@clawos-dev/clawd 0.2.177-beta.357.f436213 → 0.2.178-beta.358.7f6c694

package/dist/cli.cjs

@@ -253,12 +253,7 @@ var init_events = __esm({
       "skill-hint",
       "meta-text",
       "attachment-skills",
-      "attachment-deferred-tools",
-      // clawd shift v1：scheduler fire 时 daemon 给新 cc 的首条 user message 用
-      // `[clawd-shift-fire — ...]` plain text marker 起头任务包（不是 XML 标签，避开
-      // reducer 双源 dedup 失效雷，见 daemon shift/wrap.ts 注释）；classifyUserMessage
-      // 识别后路由到 UserMetaLine 折叠渲染，不显示成 user 气泡。
-      "clawd-shift-fire"
+      "attachment-deferred-tools"
     ];
     SKILL_SOURCE_VALUES = ["builtin", "global", "project", "plugin"];
     AGENT_SOURCE_VALUES = [
@@ -4789,16 +4784,6 @@ var init_schemas = __esm({
        * 反查路径走错；按 #750 一族防线处理，跟 ownerPersonaId 同地点 strip）。
        */
       dispatchedFromSessionId: external_exports.string().min(1).optional(),
-      /**
-       * Shift fire 派生的 session 记录调 addShift 的 source cc session id（稳定 key）；
-       * sidebar 据此把 fire 出的 session 折叠在 source session 下，跟 dispatchedFromSessionId
-       * 平行但渲染不同 icon（AlarmClock 区别于 dispatch 的 CornerDownRight），让 owner 一眼
-       * 分清"派生于人为委派"还是"派生于定时唤起"。非 shift fire session 缺省。
-       * 跟 dispatchedFromSessionId / forkedFromSessionId 三者互斥（同一 session 不会兼任）。
-       * mirror SessionFile 同 dispatchedFromSessionId 处理（shift fire 本地概念，理论上不会
-       * mirror，留 strip 防御）。
-       */
-      shiftFiredFromSessionId: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -11245,7 +11230,6 @@ function classifyUserMessage(input) {
   if (SYSTEM_REMINDER_RE.test(text) || OPENSPEC_BLOCK_RE.test(text)) {
     return { meta: "system-reminder" };
   }
-  if (CLAWD_SHIFT_FIRE_RE.test(text)) return { meta: "clawd-shift-fire" };
   if (SKILL_HINT_RE.test(text)) return { meta: "skill-hint" };
   const flags = raw;
   if (flags.isMeta === true || flags.isSynthetic === true) return { meta: "meta-text" };
@@ -11460,7 +11444,7 @@ function readCurrentContent(filePath) {
     return null;
   }
 }
-var import_node_fs10, import_node_os5, import_node_path9, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, CLAWD_SHIFT_FIRE_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
+var import_node_fs10, import_node_os5, import_node_path9, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
 var init_claude_history = __esm({
   "src/tools/claude-history.ts"() {
     "use strict";
@@ -11477,7 +11461,6 @@ var init_claude_history = __esm({
     SYSTEM_REMINDER_RE = /^\s*<system-reminder\b/i;
     OPENSPEC_BLOCK_RE = /^\s*<!--\s*OPENSPEC\b/i;
     SKILL_HINT_RE = /^\s*Base directory for this skill:\s/;
-    CLAWD_SHIFT_FIRE_RE = /^\s*\[clawd-shift-fire\b/i;
     ATTACHMENT_SILENT_SUBTYPES = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -41278,22 +41261,6 @@ function composeGuestSandbox(base, userWorkDir, spawnCwd) {
   return s;
 }
 
-// src/shift/wrap.ts
-function wrapShiftFirePrompt(args) {
-  const personaLabel = sanitizeMarkerValue(args.targetPersona);
-  return [
-    `[clawd-shift-fire target-persona=${personaLabel} \u2014 scheduled shift fire, not a live user message from the owner]`,
-    "",
-    "Respond as an assistant turn (start your output directly).",
-    "",
-    "Instruction:",
-    args.prompt
-  ].join("\n");
-}
-function sanitizeMarkerValue(v2) {
-  return v2.replace(/[\]\r\n\t]/g, "_");
-}
-
 // src/session/reducer.ts
 init_runtime();
 
