@clawos-dev/clawd 0.2.181-beta.361.269b0f5 → 0.2.181-beta.362.4cc1db7

package/dist/cli.cjs

@@ -253,11 +253,7 @@ var init_events = __esm({
       "skill-hint",
       "meta-text",
       "attachment-skills",
-      "attachment-deferred-tools",
-      // clawd shift v1：scheduler fire 时 daemon 给新 cc 的首条 user message 用
-      // <clawd-shift-fire> wrap 起头；classifyUserMessage 识别后路由到 UserMetaLine 折叠渲染，
-      // 不显示成 user 气泡（避免 instruction 文本被当 owner 实时对话）。
-      "clawd-shift-fire"
+      "attachment-deferred-tools"
     ];
     SKILL_SOURCE_VALUES = ["builtin", "global", "project", "plugin"];
     AGENT_SOURCE_VALUES = [
@@ -11244,7 +11240,6 @@ function classifyUserMessage(input) {
   if (SYSTEM_REMINDER_RE.test(text) || OPENSPEC_BLOCK_RE.test(text)) {
     return { meta: "system-reminder" };
   }
-  if (CLAWD_SHIFT_FIRE_RE.test(text)) return { meta: "clawd-shift-fire" };
   if (SKILL_HINT_RE.test(text)) return { meta: "skill-hint" };
   const flags = raw;
   if (flags.isMeta === true || flags.isSynthetic === true) return { meta: "meta-text" };
@@ -11459,7 +11454,7 @@ function readCurrentContent(filePath) {
     return null;
   }
 }
-var import_node_fs10, import_node_os5, import_node_path9, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, CLAWD_SHIFT_FIRE_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
+var import_node_fs10, import_node_os5, import_node_path9, TASK_NOTIFICATION_RE, TASK_ID_RE, TOOL_USE_ID_RE, SLASH_COMMAND_RE, LOCAL_COMMAND_RE, SYSTEM_REMINDER_RE, OPENSPEC_BLOCK_RE, SKILL_HINT_RE, ATTACHMENT_SILENT_SUBTYPES, ClaudeHistoryReader;
 var init_claude_history = __esm({
   "src/tools/claude-history.ts"() {
     "use strict";
@@ -11476,7 +11471,6 @@ var init_claude_history = __esm({
     SYSTEM_REMINDER_RE = /^\s*<system-reminder\b/i;
     OPENSPEC_BLOCK_RE = /^\s*<!--\s*OPENSPEC\b/i;
     SKILL_HINT_RE = /^\s*Base directory for this skill:\s/;
-    CLAWD_SHIFT_FIRE_RE = /^\s*<clawd-shift-fire\b/i;
     ATTACHMENT_SILENT_SUBTYPES = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -41350,6 +41344,29 @@ function buildConnectionPrompt(args) {
   return result;
 }
 
