {
         name: args.name,
         sessionId: boundSession.sessionId,
-        scriptPath
+        scriptPath,
+        personaRoot
       }
     );
     return { response: { ...result } };
@@ -44134,7 +44398,7 @@ function buildAppBuilderHandlers(deps) {
 
 // src/extension/registry.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 async function loadAll(root) {
   let entries;
   try {
@@ -44147,13 +44411,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path39.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path40.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path39.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path40.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises8.default.readFile(manifestPath, "utf8");
@@ -44198,7 +44462,7 @@ async function loadOne(dir, dirName) {
 
 // src/extension/uninstall.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -44207,7 +44471,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path40.default.join(deps.root, deps.extId);
+  const dir = import_node_path41.default.join(deps.root, deps.extId);
   try {
     await import_promises9.default.access(dir);
   } catch {
@@ -44277,228 +44541,16 @@ function buildMethodHandlers(deps) {
       broadcastProjectUpdated: deps.broadcastProjectUpdated,
       logger: deps.logger,
       // 发布上线脚手架化 (spec 2026-06-03 §5.2):
-      // personaRoot 用于拼 publish.sh 绝对路径；broadcastSessionFrame 用于失败回灌路径
-      // （runner 调 manager.send 后逐帧 dispatch 到 transport）。
+      // personaRoot 仅作 resolvePersonaRoot 未注入时的兜底；deployKitRoot 为共享脚本根。
+      // broadcastSessionFrame 用于失败回灌路径（runner 调 manager.send 后逐帧 dispatch 到 transport）。
       personaRoot: deps.appBuilderPersonaRoot,
+      deployKitRoot: deps.deployKitRoot,
       resolvePersonaRoot: deps.resolvePersonaRoot,
       broadcastSessionFrame: deps.broadcastSessionFrame
     })
   };
 }
 