@@ -41351,6 +41318,29 @@ function buildConnectionPrompt(args) {
   return result;
 }
 
+// src/persona/sharing-prompt.ts
+var ATTACHMENT_SHARING_HINT = `## \u628A\u4EA7\u51FA\u6587\u4EF6\u5206\u4EAB\u7ED9\u5BF9\u65B9\uFF08attachment\uFF09
+
+\u5F53\u4F60\u4EA7\u51FA\u4E86\u6587\u4EF6\u3001\u9700\u8981\u8BA9\u5BF9\u65B9\u62FF\u5230\u65F6\uFF08\u5C24\u5176 Bash \u89E3\u538B/\u751F\u6210\u7684\u6587\u4EF6\uFF0C\u6216\u8DE8\u8BBE\u5907\u88AB\u59D4\u6D3E\u65F6\u5BF9\u65B9\u5728\u53E6\u4E00\u53F0\u673A\u5668\u3001\u770B\u4E0D\u5230\u4F60\u7684\u672C\u5730\u8DEF\u5F84\uFF09\uFF0C\u7528 daemon \u7684 HTTP RPC \u628A\u6587\u4EF6\u8F6C\u6210\u4E00\u4E2A\u5E26\u7B7E\u540D\u7684\u4E0B\u8F7D URL\uFF1A
+
+1. \u5165\u7FA4\uFF08\u767B\u8BB0\u5230\u672C session \u7684\u5171\u4EAB\u6E05\u5355\uFF09\uFF1A
+   \`\`\`bash
+   curl -sS -X POST "$CLAWD_DAEMON_URL/api/rpc/attachment.groupAdd" \\
+     -H "X-Clawd-Session-Id: $CLAWD_SESSION_ID" -H 'Content-Type: application/json' \\
+     -d '{"relPath":"<\u6587\u4EF6\u7684\u7EDD\u5BF9\u8DEF\u5F84>"}'
+   \`\`\`
+2. \u7B7E\u540D\u62FF URL\uFF1A
+   \`\`\`bash
+   curl -sS -X POST "$CLAWD_DAEMON_URL/api/rpc/attachment.signUrl" \\
+     -H "X-Clawd-Session-Id: $CLAWD_SESSION_ID" -H 'Content-Type: application/json' \\
+     -d '{"relPath":"<\u540C\u4E00\u4E2A\u7EDD\u5BF9\u8DEF\u5F84>"}'
+   \`\`\`
+   \u8FD4\u56DE\u7684 \`url\` \u5C31\u662F\u5BF9\u65B9\u53EF\u76F4\u63A5\u6253\u5F00/\u4E0B\u8F7D\u7684\u94FE\u63A5\u3002
+
+- \`relPath\` \u5FC5\u987B\u4F20**\u7EDD\u5BF9\u8DEF\u5F84**\uFF08\u4F60\u4EA7\u51FA\u6587\u4EF6\u7684\u771F\u5B9E\u8DEF\u5F84\uFF09\uFF0C\u4E0D\u8981\u4F20\u76F8\u5BF9\u8DEF\u5F84\u3002
+- \u53EA\u80FD\u5206\u4EAB\u4F60\u81EA\u5DF1\u5DE5\u4F5C\u76EE\u5F55\u5185\u7684\u6587\u4EF6\uFF0C\u8D8A\u754C\u4F1A\u88AB\u62D2\u3002
+- \u88AB dispatch \u63A5\u5230\u4EFB\u52A1\u3001\u8981\u56DE\u4F20\u4EA7\u7269\u65F6\uFF1A\u628A\u7B7E\u540D URL \u5199\u8FDB \`personaDispatchComplete\` \u7684 \`text\` \u91CC\uFF08\`filePaths\` \u53EA\u662F\u4F60\u672C\u673A\u7684\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u8DE8\u8BBE\u5907\u5BF9\u65B9\u6253\u4E0D\u5F00\uFF0CURL \u624D\u80FD\u6253\u5F00\uFF09\u3002`;
+
 // src/dispatch/system-prompt.ts
 var DISPATCH_SYSTEM_PROMPT_HINT = `## \u59D4\u6D3E\u7ED9\u53E6\u4E00\u4E2A persona\uFF08dispatch\uFF09
 