+// src/persona/sharing-prompt.ts
+var ATTACHMENT_SHARING_HINT = `## \u628A\u4EA7\u51FA\u6587\u4EF6\u5206\u4EAB\u7ED9\u5BF9\u65B9\uFF08attachment\uFF09
+
+\u5F53\u4F60\u4EA7\u51FA\u4E86\u6587\u4EF6\u3001\u9700\u8981\u8BA9\u5BF9\u65B9\u62FF\u5230\u65F6\uFF08\u5C24\u5176 Bash \u89E3\u538B/\u751F\u6210\u7684\u6587\u4EF6\uFF0C\u6216\u8DE8\u8BBE\u5907\u88AB\u59D4\u6D3E\u65F6\u5BF9\u65B9\u5728\u53E6\u4E00\u53F0\u673A\u5668\u3001\u770B\u4E0D\u5230\u4F60\u7684\u672C\u5730\u8DEF\u5F84\uFF09\uFF0C\u7528 daemon \u7684 HTTP RPC \u628A\u6587\u4EF6\u8F6C\u6210\u4E00\u4E2A\u5E26\u7B7E\u540D\u7684\u4E0B\u8F7D URL\uFF1A
+
+1. \u5165\u7FA4\uFF08\u767B\u8BB0\u5230\u672C session \u7684\u5171\u4EAB\u6E05\u5355\uFF09\uFF1A
+   \`\`\`bash
+   curl -sS -X POST "$CLAWD_DAEMON_URL/api/rpc/attachment.groupAdd" \\
+     -H "X-Clawd-Session-Id: $CLAWD_SESSION_ID" -H 'Content-Type: application/json' \\
+     -d '{"relPath":"<\u6587\u4EF6\u7684\u7EDD\u5BF9\u8DEF\u5F84>"}'
+   \`\`\`
+2. \u7B7E\u540D\u62FF URL\uFF1A
+   \`\`\`bash
+   curl -sS -X POST "$CLAWD_DAEMON_URL/api/rpc/attachment.signUrl" \\
+     -H "X-Clawd-Session-Id: $CLAWD_SESSION_ID" -H 'Content-Type: application/json' \\
+     -d '{"relPath":"<\u540C\u4E00\u4E2A\u7EDD\u5BF9\u8DEF\u5F84>"}'
+   \`\`\`
+   \u8FD4\u56DE\u7684 \`url\` \u5C31\u662F\u5BF9\u65B9\u53EF\u76F4\u63A5\u6253\u5F00/\u4E0B\u8F7D\u7684\u94FE\u63A5\u3002
+
+- \`relPath\` \u5FC5\u987B\u4F20**\u7EDD\u5BF9\u8DEF\u5F84**\uFF08\u4F60\u4EA7\u51FA\u6587\u4EF6\u7684\u771F\u5B9E\u8DEF\u5F84\uFF09\uFF0C\u4E0D\u8981\u4F20\u76F8\u5BF9\u8DEF\u5F84\u3002
+- \u53EA\u80FD\u5206\u4EAB\u4F60\u81EA\u5DF1\u5DE5\u4F5C\u76EE\u5F55\u5185\u7684\u6587\u4EF6\uFF0C\u8D8A\u754C\u4F1A\u88AB\u62D2\u3002
+- \u88AB dispatch \u63A5\u5230\u4EFB\u52A1\u3001\u8981\u56DE\u4F20\u4EA7\u7269\u65F6\uFF1A\u628A\u7B7E\u540D URL \u5199\u8FDB \`personaDispatchComplete\` \u7684 \`text\` \u91CC\uFF08\`filePaths\` \u53EA\u662F\u4F60\u672C\u673A\u7684\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u8DE8\u8BBE\u5907\u5BF9\u65B9\u6253\u4E0D\u5F00\uFF0CURL \u624D\u80FD\u6253\u5F00\uFF09\u3002`;
+
 // src/dispatch/system-prompt.ts
 var DISPATCH_SYSTEM_PROMPT_HINT = `## \u59D4\u6D3E\u7ED9\u53E6\u4E00\u4E2A persona\uFF08dispatch\uFF09
 
@@ -41515,6 +41532,9 @@ function buildSpawnContext(state, deps) {
   if (dispatchMcpConfigPath2) {
     ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + DISPATCH_SYSTEM_PROMPT_HINT;
   }
+  if (daemonUrl) {
+    ctx.extraSystemPrompt = (ctx.extraSystemPrompt ? ctx.extraSystemPrompt + "\n\n" : "") + ATTACHMENT_SHARING_HINT;
+  }
   if (meta?.extraSettings) {
     ctx.extraSettings = meta.extraSettings;
   }
@@ -47323,7 +47343,7 @@ var import_node_crypto4 = require("crypto");
 var MAX_RUNS_PER_SHIFT = 30;
 var DEFAULT_TIMEOUT_MS = 30 * 6e4;
 var CONSECUTIVE_ERROR_THRESHOLD = 5;
-var TICK_INTERVAL_MS = 1e3;
+var TICK_INTERVAL_MS = 1e4;
 var STORE_FLUSH_DEBOUNCE_MS = 500;
 var CLOCK_JUMP_THRESHOLD_MS = 5 * 6e4;
 
@@ -49249,6 +49269,67 @@ function removeSubscription(client, sessionId) {
   else client.subscribedSessions.set(sessionId, next);
 }
 
