@clawos-dev/clawd 0.2.292 → 0.2.293

package/dist/cli.cjs

@@ -43776,9 +43776,11 @@ init_protocol();
 var import_node_os2 = require("os");
 var FORCED_DENY_READ = ["~/"];
 function personaEditDeny(personaDir) {
+  return `Edit(${tildePath(personaDir)}/**)`;
+}
+function tildePath(p2) {
   const home = (0, import_node_os2.homedir)();
-  const rel = personaDir.startsWith(`${home}/`) ? `~${personaDir.slice(home.length)}` : personaDir;
-  return `Edit(${rel}/**)`;
+  return p2.startsWith(`${home}/`) ? `~${p2.slice(home.length)}` : p2;
 }
 function unionArr(a, b2) {
   const out = [...a ?? []];
@@ -43794,8 +43796,8 @@ function buildGuestSettingsV1() {
   return {
     permissions: {
       defaultMode: "dontAsk"
-      // persona-dir 的 Edit deny 由 composeGuestSandbox 按 spawnCwd 注入 '~/<persona>/**' 绝对规则
-      // （base 不放相对 './'——会随 getCwd 漂移误拦项目，见 personaEditDeny）。
+      // persona-dir 的 Edit deny 由 store.writeSandboxSettings 落盘注入 '~/<persona>/**' 绝对规则
+      // （base 模板不放相对 './'——会随 getCwd 漂移误拦项目，见 personaEditDeny）。
     },
     sandbox: {
       enabled: true,
@@ -43808,7 +43810,7 @@ function buildGuestSettingsV1() {
         denyWrite: [],
         // **不放 '~/'**（写是白名单制，home 自动不可写）；persona(cwd) 由 compose 强制 deny
         allowRead: [],
-        // userWorkDir + persona cwd 由 compose 强制注入，profile 加工具链精确路径
+        // persona 读权由 store.writeSandboxSettings 落盘注入；userWorkDir 由 compose 注入；profile 加工具链精确路径
         allowWrite: []
       }
     }
@@ -43846,7 +43848,7 @@ function composeGuestSandbox(base, userWorkDir, spawnCwd) {
   s.sandbox.allowUnsandboxedCommands = false;
   fsv.denyRead = unionArr(fsv.denyRead, FORCED_DENY_READ);
   fsv.denyWrite = unionArr((fsv.denyWrite ?? []).filter((p2) => p2 !== "~/"), [spawnCwd]);
-  fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir, spawnCwd]);
+  fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir]);
   fsv.allowWrite = unionArr(fsv.allowWrite, [userWorkDir]);
   return s;
 }
@@ -44088,6 +44090,8 @@ function buildConnectionPrompt(args) {
     let line = `\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
     if (args.mode === "guest") {
       line += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
+    } else {
+      line += "persona \u76EE\u5F55\u5B58\u653E\u7684\u662F\u4EBA\u683C\u914D\u7F6E\uFF1B\u5DE5\u4F5C\u4EA7\u7269\u3001\u4E34\u65F6\u6587\u4EF6\u3001\u4E0B\u8F7D\u5185\u5BB9\u9ED8\u8BA4\u5199\u5230\u4E0A\u9762\u7684\u5DE5\u4F5C\u76EE\u5F55\uFF0C\u4E0D\u8981\u843D\u5728 persona \u76EE\u5F55\u91CC\uFF08\u66F4\u65B0\u4EBA\u683C\u914D\u7F6E\u672C\u8EAB\u9664\u5916\uFF09\u3002";
     }
     parts.push(line);
   }
@@ -47736,21 +47740,40 @@ var PersonaStore = class {
    * 覆盖式写 persona 级 sandbox 配置（seed 给有 profile 的 persona 写 base⊕profile；owner 之后可手编）。
    * 这份是 guest 沙箱的 **base 真源**：manager spawn 时 composeGuestSandbox 读它 + 叠 sandbox 强制底座
    * （enabled/denyRead/denyWrite/userWorkDir owner 削弱不了）→ 写 per-guest 文件给 CC。
-   * 写入时强制注入本 persona 的 Edit-deny（'~/<persona>/**' 按实际 persona dir 算）+ 剥掉历史相对 'Edit(./**)'，
-   * 让落盘 base 就是 source of truth（compose 不再运行时替换 permission deny）。
+   * 写入时强制注入本 persona 的**基线**（Edit-deny + allowRead，见 injectPersonaBaseline），
+   * 让落盘 base 就是 source of truth（compose 不再运行时替换 permission deny / 注入 persona 读权）。
    */
   writeSandboxSettings(personaId2, settings) {
     this.atomicWrite(
       this.sandboxSettingsPath(personaId2),
-      JSON.stringify(this.injectPersonaEditDeny(personaId2, settings), null, 2)
+      JSON.stringify(this.injectPersonaBaseline(personaId2, settings), null, 2)
     );
   }
-  /** 把 persona Edit-deny（绝对 '~/<persona>/**'）并进 settings.permissions.deny，剥掉历史相对 'Edit(./**)'。 */
-  injectPersonaEditDeny(personaId2, settings) {
+  /**
+   * persona 基线注入：Edit-deny（绝对 '~/<persona>/**'）并进 permissions.deny + 剥掉历史相对
+   * 'Edit(./**)'；persona 目录 '~/' 路径 union 进 sandbox.filesystem.allowRead（guest 读权