@@ -41516,6 +41506,9 @@ function buildSpawnContext(state, deps) {
   if (dispatchMcpConfigPath2) {
     ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + DISPATCH_SYSTEM_PROMPT_HINT;
   }
+  if (daemonUrl) {
+    ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + ATTACHMENT_SHARING_HINT;
+  }
   if (meta?.extraSettings) {
     ctx.extraSettings = meta.extraSettings;
   }
@@ -43275,14 +43268,10 @@ var SessionManager = class {
   // 强制走 deps.store（即 default scope），不走 scopeForFile：mirror 物理落 default 即可。
   // 远端 creator / origin 字段原值保留（不被本机 ctx 派生覆写）。
   //
-  // strip 远端 personaId / dispatchedFromSessionId / shiftFiredFromSessionId：mirror
-  // SessionFile 上这些字段都指向朋友 daemon 上的本地 id，本机不持有对应 persona /
-  // 源 session。留着会让按这些字段反查的本机消费者（MyPersonasSection 按 ownerPersonaId
-  // 反查 persona、sidebar 按 dispatchedFromSessionId / shiftFiredFromSessionId 折叠
-  // sub-session）走错分支。写入前清掉。#750 一族防线。
-  //
-  // shift fire 是本地 daemon scheduler 行为，理论上不产生 mirror SessionFile，但留 strip
-  // 防御（同 dispatchedFromSessionId 处理姿势对齐）。
+  // strip 远端 personaId / dispatchedFromSessionId：mirror SessionFile 上这两个字段都指向
+  // 朋友 daemon 上的本地 id，本机不持有对应 persona / 源 session。留着会让按这些字段反查的
+  // 本机消费者（MyPersonasSection 按 ownerPersonaId 反查 persona、sidebar 按
+  // dispatchedFromSessionId 折叠 sub-session）走错分支。写入前清掉。#750 一族防线。
   //
   // 与 manager.create / manager.update 区别：
   //   - 不走 newRunner / attachObserver / cwd 校验（mirror 是纯 metadata 层）
@@ -43291,7 +43280,6 @@ var SessionManager = class {
     const {
       ownerPersonaId: _strippedPid,
       dispatchedFromSessionId: _strippedDsp,
-      shiftFiredFromSessionId: _strippedSft,
       ...rest
     } = file;
     return this.deps.store.write(rest);
@@ -43994,7 +43982,6 @@ var SessionManager = class {
       cwd,
       tool: "claude",
       ownerPersonaId: args.targetPersona,
-      ...args.sourceSessionId ? { shiftFiredFromSessionId: args.sourceSessionId } : {},
       createdAt: now,
       updatedAt: now
     };
@@ -44030,16 +44017,7 @@ var SessionManager = class {
     });
     const runner = this.ensureRunnerForScope(file, scope);
     this.deps.logger?.info("shift.createShiftSession.runner-ready", { sessionId });
-    runner.input({
-      kind: "command",
-      command: {
-        kind: "send",
-        text: wrapShiftFirePrompt({
-          prompt: args.prompt,
-          targetPersona: args.targetPersona
-        })
-      }
-    });
+    runner.input({ kind: "command", command: { kind: "send", text: args.prompt } });
     const kill = () => {
       const r = this.runners.get(sessionId);
       if (!r) return;
@@ -47561,8 +47539,7 @@ function createShiftScheduler(deps) {
             shiftId: shift.id,
             targetPersona: shift.targetPersona,
             prompt: shift.prompt,
-            timeoutMs,
-            ...shift.createdBySessionId ? { sourceSessionId: shift.createdBySessionId } : {}
+            timeoutMs
           });
           sessionId = spawned.sessionId;
           const startRun = {
@@ -47616,12 +47593,8 @@ function createShiftScheduler(deps) {
 
