npm - @clawos-dev/clawd - Versions diffs - 0.2.292 → 0.2.294 - Mend

@clawos-dev/clawd 0.2.292 → 0.2.294

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/cli.cjs +735 -567
package/dist/dispatch/mcp-server.cjs +3 -1
package/dist/share-ui/assets/{guest-Bdm2Luf5.js → guest-DVak1a-R.js} +5 -5
package/dist/share-ui/guest.html +1 -1
package/package.json +1 -1

package/dist/cli.cjs CHANGED Viewed

@@ -450,8 +450,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path78, errorMaps, issueData } = params;
-      const fullPath = [...path78, ...issueData.path || []];
+      const { data, path: path79, errorMaps, issueData } = params;
+      const fullPath = [...path79, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -762,11 +762,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path78, key) {
+      constructor(parent, value, path79, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path78;
+        this._path = path79;
         this._key = key;
       }
       get path() {
@@ -7034,8 +7034,10 @@ var init_schemas = __esm({
        * 由 daemon lark-bot-connector 模块写入，UI 只读（sidebar 按此字段隐藏，Drawer 群清单按此聚合）。
        */
       larkChatId: external_exports.string().min(1).optional(),
-      /** 飞书群名快照（展示用，随事件里的群名更新，可能滞后于飞书侧改名） */
+      /** 飞书会话名快照（展示用）：群会话为群名、私聊会话为对方用户名；随事件更新，可能滞后 */
       larkChatName: external_exports.string().min(1).optional(),
+      /** lark 会话类型（spec 2026-08-06 P9）：p2p 与群的 chat_id 形态无法区分，UI 文案分支需要。可选=兼容老数据（缺省按 group 展示） */
+      larkChatType: external_exports.enum(["p2p", "group"]).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -8769,8 +8771,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path78 = req.path;
-        _req.url = typeof path78 === "string" ? path78 : req.url ? req.url.path || req.url : void 0;
+        const path79 = req.path;
+        _req.url = typeof path79 === "string" ? path79 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -8935,14 +8937,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path78) {
+    function parsePath(path79) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path78.length; i++) {
-        const char = path78[i];
+      for (let i = 0; i < path79.length; i++) {
+        const char = path79[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -9073,10 +9075,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path78 of paths) {
-        const parts = parsePath(path78);
+      for (const path79 of paths) {
+        const parts = parsePath(path79);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path78, remove);
+          redactWildcardPath(obj, parts, censor, path79, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -9161,8 +9163,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path78) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path78];
+            const wrappedCensor = typeof censor === "function" ? (value, path79) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path79];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -9197,8 +9199,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path78 of pathsToClone) {
-        const parts = parsePath(path78);
+      for (const path79 of pathsToClone) {
+        const parts = parsePath(path79);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -9250,24 +9252,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path78) {
-      if (typeof path78 !== "string") {
+    function validatePath(path79) {
+      if (typeof path79 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path78 === "") {
+      if (path79 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path78.includes("..")) {
-        throw new Error(`Invalid redaction path (${path78})`);
+      if (path79.includes("..")) {
+        throw new Error(`Invalid redaction path (${path79})`);
       }
-      if (path78.includes(",")) {
-        throw new Error(`Invalid redaction path (${path78})`);
+      if (path79.includes(",")) {
+        throw new Error(`Invalid redaction path (${path79})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path78.length; i++) {
-        const char = path78[i];
+      for (let i = 0; i < path79.length; i++) {
+        const char = path79[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -9281,20 +9283,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path78})`);
+            throw new Error(`Invalid redaction path (${path79})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path78})`);
+        throw new Error(`Invalid redaction path (${path79})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path78 of paths) {
-        validatePath(path78);
+      for (const path79 of paths) {
+        validatePath(path79);
       }
     }
     function slowRedact(options = {}) {
@@ -9462,8 +9464,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path78) => {
-            return censor(value, [k2, ...path78]);
+          const wrappedCensor = typeof censor === "function" ? (value, path79) => {
+            return censor(value, [k2, ...path79]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -9681,10 +9683,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs68 = require("fs");
+    var fs69 = require("fs");
     var EventEmitter3 = require("events");
     var inherits = require("util").inherits;
-    var path78 = require("path");
+    var path79 = require("path");
     var sleep2 = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -9738,20 +9740,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs68.mkdirSync(path78.dirname(file), { recursive: true });
-          const fd = fs68.openSync(file, flags, mode);
+          if (sonic.mkdir) fs69.mkdirSync(path79.dirname(file), { recursive: true });
+          const fd = fs69.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs68.mkdir(path78.dirname(file), { recursive: true }, (err) => {
+        fs69.mkdir(path79.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs68.open(file, flags, mode, fileOpened);
+          fs69.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs68.open(file, flags, mode, fileOpened);
+        fs69.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -9792,8 +9794,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs68.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs68.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs69.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs69.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -9802,15 +9804,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs68.writeSync(this.fd, this._writingBuf);
+            return fs69.writeSync(this.fd, this._writingBuf);
           }
-          return fs68.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs69.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs68.write(this.fd, this._writingBuf, this.release);
+            return fs69.write(this.fd, this._writingBuf, this.release);
           }
-          return fs68.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs69.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -9867,7 +9869,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs68.fsyncSync(this.fd);
+          fs69.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -9981,7 +9983,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs68.fsync(this.fd, (err) => {
+            fs69.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -10083,7 +10085,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs68.close(fd, (err) => {
+          fs69.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -10132,7 +10134,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs68.writeSync(this.fd, buf) : fs68.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs69.writeSync(this.fd, buf) : fs69.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -10148,7 +10150,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs68.fsyncSync(this.fd);
+        fs69.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -10169,7 +10171,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs68.writeSync(this.fd, buf);
+          const n = fs69.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -10197,13 +10199,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs68.writeSync(this.fd, this._writingBuf) : fs68.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs69.writeSync(this.fd, this._writingBuf) : fs69.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs68.write(this.fd, this._writingBuf, release);
+        fs69.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -10212,7 +10214,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs68.writeSync(this.fd, this._writingBuf);
+          const written = fs69.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -10221,7 +10223,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs68.write(this.fd, this._writingBuf, release);
+        fs69.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -10237,12 +10239,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs68.fsync(sonic.fd, closeWrapped);
+        fs69.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs68.close(sonic.fd, done);
+          fs69.close(sonic.fd, done);
         } else {
           done();
         }
@@ -13377,11 +13379,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path78, added, removed, oldPosInc, options) {
-        var last = path78.lastComponent;
+      addToPath: function addToPath(path79, added, removed, oldPosInc, options) {
+        var last = path79.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path78.oldPos + oldPosInc,
+            oldPos: path79.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -13391,7 +13393,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path78.oldPos + oldPosInc,
+            oldPos: path79.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -13900,10 +13902,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path78 = typeof rec3.path === "string" ? rec3.path : null;
+      const path79 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path78 || content == null) return null;
-      const entry = { path: path78, content };
+      if (!path79 || content == null) return null;
+      const entry = { path: path79, content };
       if (typeof rec3.mtimeMs === "number") entry.mtimeMs = rec3.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -14720,10 +14722,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec3 = m2;
-      const path78 = typeof rec3.path === "string" ? rec3.path : null;
+      const path79 = typeof rec3.path === "string" ? rec3.path : null;
       const content = typeof rec3.content === "string" ? rec3.content : null;
-      if (!path78 || content == null) return null;
-      const out = { path: path78, content };
+      if (!path79 || content == null) return null;
+      const out = { path: path79, content };
       if (typeof rec3.mtimeMs === "number") out.mtimeMs = rec3.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -35692,8 +35694,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path78) {
-      var parts = path78.split("/");
+    exports2.resolve = function(path79) {
+      var parts = path79.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -41546,18 +41548,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path78) {
-      if (path78.slice(-1) === "/") {
-        path78 = path78.substring(0, path78.length - 1);
+    var parentFolder = function(path79) {
+      if (path79.slice(-1) === "/") {
+        path79 = path79.substring(0, path79.length - 1);
       }
-      var lastSlash = path78.lastIndexOf("/");
-      return lastSlash > 0 ? path78.substring(0, lastSlash) : "";