-// src/app-builder/project-store.ts
-var import_node_fs32 = require("fs");
-var import_node_child_process13 = require("child_process");
-var import_node_path41 = require("path");
-init_protocol();
-var PROJECTS_DIR = "projects";
-var META_FILE = ".clawd-project.json";
-var SCAFFOLD_SCRIPT_REL = "extension-kit/scripts/new-extension.sh";
-var DEFAULT_TEMPLATE = "nestjs-react";
-var SCAFFOLD_TIMEOUT_MS = 3e4;
-var ProjectStore = class {
-  /** @param root projects 父目录，例如 `~/.clawd/users/<userId>/`（v2 per-user） */
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  /** projects/<name>/.clawd-project.json 路径 */
-  metaPath(name) {
-    return (0, import_node_path41.join)(this.projectsRoot(), name, META_FILE);
-  }
-  /** projects/<name>/ 目录路径（cwd 用） */
-  projectDir(name) {
-    return (0, import_node_path41.join)(this.projectsRoot(), name);
-  }
-  projectsRoot() {
-    return (0, import_node_path41.join)(this.root, PROJECTS_DIR);
-  }
-  async list() {
-    let entries;
-    try {
-      entries = await import_node_fs32.promises.readdir(this.projectsRoot());
-    } catch (err) {
-      if (err.code === "ENOENT") return [];
-      throw err;
-    }
-    const out = [];
-    for (const name of entries) {
-      try {
-        const raw = await import_node_fs32.promises.readFile(this.metaPath(name), "utf8");
-        const json = JSON.parse(raw);
-        let migrated = false;
-        if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
-          json.devCommand = DEFAULT_DEV_COMMAND;
-          migrated = true;
-        }
-        const parsed = ProjectMetadataSchema.safeParse(json);
-        if (parsed.success) {
-          out.push(parsed.data);
-          if (migrated) {
-            void import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
-            });
-          }
-        }
-      } catch {
-      }
-    }
-    return out.sort((a, b2) => a.name.localeCompare(b2.name));
-  }
-  /**
-   * @param reservedPorts 其它 user 已占端口（v2 per-user：端口必须全局唯一，所有 user 的
-   *   dev server 同机跑；per-user store 各自只 list 自己，靠 handler 收集全局端口传进来，
-   *   否则不同 user 的首个项目都从 PROJECT_PORT_MIN 起 → 全撞 6173）。
-   */
-  async create(name, reservedPorts) {
-    const existing = await this.list();
-    if (existing.some((p2) => p2.name === name)) {
-      throw new Error(`project "${name}" already exists / \u5DF2\u5B58\u5728`);
-    }
-    const usedPorts = new Set(existing.map((p2) => p2.port));
-    if (reservedPorts) for (const p2 of reservedPorts) usedPorts.add(p2);
-    let port = -1;
-    for (let p2 = PROJECT_PORT_MIN; p2 <= PROJECT_PORT_MAX; p2++) {
-      if (!usedPorts.has(p2)) {
-        port = p2;
-        break;
-      }
-    }
-    if (port < 0) {
-      throw new Error(
-        `port pool exhausted / \u7AEF\u53E3\u6C60\u5DF2\u6EE1\uFF08${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}\uFF09\uFF0C\u5148\u5220\u4E00\u4E2A project \u91CA\u653E\u7AEF\u53E3`
-      );
-    }
-    const meta = {
-      name,
-      port,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      devCommand: DEFAULT_DEV_COMMAND
-    };
-    const validated = ProjectMetadataSchema.safeParse(meta);
-    if (!validated.success) {
-      throw new Error(`invalid name "${name}": ${validated.error.message}`);
-    }
-    const dir = this.projectDir(name);
-    await import_node_fs32.promises.mkdir(dir, { recursive: true });
-    await import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
-    return meta;
-  }
-  /**
-   * 同步内联 scaffold：spawn `extension-kit/scripts/new-extension.sh <name>` 等 exit。
-   * 必须在 `create()` 之后调（脚本期望 projects/<name>/.clawd-project.json 已就位 = picker 模式）。
-   * 失败抛错；上层（handler）应当 catch 后回滚（删 dir + 不 mutate session）。
-   *
-   * spec 2026-06-02 §5.6.3：scaffold 对 assistant 不可见，避免 assistant 被诱导去"读 example
-   * 代码再参考"。assistant 进 project 时目录已是完整模板，直接 pnpm install 即可。
-   */
-  async scaffold(name, template = DEFAULT_TEMPLATE, personaRoot = this.root) {
-    const scriptPath = (0, import_node_path41.join)(personaRoot, SCAFFOLD_SCRIPT_REL);
-    const destDir = this.projectDir(name);
-    return await new Promise((resolve6, reject) => {
-      const child = (0, import_node_child_process13.spawn)("bash", [scriptPath, name, template, destDir], {
-        cwd: personaRoot,
-        env: { ...process.env, PATH: process.env.PATH ?? "" },
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      let stdout = "";
-      let stderr = "";
-      child.stdout.on("data", (d) => {
-        stdout += d.toString("utf8");
-      });
-      child.stderr.on("data", (d) => {
-        stderr += d.toString("utf8");
-      });
-      const timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        reject(new Error(`scaffold timeout (>${SCAFFOLD_TIMEOUT_MS}ms): ${scriptPath} ${name} ${template}`));
-      }, SCAFFOLD_TIMEOUT_MS);
-      child.on("error", (err) => {
-        clearTimeout(timer);
-        reject(new Error(`scaffold spawn failed: ${err.message}`));
-      });
-      child.on("exit", (code, signal) => {
-        clearTimeout(timer);
-        if (code === 0) resolve6({ stdout, stderr });