 // src/shift/spawn.ts
 function createShiftSpawnFn(deps) {
-  return async ({ targetPersona, prompt, timeoutMs, sourceSessionId }) => {
-    const created = deps.sessionManager.createShiftSession({
-      targetPersona,
-      prompt,
-      ...sourceSessionId ? { sourceSessionId } : {}
-    });
+  return async ({ targetPersona, prompt, timeoutMs }) => {
+    const created = deps.sessionManager.createShiftSession({ targetPersona, prompt });
     let resolveOuter = () => {
     };
     const ended = new Promise((r) => {
@@ -47675,14 +47648,12 @@ function validateSchedule(schedule) {
 function buildShiftInternalHandlers(deps) {
   const add = async (frame) => {
     const persona = readPersonaId(frame);
-    const callerSessionId = typeof frame.sessionId === "string" ? frame.sessionId : void 0;
     const { type: _t, requestId: _r, personaId: _p, sessionId: _s, ...rest } = frame;
     const args = rest;
     validateSchedule(args.schedule);
     const shift = deps.store.add({
       ownerId: deps.ownerIdProvider(),
       createdByPersona: persona,
-      ...callerSessionId ? { createdBySessionId: callerSessionId } : {},
       name: args.name,
       enabled: true,
       schedule: args.schedule,
@@ -49250,6 +49221,67 @@ function removeSubscription(client, sessionId) {
   else client.subscribedSessions.set(sessionId, next);
 }
 
+// src/transport/rpc-adapter.ts
+var EXPOSED_RPC_METHODS = [
+  "appBuilder.createProject",
+  "appBuilder.listProjects",
+  "appBuilder.updateProjectPort",
+  "appBuilder.setProdUrl",
+  // 单栏 refactor §5.6.2 stage fix：scaffold + install 完成调 startDevServer 起 dev server；
+  // 中间用 reportStage 上报阶段（scaffolding / installing / failed），UI 据 stage 推帧切 PreviewPane。
+  "appBuilder.startDevServer",
+  "appBuilder.reportStage",
+  // 单栏 §5.6.5 fix: UI 切 session 时调（assistant 不需要主动调，但暴露白名单避免误猜成 forbidden）
+  "appBuilder.setActiveSession",
+  // dataclaw-builder：persona 建页时取建页人身份（含 union_id）写进生成 app 的配置。
+  // 路由到 handlers['auth:getIdentity']，只返 identity、绝不带 ttcToken（见 handlers/feishu-auth.ts）。
+  "auth.getIdentity",
+  // Persona dispatch (Task 4): A 端 dispatch MCP server 调 run（hold-and-wait 一次）；
+  // B 端 dispatch MCP server 调 complete（带 outcome 触发 run 端 resolve）。详见
+  // protocol/src/dispatch.ts。
+  "personaDispatch.run",
+  "personaDispatch.complete",
+  // clawd-shift v1 (spec 2026-06-24-clawd-shift)：cc 子进程内的 shift MCP server 调
+  // 这 5 个 method 管理 owner 的 shift（fire-and-forget 排班）。鉴权靠 body.personaId
+  // （mcp-server 从 process.env.CLAWD_PERSONA_ID 读，源 = SessionFile.ownerPersonaId）。
+  // handler 内 cancel/update/history 校验 createdByPersona === personaId 防越权。
+  "shift-internal.add",
+  "shift-internal.list",
+  "shift-internal.cancel",
+  "shift-internal.update",
+  "shift-internal.history",
+  // file-sharing：persona guest agent 把自己工作目录内的产物入群+签名分享。
+  // 路径越界由 handlers/attachment.ts guardAttachmentPath（scope-based）拦截。
+  "attachment.groupAdd",
+  "attachment.signUrl"
+];
+async function handleRpcRequest(input) {
+  const { method, body, sessionId, dispatcher } = input;
+  if (!sessionId) {
+    return { status: 400, body: { ok: false, error: "MISSING_SESSION_ID", message: "X-Clawd-Session-Id header required" } };
+  }
+  if (!EXPOSED_RPC_METHODS.includes(method)) {
+    return { status: 403, body: { ok: false, error: "METHOD_NOT_EXPOSED", message: `method "${method}" not exposed via HTTP RPC` } };
+  }
+  const internalMethod = method.replace(".", ":");
+  const augmentedBody = {
+    ...typeof body === "object" && body != null ? body : {},
+    sessionId
+  };
+  try {
+    const result = await dispatcher.dispatch(internalMethod, augmentedBody, { sessionId });
+    return { status: 200, body: { ok: true, result } };
+  } catch (err) {
+    const e = err;
+    const code = e?.code ?? "INTERNAL";
+    const message = e?.message ?? String(err);
+    return { status: 400, body: { ok: false, error: code, message } };
+  }
+}
+function resolveExposedHandler(handlers, internalMethod) {
+  return handlers[internalMethod] ?? handlers[internalMethod.replace(":", ".")];
+}
+
 // src/transport/auth.ts
 init_protocol();
 var AuthGate = class {
@@ -50492,60 +50524,6 @@ async function importZip(buf, root) {
   }
 }
 