+      var lastSlash = path79.lastIndexOf("/");
+      return lastSlash > 0 ? path79.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path78) {
-      if (path78.slice(-1) !== "/") {
-        path78 += "/";
+    var forceTrailingSlash = function(path79) {
+      if (path79.slice(-1) !== "/") {
+        path79 += "/";
       }
-      return path78;
+      return path79;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -42559,7 +42561,7 @@ var require_lib3 = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path65.default.dirname(opts.recordPath);
+  const dir = import_node_path66.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -42573,8 +42575,8 @@ function startRunCaseRecorder(opts) {
   });
   const ensureStream = () => {
     if (stream) return stream;
-    import_node_fs49.default.mkdirSync(dir, { recursive: true });
-    stream = import_node_fs49.default.createWriteStream(opts.recordPath, { flags: "a" });
+    import_node_fs50.default.mkdirSync(dir, { recursive: true });
+    stream = import_node_fs50.default.createWriteStream(opts.recordPath, { flags: "a" });
     stream.on("close", () => closedResolve());
     return stream;
   };
@@ -42599,12 +42601,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs49, import_node_path65;
+var import_node_fs50, import_node_path66;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
-    import_node_fs49 = __toESM(require("fs"), 1);
-    import_node_path65 = __toESM(require("path"), 1);
+    import_node_fs50 = __toESM(require("fs"), 1);
+    import_node_path66 = __toESM(require("path"), 1);
   }
 });
@@ -42647,7 +42649,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs50.mkdtempSync)(import_node_path66.default.join(import_node_os23.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs51.mkdtempSync)(import_node_path67.default.join(import_node_os23.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -42808,19 +42810,19 @@ async function runController(opts) {
   if (sigintHandler) process.off("SIGINT", sigintHandler);
   if (ownsCwd) {
     try {
-      (0, import_node_fs50.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_node_fs51.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   }
   return exitCode ?? 0;
 }
-var import_node_fs50, import_node_os23, import_node_path66;
+var import_node_fs51, import_node_os23, import_node_path67;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
-    import_node_fs50 = require("fs");
+    import_node_fs51 = require("fs");
     import_node_os23 = __toESM(require("os"), 1);
-    import_node_path66 = __toESM(require("path"), 1);
+    import_node_path67 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -43095,8 +43097,8 @@ Env (advanced):
 `;
 // src/index.ts
-var import_node_path64 = __toESM(require("path"), 1);
-var import_node_fs48 = __toESM(require("fs"), 1);
+var import_node_path65 = __toESM(require("path"), 1);
+var import_node_fs49 = __toESM(require("fs"), 1);
 var import_node_os22 = __toESM(require("os"), 1);
 // ../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/stringify.js
@@ -43776,9 +43778,14 @@ init_protocol();
 var import_node_os2 = require("os");
 var FORCED_DENY_READ = ["~/"];
 function personaEditDeny(personaDir) {
+  return `Edit(${tildePath(personaDir)}/**)`;
+}
+function personaReadAllow(personaDir) {
+  return `Read(${tildePath(personaDir)}/**)`;
+}
+function tildePath(p2) {
   const home = (0, import_node_os2.homedir)();
-  const rel = personaDir.startsWith(`${home}/`) ? `~${personaDir.slice(home.length)}` : personaDir;
-  return `Edit(${rel}/**)`;
+  return p2.startsWith(`${home}/`) ? `~${p2.slice(home.length)}` : p2;
 }
 function unionArr(a, b2) {
   const out = [...a ?? []];
@@ -43794,8 +43801,8 @@ function buildGuestSettingsV1() {
   return {
     permissions: {
       defaultMode: "dontAsk"
-      // persona-dir 的 Edit deny 由 composeGuestSandbox 按 spawnCwd 注入 '~/<persona>/**' 绝对规则
-      // （base 不放相对 './'——会随 getCwd 漂移误拦项目，见 personaEditDeny）。
+      // persona-dir 的 Edit deny 由 store.writeSandboxSettings 落盘注入 '~/<persona>/**' 绝对规则
+      // （base 模板不放相对 './'——会随 getCwd 漂移误拦项目，见 personaEditDeny）。
     },
     sandbox: {
       enabled: true,
@@ -43808,7 +43815,7 @@ function buildGuestSettingsV1() {
         denyWrite: [],
         // **不放 '~/'**（写是白名单制，home 自动不可写）；persona(cwd) 由 compose 强制 deny
         allowRead: [],
-        // userWorkDir + persona cwd 由 compose 强制注入，profile 加工具链精确路径
+        // persona 读权由 store.writeSandboxSettings 落盘注入；userWorkDir 由 compose 注入；profile 加工具链精确路径
         allowWrite: []
       }
     }
@@ -43846,8 +43853,9 @@ function composeGuestSandbox(base, userWorkDir, spawnCwd) {
   s.sandbox.allowUnsandboxedCommands = false;
   fsv.denyRead = unionArr(fsv.denyRead, FORCED_DENY_READ);
   fsv.denyWrite = unionArr((fsv.denyWrite ?? []).filter((p2) => p2 !== "~/"), [spawnCwd]);
-  fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir, spawnCwd]);
+  fsv.allowRead = unionArr(fsv.allowRead, [userWorkDir]);
   fsv.allowWrite = unionArr(fsv.allowWrite, [userWorkDir]);
+  s.permissions.allow = unionArr(s.permissions.allow, [`Read(${tildePath(userWorkDir)}/**)`]);
   return s;
 }
@@ -44088,6 +44096,8 @@ function buildConnectionPrompt(args) {
     let line = `\u4F60\u7684\u6587\u4EF6\u5DE5\u4F5C\u76EE\u5F55\u662F ${args.workDir}\uFF0C\u8FD9\u4E2A\u76EE\u5F55\u5BF9\u4F60\u53EF\u8BFB\u53EF\u5199\uFF0C\u6587\u4EF6\u7684\u8BFB\u53D6/\u521B\u5EFA/\u4FEE\u6539\u90FD\u5728\u8FD9\u91CC\u8FDB\u884C\u3002`;
     if (args.mode === "guest") {
       line += "persona \u76EE\u5F55\u5BF9\u4F60\u53EA\u8BFB\uFF0C\u4E0D\u8981\u5F80\u91CC\u5199\u3002";
+    } else {
+      line += "persona \u76EE\u5F55\u5B58\u653E\u7684\u662F\u4EBA\u683C\u914D\u7F6E\uFF1B\u5DE5\u4F5C\u4EA7\u7269\u3001\u4E34\u65F6\u6587\u4EF6\u3001\u4E0B\u8F7D\u5185\u5BB9\u9ED8\u8BA4\u5199\u5230\u4E0A\u9762\u7684\u5DE5\u4F5C\u76EE\u5F55\uFF0C\u4E0D\u8981\u843D\u5728 persona \u76EE\u5F55\u91CC\uFF08\u66F4\u65B0\u4EBA\u683C\u914D\u7F6E\u672C\u8EAB\u9664\u5916\uFF09\u3002";
     }
     parts.push(line);
   }
@@ -47177,8 +47187,9 @@ var SessionManager = class {
         // guest 三件套：creatorPrincipalId=capId（scopeForFile 回落防线）、
         // creatorDisplayName（reducer guest 分支硬性要求，缺则 spawn 抛）
         creatorPrincipalId: capId,
-        creatorDisplayName: `\u98DE\u4E66\u7FA4\xB7${args.chatName ?? args.chatId}`,
+        creatorDisplayName: `${(args.chatType ?? "group") === "p2p" ? "\u98DE\u4E66\u79C1\u804A" : "\u98DE\u4E66\u7FA4"}\xB7${args.chatName ?? args.chatId}`,
         larkChatId: args.chatId,
+        larkChatType: args.chatType ?? "group",
         ...args.chatName ? { larkChatName: args.chatName } : {},
         createdAt: now,
         updatedAt: now
@@ -47736,21 +47747,47 @@ var PersonaStore = class {
    * 覆盖式写 persona 级 sandbox 配置（seed 给有 profile 的 persona 写 base⊕profile；owner 之后可手编）。
    * 这份是 guest 沙箱的 **base 真源**：manager spawn 时 composeGuestSandbox 读它 + 叠 sandbox 强制底座
    * （enabled/denyRead/denyWrite/userWorkDir owner 削弱不了）→ 写 per-guest 文件给 CC。
-   * 写入时强制注入本 persona 的 Edit-deny（'~/<persona>/**' 按实际 persona dir 算）+ 剥掉历史相对 'Edit(./**)'，
-   * 让落盘 base 就是 source of truth（compose 不再运行时替换 permission deny）。
+   * 写入时强制注入本 persona 的**基线**（Edit-deny + allowRead，见 injectPersonaBaseline），
+   * 让落盘 base 就是 source of truth（compose 不再运行时替换 permission deny / 注入 persona 读权）。
    */
   writeSandboxSettings(personaId2, settings) {
     this.atomicWrite(
       this.sandboxSettingsPath(personaId2),
-      JSON.stringify(this.injectPersonaEditDeny(personaId2, settings), null, 2)
+      JSON.stringify(this.injectPersonaBaseline(personaId2, settings), null, 2)
     );
   }
-  /** 把 persona Edit-deny（绝对 '~/<persona>/**'）并进 settings.permissions.deny，剥掉历史相对 'Edit(./**)'。 */
-  injectPersonaEditDeny(personaId2, settings) {
+  /**
+   * persona 基线注入：Edit-deny（绝对 '~/<persona>/**'）并进 permissions.deny + 剥掉历史相对
+   * 'Edit(./**)'；persona 目录 '~/' 路径 union 进 sandbox.filesystem.allowRead（guest 读权
+   * 落盘即真源，compose 不再运行时注入——spec 2026-08-06-persona-workdir-discipline §1-§2）；
+   * `Read(~/<persona>/**)` union 进 permissions.allow——OS 沙箱层可读只放行了 Bash，CC 自带
+   * Read 工具在最严格 base（dontAsk + 无 allow）下仍被拒，工具层与 OS 层必须同构放行
+   * （guest「自由读 persona 目录、只写自己 userWorkDir」，spec 2026-08-06-lark-dm §P10 通用化）。
+   */
+  injectPersonaBaseline(personaId2, settings) {
+    const dir = this.personaDir(personaId2);
     const s = settings;
-    const rule = personaEditDeny(this.personaDir(personaId2));
-    const prev = (s.permissions?.deny ?? []).filter((r) => r !== "Edit(./**)" && r !== rule);
-    return { ...s, permissions: { ...s.permissions ?? {}, deny: [...prev, rule] } };
+    const rule = personaEditDeny(dir);
+    const rawDeny = s.permissions && typeof s.permissions === "object" ? s.permissions.deny : void 0;
+    const prevDeny = (Array.isArray(rawDeny) ? rawDeny : []).filter((r) => r !== "Edit(./**)" && r !== rule);
+    const readRule = personaReadAllow(dir);
+    const rawAllow = s.permissions && typeof s.permissions === "object" ? s.permissions.allow : void 0;
+    const prevAllow = (Array.isArray(rawAllow) ? rawAllow : []).filter((r) => r !== readRule);
+    const readPath = tildePath(dir);
+    const sandbox = s.sandbox && typeof s.sandbox === "object" && !Array.isArray(s.sandbox) ? s.sandbox : {};
+    const rawFs = sandbox.filesystem;
+    const filesystem = rawFs && typeof rawFs === "object" && !Array.isArray(rawFs) ? rawFs : {};
+    const rawRead = filesystem.allowRead;
+    const prevRead = (Array.isArray(rawRead) ? rawRead : []).filter((p2) => p2 !== readPath);
+    return {
+      ...s,
+      permissions: {
+        ...s.permissions && typeof s.permissions === "object" ? s.permissions : {},
+        allow: [...prevAllow, readRule],
+        deny: [...prevDeny, rule]
+      },
+      sandbox: { ...sandbox, filesystem: { ...filesystem, allowRead: [...prevRead, readPath] } }
+    };
   }
   codexSandboxSettingsPath(personaId2) {
     return path12.join(this.personaDir(personaId2), ".clawd", "codex-sandbox.json");
@@ -48615,6 +48652,38 @@ function migrateCodexSandbox(args) {
   }
   if (n > 0) args.logger.info("persona.codex-sandbox.done", { migrated: n });
 }
+function migrateSandboxAllowRead(args) {
+  let n = 0;
+  for (const personaId2 of args.store.list()) {
+    try {
+      const readPath = tildePath(args.store.personaDirPath(personaId2));
+      if (!fs12.existsSync(args.store.sandboxSettingsPath(personaId2))) {
+        args.store.writeSandboxSettings(personaId2, buildGuestSettingsV1());
+        n++;
+        continue;
+      }
+      const raw = args.store.readSandboxSettings(personaId2);
+      if (raw === null) {
+        args.logger.warn("persona.sandbox.allow-read.corrupt-skip", { personaId: personaId2 });
+        continue;
+      }
+      const allowRead = raw.sandbox?.filesystem?.allowRead;
+      const permAllow = raw.permissions?.allow;
+      const readRule = personaReadAllow(args.store.personaDirPath(personaId2));
+      if (Array.isArray(allowRead) && allowRead.includes(readPath) && Array.isArray(permAllow) && permAllow.includes(readRule))
+        continue;
+      args.store.writeSandboxSettings(personaId2, raw);
+      n++;
+      args.logger.info("persona.sandbox.allow-read.migrated", { personaId: personaId2 });
+    } catch (err) {
+      args.logger.warn("persona.sandbox.allow-read.failed", {
+        personaId: personaId2,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  if (n > 0) args.logger.info("persona.sandbox.allow-read.done", { migrated: n });
+}
 var PERSONA_BUILDER_ID = "persona-builder";