-        else reject(new Error(`scaffold exit ${code ?? signal}: ${stderr.slice(0, 500)}`));
-      });
-    });
-  }
-  async delete(name) {
-    const dir = this.projectDir(name);
-    await import_node_fs32.promises.rm(dir, { recursive: true, force: true });
-  }
-  async updatePort(name, newPort) {
-    if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
-      throw new Error(
-        `port range invalid: must be ${PROJECT_PORT_MIN}-${PROJECT_PORT_MAX}, got ${newPort}`
-      );
-    }
-    const list = await this.list();
-    const target = list.find((p2) => p2.name === name);
-    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-    const conflict = list.find((p2) => p2.name !== name && p2.port === newPort);
-    if (conflict) {
-      throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
-    }
-    const updated = { ...target, port: newPort };
-    await import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
-    return updated;
-  }
-  /**
-   * 单栏 refactor (spec 2026-06-02 §5.6.1)：发布上线后写公网 URL 到 .clawd-project.json.prodUrl。
-   * UI 通过 listProjects 读到 prodUrl 后切预览栏到线上 URL，取代旧 prod marker 机制。
-   * 重复调用幂等（覆盖旧 URL）。url 由 ProjectMetadataSchema 校验 url() 格式。
-   */
-  async setProdUrl(name, url) {
-    const list = await this.list();
-    const target = list.find((p2) => p2.name === name);
-    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-    const updated = { ...target, prodUrl: url };
-    const validated = ProjectMetadataSchema.safeParse(updated);
-    if (!validated.success) {
-      throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
-    }
-    await import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-    return validated.data;
-  }
-  /**
-   * 发布上线脚手架化 (spec 2026-06-03-app-builder-publish-scaffold-design §5.1.4)：
-   * 写 publishJob 字段到 .clawd-project.json。仅承载 in-flight 状态 ——
-   *   - daemon 收到第一个 ::stage::build marker 时写入
-   *   - 每次 stage 切换更新 stage 字段（jobId / startedAt 不变）
-   *   - 成功 / 失败 / dismiss 时调 clearPublishJob 清掉
-   *   - 只有 daemon 崩才会留残骸
-   * 写入时保留所有其他字段（prodUrl 等不受影响）。
-   */
-  async setPublishJob(name, job) {
-    const list = await this.list();
-    const target = list.find((p2) => p2.name === name);
-    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-    const updated = { ...target, publishJob: job };
-    const validated = ProjectMetadataSchema.safeParse(updated);
-    if (!validated.success) {
-      throw new Error(`invalid publishJob: ${validated.error.message}`);
-    }
-    await import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-    return validated.data;
-  }
-  /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
-  async clearPublishJob(name) {
-    const list = await this.list();
-    const target = list.find((p2) => p2.name === name);
-    if (!target) throw new Error(`project "${name}" not found / \u4E0D\u5B58\u5728`);
-    if (!target.publishJob) return target;
-    const { publishJob: _drop, ...rest } = target;
-    void _drop;
-    const validated = ProjectMetadataSchema.safeParse(rest);
-    if (!validated.success) {
-      throw new Error(`failed to clear publishJob: ${validated.error.message}`);
-    }
-    await import_node_fs32.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
-    return validated.data;
-  }
-};
-
 // src/app-builder/dev-server-supervisor.ts
 var import_node_child_process14 = require("child_process");
 var import_node_events2 = require("events");
@@ -45430,6 +45482,13 @@ async function startDaemon(config) {
   } else {
     logger.warn("persona.seed.skip", { reason: "defaults-root-not-found" });
   }
+  const deployKitBundleRoot = findDeployKitRoot();
+  if (deployKitBundleRoot) {
+    seedDeployKit({ deployKitBundleRoot, dataDir: config.dataDir, logger });
+    refreshDeployKit({ deployKitBundleRoot, dataDir: config.dataDir, logger });
+  } else {
+    logger.warn("deploy-kit.bundle-missing", {});
+  }
   migrateAgentsMirror({ store: personaStore, logger });
   migrateCodexSandbox({ store: personaStore, logger });
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
@@ -45755,7 +45814,9 @@ async function startDaemon(config) {
     // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
     // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
     appBuilderPersonaRoot: import_node_path45.default.join(config.dataDir, "personas", "persona-app-builder"),
-    // scaffold 按当前 session 的 persona 解析其安装根，让新 persona 复用流水线用自己的模板。
+    // 共享 deploy-kit 根：scaffold/publish 脚本骨架 + 阿里云凭证单一真源。
+    deployKitRoot: import_node_path45.default.join(config.dataDir, "deploy-kit"),
+    // scaffold/publish 按当前 session 的 persona 解析其安装根，让每个 persona 用自己的模板/注入配置。
     resolvePersonaRoot: (personaId) => import_node_path45.default.join(config.dataDir, "personas", personaId),
     // 发布上线脚手架化 (spec 2026-06-03 §5.2.2):
     // 复用 SessionManagerDeps.broadcastFrame 同款 dispatch 逻辑 —— runner 调 manager.send

package/dist/deploy-kit/.secrets/aliyun.env.example

@@ -0,0 +1,4 @@
+# 阿里云访问凭证（所有 FC persona 共用一份）。复制为同目录 aliyun.env 并填实际值；
+# aliyun.env 不进 git（见 .gitignore），daemon 启动不覆盖。
+ALIBABA_CLOUD_ACCESS_KEY_ID=replace-me
+ALIBABA_CLOUD_ACCESS_KEY_SECRET=replace-me