-// src/transport/rpc-adapter.ts
-var EXPOSED_RPC_METHODS = [
-  "appBuilder.createProject",
-  "appBuilder.listProjects",
-  "appBuilder.updateProjectPort",
-  "appBuilder.setProdUrl",
-  // 单栏 refactor §5.6.2 stage fix：scaffold + install 完成调 startDevServer 起 dev server；
-  // 中间用 reportStage 上报阶段（scaffolding / installing / failed），UI 据 stage 推帧切 PreviewPane。
-  "appBuilder.startDevServer",
-  "appBuilder.reportStage",
-  // 单栏 §5.6.5 fix: UI 切 session 时调（assistant 不需要主动调，但暴露白名单避免误猜成 forbidden）
-  "appBuilder.setActiveSession",
-  // dataclaw-builder：persona 建页时取建页人身份（含 union_id）写进生成 app 的配置。
-  // 路由到 handlers['auth:getIdentity']，只返 identity、绝不带 ttcToken（见 handlers/feishu-auth.ts）。
-  "auth.getIdentity",
-  // Persona dispatch (Task 4): A 端 dispatch MCP server 调 run（hold-and-wait 一次）；
-  // B 端 dispatch MCP server 调 complete（带 outcome 触发 run 端 resolve）。详见
-  // protocol/src/dispatch.ts。
-  "personaDispatch.run",
-  "personaDispatch.complete",
-  // clawd-shift v1 (spec 2026-06-24-clawd-shift)：cc 子进程内的 shift MCP server 调
-  // 这 5 个 method 管理 owner 的 shift（fire-and-forget 排班）。鉴权靠 body.personaId
-  // （mcp-server 从 process.env.CLAWD_PERSONA_ID 读，源 = SessionFile.ownerPersonaId）。
-  // handler 内 cancel/update/history 校验 createdByPersona === personaId 防越权。
-  "shift-internal.add",
-  "shift-internal.list",
-  "shift-internal.cancel",
-  "shift-internal.update",
-  "shift-internal.history"
-];
-async function handleRpcRequest(input) {
-  const { method, body, sessionId, dispatcher } = input;
-  if (!sessionId) {
-    return { status: 400, body: { ok: false, error: "MISSING_SESSION_ID", message: "X-Clawd-Session-Id header required" } };
-  }
-  if (!EXPOSED_RPC_METHODS.includes(method)) {
-    return { status: 403, body: { ok: false, error: "METHOD_NOT_EXPOSED", message: `method "${method}" not exposed via HTTP RPC` } };
-  }
-  const internalMethod = method.replace(".", ":");
-  const augmentedBody = {
-    ...typeof body === "object" && body != null ? body : {},
-    sessionId
-  };
-  try {
-    const result = await dispatcher.dispatch(internalMethod, augmentedBody, { sessionId });
-    return { status: 200, body: { ok: true, result } };
-  } catch (err) {
-    const e = err;
-    const code = e?.code ?? "INTERNAL";
-    const message = e?.message ?? String(err);
-    return { status: 400, body: { ok: false, error: code, message } };
-  }
-}
-
 // src/transport/http-router.ts
 var RPC_ROUTE_PREFIX = "/api/rpc/";
 var RPC_BODY_MAX_BYTES = 1 * 1024 * 1024;
@@ -52936,6 +52914,16 @@ function personaIdFromPath(absPath, personaRoot) {
   const id = rel.split(path44.sep)[0];
   return id || null;
 }
+function isPathWithin(dir, absPath) {
+  const d = path44.resolve(dir);
+  const t = path44.resolve(absPath);
+  const sep3 = d.endsWith(path44.sep) ? "" : path44.sep;
+  return t === d || t.startsWith(d + sep3);
+}
+function isPathInGuestBoundary(personaRoot, personaId, userWorkDir, absPath) {
+  if (userWorkDir && isPathWithin(userWorkDir, absPath)) return true;
+  return personaIdFromPath(path44.resolve(absPath), personaRoot) === personaId;
+}
 