 var PERSONA_BUILDER_TOMBSTONE_MARKER = "<!-- clawd:persona-builder-retired -->";
 var PERSONA_BUILDER_TOMBSTONE = `${PERSONA_BUILDER_TOMBSTONE_MARKER}
@@ -49249,8 +49318,8 @@ function turnStartInput(text) {
   const items = [];
   let leftover = text;
   for (const m2 of text.matchAll(SKILL_RE)) {
-    const [marker, name, path78] = m2;
-    items.push({ type: "skill", name, path: path78 });
+    const [marker, name, path79] = m2;
+    items.push({ type: "skill", name, path: path79 });
     leftover = leftover.replace(marker, "");
   }
   for (const m2 of text.matchAll(ATTACHMENT_RE2)) {
@@ -51944,14 +52013,62 @@ function createLarkBotCloudClient(opts) {
     async claimEvents() {
       const json = await request("POST", "/api/lark-bot/events/claim");
       return json.items ?? [];
+    },
+    async fetchResource(appId, messageId, fileKey, maxBytes) {
+      const ac = new AbortController();
+      const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
+      const qs = new URLSearchParams({
+        appId,
+        messageId,
+        fileKey,
+        ...maxBytes ? { maxBytes: String(maxBytes) } : {}
+      }).toString();
+      let res;
+      try {
+        res = await f(`${base}/api/lark-bot/resource?${qs}`, {
+          method: "GET",
+          signal: ac.signal,
+          headers: {
+            authorization: `Bearer ${opts.apiKey}`,
+            "x-did": encodeURIComponent(opts.deviceId),
+            "x-name": encodeURIComponent(opts.displayName),
+            "x-scene": "daemon"
+          }
+        });
+      } catch (err) {
+        throw new LarkBotCloudError(`lark-bot cloud resource fetch failed: ${err.message}`);
+      } finally {
+        clearTimeout(timer);
+      }
+      if (!res.ok) {
+        throw new LarkBotCloudError(`lark-bot cloud resource: HTTP ${res.status}`, res.status);
+      }
+      const data = Buffer.from(await res.arrayBuffer());
+      const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+      return { data, contentType };
     }
   };
 }
 // src/lark-bot-connector/chat-router.ts
+var import_node_fs27 = __toESM(require("fs"), 1);
+var import_node_path28 = __toESM(require("path"), 1);
 init_protocol();
 var ERROR_REPLY_TEXT = "\u5904\u7406\u51FA\u9519\u4E86\uFF0C\u8BF7\u91CD\u8BD5";
 var DEFAULT_TURN_TIMEOUT_MS = 10 * 60 * 1e3;
+var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+var EXT_BY_MIME = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp"
+};
+var IMAGE_OVERSIZE_TEXT = "[\u56FE\u7247\u6D88\u606F\uFF0C\u8D85\u51FA\u5927\u5C0F\u9650\u5236]";
+var IMAGE_UNAVAILABLE_TEXT = "[\u56FE\u7247\u6D88\u606F\uFF0C\u6682\u4E0D\u652F\u6301\u67E5\u770B]";
+function safeMediaName(raw) {
+  const cleaned = raw.replace(/[^a-zA-Z0-9_\-.]/g, "_").replace(/^\.+/, (d) => "_".repeat(d.length));
+  return (cleaned || "msg").replace(/\.\./g, "__");
+}
 function createLarkChatRouter(deps) {
   const timeoutMs = deps.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
   const replyDelays = deps.replyRetryDelaysMs ?? [2e3, 8e3, 3e4];
@@ -51964,7 +52081,34 @@ function createLarkChatRouter(deps) {
       return;
     }
     const speaker = env.senderName || env.senderOpenId || "\u672A\u77E5\u6210\u5458";
-    const body = env.text?.trim() ? env.text : "[\u975E\u6587\u672C\u6D88\u606F]";
+    const imageLines = [];
+    for (const [i, key] of (env.imageKeys ?? []).entries()) {
+      try {
+        if (!deps.fetchResource || !deps.mediaRootFor) throw new Error("resource pipeline not wired");
+        const r = await deps.fetchResource(env.appId, env.messageId, key, MAX_IMAGE_BYTES);
+        if (r.data.byteLength > MAX_IMAGE_BYTES) {
+          deps.logger?.warn(`larkBot image oversize ${key}: ${r.data.byteLength}B`);
+          imageLines.push(IMAGE_OVERSIZE_TEXT);
+          continue;
+        }
+        const ext = EXT_BY_MIME[r.contentType];
+        if (!ext) {
+          deps.logger?.warn(`larkBot image unsupported mime ${key}: ${r.contentType}`);
+          imageLines.push(IMAGE_UNAVAILABLE_TEXT);
+          continue;
+        }
+        const dir = deps.mediaRootFor(env.chatId);
+        import_node_fs27.default.mkdirSync(dir, { recursive: true });
+        const p2 = import_node_path28.default.join(dir, `${safeMediaName(env.messageId)}-${i}.${ext}`);
+        import_node_fs27.default.writeFileSync(p2, r.data);
+        imageLines.push(`[\u56FE\u7247: ${p2}]\uFF08\u7528 Read \u5DE5\u5177\u67E5\u770B\uFF09`);
+      } catch (err) {
+        deps.logger?.warn(`larkBot image fetch failed ${key}: ${err.message}`);
+        imageLines.push(IMAGE_UNAVAILABLE_TEXT);
+      }
+    }
+    const rawBody = [env.text?.trim(), ...imageLines].filter(Boolean).join("\n");
+    const body = rawBody || "[\u975E\u6587\u672C\u6D88\u606F]";
     const text = `${body}
 ${formatLarkSpeakerReminder(speaker)}`;
@@ -51972,6 +52116,7 @@ ${formatLarkSpeakerReminder(speaker)}`;
       personaId: env.personaId,
       chatId: env.chatId,
       chatName: env.chatName,
+      chatType: env.chatType ?? "group",
       senderOpenId: env.senderOpenId ?? "",
       senderName: env.senderName ?? env.senderOpenId ?? "\u672A\u77E5\u6210\u5458",
       text
@@ -52734,7 +52879,7 @@ var CodexHistoryReader = class {
 };
 // src/tools/codex-skills.ts
-var import_node_path28 = __toESM(require("path"), 1);
+var import_node_path29 = __toESM(require("path"), 1);
 function str3(v2) {
   return typeof v2 === "string" ? v2 : void 0;
 }
@@ -52749,13 +52894,13 @@ function mapSkillsListResponse(res) {
       const r = s ?? {};
       const name = str3(r.name);
       if (!name) continue;
-      const path78 = str3(r.path);
+      const path79 = str3(r.path);
       const description = str3(r.description);
       const isPlugin = name.includes(":");
       out.push({
         name,
         source: isPlugin ? "plugin" : "project",
-        ...path78 ? { path: path78 } : {},
+        ...path79 ? { path: path79 } : {},
         ...description ? { description } : {},
         ...isPlugin ? { plugin: name.split(":")[0] } : {}
       });
@@ -52771,30 +52916,30 @@ async function listCodexSkills(cwd, deps = {}) {
     // 先写 extraRoots 再写 list（stdio 按写入顺序处理，fire-and-forget 不 await 回包；
     // codex-session.ts ready 序列同款，两处保持一致）。失败不阻塞 list。
     beforeRequest: (client) => {
-      void client.request("skills/extraRoots/set", { extraRoots: [import_node_path28.default.join(cwd, ".claude", "skills")] }).catch(() => void 0);
+      void client.request("skills/extraRoots/set", { extraRoots: [import_node_path29.default.join(cwd, ".claude", "skills")] }).catch(() => void 0);
     }
   });
   return mapSkillsListResponse(res);
 }
 // src/workspace/browser.ts
-var import_node_fs27 = __toESM(require("fs"), 1);
+var import_node_fs28 = __toESM(require("fs"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_path29 = __toESM(require("path"), 1);
+var import_node_path30 = __toESM(require("path"), 1);
 init_protocol();
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 function resolveInsideCwd(cwd, subpath) {
-  const absCwd = import_node_path29.default.resolve(cwd);
-  const joined = import_node_path29.default.resolve(absCwd, subpath ?? ".");
-  const rel = import_node_path29.default.relative(absCwd, joined);
-  if (rel.startsWith("..") || import_node_path29.default.isAbsolute(rel)) {
+  const absCwd = import_node_path30.default.resolve(cwd);
+  const joined = import_node_path30.default.resolve(absCwd, subpath ?? ".");
+  const rel = import_node_path30.default.relative(absCwd, joined);
+  if (rel.startsWith("..") || import_node_path30.default.isAbsolute(rel)) {
     throw new ClawdError(ERROR_CODES.INVALID_PATH, `path escapes cwd: ${subpath}`);
   }
   return joined;
 }
 function ensureCwd(cwd) {
   try {
-    const stat = import_node_fs27.default.statSync(cwd);
+    const stat = import_node_fs28.default.statSync(cwd);
     if (!stat.isDirectory()) {
       throw new ClawdError(ERROR_CODES.INVALID_CWD, `not a directory: ${cwd}`);
     }
@@ -52808,7 +52953,7 @@ var WorkspaceBrowser = class {
     const cwd = args.cwd && args.cwd.length > 0 ? args.cwd : import_node_os8.default.homedir();
     ensureCwd(cwd);
     const full = resolveInsideCwd(cwd, args.path);
-    const dirents = import_node_fs27.default.readdirSync(full, { withFileTypes: true });
+    const dirents = import_node_fs28.default.readdirSync(full, { withFileTypes: true });
     const entries = [];
     for (const d of dirents) {
       if (!args.showHidden && d.name.startsWith(".")) continue;
@@ -52818,7 +52963,7 @@ var WorkspaceBrowser = class {
         mtime: ""
       };
       try {
-        const st = import_node_fs27.default.statSync(import_node_path29.default.join(full, d.name));
+        const st = import_node_fs28.default.statSync(import_node_path30.default.join(full, d.name));
         entry.mtime = new Date(st.mtimeMs).toISOString();
         if (d.isFile()) entry.size = st.size;
       } catch {
@@ -52834,14 +52979,14 @@ var WorkspaceBrowser = class {
   read(args) {
     ensureCwd(args.cwd);
     const full = resolveInsideCwd(args.cwd, args.path);
-    const st = import_node_fs27.default.statSync(full);
+    const st = import_node_fs28.default.statSync(full);
     if (!st.isFile()) {
       throw new ClawdError(ERROR_CODES.INVALID_PATH, `not a file: ${args.path}`);
     }
     if (st.size > MAX_FILE_BYTES) {
       throw new ClawdError(ERROR_CODES.FILE_TOO_LARGE, `file > ${MAX_FILE_BYTES} bytes`);
     }
-    const buf = import_node_fs27.default.readFileSync(full);
+    const buf = import_node_fs28.default.readFileSync(full);
     const isBinary = buf.includes(0);
     if (isBinary) {
       return {
@@ -52863,20 +53008,20 @@ var WorkspaceBrowser = class {
 };
 // src/skills/agents-scanner.ts
-var import_node_fs28 = __toESM(require("fs"), 1);
+var import_node_fs29 = __toESM(require("fs"), 1);
 var import_node_os9 = __toESM(require("os"), 1);
-var import_node_path30 = __toESM(require("path"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
 var DEFAULT_POLICY_DIR_DARWIN = "/Library/Application Support/ClaudeCode/.claude/agents";
 function isDirLikeSync2(p2) {
   try {
-    return import_node_fs28.default.statSync(p2).isDirectory();
+    return import_node_fs29.default.statSync(p2).isDirectory();
   } catch {
     return false;
   }
 }
 function fileExistsSync(p2) {
   try {
-    return import_node_fs28.default.statSync(p2).isFile();
+    return import_node_fs29.default.statSync(p2).isFile();
   } catch {
     return false;
   }
@@ -52884,7 +53029,7 @@ function fileExistsSync(p2) {
 function parseAgentFile(filePath) {
   let content;
   try {
-    content = import_node_fs28.default.readFileSync(filePath, "utf8");
+    content = import_node_fs29.default.readFileSync(filePath, "utf8");
   } catch {
     return {};
   }
@@ -52897,16 +53042,16 @@ function parseAgentFile(filePath) {
 function scanAgentsDir(dir, source, seen, out) {
   let entries;
   try {
-    entries = import_node_fs28.default.readdirSync(dir, { withFileTypes: true });
+    entries = import_node_fs29.default.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const ent of entries) {
     if (!ent.name.endsWith(".md")) continue;
-    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path30.default.join(dir, ent.name)))) {
+    if (!ent.isFile() && !(ent.isSymbolicLink() && fileExistsSync(import_node_path31.default.join(dir, ent.name)))) {
       continue;
     }
-    const filePath = import_node_path30.default.join(dir, ent.name);
+    const filePath = import_node_path31.default.join(dir, ent.name);