+// src/transport/rpc-adapter.ts
+var EXPOSED_RPC_METHODS = [
+  "appBuilder.createProject",
+  "appBuilder.listProjects",
+  "appBuilder.updateProjectPort",
+  "appBuilder.setProdUrl",
+  // 单栏 refactor §5.6.2 stage fix：scaffold + install 完成调 startDevServer 起 dev server；
+  // 中间用 reportStage 上报阶段（scaffolding / installing / failed），UI 据 stage 推帧切 PreviewPane。
+  "appBuilder.startDevServer",
+  "appBuilder.reportStage",
+  // 单栏 §5.6.5 fix: UI 切 session 时调（assistant 不需要主动调，但暴露白名单避免误猜成 forbidden）
+  "appBuilder.setActiveSession",
+  // dataclaw-builder：persona 建页时取建页人身份（含 union_id）写进生成 app 的配置。
+  // 路由到 handlers['auth:getIdentity']，只返 identity、绝不带 ttcToken（见 handlers/feishu-auth.ts）。
+  "auth.getIdentity",
+  // Persona dispatch (Task 4): A 端 dispatch MCP server 调 run（hold-and-wait 一次）；
+  // B 端 dispatch MCP server 调 complete（带 outcome 触发 run 端 resolve）。详见
+  // protocol/src/dispatch.ts。
+  "personaDispatch.run",
+  "personaDispatch.complete",
+  // clawd-shift v1 (spec 2026-06-24-clawd-shift)：cc 子进程内的 shift MCP server 调
+  // 这 5 个 method 管理 owner 的 shift（fire-and-forget 排班）。鉴权靠 body.personaId
+  // （mcp-server 从 process.env.CLAWD_PERSONA_ID 读，源 = SessionFile.ownerPersonaId）。
+  // handler 内 cancel/update/history 校验 createdByPersona === personaId 防越权。
+  "shift-internal.add",
+  "shift-internal.list",
+  "shift-internal.cancel",
+  "shift-internal.update",
+  "shift-internal.history",
+  // file-sharing：persona guest agent 把自己工作目录内的产物入群+签名分享。
+  // 路径越界由 handlers/attachment.ts guardAttachmentPath（scope-based）拦截。
+  "attachment.groupAdd",
+  "attachment.signUrl"
+];
+async function handleRpcRequest(input) {
+  const { method, body, sessionId, dispatcher } = input;
+  if (!sessionId) {
+    return { status: 400, body: { ok: false, error: "MISSING_SESSION_ID", message: "X-Clawd-Session-Id header required" } };
+  }
+  if (!EXPOSED_RPC_METHODS.includes(method)) {
+    return { status: 403, body: { ok: false, error: "METHOD_NOT_EXPOSED", message: `method "${method}" not exposed via HTTP RPC` } };
+  }
+  const internalMethod = method.replace(".", ":");
+  const augmentedBody = {
+    ...typeof body === "object" && body != null ? body : {},
+    sessionId
+  };
+  try {
+    const result = await dispatcher.dispatch(internalMethod, augmentedBody, { sessionId });
+    return { status: 200, body: { ok: true, result } };
+  } catch (err) {
+    const e = err;
+    const code = e?.code ?? "INTERNAL";
+    const message = e?.message ?? String(err);
+    return { status: 400, body: { ok: false, error: code, message } };
+  }
+}
+function resolveExposedHandler(handlers, internalMethod) {
+  return handlers[internalMethod] ?? handlers[internalMethod.replace(":", ".")];
+}
+
 // src/transport/auth.ts
 init_protocol();
 var AuthGate = class {
@@ -50491,60 +50572,6 @@ async function importZip(buf, root) {
   }
 }
 