 // src/handlers/history.ts
 init_protocol();
@@ -53747,6 +53735,31 @@ function assertGuestAttachmentPath(ctx, absPath, personaRoot, method, usersRoot)
   }
 }
 function buildAttachmentHandlers(deps) {
+  function guardAttachmentPath(ctx, sessionId, candidateAbs, method, nonGuestPolicy) {
+    if (ctx?.principal.kind === "owner") return;
+    const scope = deps.getSessionScope?.(sessionId);
+    if (!scope) return;
+    if (scope.kind === "persona" && scope.mode === "guest") {
+      if (!deps.personaRoot) return;
+      const userWorkDir = deps.usersRoot ? deriveUserWorkDir(scope.capId, deps.usersRoot) : void 0;
+      if (!isPathInGuestBoundary(deps.personaRoot, scope.personaId, userWorkDir, candidateAbs)) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `${method}: path outside guest work dir: ${candidateAbs}`
+        );
+      }
+      return;
+    }
+    if (nonGuestPolicy === "group-acl") return;
+    const cwd = deps.sessionStore?.read(sessionId)?.cwd;
+    if (!cwd) return;
+    if (!isPathWithin(cwd, candidateAbs)) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `${method}: path outside session work dir: ${candidateAbs}`
+      );
+    }
+  }
   const signUrl = async (frame, _client, ctx) => {
     const parsed = AttachmentSignUrlArgs.safeParse(frame);
     if (!parsed.success) {
@@ -53789,7 +53802,7 @@ function buildAttachmentHandlers(deps) {
     }
     const cwdAbs = import_node_path36.default.resolve(sessionFile.cwd);
     const candidateAbs = import_node_path36.default.isAbsolute(args.relPath) ? import_node_path36.default.resolve(args.relPath) : import_node_path36.default.resolve(cwdAbs, args.relPath);
-    assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl", deps.usersRoot);
+    guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.signUrl", "group-acl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
       const storedAbs = import_node_path36.default.isAbsolute(e.relPath) ? import_node_path36.default.resolve(e.relPath) : import_node_path36.default.resolve(cwdAbs, e.relPath);
@@ -53828,15 +53841,18 @@ function buildAttachmentHandlers(deps) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
     }
     const args = parsed.data;
-    guardGuestBySessionCwd(ctx, args.sessionId, "attachment.groupAdd");
     const scope = deps.getSessionScope(args.sessionId);
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
     }
+    const cwdAbs = import_node_path36.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
+    const candidateAbs = import_node_path36.default.isAbsolute(args.relPath) ? import_node_path36.default.resolve(args.relPath) : import_node_path36.default.resolve(cwdAbs, args.relPath);
+    guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.groupAdd", "cwd-subtree");
+    const from = ctx?.principal.kind === "owner" ? "owner" : "agent";
     const size = 0;
     const entry = deps.groupFileStore.upsert(scope, args.sessionId, {
       relPath: args.relPath,
-      from: "owner",
+      from,
       label: args.label,
       size,
       mime: lookupMime(args.relPath)
@@ -57454,7 +57470,7 @@ async function startDaemon(config) {
   });
   const rpcDispatcher = {
     async dispatch(method, args, _ctx) {
-      const handler = handlers[method];
+      const handler = resolveExposedHandler(handlers, method);
       if (!handler) {
         throw Object.assign(new Error(`unknown RPC method "${method}"`), { code: "METHOD_NOT_IMPLEMENTED" });
       }

package/dist/shift/mcp-server.cjs

@@ -21251,9 +21251,7 @@ async function main() {
       inputSchema: {
         name: external_exports.string().describe("short label shown in shift.json + future UI"),
         schedule: ScheduleSchema,
-        prompt: external_exports.string().describe(
-          "instruction the spawned cc executes on startup (NOT a chat message from the owner). Write what you want the persona to DO or SAY at fire time, in instruction form \u2014 daemon wraps it in a `[clawd-shift-fire \u2014 ...]` task pack so the spawned cc treats it as a scheduled action and responds as an assistant turn (no user-bubble appears in the owner's UI)."
-        ),
+        prompt: external_exports.string().describe("first user message injected when the new cc starts"),
         targetPersona: external_exports.string().optional().describe("which persona to spawn; defaults to the calling persona"),
         timeoutMs: external_exports.number().optional().describe("hard timeout per fire; default 30 minutes")
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.177-beta.357.f436213",
+  "version": "0.2.178-beta.358.7f6c694",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",