     const baseName = ent.name.replace(/\.md$/, "");
     if (seen.has(baseName)) continue;
     seen.add(baseName);
@@ -52924,12 +53069,12 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
   function walk2(dir, namespaces) {
     let entries;
     try {
-      entries = import_node_fs28.default.readdirSync(dir, { withFileTypes: true });
+      entries = import_node_fs29.default.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
-      const childPath = import_node_path30.default.join(dir, ent.name);
+      const childPath = import_node_path31.default.join(dir, ent.name);
       if (ent.isDirectory() || ent.isSymbolicLink() && isDirLikeSync2(childPath)) {
         walk2(childPath, [...namespaces, ent.name]);
         continue;
@@ -52954,13 +53099,13 @@ function scanPluginAgentsTree(root, pluginName, seen, out) {
   walk2(root, []);
 }
 function readInstalledPlugins2(home) {
-  const pluginsDir = import_node_path30.default.join(home, ".claude", "plugins");
-  const v2 = import_node_path30.default.join(pluginsDir, "installed_plugins_v2.json");
-  const v1 = import_node_path30.default.join(pluginsDir, "installed_plugins.json");
+  const pluginsDir = import_node_path31.default.join(home, ".claude", "plugins");
+  const v2 = import_node_path31.default.join(pluginsDir, "installed_plugins_v2.json");
+  const v1 = import_node_path31.default.join(pluginsDir, "installed_plugins.json");
   let raw = null;
   for (const candidate of [v2, v1]) {
     try {
-      raw = import_node_fs28.default.readFileSync(candidate, "utf8");
+      raw = import_node_fs29.default.readFileSync(candidate, "utf8");
       break;
     } catch {
     }
@@ -52985,19 +53130,19 @@ function readInstalledPlugins2(home) {
   return out;
 }
 function walkUpProjectAgentsDirs(startCwd, home, seen, out) {
-  let cur = import_node_path30.default.resolve(startCwd);
-  const fsRoot = import_node_path30.default.parse(cur).root;
+  let cur = import_node_path31.default.resolve(startCwd);
+  const fsRoot = import_node_path31.default.parse(cur).root;
   while (true) {
-    scanAgentsDir(import_node_path30.default.join(cur, ".claude", "agents"), "project", seen, out);
+    scanAgentsDir(import_node_path31.default.join(cur, ".claude", "agents"), "project", seen, out);
     let hasGit = false;
     try {
-      hasGit = import_node_fs28.default.existsSync(import_node_path30.default.join(cur, ".git"));
+      hasGit = import_node_fs29.default.existsSync(import_node_path31.default.join(cur, ".git"));
     } catch {
     }
     if (hasGit) return;
     if (cur === home) return;
     if (cur === fsRoot) return;
-    const parent = import_node_path30.default.dirname(cur);
+    const parent = import_node_path31.default.dirname(cur);
     if (parent === cur) return;
     cur = parent;
   }
@@ -53032,7 +53177,7 @@ var AgentsScanner = class {
     }
     const fsBlock = [];
     scanAgentsDir(
-      import_node_path30.default.join(this.home, ".claude", "agents"),
+      import_node_path31.default.join(this.home, ".claude", "agents"),
       "global",
       seen,
       fsBlock
@@ -53046,7 +53191,7 @@ var AgentsScanner = class {
       ...this.extraPluginRoots
     ];
     for (const { name, root } of plugins) {
-      const agentsRoot = import_node_path30.default.join(root, "agents");
+      const agentsRoot = import_node_path31.default.join(root, "agents");
       scanPluginAgentsTree(agentsRoot, name, seen, fsBlock);
     }
     return [...builtinBlock, ...fsBlock];
@@ -53054,15 +53199,15 @@ var AgentsScanner = class {
 };
 // src/observer/session-observer.ts
-var import_node_fs30 = __toESM(require("fs"), 1);
+var import_node_fs31 = __toESM(require("fs"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_path33 = __toESM(require("path"), 1);
 init_claude_history();
 // src/observer/subagent-meta-observer.ts
-var import_node_fs29 = __toESM(require("fs"), 1);
+var import_node_fs30 = __toESM(require("fs"), 1);
 var import_node_os10 = __toESM(require("os"), 1);
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_path32 = __toESM(require("path"), 1);
 init_claude_history();
 var META_RE = /^agent-([A-Za-z0-9_-]+)\.meta\.json$/;
 var SubagentMetaObserver = class {
@@ -53075,7 +53220,7 @@ var SubagentMetaObserver = class {
   watches = /* @__PURE__ */ new Map();
   // public for spec only：测试直接拼路径写假 meta.json；生产 start() 内部自己解析
   resolveSubagentDir(cwd, toolSessionId) {
-    return import_node_path31.default.join(
+    return import_node_path32.default.join(
       this.home,
       ".claude",
       "projects",
@@ -53105,7 +53250,7 @@ var SubagentMetaObserver = class {
   attachWatcher(w2) {
     if (w2.watcher) return;
     try {
-      w2.watcher = import_node_fs29.default.watch(w2.dirPath, { persistent: false }, (_evt, name) => {
+      w2.watcher = import_node_fs30.default.watch(w2.dirPath, { persistent: false }, (_evt, name) => {
         if (!name) return;
         const m2 = META_RE.exec(String(name));
         if (!m2) return;
@@ -53117,7 +53262,7 @@ var SubagentMetaObserver = class {
   scan(w2) {
     let entries;
     try {
-      entries = import_node_fs29.default.readdirSync(w2.dirPath);
+      entries = import_node_fs30.default.readdirSync(w2.dirPath);
     } catch {
       return;
     }
@@ -53131,10 +53276,10 @@ var SubagentMetaObserver = class {
     if (!m2) return;
     const agentId = m2[1];
     if (w2.emitted.has(agentId)) return;
-    const file = import_node_path31.default.join(w2.dirPath, name);
+    const file = import_node_path32.default.join(w2.dirPath, name);
     let raw;
     try {
-      raw = import_node_fs29.default.readFileSync(file, "utf8");
+      raw = import_node_fs30.default.readFileSync(file, "utf8");
     } catch {
       return;
     }
@@ -53191,14 +53336,14 @@ var SessionObserver = class {
   metaObserver;
   resolveJsonlPath(cwd, toolSessionId, override) {
     if (override) return override;
-    return import_node_path32.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
+    return import_node_path33.default.join(this.home, ".claude", "projects", cwdToHashDir(cwd), `${toolSessionId}.jsonl`);
   }
   start(args) {
     this.stop(args.sessionId);
     const filePath = this.resolveJsonlPath(args.cwd, args.toolSessionId, args.jsonlPath);
     let size = 0;
     try {
-      size = import_node_fs30.default.statSync(filePath).size;
+      size = import_node_fs31.default.statSync(filePath).size;
     } catch {
     }
     const w2 = {
@@ -53211,16 +53356,16 @@ var SessionObserver = class {
       adapter: args.adapter,
       prevIsRejectSentinel: false,
       toolSessionId: args.toolSessionId,
-      sawFile: import_node_fs30.default.existsSync(filePath),
+      sawFile: import_node_fs31.default.existsSync(filePath),
       lastRelocateScanMs: 0,
       pendingCwdDerive: false,
       lastDeriveMs: 0
     };
     try {
-      import_node_fs30.default.mkdirSync(import_node_path32.default.dirname(filePath), { recursive: true });
+      import_node_fs31.default.mkdirSync(import_node_path33.default.dirname(filePath), { recursive: true });
     } catch {
     }
-    w2.watcher = import_node_fs30.default.watch(import_node_path32.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
+    w2.watcher = import_node_fs31.default.watch(import_node_path33.default.dirname(filePath), { persistent: false }, (_event, changedName) => {
       if (!changedName || !w2.filePath.endsWith(changedName)) return;
       this.poll(w2);
     });
@@ -53243,7 +53388,7 @@ var SessionObserver = class {
   // 异常静默吞，不阻塞 watcher 启动
   hydrateMetaTail(w2, maxLines = 200) {
     try {
-      const raw = import_node_fs30.default.readFileSync(w2.filePath, "utf8");
+      const raw = import_node_fs31.default.readFileSync(w2.filePath, "utf8");
       if (!raw) return;
       const allLines = raw.split("\n").filter((l) => l.trim().length > 0);
       if (allLines.length === 0) return;
@@ -53267,7 +53412,7 @@ var SessionObserver = class {
   poll(w2) {
     let size = 0;
     try {
-      size = import_node_fs30.default.statSync(w2.filePath).size;
+      size = import_node_fs31.default.statSync(w2.filePath).size;
     } catch {
       if (w2.sawFile) this.maybeRelocate(w2);
       return;
@@ -53278,11 +53423,11 @@ var SessionObserver = class {
       w2.buf = "";
     }
     if (size === w2.lastSize) return;
-    const fd = import_node_fs30.default.openSync(w2.filePath, "r");
+    const fd = import_node_fs31.default.openSync(w2.filePath, "r");
     try {
       const len = size - w2.lastSize;
       const buf = Buffer.alloc(len);
-      import_node_fs30.default.readSync(fd, buf, 0, len, w2.lastSize);
+      import_node_fs31.default.readSync(fd, buf, 0, len, w2.lastSize);
       w2.lastSize = size;
       w2.buf += buf.toString("utf8");
       let newlineIndex;
@@ -53305,7 +53450,7 @@ var SessionObserver = class {
         }
       }
     } finally {
-      import_node_fs30.default.closeSync(fd);
+      import_node_fs31.default.closeSync(fd);
     }
     if (w2.pendingCwdDerive) this.maybeDeriveCwd(w2);
   }
@@ -53317,7 +53462,7 @@ var SessionObserver = class {
     const now = Date.now();
     if (now - w2.lastRelocateScanMs < 1e3) return;
     w2.lastRelocateScanMs = now;
-    const projectsRoot = import_node_path32.default.join(this.home, ".claude", "projects");
+    const projectsRoot = import_node_path33.default.join(this.home, ".claude", "projects");
     const found = findTranscriptByToolSessionId(projectsRoot, w2.toolSessionId);
     if (!found || found === w2.filePath) return;
     try {
@@ -53326,7 +53471,7 @@ var SessionObserver = class {
     }
     w2.filePath = found;
     try {
-      w2.watcher = import_node_fs30.default.watch(import_node_path32.default.dirname(found), { persistent: false }, (_event, changedName) => {
+      w2.watcher = import_node_fs31.default.watch(import_node_path33.default.dirname(found), { persistent: false }, (_event, changedName) => {
         if (!changedName || !w2.filePath.endsWith(changedName)) return;
         this.poll(w2);
       });
@@ -54121,8 +54266,8 @@ async function authenticate(token, deps) {
 }
 // src/legacy-cleanup.ts
-var fs35 = __toESM(require("fs/promises"), 1);
-var path37 = __toESM(require("path"), 1);
+var fs36 = __toESM(require("fs/promises"), 1);
+var path38 = __toESM(require("path"), 1);
 var LEGACY_FILES = [
   "personal-capability.json",
   "received-capabilities.json",
@@ -54131,9 +54276,9 @@ var LEGACY_FILES = [
 async function cleanupLegacyCapabilityFiles(dataDir, logger) {
   const removed = [];
   for (const name of LEGACY_FILES) {
-    const p2 = path37.join(dataDir, name);
+    const p2 = path38.join(dataDir, name);
     try {
-      await fs35.unlink(p2);
+      await fs36.unlink(p2);
       removed.push(name);
       logger.debug("legacy capability file removed", { file: name });
     } catch (err) {
@@ -54145,13 +54290,13 @@ async function cleanupLegacyCapabilityFiles(dataDir, logger) {
 }
 // src/inbox/inbox-store.ts
-var fs36 = __toESM(require("fs"), 1);
-var path38 = __toESM(require("path"), 1);
+var fs37 = __toESM(require("fs"), 1);
+var path39 = __toESM(require("path"), 1);
 var INBOX_SUBDIR = "inbox";
 var InboxStore = class {
   constructor(dataDir) {
     this.dataDir = dataDir;
-    fs36.mkdirSync(this.dirPath(), { recursive: true });
+    fs37.mkdirSync(this.dirPath(), { recursive: true });
   }
   dataDir;
   /**
@@ -54163,7 +54308,7 @@ var InboxStore = class {
     const file = this.filePath(peerDeviceId);
     let raw;
     try {
-      raw = fs36.readFileSync(file, "utf8");