-// src/transport/rpc-adapter.ts
-var EXPOSED_RPC_METHODS = [
-  "appBuilder.createProject",
-  "appBuilder.listProjects",
-  "appBuilder.updateProjectPort",
-  "appBuilder.setProdUrl",
-  // 单栏 refactor §5.6.2 stage fix：scaffold + install 完成调 startDevServer 起 dev server；
-  // 中间用 reportStage 上报阶段（scaffolding / installing / failed），UI 据 stage 推帧切 PreviewPane。
-  "appBuilder.startDevServer",
-  "appBuilder.reportStage",
-  // 单栏 §5.6.5 fix: UI 切 session 时调（assistant 不需要主动调，但暴露白名单避免误猜成 forbidden）
-  "appBuilder.setActiveSession",
-  // dataclaw-builder：persona 建页时取建页人身份（含 union_id）写进生成 app 的配置。
-  // 路由到 handlers['auth:getIdentity']，只返 identity、绝不带 ttcToken（见 handlers/feishu-auth.ts）。
-  "auth.getIdentity",
-  // Persona dispatch (Task 4): A 端 dispatch MCP server 调 run（hold-and-wait 一次）；
-  // B 端 dispatch MCP server 调 complete（带 outcome 触发 run 端 resolve）。详见
-  // protocol/src/dispatch.ts。
-  "personaDispatch.run",
-  "personaDispatch.complete",
-  // clawd-shift v1 (spec 2026-06-24-clawd-shift)：cc 子进程内的 shift MCP server 调
-  // 这 5 个 method 管理 owner 的 shift（fire-and-forget 排班）。鉴权靠 body.personaId
-  // （mcp-server 从 process.env.CLAWD_PERSONA_ID 读，源 = SessionFile.ownerPersonaId）。
-  // handler 内 cancel/update/history 校验 createdByPersona === personaId 防越权。
-  "shift-internal.add",
-  "shift-internal.list",
-  "shift-internal.cancel",
-  "shift-internal.update",
-  "shift-internal.history"
-];
-async function handleRpcRequest(input) {
-  const { method, body, sessionId, dispatcher } = input;
-  if (!sessionId) {
-    return { status: 400, body: { ok: false, error: "MISSING_SESSION_ID", message: "X-Clawd-Session-Id header required" } };
-  }
-  if (!EXPOSED_RPC_METHODS.includes(method)) {
-    return { status: 403, body: { ok: false, error: "METHOD_NOT_EXPOSED", message: `method "${method}" not exposed via HTTP RPC` } };
-  }
-  const internalMethod = method.replace(".", ":");
-  const augmentedBody = {
-    ...typeof body === "object" && body != null ? body : {},
-    sessionId
-  };
-  try {
-    const result = await dispatcher.dispatch(internalMethod, augmentedBody, { sessionId });
-    return { status: 200, body: { ok: true, result } };
-  } catch (err) {
-    const e = err;
-    const code = e?.code ?? "INTERNAL";
-    const message = e?.message ?? String(err);
-    return { status: 400, body: { ok: false, error: code, message } };
-  }
-}
-
 // src/transport/http-router.ts
 var RPC_ROUTE_PREFIX = "/api/rpc/";
 var RPC_BODY_MAX_BYTES = 1 * 1024 * 1024;
@@ -52935,6 +52962,16 @@ function personaIdFromPath(absPath, personaRoot) {
   const id = rel.split(path44.sep)[0];
   return id || null;
 }
+function isPathWithin(dir, absPath) {
+  const d = path44.resolve(dir);
+  const t = path44.resolve(absPath);
+  const sep3 = d.endsWith(path44.sep) ? "" : path44.sep;
+  return t === d || t.startsWith(d + sep3);
+}
+function isPathInGuestBoundary(personaRoot, personaId, userWorkDir, absPath) {
+  if (userWorkDir && isPathWithin(userWorkDir, absPath)) return true;
+  return personaIdFromPath(path44.resolve(absPath), personaRoot) === personaId;
+}
 