+   * 落盘即真源，compose 不再运行时注入——spec 2026-08-06-persona-workdir-discipline §1-§2）。
+   */
+  injectPersonaBaseline(personaId2, settings) {
+    const dir = this.personaDir(personaId2);
     const s = settings;
-    const rule = personaEditDeny(this.personaDir(personaId2));
-    const prev = (s.permissions?.deny ?? []).filter((r) => r !== "Edit(./**)" && r !== rule);
-    return { ...s, permissions: { ...s.permissions ?? {}, deny: [...prev, rule] } };
+    const rule = personaEditDeny(dir);
+    const rawDeny = s.permissions && typeof s.permissions === "object" ? s.permissions.deny : void 0;
+    const prevDeny = (Array.isArray(rawDeny) ? rawDeny : []).filter((r) => r !== "Edit(./**)" && r !== rule);
+    const readPath = tildePath(dir);
+    const sandbox = s.sandbox && typeof s.sandbox === "object" && !Array.isArray(s.sandbox) ? s.sandbox : {};
+    const rawFs = sandbox.filesystem;
+    const filesystem = rawFs && typeof rawFs === "object" && !Array.isArray(rawFs) ? rawFs : {};
+    const rawRead = filesystem.allowRead;
+    const prevRead = (Array.isArray(rawRead) ? rawRead : []).filter((p2) => p2 !== readPath);
+    return {
+      ...s,
+      permissions: {
+        ...s.permissions && typeof s.permissions === "object" ? s.permissions : {},
+        deny: [...prevDeny, rule]
+      },
+      sandbox: { ...sandbox, filesystem: { ...filesystem, allowRead: [...prevRead, readPath] } }
+    };
   }
   codexSandboxSettingsPath(personaId2) {
     return path12.join(this.personaDir(personaId2), ".clawd", "codex-sandbox.json");
@@ -48615,6 +48638,35 @@ function migrateCodexSandbox(args) {
   }
   if (n > 0) args.logger.info("persona.codex-sandbox.done", { migrated: n });
 }
+function migrateSandboxAllowRead(args) {
+  let n = 0;
+  for (const personaId2 of args.store.list()) {
+    try {
+      const readPath = tildePath(args.store.personaDirPath(personaId2));
+      if (!fs12.existsSync(args.store.sandboxSettingsPath(personaId2))) {
+        args.store.writeSandboxSettings(personaId2, buildGuestSettingsV1());
+        n++;
+        continue;
+      }
+      const raw = args.store.readSandboxSettings(personaId2);
+      if (raw === null) {
+        args.logger.warn("persona.sandbox.allow-read.corrupt-skip", { personaId: personaId2 });
+        continue;
+      }
+      const allowRead = raw.sandbox?.filesystem?.allowRead;
+      if (Array.isArray(allowRead) && allowRead.includes(readPath)) continue;
+      args.store.writeSandboxSettings(personaId2, raw);
+      n++;
+      args.logger.info("persona.sandbox.allow-read.migrated", { personaId: personaId2 });
+    } catch (err) {
+      args.logger.warn("persona.sandbox.allow-read.failed", {
+        personaId: personaId2,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  if (n > 0) args.logger.info("persona.sandbox.allow-read.done", { migrated: n });
+}
 var PERSONA_BUILDER_ID = "persona-builder";
 var PERSONA_BUILDER_TOMBSTONE_MARKER = "<!-- clawd:persona-builder-retired -->";
 var PERSONA_BUILDER_TOMBSTONE = `${PERSONA_BUILDER_TOMBSTONE_MARKER}
@@ -54833,7 +54885,7 @@ function assertValidFileName(fileName) {
 var HASH_PREFIX_LEN = 16;
 async function writeUploadedAttachment(args) {
   assertValidFileName(args.fileName);
-  const attachmentsRoot = import_node_path34.default.join(args.sessionDir, ".attachments");
+  const attachmentsRoot = import_node_path34.default.join(args.baseDir, ".attachments");
   try {
     import_node_fs31.default.mkdirSync(attachmentsRoot, { recursive: true });
   } catch (err) {
@@ -54904,7 +54956,7 @@ async function writeUploadedAttachment(args) {
     }
   }
   const absPath = import_node_path34.default.join(hashDir, finalFileName);
-  const relPath = import_node_path34.default.relative(args.sessionDir, absPath);
+  const relPath = absPath;
   args.groupFileStore.upsert(args.scope, args.sessionId, {
     relPath: absPath,