+      raw = fs37.readFileSync(file, "utf8");
     } catch (err) {
       if (err?.code === "ENOENT") return [];
       return [];
@@ -54179,7 +54324,7 @@ var InboxStore = class {
     const dir = this.dirPath();
     let entries;
     try {
-      entries = fs36.readdirSync(dir);
+      entries = fs37.readdirSync(dir);
     } catch (err) {
       if (err?.code === "ENOENT") return [];
       return [];
@@ -54195,9 +54340,9 @@ var InboxStore = class {
     if (existing.some((m2) => m2.id === message.id)) return;
     const file = this.filePath(message.peerDeviceId);
     const line = JSON.stringify(message) + "\n";
-    fs36.appendFileSync(file, line, { mode: 384 });
+    fs37.appendFileSync(file, line, { mode: 384 });
     try {
-      fs36.chmodSync(file, 384);
+      fs37.chmodSync(file, 384);
     } catch {
     }
   }
@@ -54227,7 +54372,7 @@ var InboxStore = class {
   removeByPeerDeviceId(peerDeviceId) {
     const file = this.filePath(peerDeviceId);
     try {
-      fs36.unlinkSync(file);
+      fs37.unlinkSync(file);
     } catch (err) {
       if (err?.code === "ENOENT") return;
     }
@@ -54236,18 +54381,18 @@ var InboxStore = class {
     const file = this.filePath(peerDeviceId);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
     const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
-    fs36.writeFileSync(tmp, content, { mode: 384 });
-    fs36.renameSync(tmp, file);
+    fs37.writeFileSync(tmp, content, { mode: 384 });
+    fs37.renameSync(tmp, file);
     try {
-      fs36.chmodSync(file, 384);
+      fs37.chmodSync(file, 384);
     } catch {
     }
   }
   dirPath() {
-    return path38.join(this.dataDir, INBOX_SUBDIR);
+    return path39.join(this.dataDir, INBOX_SUBDIR);
   }
   filePath(peerDeviceId) {
-    return path38.join(this.dirPath(), `${peerDeviceId}.jsonl`);
+    return path39.join(this.dirPath(), `${peerDeviceId}.jsonl`);
   }
 };
 function parseAllLines(raw) {
@@ -54335,8 +54480,8 @@ var InboxManager = class {
 };
 // src/state/contact-store.ts
-var fs37 = __toESM(require("fs"), 1);
-var path39 = __toESM(require("path"), 1);
+var fs38 = __toESM(require("fs"), 1);
+var path40 = __toESM(require("path"), 1);
 var FILE_NAME = "contacts.json";
 var ContactStore = class {
   constructor(dataDir) {
@@ -54346,10 +54491,10 @@ var ContactStore = class {
   contacts = /* @__PURE__ */ new Map();
   load() {
     this.contacts.clear();
-    const file = path39.join(this.dataDir, FILE_NAME);
+    const file = path40.join(this.dataDir, FILE_NAME);
     let raw;
     try {
-      raw = fs37.readFileSync(file, "utf8");
+      raw = fs38.readFileSync(file, "utf8");
     } catch (err) {
       if (err?.code !== "ENOENT") this.renameBak(file);
       return;
@@ -54418,20 +54563,20 @@ var ContactStore = class {
     return true;
   }
   flush() {
-    const file = path39.join(this.dataDir, FILE_NAME);
+    const file = path40.join(this.dataDir, FILE_NAME);
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
     const content = JSON.stringify(
       { contacts: Array.from(this.contacts.values()) },
       null,
       2
     );
-    fs37.mkdirSync(this.dataDir, { recursive: true });
-    fs37.writeFileSync(tmp, content, { mode: 384 });
-    fs37.renameSync(tmp, file);
+    fs38.mkdirSync(this.dataDir, { recursive: true });
+    fs38.writeFileSync(tmp, content, { mode: 384 });
+    fs38.renameSync(tmp, file);
   }
   renameBak(file) {
     try {
-      fs37.renameSync(file, `${file}.bak`);
+      fs38.renameSync(file, `${file}.bak`);
     } catch {
     }
   }
@@ -54539,61 +54684,61 @@ async function connectRemote(args) {
 }
 // src/migrations/2026-05-20-flatten-sessions.ts
-var fs38 = __toESM(require("fs"), 1);
-var path40 = __toESM(require("path"), 1);
+var fs39 = __toESM(require("fs"), 1);
+var path41 = __toESM(require("path"), 1);
 var MIGRATION_FLAG_NAME = ".migration.v1.done";
 function migrateFlattenSessions(opts) {
   const dataDir = opts.dataDir;
   const now = opts.now ?? Date.now;
-  const sessionsDir = path40.join(dataDir, "sessions");
-  const flagPath = path40.join(sessionsDir, MIGRATION_FLAG_NAME);
+  const sessionsDir = path41.join(dataDir, "sessions");
+  const flagPath = path41.join(sessionsDir, MIGRATION_FLAG_NAME);
   if (existsSync3(flagPath)) {
     return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
   }
   let movedBare = 0;
   let movedVmOwner = 0;
   let archivedListener = 0;
-  const defaultDir = path40.join(sessionsDir, "default");
+  const defaultDir = path41.join(sessionsDir, "default");
   if (existsSync3(defaultDir)) {
     for (const entry of readdirSafe(defaultDir)) {
       if (!entry.endsWith(".json")) continue;
-      const src = path40.join(defaultDir, entry);
-      const dst = path40.join(sessionsDir, entry);
-      fs38.renameSync(src, dst);
+      const src = path41.join(defaultDir, entry);
+      const dst = path41.join(sessionsDir, entry);
+      fs39.renameSync(src, dst);
       movedBare += 1;
     }
     rmdirIfEmpty(defaultDir);
   }
   for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path40.join(sessionsDir, pid);
+    const personaDir = path41.join(sessionsDir, pid);
     if (!isDir(personaDir)) continue;
     if (pid === "default") continue;
-    const ownerSrc = path40.join(personaDir, "owner");
+    const ownerSrc = path41.join(personaDir, "owner");
     if (existsSync3(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path40.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
-      fs38.mkdirSync(ownerDst, { recursive: true });
+      const ownerDst = path41.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      fs39.mkdirSync(ownerDst, { recursive: true });
       for (const file of readdirSafe(ownerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs38.renameSync(path40.join(ownerSrc, file), path40.join(ownerDst, file));
+        fs39.renameSync(path41.join(ownerSrc, file), path41.join(ownerDst, file));
         movedVmOwner += 1;
       }
       rmdirIfEmpty(ownerSrc);
     }
-    const listenerSrc = path40.join(personaDir, "listener");
+    const listenerSrc = path41.join(personaDir, "listener");
     if (existsSync3(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path40.join(dataDir, ".legacy", `listener-${pid}`);
-      fs38.mkdirSync(archiveDst, { recursive: true });
+      const archiveDst = path41.join(dataDir, ".legacy", `listener-${pid}`);
+      fs39.mkdirSync(archiveDst, { recursive: true });
       for (const file of readdirSafe(listenerSrc)) {
         if (!file.endsWith(".json")) continue;
-        fs38.renameSync(path40.join(listenerSrc, file), path40.join(archiveDst, file));
+        fs39.renameSync(path41.join(listenerSrc, file), path41.join(archiveDst, file));
         archivedListener += 1;
       }
       rmdirIfEmpty(listenerSrc);
     }
     rmdirIfEmpty(personaDir);
   }
-  fs38.mkdirSync(sessionsDir, { recursive: true });
-  fs38.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
+  fs39.mkdirSync(sessionsDir, { recursive: true });
+  fs39.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
   return {
     skipped: false,
     flagWritten: true,
@@ -54604,7 +54749,7 @@ function migrateFlattenSessions(opts) {
 }
 function existsSync3(p2) {
   try {
-    fs38.statSync(p2);
+    fs39.statSync(p2);
     return true;
   } catch {
     return false;
@@ -54612,31 +54757,31 @@ function existsSync3(p2) {
 }
 function isDir(p2) {
   try {
-    return fs38.statSync(p2).isDirectory();
+    return fs39.statSync(p2).isDirectory();
   } catch {
     return false;
   }
 }
 function readdirSafe(p2) {
   try {
-    return fs38.readdirSync(p2);
+    return fs39.readdirSync(p2);
   } catch {
     return [];
   }
 }
 function rmdirIfEmpty(p2) {
   try {
-    fs38.rmdirSync(p2);
+    fs39.rmdirSync(p2);
   } catch {
   }
 }
 // src/transport/http-router.ts
-var import_node_fs32 = __toESM(require("fs"), 1);
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_fs33 = __toESM(require("fs"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 // src/attachment/mime.ts
-var import_node_path33 = __toESM(require("path"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -54743,7 +54888,7 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path33.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path34.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
@@ -54813,8 +54958,8 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
 }
 // src/attachment/upload.ts
-var import_node_fs31 = __toESM(require("fs"), 1);
-var import_node_path34 = __toESM(require("path"), 1);
+var import_node_fs32 = __toESM(require("fs"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
 var import_node_crypto8 = __toESM(require("crypto"), 1);
 var import_promises3 = require("stream/promises");
 var UploadError = class extends Error {
@@ -54826,22 +54971,22 @@ var UploadError = class extends Error {
   code;
 };
 function assertValidFileName(fileName) {
-  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path34.default.basename(fileName)) {
+  if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.startsWith(".") || fileName.includes("/") || fileName.includes("\\") || fileName !== import_node_path35.default.basename(fileName)) {
     throw new UploadError("INVALID_FILENAME", `fileName must be a plain basename, got: ${fileName}`);
   }
 }
 var HASH_PREFIX_LEN = 16;
 async function writeUploadedAttachment(args) {
   assertValidFileName(args.fileName);
-  const attachmentsRoot = import_node_path34.default.join(args.sessionDir, ".attachments");
+  const attachmentsRoot = import_node_path35.default.join(args.baseDir, ".attachments");
   try {
-    import_node_fs31.default.mkdirSync(attachmentsRoot, { recursive: true });
+    import_node_fs32.default.mkdirSync(attachmentsRoot, { recursive: true });
   } catch (err) {
     throw new UploadError("STORAGE_ERROR", `mkdir failed: ${err.message}`);
   }
   const hasher = import_node_crypto8.default.createHash("sha256");
   let actualSize = 0;
-  const tmpPath = import_node_path34.default.join(
+  const tmpPath = import_node_path35.default.join(
     attachmentsRoot,
     `.upload-${process.pid}-${Date.now()}-${import_node_crypto8.default.randomBytes(4).toString("hex")}`
   );
@@ -54856,18 +55001,18 @@ async function writeUploadedAttachment(args) {
           yield buf;
         }
       },
-      import_node_fs31.default.createWriteStream(tmpPath, { mode: 384 })
+      import_node_fs32.default.createWriteStream(tmpPath, { mode: 384 })
     );
   } catch (err) {
     try {
-      import_node_fs31.default.unlinkSync(tmpPath);
+      import_node_fs32.default.unlinkSync(tmpPath);
     } catch {
     }
     throw new UploadError("STORAGE_ERROR", `write failed: ${err.message}`);
   }
   if (actualSize !== args.contentLength) {
     try {
-      import_node_fs31.default.unlinkSync(tmpPath);
+      import_node_fs32.default.unlinkSync(tmpPath);
     } catch {
     }
     throw new UploadError(
@@ -54876,35 +55021,35 @@ async function writeUploadedAttachment(args) {
     );
   }
   const attachmentId = hasher.digest("hex").slice(0, HASH_PREFIX_LEN);
-  const hashDir = import_node_path34.default.join(attachmentsRoot, attachmentId);
+  const hashDir = import_node_path35.default.join(attachmentsRoot, attachmentId);
   let finalFileName;
   let hashDirExists = false;
   try {
-    hashDirExists = import_node_fs31.default.statSync(hashDir).isDirectory();
+    hashDirExists = import_node_fs32.default.statSync(hashDir).isDirectory();
   } catch {
   }
   if (hashDirExists) {
