@clawos-dev/clawd 0.2.149-beta.315.fe63177 → 0.2.150-beta.316.82021dd

package/dist/cli.cjs

@@ -35558,41 +35558,34 @@ var fs9 = __toESM(require("fs"), 1);
 var path11 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
-var DEFAULT_BYPASS_PROFILE = {
-  permissions: { defaultMode: "bypassPermissions" }
-};
 var DEFAULT_PERSONAS = [
   {
     personaId: "persona-researcher",
     label: "\u8C03\u7814\u5458",
     model: "opus",
     iconKey: "research",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     personaId: "persona-knowledge-base",
     label: "\u77E5\u8BC6\u5E93\u7BA1\u7406\u5458",
     model: "opus",
     iconKey: "reading",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     personaId: "persona-clawd-helper",
     label: "clawd\u4F7F\u7528\u52A9\u624B",
     model: "opus",
     iconKey: "assist",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     personaId: "persona-feishu-assistant",
     label: "\u98DE\u4E66\u52A9\u7406",
     model: "opus",
     iconKey: "assist",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     // app-builder：全栈应用搭建师，绑 extension-kit 模板 + multi-project picker
@@ -35676,16 +35669,14 @@ var DEFAULT_PERSONAS = [
     label: "\u5F00\u53D1\u8005",
     model: "opus",
     iconKey: "code",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     personaId: "persona-bug-fixer",
     label: "Bug \u4FEE\u590D\u5E08",
     model: "opus",
     iconKey: "debug",
-    public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    public: false
   },
   {
     // HTML PPT 制作师：把想法/文字/旧 PPT 转成单文件 HTML 演示稿
@@ -35695,7 +35686,35 @@ var DEFAULT_PERSONAS = [
     model: "opus",
     iconKey: "doc",
     public: false,
-    sandboxProfile: DEFAULT_BYPASS_PROFILE
+    // 与 app-builder 对齐"调用阿里云的工作方式"（owner 2026-06-17 要求）：开发型 profile —— 放开文件/web
+    // 工具 + node/pnpm 工具链精确路径 + 出站 TLD 通配白名单。html-slides 需要联网（git clone frontend-slides
+    // skill、调阿里云 CLI/SDK）。
+    // 阿里云凭证：**复用共享 deploy-kit 单源**（$HOME/.clawd/deploy-kit/.secrets/aliyun.env，全 FC persona 共用、
+    // seedDeployKit 每次安装都铺），不在 persona 目录另存一份。app-builder 的 FC 部署走 daemon 侧脚本（沙箱外）
+    // 故其 profile 无需 carve 这个路径；html-slides 没有 daemon 侧流程、要在 cc 沙箱内直接 `set -a; . $HOME/.clawd/
+    // deploy-kit/.secrets/aliyun.env; set +a` 后调 aliyun CLI（env 凭证绕过沙箱外的 ~/.aliyun/），所以这里**额外**把
+    // 这个凭证文件加进 allowRead（denyRead '~/' 之上的精确凿洞，单文件、最小暴露，同 ~/.npmrc 先例）。
+    sandboxProfile: {
+      permissions: {
+        defaultMode: "bypassPermissions",
+        allow: ["Read", "Edit", "Write", "Glob", "Grep", "WebFetch", "WebSearch"]
+      },
+      sandbox: {
+        filesystem: {
+          allowRead: ["~/.npmrc", "~/Library/Preferences/pnpm", "~/.nvm", "~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store", "~/.clawd/deploy-kit/.secrets/aliyun.env"],
+          allowWrite: ["~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store"]
+        },
+        network: {
+          allowedDomains: ["*.com", "*.org", "*.io", "*.net", "*.dev", "*.app", "*.cn", "*.co", "*.chat", "*.ai"],
+          allowLocalBinding: true
+        }
+      }
+    },
+    codexSandbox: {
+      writableRoots: ["~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store"],
+      denyRead: [".secrets/**"],
+      network: true
+    }
   }
 ];
 function bundleSiblingFromArgv(argv1, sibling) {
@@ -42956,7 +42975,6 @@ function buildFeishuAuthHandlers(deps) {
   const logout = async () => {
     deps.ownerIdentityStore.clear();
     deps.serverKeyStore.clear();
-    deps.onLogout();
     return {
       response: { type: "auth:logout:ok" }
     };
@@ -46517,25 +46535,7 @@ async function startDaemon(config) {
     bundleCache,
     // 飞书统一身份 Phase 1：登录 RPC handlers（auth:login:start / getIdentity / logout）
     // deviceId（决策 #15）：getIdentity 返回给 UI 拼"我的设备标识"
-    feishuAuth: {
-      loginFlow,
-      ownerIdentityStore,
-      deviceId: authFile.deviceId,
-      serverKeyStore,
-      // 退出登录：登录（feishuLogin.handleLoginCallback）在进程内设置的身份状态的对称逆操作。
-      // 核心是 feishuActive 翻 false——否则 dispatcher 飞书 gate（下方 feishuActive 判定，每帧
-      // 现读 let binding）退登后仍放行 gated 方法。一并把归属人重置回未登录初值 + 重建 handlers
-      // （deps 持 ownerId/displayName 值快照，whoami/出站自报身份用），与登录置位三件套对称。
-      // 不踢连：踢连是登录热切换换身份 ctx 的需要；退登只是降级，gate 每帧现读即时生效，
-      // 既有连接继续用，避免改动连接生命周期 / wire 契约。
-      onLogout: () => {
-        feishuActive = false;
-        ownerId = "";
-        ownerProvider = "";
-        ownerDisplayName = loadOwnerDisplayName(config.dataDir);
-        handlers = makeHandlers();
-      }
-    },
+    feishuAuth: { loginFlow, ownerIdentityStore, deviceId: authFile.deviceId, serverKeyStore },
     // 设备目录 + 连接（决策 #15：daemon 代理中心 server）。
     // exchange/listDevices 包掉 owner ttcJwt（每次现读 store——热切换后立即用新身份）；
     // dispatcher 的 FEISHU_GATED_METHODS gate 已保证未登录时这些 RPC 到不了 handler，

package/dist/persona-defaults/persona-html-slides/.mcp.json

@@ -0,0 +1,15 @@
+{
+  "_comment": "preinstall ship 进 daemon defaults，daemon 启动时 refreshDaemonManagedDirs 把这文件同步到 ~/.clawd*/personas/persona-html-slides/.mcp.json。cc CLI 启动时（cwd=projects/<name>/）会向上找 persona dir 的 .mcp.json 自动加载。用 @aliyun-rds/supabase-mcp-server（阿里云 RDS 包装，跟 clawos / lovagent / extension-kit / app-builder 一致），底下连阿里云自建 supabase 实例 120.26.157.138。AK 是共享 demo 凭证（跟 .secrets/aliyun.env 同性质，PR #808 设计前提），跟 lovagent .mcp.json 用同一把（RDS 权限）。",
+  "mcpServers": {
+    "supabase": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "@aliyun-rds/supabase-mcp-server",
+        "--aliyun-ak", "LTAI5tSebp9pyBLk2nxF5wDg",
+        "--aliyun-sk", "DnkOBhZ9pLympYlwcLuQbsaGRIitwG",
+        "--aliyun-region", "cn-hangzhou"
+      ]
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.149-beta.315.fe63177",
+  "version": "0.2.150-beta.316.82021dd",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",