     // 存绝对路径，与现有 agent 入清单的形态一致（attachment.ts:144 双形态兼容）
@@ -55411,9 +55463,9 @@ function createHttpRouter(deps) {
         });
         return true;
       }
-      const sessionDir = up.getSessionDir(sessionId);
+      const baseDir = up.getAttachmentBaseDir(sessionId);
       const scope = up.getSessionScope(sessionId);
-      if (!sessionDir || !scope) {
+      if (!baseDir || !scope) {
         sendUploadJson(404, { code: "NOT_FOUND", message: `session ${sessionId} not found` });
         return true;
       }
@@ -55435,7 +55487,7 @@ function createHttpRouter(deps) {
       }
       try {
         const result = await writeUploadedAttachment({
-          sessionDir,
+          baseDir,
           sessionId,
           scope,
           fileName,
@@ -55613,57 +55665,66 @@ function runAttachmentGc(args) {
       if (import_node_path37.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
     }
   }
+  const visited = /* @__PURE__ */ new Set();
   for (const { scope, sessionId } of args.sessionScopes) {
-    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path37.default.join(
+    const legacyDir = args.getSessionCwd?.(sessionId) ?? import_node_path37.default.join(
       args.dataDir,
       "sessions",
       ...scopeSubPath(scope).map(safeFileName),
       safeFileName(sessionId)
     );
-    const attRoot = import_node_path37.default.join(sessionDir, ".attachments");
-    let hashDirs;
-    try {
-      hashDirs = import_node_fs33.default.readdirSync(attRoot);
-    } catch (err) {
-      if (err.code === "ENOENT") continue;
-      args.logger?.warn("attachment gc: readdir failed", { attRoot, err: err.message });
-      continue;
-    }
-    for (const hashDir of hashDirs) {
-      const hashDirAbs = import_node_path37.default.join(attRoot, hashDir);
-      let files;
+    const userWorkDir = args.getUserWorkDir?.(sessionId) ?? null;
+    const roots = [legacyDir, ...userWorkDir ? [userWorkDir] : []].filter((r) => {
+      if (visited.has(r)) return false;
+      visited.add(r);
+      return true;
+    });
+    for (const rootDir of roots) {
+      const attRoot = import_node_path37.default.join(rootDir, ".attachments");
+      let hashDirs;
       try {
-        files = import_node_fs33.default.readdirSync(hashDirAbs);
-      } catch {
+        hashDirs = import_node_fs33.default.readdirSync(attRoot);
+      } catch (err) {
+        if (err.code === "ENOENT") continue;
+        args.logger?.warn("attachment gc: readdir failed", { attRoot, err: err.message });
         continue;
       }
-      for (const name of files) {
-        const file = import_node_path37.default.join(hashDirAbs, name);
-        let stat;
+      for (const hashDir of hashDirs) {
+        const hashDirAbs = import_node_path37.default.join(attRoot, hashDir);
+        let files;
         try {
-          stat = import_node_fs33.default.statSync(file);
+          files = import_node_fs33.default.readdirSync(hashDirAbs);
         } catch {
           continue;
         }
-        if (!stat.isFile()) continue;
-        const age = now - stat.mtimeMs;
-        if (age < ttlMs) continue;
-        if (liveAbs.has(file)) continue;
+        for (const name of files) {
+          const file = import_node_path37.default.join(hashDirAbs, name);
+          let stat;
+          try {
+            stat = import_node_fs33.default.statSync(file);
+          } catch {
+            continue;
+          }
+          if (!stat.isFile()) continue;
+          const age = now - stat.mtimeMs;
+          if (age < ttlMs) continue;
+          if (liveAbs.has(file)) continue;
+          try {
+            import_node_fs33.default.unlinkSync(file);
+          } catch (err) {
+            args.logger?.warn("attachment gc: unlink failed", { file, err: err.message });
+          }
+        }
         try {
-          import_node_fs33.default.unlinkSync(file);