-    const existing = import_node_fs31.default.readdirSync(hashDir).filter((n) => !n.startsWith("."));
+    const existing = import_node_fs32.default.readdirSync(hashDir).filter((n) => !n.startsWith("."));
     finalFileName = existing[0] ?? args.fileName;
     try {
-      import_node_fs31.default.unlinkSync(tmpPath);
+      import_node_fs32.default.unlinkSync(tmpPath);
     } catch {
     }
   } else {
     try {
-      import_node_fs31.default.mkdirSync(hashDir, { recursive: true });
+      import_node_fs32.default.mkdirSync(hashDir, { recursive: true });
       finalFileName = args.fileName;
-      import_node_fs31.default.renameSync(tmpPath, import_node_path34.default.join(hashDir, finalFileName));
+      import_node_fs32.default.renameSync(tmpPath, import_node_path35.default.join(hashDir, finalFileName));
     } catch (err) {
       try {
-        import_node_fs31.default.unlinkSync(tmpPath);
+        import_node_fs32.default.unlinkSync(tmpPath);
       } catch {
       }
       throw new UploadError("STORAGE_ERROR", `rename failed: ${err.message}`);
     }
   }
-  const absPath = import_node_path34.default.join(hashDir, finalFileName);
-  const relPath = import_node_path34.default.relative(args.sessionDir, absPath);
+  const absPath = import_node_path35.default.join(hashDir, finalFileName);
+  const relPath = absPath;
   args.groupFileStore.upsert(args.scope, args.sessionId, {
     relPath: absPath,
     // 存绝对路径，与现有 agent 入清单的形态一致（attachment.ts:144 双形态兼容）
@@ -54918,7 +55063,7 @@ async function writeUploadedAttachment(args) {
 // src/extension/import.ts
 var import_promises4 = __toESM(require("fs/promises"), 1);
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
 var import_node_os12 = __toESM(require("os"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
 var ImportError = class extends Error {
@@ -54936,7 +55081,7 @@ async function importZip(buf, root) {
     throw new ImportError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path35.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path36.default.isAbsolute(name)) {
       throw new ImportError("ZIP_INVALID", `unsafe zip entry path: ${name}`);
     }
   }
@@ -54969,7 +55114,7 @@ async function importZip(buf, root) {
       );
     }
   }
-  const destDir = import_node_path35.default.join(root, manifest.id);
+  const destDir = import_node_path36.default.join(root, manifest.id);
   let destExists = false;
   try {
     await import_promises4.default.access(destDir);
@@ -54979,15 +55124,15 @@ async function importZip(buf, root) {
   if (destExists) {
     throw new ImportError("ALREADY_EXISTS", `extension ${manifest.id} already installed`);
   }
-  const stage = await import_promises4.default.mkdtemp(import_node_path35.default.join(import_node_os12.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
+  const stage = await import_promises4.default.mkdtemp(import_node_path36.default.join(import_node_os12.default.tmpdir(), `clawd-ext-stage-${manifest.id}-`));
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path35.default.join(stage, name);
+      const dest = import_node_path36.default.join(stage, name);
       if (entry.dir) {
         await import_promises4.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises4.default.mkdir(import_node_path35.default.dirname(dest), { recursive: true });
+      await import_promises4.default.mkdir(import_node_path36.default.dirname(dest), { recursive: true });
       const content = await entry.async("nodebuffer");
       await import_promises4.default.writeFile(dest, content);
     }
@@ -55017,7 +55162,7 @@ var SHARE_UI_ASSET_MIME = {
   ".wasm": "application/wasm"
 };
 function shareUiAssetMime(filePath) {
-  const ext = import_node_path36.default.extname(filePath).toLowerCase();
+  const ext = import_node_path37.default.extname(filePath).toLowerCase();
   return SHARE_UI_ASSET_MIME[ext] ?? lookupMime(filePath);
 }
 var AUTHED_RPC_ROUTE_PREFIX = "/rpc/";
@@ -55116,7 +55261,7 @@ function isValidUploadFileName(fileName) {
   if (fileName === "." || fileName === "..") return false;
   if (fileName.startsWith(".")) return false;
   if (fileName.includes("/") || fileName.includes("\\")) return false;
-  return fileName === import_node_path36.default.basename(fileName);
+  return fileName === import_node_path37.default.basename(fileName);
 }
 function createHttpRouter(deps) {
   return async (req, res) => {
@@ -55204,7 +55349,7 @@ function createHttpRouter(deps) {
       }
       let buf;
       try {
-        buf = await import_node_fs32.default.promises.readFile(abs);
+        buf = await import_node_fs33.default.promises.readFile(abs);
       } catch {
         sendJson(res, 404, { code: "NOT_FOUND", message: "asset not found" });
         return true;
@@ -55352,7 +55497,7 @@ function createHttpRouter(deps) {
         sendHtml(res, statusByCode[r.code], loader.renderErrorHtml(r.code, msgByCode[r.code]));
         return true;
       }
-      sendHtml(res, 200, loader.renderViewerHtml(import_node_path36.default.basename(r.absPath)));
+      sendHtml(res, 200, loader.renderViewerHtml(import_node_path37.default.basename(r.absPath)));
       return true;
     }
     const ctx = deps.authResolver.resolveFromHeader(
@@ -55411,9 +55556,9 @@ function createHttpRouter(deps) {
         });
         return true;
       }
-      const sessionDir = up.getSessionDir(sessionId);
+      const baseDir = up.getAttachmentBaseDir(sessionId);
       const scope = up.getSessionScope(sessionId);
-      if (!sessionDir || !scope) {
+      if (!baseDir || !scope) {
         sendUploadJson(404, { code: "NOT_FOUND", message: `session ${sessionId} not found` });
         return true;
       }
@@ -55435,7 +55580,7 @@ function createHttpRouter(deps) {
       }
       try {
         const result = await writeUploadedAttachment({
-          sessionDir,
+          baseDir,
           sessionId,
           scope,
           fileName,
@@ -55473,7 +55618,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path36.default.isAbsolute(pathParam)) {
+      if (import_node_path37.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -55481,7 +55626,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path36.default.join(file.cwd, pathParam);
+        absPath = import_node_path37.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -55568,7 +55713,7 @@ function withCtx(ctx, body) {
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs32.default.statSync(absPath);
+    stat = import_node_fs33.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -55583,7 +55728,7 @@ function streamFile(res, absPath, logger) {
     return;
   }
   const mime = lookupMime(absPath);
-  const basename = import_node_path36.default.basename(absPath);
+  const basename = import_node_path37.default.basename(absPath);
   res.writeHead(200, {
     "Content-Type": mime,
     "Content-Length": String(stat.size),
@@ -55591,7 +55736,7 @@ function streamFile(res, absPath, logger) {
     // 防止浏览器把任意 mime 当 html 渲染
     "X-Content-Type-Options": "nosniff"
   });
-  const stream = import_node_fs32.default.createReadStream(absPath);
+  const stream = import_node_fs33.default.createReadStream(absPath);
   stream.on("error", (err) => {
     logger?.warn("streamFile read error", { absPath, err: err.message });
     res.destroy();
@@ -55600,8 +55745,8 @@ function streamFile(res, absPath, logger) {
 }
 // src/attachment/gc.ts
-var import_node_fs33 = __toESM(require("fs"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_fs34 = __toESM(require("fs"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
 var DEFAULT_TTL_MS = 30 * 24 * 3600 * 1e3;
 function runAttachmentGc(args) {
   const now = (args.now ?? Date.now)();
@@ -55610,66 +55755,75 @@ function runAttachmentGc(args) {
   for (const { scope, sessionId } of args.sessionScopes) {
     for (const entry of args.groupFileStore.list(scope, sessionId)) {
       if (entry.stale) continue;
-      if (import_node_path37.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
+      if (import_node_path38.default.isAbsolute(entry.relPath)) liveAbs.add(entry.relPath);
     }
   }
+  const visited = /* @__PURE__ */ new Set();
   for (const { scope, sessionId } of args.sessionScopes) {
-    const sessionDir = args.getSessionCwd?.(sessionId) ?? import_node_path37.default.join(
+    const legacyDir = args.getSessionCwd?.(sessionId) ?? import_node_path38.default.join(
       args.dataDir,
       "sessions",
       ...scopeSubPath(scope).map(safeFileName),
       safeFileName(sessionId)
     );
-    const attRoot = import_node_path37.default.join(sessionDir, ".attachments");
-    let hashDirs;
-    try {
-      hashDirs = import_node_fs33.default.readdirSync(attRoot);
-    } catch (err) {
-      if (err.code === "ENOENT") continue;
-      args.logger?.warn("attachment gc: readdir failed", { attRoot, err: err.message });
-      continue;
-    }
-    for (const hashDir of hashDirs) {
-      const hashDirAbs = import_node_path37.default.join(attRoot, hashDir);
-      let files;
+    const userWorkDir = args.getUserWorkDir?.(sessionId) ?? null;
+    const roots = [legacyDir, ...userWorkDir ? [userWorkDir] : []].filter((r) => {
+      if (visited.has(r)) return false;
+      visited.add(r);
+      return true;
+    });
+    for (const rootDir of roots) {
+      const attRoot = import_node_path38.default.join(rootDir, ".attachments");
+      let hashDirs;
       try {
-        files = import_node_fs33.default.readdirSync(hashDirAbs);
-      } catch {
+        hashDirs = import_node_fs34.default.readdirSync(attRoot);
+      } catch (err) {
+        if (err.code === "ENOENT") continue;
+        args.logger?.warn("attachment gc: readdir failed", { attRoot, err: err.message });
         continue;
       }
-      for (const name of files) {
-        const file = import_node_path37.default.join(hashDirAbs, name);
-        let stat;
+      for (const hashDir of hashDirs) {
+        const hashDirAbs = import_node_path38.default.join(attRoot, hashDir);
+        let files;
         try {
-          stat = import_node_fs33.default.statSync(file);
+          files = import_node_fs34.default.readdirSync(hashDirAbs);
         } catch {
           continue;
         }
-        if (!stat.isFile()) continue;
-        const age = now - stat.mtimeMs;
-        if (age < ttlMs) continue;
-        if (liveAbs.has(file)) continue;
+        for (const name of files) {
+          const file = import_node_path38.default.join(hashDirAbs, name);
+          let stat;
+          try {
+            stat = import_node_fs34.default.statSync(file);
+          } catch {
+            continue;
+          }
+          if (!stat.isFile()) continue;
+          const age = now - stat.mtimeMs;
+          if (age < ttlMs) continue;
+          if (liveAbs.has(file)) continue;
+          try {
+            import_node_fs34.default.unlinkSync(file);
+          } catch (err) {
+            args.logger?.warn("attachment gc: unlink failed", { file, err: err.message });
+          }
+        }
         try {
-          import_node_fs33.default.unlinkSync(file);
-        } catch (err) {
-          args.logger?.warn("attachment gc: unlink failed", { file, err: err.message });
+          if (import_node_fs34.default.readdirSync(hashDirAbs).length === 0) import_node_fs34.default.rmdirSync(hashDirAbs);
+        } catch {
         }
       }
       try {
-        if (import_node_fs33.default.readdirSync(hashDirAbs).length === 0) import_node_fs33.default.rmdirSync(hashDirAbs);