 // src/handlers/history.ts
 init_protocol();
@@ -53746,6 +53783,31 @@ function assertGuestAttachmentPath(ctx, absPath, personaRoot, method, usersRoot)
   }
 }
 function buildAttachmentHandlers(deps) {
+  function guardAttachmentPath(ctx, sessionId, candidateAbs, method, nonGuestPolicy) {
+    if (ctx?.principal.kind === "owner") return;
+    const scope = deps.getSessionScope?.(sessionId);
+    if (!scope) return;
+    if (scope.kind === "persona" && scope.mode === "guest") {
+      if (!deps.personaRoot) return;
+      const userWorkDir = deps.usersRoot ? deriveUserWorkDir(scope.capId, deps.usersRoot) : void 0;
+      if (!isPathInGuestBoundary(deps.personaRoot, scope.personaId, userWorkDir, candidateAbs)) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `${method}: path outside guest work dir: ${candidateAbs}`
+        );
+      }
+      return;
+    }
+    if (nonGuestPolicy === "group-acl") return;
+    const cwd = deps.sessionStore?.read(sessionId)?.cwd;
+    if (!cwd) return;
+    if (!isPathWithin(cwd, candidateAbs)) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `${method}: path outside session work dir: ${candidateAbs}`
+      );
+    }
+  }
   const signUrl = async (frame, _client, ctx) => {
     const parsed = AttachmentSignUrlArgs.safeParse(frame);
     if (!parsed.success) {
@@ -53788,7 +53850,7 @@ function buildAttachmentHandlers(deps) {
     }
     const cwdAbs = import_node_path36.default.resolve(sessionFile.cwd);
     const candidateAbs = import_node_path36.default.isAbsolute(args.relPath) ? import_node_path36.default.resolve(args.relPath) : import_node_path36.default.resolve(cwdAbs, args.relPath);
-    assertGuestAttachmentPath(ctx, candidateAbs, deps.personaRoot, "attachment.signUrl", deps.usersRoot);
+    guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.signUrl", "group-acl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
       const storedAbs = import_node_path36.default.isAbsolute(e.relPath) ? import_node_path36.default.resolve(e.relPath) : import_node_path36.default.resolve(cwdAbs, e.relPath);
@@ -53827,15 +53889,18 @@ function buildAttachmentHandlers(deps) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
     }
     const args = parsed.data;
-    guardGuestBySessionCwd(ctx, args.sessionId, "attachment.groupAdd");
     const scope = deps.getSessionScope(args.sessionId);
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
     }
+    const cwdAbs = import_node_path36.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
+    const candidateAbs = import_node_path36.default.isAbsolute(args.relPath) ? import_node_path36.default.resolve(args.relPath) : import_node_path36.default.resolve(cwdAbs, args.relPath);
+    guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.groupAdd", "cwd-subtree");
+    const from = ctx?.principal.kind === "owner" ? "owner" : "agent";
     const size = 0;
     const entry = deps.groupFileStore.upsert(scope, args.sessionId, {
       relPath: args.relPath,
-      from: "owner",
+      from,
       label: args.label,
       size,
       mime: lookupMime(args.relPath)
@@ -57410,7 +57475,7 @@ async function startDaemon(config) {
   });
   const rpcDispatcher = {
     async dispatch(method, args, _ctx) {
-      const handler = handlers[method];
+      const handler = resolveExposedHandler(handlers, method);
       if (!handler) {
         throw Object.assign(new Error(`unknown RPC method "${method}"`), { code: "METHOD_NOT_IMPLEMENTED" });
       }

package/dist/shift/mcp-server.cjs

@@ -21252,7 +21252,7 @@ async function main() {
         name: external_exports.string().describe("short label shown in shift.json + future UI"),
         schedule: ScheduleSchema,
         prompt: external_exports.string().describe(
-          "instruction the spawned cc executes on startup (NOT a chat message from the owner). Write what you want the persona to DO or SAY at fire time, in instruction form \u2014 daemon wraps it in a <clawd-shift-fire> tag so the spawned cc treats it as a scheduled action and responds as an assistant turn (no user-bubble appears in the owner's UI)."
+          "instruction the spawned cc executes on startup (NOT a chat message from the owner). Write what you want the persona to DO or SAY at fire time, in instruction form \u2014 daemon wraps it in a `<clawd-shift-fire>` tag so the spawned cc treats it as a scheduled action and responds as an assistant turn (the wrap is stripped from the owner's UI bubble)."
         ),
         targetPersona: external_exports.string().optional().describe("which persona to spawn; defaults to the calling persona"),
         timeoutMs: external_exports.number().optional().describe("hard timeout per fire; default 30 minutes")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.181-beta.361.269b0f5",
+  "version": "0.2.181-beta.362.4cc1db7",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",