-        } catch (err) {
-          args.logger?.warn("attachment gc: unlink failed", { file, err: err.message });
+          if (import_node_fs33.default.readdirSync(hashDirAbs).length === 0) import_node_fs33.default.rmdirSync(hashDirAbs);
+        } catch {
         }
       }
       try {
-        if (import_node_fs33.default.readdirSync(hashDirAbs).length === 0) import_node_fs33.default.rmdirSync(hashDirAbs);
+        if (import_node_fs33.default.readdirSync(attRoot).length === 0) import_node_fs33.default.rmdirSync(attRoot);
       } catch {
       }
     }
-    try {
-      if (import_node_fs33.default.readdirSync(attRoot).length === 0) import_node_fs33.default.rmdirSync(attRoot);
-    } catch {
-    }
   }
 }
 
@@ -58789,7 +58850,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.292".length > 0 ? "0.2.292" : "dev";
+var version = "0.2.293".length > 0 ? "0.2.293" : "dev";
 
 // src/cli-probe/probe.ts
 var fs55 = __toESM(require("fs"), 1);
@@ -62058,6 +62119,7 @@ async function startDaemon(config) {
   refreshSandboxSettings({ store: personaStore, logger });
   migrateAgentsMirror({ store: personaStore, logger });
   migrateCodexSandbox({ store: personaStore, logger });
+  migrateSandboxAllowRead({ store: personaStore, logger });
   retirePersonaBuilder({ store: personaStore, logger });
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const dispatchStore = createDispatchStore({
@@ -62487,6 +62549,12 @@ async function startDaemon(config) {
   });
   const getProjectStore = (userId) => new ProjectStore(deriveUserWorkDir(userId, usersRoot));
   const appBuilderStore = getProjectStore(ownerPrincipalId);
+  const attachmentUserWorkDir = (sid) => {
+    const scope = manager.findOwnedSessionScope(sid);
+    if (scope?.kind !== "persona") return null;
+    const userId = scope.mode === "owner" ? ownerPrincipalId : scope.capId;
+    return deriveUserWorkDir(userId, usersRoot);
+  };
   recoverInterruptedPublishJobs(appBuilderStore, logger).catch((err) => {
     logger.warn("app-builder.publish.recover-startup-failed", {
       error: err instanceof Error ? err.message : String(err)
@@ -62879,15 +62947,17 @@ async function startDaemon(config) {
     larkBotEvent: larkBotEventEndpoint,
     // /files HMAC verify 用 auth.json token（与 attachment.signUrl 同源）。
     getSignSecret: () => authFile.token,
-    // chatinput 附件上传（POST /attachments/upload，spec §6.1）。upload pipeline
-    // 在 session.cwd 下的 .attachments/ 落盘；签名 secret 与 /files HMAC 同源；
-    // tunnel 未启时返 503 TUNNEL_NOT_READY 让前端显式提示。
+    // chatinput 附件上传（POST /attachments/upload，spec §6.1 + 2026-08-06 §5）。落盘根按
+    // scope 切换：persona 会话 → 连接者 userWorkDir（与 connection-prompt 宣称的工作目录一致，
+    // guest 对 persona 目录的读权不再连带看到 owner 上传的附件）；非 persona 会话 → session.cwd
+    // （项目目录本就是用户地盘）。签名 secret 与 /files HMAC 同源；tunnel 未启时返 503。
     attachmentUpload: {
       groupFileStore,
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
-      getSessionDir: (sid) => {
+      getAttachmentBaseDir: (sid) => {
         const f = manager.findOwnedSession(sid);
-        return f ? f.cwd : null;
+        if (!f) return null;
+        return attachmentUserWorkDir(sid) ?? f.cwd;
       },
       getHttpBaseUrl: () => currentTunnelUrl ? getHttpBaseUrl() : null
     },
@@ -63131,8 +63201,10 @@ ${bar}
           scope,
           sessionId
         })),
-        // 注入 cwd 让 GC 直接定位 .attachments 目录（与 upload 落盘点一致）
+        // 双根扫描（spec 2026-08-06 §5）：legacy cwd 根（迁移前落盘点，30 天自然老化）+
+        // userWorkDir 根（迁移后 upload 落盘点，与 getAttachmentBaseDir 同源派生）
         getSessionCwd: (sid) => manager.findOwnedSession(sid)?.cwd ?? null,
+        getUserWorkDir: attachmentUserWorkDir,
         logger
       });
     } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.292",
+  "version": "0.2.293",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",