+        if (import_node_fs34.default.readdirSync(attRoot).length === 0) import_node_fs34.default.rmdirSync(attRoot);
       } catch {
       }
     }
-    try {
-      if (import_node_fs33.default.readdirSync(attRoot).length === 0) import_node_fs33.default.rmdirSync(attRoot);
-    } catch {
-    }
   }
 }
 // src/attachment/group.ts
-var import_node_fs34 = __toESM(require("fs"), 1);
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_fs35 = __toESM(require("fs"), 1);
+var import_node_path39 = __toESM(require("path"), 1);
 var import_node_crypto9 = __toESM(require("crypto"), 1);
 init_protocol();
 var GroupFileStore = class {
@@ -55681,11 +55835,11 @@ var GroupFileStore = class {
     this.logger = opts.logger;
   }
   rootForScope(scope) {
-    return import_node_path38.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+    return import_node_path39.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
   }
   /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
   filePath(scope, sessionId) {
-    return import_node_path38.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+    return import_node_path39.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
   }
   cacheKey(scope, sessionId) {
     return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
@@ -55694,7 +55848,7 @@ var GroupFileStore = class {
   readFile(scope, sessionId) {
     const file = this.filePath(scope, sessionId);
     try {
-      const raw = import_node_fs34.default.readFileSync(file, "utf8");
+      const raw = import_node_fs35.default.readFileSync(file, "utf8");
       const parsed = JSON.parse(raw);
       if (!Array.isArray(parsed)) {
         this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
@@ -55720,10 +55874,10 @@ var GroupFileStore = class {
   }
   writeFile(scope, sessionId, entries) {
     const file = this.filePath(scope, sessionId);
-    import_node_fs34.default.mkdirSync(import_node_path38.default.dirname(file), { recursive: true });
+    import_node_fs35.default.mkdirSync(import_node_path39.default.dirname(file), { recursive: true });
     const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs34.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs34.default.renameSync(tmp, file);
+    import_node_fs35.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs35.default.renameSync(tmp, file);
   }
   /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
   list(scope, sessionId) {
@@ -55809,10 +55963,10 @@ var GroupFileStore = class {
 };
 // src/discovery/state-file.ts
-var import_node_fs35 = __toESM(require("fs"), 1);
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_fs36 = __toESM(require("fs"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 function defaultStateFilePath(dataDir) {
-  return import_node_path39.default.join(dataDir, "state.json");
+  return import_node_path40.default.join(dataDir, "state.json");
 }
 function isPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
@@ -55834,7 +55988,7 @@ var StateFileManager = class {
   }
   read() {
     try {
-      const raw = import_node_fs35.default.readFileSync(this.file, "utf8");
+      const raw = import_node_fs36.default.readFileSync(this.file, "utf8");
       const parsed = JSON.parse(raw);
       return parsed;
     } catch {
@@ -55848,20 +56002,20 @@ var StateFileManager = class {
     return { status: "stale", existing };
   }
   write(state) {
-    import_node_fs35.default.mkdirSync(import_node_path39.default.dirname(this.file), { recursive: true });
+    import_node_fs36.default.mkdirSync(import_node_path40.default.dirname(this.file), { recursive: true });
     const tmp = `${this.file}.tmp.${process.pid}.${Date.now()}`;
-    import_node_fs35.default.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
-    import_node_fs35.default.renameSync(tmp, this.file);
+    import_node_fs36.default.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
+    import_node_fs36.default.renameSync(tmp, this.file);
     if (process.platform !== "win32") {
       try {
-        import_node_fs35.default.chmodSync(this.file, 384);
+        import_node_fs36.default.chmodSync(this.file, 384);
       } catch {
       }
     }
   }
   delete() {
     try {
-      import_node_fs35.default.unlinkSync(this.file);
+      import_node_fs36.default.unlinkSync(this.file);
     } catch {
     }
   }
@@ -55875,14 +56029,14 @@ function readSpawnedByDesktopFromEnv(env = process.env) {
 }
 // src/tunnel/tunnel-manager.ts
-var import_node_fs39 = __toESM(require("fs"), 1);
-var import_node_path43 = __toESM(require("path"), 1);
+var import_node_fs40 = __toESM(require("fs"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 var import_node_crypto10 = __toESM(require("crypto"), 1);
 var import_node_child_process9 = require("child_process");
 // src/tunnel/tunnel-store.ts
-var import_node_fs36 = __toESM(require("fs"), 1);
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_fs37 = __toESM(require("fs"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var TunnelStore = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -55890,7 +56044,7 @@ var TunnelStore = class {
   filePath;
   async get() {
     try {
-      const raw = await import_node_fs36.default.promises.readFile(this.filePath, "utf8");
+      const raw = await import_node_fs37.default.promises.readFile(this.filePath, "utf8");
       const obj = JSON.parse(raw);
       if (!isPersistedTunnel(obj)) return null;
       return obj;
@@ -55901,22 +56055,22 @@ var TunnelStore = class {
     }
   }
   async set(v2) {
-    const dir = import_node_path40.default.dirname(this.filePath);
-    await import_node_fs36.default.promises.mkdir(dir, { recursive: true });
+    const dir = import_node_path41.default.dirname(this.filePath);
+    await import_node_fs37.default.promises.mkdir(dir, { recursive: true });
     const data = JSON.stringify(v2, null, 2);
     const tmp = `${this.filePath}.tmp.${process.pid}.${Date.now()}`;
-    await import_node_fs36.default.promises.writeFile(tmp, data, { mode: 384 });
+    await import_node_fs37.default.promises.writeFile(tmp, data, { mode: 384 });
     if (process.platform !== "win32") {
       try {
-        await import_node_fs36.default.promises.chmod(tmp, 384);
+        await import_node_fs37.default.promises.chmod(tmp, 384);
       } catch {
       }
     }
-    await import_node_fs36.default.promises.rename(tmp, this.filePath);
+    await import_node_fs37.default.promises.rename(tmp, this.filePath);
   }
   async clear() {
     try {
-      await import_node_fs36.default.promises.unlink(this.filePath);
+      await import_node_fs37.default.promises.unlink(this.filePath);
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") throw err;
@@ -56011,9 +56165,9 @@ function escape(v2) {
 }
 // src/tunnel/frpc-binary.ts
-var import_node_fs37 = __toESM(require("fs"), 1);
+var import_node_fs38 = __toESM(require("fs"), 1);
 var import_node_os13 = __toESM(require("os"), 1);
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 var import_node_child_process7 = require("child_process");
 var import_node_stream3 = require("stream");
 var import_promises5 = require("stream/promises");
@@ -56045,20 +56199,20 @@ function frpcDownloadUrl(version2, p2) {
 }
 async function ensureFrpcBinary(opts) {
   if (opts.override) {
-    if (!import_node_fs37.default.existsSync(opts.override)) {
+    if (!import_node_fs38.default.existsSync(opts.override)) {
       throw new Error(`frpc binary not found at override path: ${opts.override}`);
     }
     return opts.override;
   }
   const version2 = opts.version ?? FRPC_VERSION;
   const platform = opts.platform ?? detectPlatform();
-  const binDir = import_node_path41.default.join(opts.dataDir, "bin");
-  import_node_fs37.default.mkdirSync(binDir, { recursive: true });
+  const binDir = import_node_path42.default.join(opts.dataDir, "bin");
+  import_node_fs38.default.mkdirSync(binDir, { recursive: true });
   cleanupStaleArtifacts(binDir);
-  const stableBin = import_node_path41.default.join(binDir, "frpc");
-  if (import_node_fs37.default.existsSync(stableBin)) return stableBin;
+  const stableBin = import_node_path42.default.join(binDir, "frpc");
+  if (import_node_fs38.default.existsSync(stableBin)) return stableBin;
   const partialBin = `${stableBin}.partial`;
-  const tarballPath = import_node_path41.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
+  const tarballPath = import_node_path42.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
   try {
     const url = frpcDownloadUrl(version2, platform);
     await downloadToFile(url, tarballPath, opts.fetchImpl);
@@ -56067,8 +56221,8 @@ async function ensureFrpcBinary(opts) {
     } else {
       await extractFrpcFromTarball(tarballPath, binDir, version2, platform, partialBin);
     }
-    import_node_fs37.default.chmodSync(partialBin, 493);
-    import_node_fs37.default.renameSync(partialBin, stableBin);
+    import_node_fs38.default.chmodSync(partialBin, 493);
+    import_node_fs38.default.renameSync(partialBin, stableBin);
   } finally {
     safeUnlink(tarballPath);
     safeUnlink(partialBin);
@@ -56078,15 +56232,15 @@ async function ensureFrpcBinary(opts) {
 function cleanupStaleArtifacts(binDir) {
   let entries;
   try {
-    entries = import_node_fs37.default.readdirSync(binDir);
+    entries = import_node_fs38.default.readdirSync(binDir);
   } catch {
     return;
   }
   for (const name of entries) {
     if (name.endsWith(".partial") || name.startsWith("extract-")) {
-      const full = import_node_path41.default.join(binDir, name);
+      const full = import_node_path42.default.join(binDir, name);
       try {
-        import_node_fs37.default.rmSync(full, { recursive: true, force: true });
+        import_node_fs38.default.rmSync(full, { recursive: true, force: true });
       } catch {
       }
     }
@@ -56094,7 +56248,7 @@ function cleanupStaleArtifacts(binDir) {
 }
 function safeUnlink(p2) {
   try {
-    import_node_fs37.default.unlinkSync(p2);
+    import_node_fs38.default.unlinkSync(p2);
   } catch {
   }
 }
@@ -56105,13 +56259,13 @@ async function downloadToFile(url, dest, fetchImpl) {
   if (!res.ok || !res.body) {
     throw new Error(`download failed: ${res.status} ${res.statusText}`);
   }
-  const out = import_node_fs37.default.createWriteStream(dest);
+  const out = import_node_fs38.default.createWriteStream(dest);
   const nodeStream = import_node_stream3.Readable.fromWeb(res.body);
   await (0, import_promises5.pipeline)(nodeStream, out);
 }
 async function extractFrpcFromTarball(tarball, binDir, version2, platform, destBin) {
-  const work = import_node_path41.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
-  import_node_fs37.default.mkdirSync(work, { recursive: true });
+  const work = import_node_path42.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
+  import_node_fs38.default.mkdirSync(work, { recursive: true });
   try {
     await new Promise((resolve6, reject) => {
       const proc = (0, import_node_child_process7.spawn)("tar", ["xzf", tarball, "-C", work], { stdio: "pipe" });
@@ -56119,32 +56273,32 @@ async function extractFrpcFromTarball(tarball, binDir, version2, platform, destB
       proc.on("exit", (code) => code === 0 ? resolve6() : reject(new Error(`tar exited ${code}`)));
     });
     const dirName = `frp_${version2}_${platform.os}_${platform.arch}`;
-    const src = import_node_path41.default.join(work, dirName, "frpc");
-    if (!import_node_fs37.default.existsSync(src)) {
+    const src = import_node_path42.default.join(work, dirName, "frpc");
+    if (!import_node_fs38.default.existsSync(src)) {
       throw new Error(`frpc not found inside tarball at ${src}`);
     }
-    import_node_fs37.default.copyFileSync(src, destBin);
+    import_node_fs38.default.copyFileSync(src, destBin);
   } finally {
-    import_node_fs37.default.rmSync(work, { recursive: true, force: true });
+    import_node_fs38.default.rmSync(work, { recursive: true, force: true });
   }
 }
 // src/tunnel/frpc-process.ts
-var import_node_fs38 = __toESM(require("fs"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
+var import_node_fs39 = __toESM(require("fs"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
 var import_node_child_process8 = require("child_process");
 function frpcPidFilePath(dataDir) {
-  return import_node_path42.default.join(dataDir, "frpc.pid");
+  return import_node_path43.default.join(dataDir, "frpc.pid");
 }
 function writeFrpcPid(dataDir, pid) {
   try {
-    import_node_fs38.default.writeFileSync(frpcPidFilePath(dataDir), String(pid), { mode: 384 });
+    import_node_fs39.default.writeFileSync(frpcPidFilePath(dataDir), String(pid), { mode: 384 });
   } catch {
   }
 }
 function clearFrpcPid(dataDir) {
   try {
-    import_node_fs38.default.unlinkSync(frpcPidFilePath(dataDir));
+    import_node_fs39.default.unlinkSync(frpcPidFilePath(dataDir));
   } catch {
   }
 }
@@ -56160,7 +56314,7 @@ function defaultIsPidAlive(pid) {
 }
 function defaultReadPidFile(file) {
   try {
-    return import_node_fs38.default.readFileSync(file, "utf8");
+    return import_node_fs39.default.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -56176,7 +56330,7 @@ function defaultSleep2(ms) {
 }
 async function killStaleFrpc(deps) {
   const pidFile = frpcPidFilePath(deps.dataDir);
-  const tomlPath = import_node_path42.default.join(deps.dataDir, "frpc.toml");
+  const tomlPath = import_node_path43.default.join(deps.dataDir, "frpc.toml");
   const readPidFile = deps.readPidFileImpl ?? defaultReadPidFile;
   const isAlive = deps.isPidAliveImpl ?? defaultIsPidAlive;
   const killPid = deps.killPidImpl ?? defaultKillPid;
@@ -56200,7 +56354,7 @@ async function killStaleFrpc(deps) {
   }
   if (victims.size === 0) {
     try {
-      import_node_fs38.default.unlinkSync(pidFile);
+      import_node_fs39.default.unlinkSync(pidFile);
     } catch {
     }
     return;
@@ -56211,7 +56365,7 @@ async function killStaleFrpc(deps) {
   }
   await sleep2(deps.reapWaitMs ?? 300);
   try {
-    import_node_fs38.default.unlinkSync(pidFile);
+    import_node_fs39.default.unlinkSync(pidFile);
   } catch {
   }
 }
@@ -56248,7 +56402,7 @@ var DEFAULT_TUNNEL_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var TunnelManager = class {
   constructor(deps) {
     this.deps = deps;
-    this.store = deps.store ?? new TunnelStore(import_node_path43.default.join(deps.dataDir, "tunnel.json"));
+    this.store = deps.store ?? new TunnelStore(import_node_path44.default.join(deps.dataDir, "tunnel.json"));
     this.ttlMs = deps.ttlMs ?? DEFAULT_TUNNEL_TTL_MS;
     this.startupTimeoutMs = deps.startupTimeoutMs ?? 15e3;
   }
@@ -56375,7 +56529,7 @@ var TunnelManager = class {
         dataDir: this.deps.dataDir,
         override: this.deps.frpcBinaryOverride ?? void 0
       });
-      const tomlPath = import_node_path43.default.join(this.deps.dataDir, "frpc.toml");
+      const tomlPath = import_node_path44.default.join(this.deps.dataDir, "frpc.toml");
       const proxyName = `clawd-${t.subdomain}-${localPort}-${import_node_crypto10.default.randomBytes(3).toString("hex")}`;
       const toml = buildFrpcToml({
         serverAddr: t.frpsHost,
@@ -56386,14 +56540,14 @@ var TunnelManager = class {
         localPort,
         logLevel: "info"
       });
-      await import_node_fs39.default.promises.writeFile(tomlPath, toml, { mode: 384 });
+      await import_node_fs40.default.promises.writeFile(tomlPath, toml, { mode: 384 });
       const proc = (this.deps.spawnImpl ?? import_node_child_process9.spawn)(frpcBin, ["-c", tomlPath], {
         stdio: ["ignore", "pipe", "pipe"]
       });
-      const logDir = import_node_path43.default.join(this.deps.dataDir, "log");
-      import_node_fs39.default.mkdirSync(logDir, { recursive: true });
-      const logFilePath = import_node_path43.default.join(logDir, "frpc.log");
-      const logStream = import_node_fs39.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
+      const logDir = import_node_path44.default.join(this.deps.dataDir, "log");
+      import_node_fs40.default.mkdirSync(logDir, { recursive: true });
+      const logFilePath = import_node_path44.default.join(logDir, "frpc.log");
+      const logStream = import_node_fs40.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
       logStream.on("error", () => {
       });
       const tee = (chunk) => {
@@ -56476,27 +56630,27 @@ async function waitForFrpcReady(proc, timeoutMs) {
 // src/tunnel/device-key.ts
 var import_node_os14 = __toESM(require("os"), 1);
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
 var import_node_crypto11 = __toESM(require("crypto"), 1);
 var DERIVE_SALT = "clawd-tunnel-device-v1";
 function deriveStableDeviceKey(opts = {}) {
   const hostname = opts.hostname ?? import_node_os14.default.hostname();
   const uid = opts.uid ?? (typeof import_node_os14.default.userInfo === "function" ? import_node_os14.default.userInfo().uid : 0);
   const home = opts.home ?? import_node_os14.default.homedir();
-  const defaultDataDir = import_node_path44.default.resolve(import_node_path44.default.join(home, ".clawd"));
-  const normalizedDataDir = opts.dataDir ? import_node_path44.default.resolve(opts.dataDir) : null;
+  const defaultDataDir = import_node_path45.default.resolve(import_node_path45.default.join(home, ".clawd"));
+  const normalizedDataDir = opts.dataDir ? import_node_path45.default.resolve(opts.dataDir) : null;
   const isDefaultDir = normalizedDataDir == null || normalizedDataDir === defaultDataDir;
   const input = isDefaultDir ? `${hostname}::${uid}` : `${hostname}::${uid}::${normalizedDataDir}`;
   return import_node_crypto11.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
 }
 // src/auth-store.ts
-var import_node_fs40 = __toESM(require("fs"), 1);
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_fs41 = __toESM(require("fs"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var import_node_crypto12 = __toESM(require("crypto"), 1);
 var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
-  return import_node_path45.default.join(dataDir, AUTH_FILE_NAME);
+  return import_node_path46.default.join(dataDir, AUTH_FILE_NAME);
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
@@ -56528,7 +56682,7 @@ function defaultGenerateOwnerPrincipalId() {
 }
 function readAuthFile(file) {
   try {
-    const raw = import_node_fs40.default.readFileSync(file, "utf8");
+    const raw = import_node_fs41.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
       return null;
@@ -56548,25 +56702,25 @@ function readAuthFile(file) {
   }
 }
 function writeAuthFile(file, content) {
-  import_node_fs40.default.mkdirSync(import_node_path45.default.dirname(file), { recursive: true });
-  import_node_fs40.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
+  import_node_fs41.default.mkdirSync(import_node_path46.default.dirname(file), { recursive: true });
+  import_node_fs41.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
   try {
-    import_node_fs40.default.chmodSync(file, 384);
+    import_node_fs41.default.chmodSync(file, 384);
   } catch {
   }
 }
 // src/owner-profile.ts
-var import_node_fs41 = __toESM(require("fs"), 1);
+var import_node_fs42 = __toESM(require("fs"), 1);
 var import_node_os15 = __toESM(require("os"), 1);
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_path47 = __toESM(require("path"), 1);
 var PROFILE_FILENAME = "profile.json";
 function loadOwnerDisplayName(dataDir) {
   const fallback = import_node_os15.default.userInfo().username;
-  const profilePath = import_node_path46.default.join(dataDir, PROFILE_FILENAME);
+  const profilePath = import_node_path47.default.join(dataDir, PROFILE_FILENAME);
   let raw;
   try {
-    raw = import_node_fs41.default.readFileSync(profilePath, "utf8");
+    raw = import_node_fs42.default.readFileSync(profilePath, "utf8");
   } catch {
     return fallback;
   }
@@ -56589,18 +56743,18 @@ function loadOwnerDisplayName(dataDir) {
 }
 // src/feishu-auth/owner-identity-store.ts
-var import_node_fs42 = __toESM(require("fs"), 1);
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_fs43 = __toESM(require("fs"), 1);
+var import_node_path48 = __toESM(require("path"), 1);
 var OWNER_IDENTITY_FILE_NAME = "owner-identity.json";
 var OwnerIdentityStore = class {
   file;
   constructor(dataDir) {
-    this.file = import_node_path47.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
+    this.file = import_node_path48.default.join(dataDir, OWNER_IDENTITY_FILE_NAME);
   }
   read() {
     let raw;
     try {
-      raw = import_node_fs42.default.readFileSync(this.file, "utf8");
+      raw = import_node_fs43.default.readFileSync(this.file, "utf8");
     } catch {
       return null;
     }
@@ -56628,16 +56782,16 @@ var OwnerIdentityStore = class {
     };
   }
   write(record) {
-    import_node_fs42.default.mkdirSync(import_node_path47.default.dirname(this.file), { recursive: true });
-    import_node_fs42.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
+    import_node_fs43.default.mkdirSync(import_node_path48.default.dirname(this.file), { recursive: true });
+    import_node_fs43.default.writeFileSync(this.file, JSON.stringify(record, null, 2), { mode: 384 });
     try {
-      import_node_fs42.default.chmodSync(this.file, 384);
+      import_node_fs43.default.chmodSync(this.file, 384);
     } catch {
     }
   }
   clear() {
     try {
-      import_node_fs42.default.unlinkSync(this.file);
+      import_node_fs43.default.unlinkSync(this.file);
     } catch (err) {
       const code = err?.code;
       if (code !== "ENOENT") throw err;
@@ -56774,9 +56928,9 @@ var CentralClientError = class extends Error {
   code;
   cause;
 };
-async function centralRequest(opts, path78, init) {
+async function centralRequest(opts, path79, init) {
   const f = opts.fetchImpl ?? globalThis.fetch;
-  const url = `${opts.api.replace(/\/+$/, "")}${path78}`;
+  const url = `${opts.api.replace(/\/+$/, "")}${path79}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
   let res;
@@ -56970,8 +57124,8 @@ function verifyConnectToken(args) {
 }
 // src/feishu-auth/server-key.ts
-var fs52 = __toESM(require("fs"), 1);
-var path56 = __toESM(require("path"), 1);
+var fs53 = __toESM(require("fs"), 1);
+var path57 = __toESM(require("path"), 1);
 var FILE_NAME2 = "server-signing-key.json";
 var ServerKeyStore = class {
   constructor(dataDir) {
@@ -56979,12 +57133,12 @@ var ServerKeyStore = class {
   }
   dataDir;
   filePath() {
-    return path56.join(this.dataDir, FILE_NAME2);
+    return path57.join(this.dataDir, FILE_NAME2);
   }
   /** 读缓存的公钥；无缓存 / 损坏 → null（调用方决定是否触发拉取） */
   read() {
     try {
-      const raw = fs52.readFileSync(this.filePath(), "utf8");
+      const raw = fs53.readFileSync(this.filePath(), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.publicKeyPem === "string" && parsed.publicKeyPem.includes("PUBLIC KEY")) {
         return parsed.publicKeyPem;
@@ -56999,12 +57153,12 @@ var ServerKeyStore = class {
       publicKeyPem,
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    fs52.mkdirSync(this.dataDir, { recursive: true });
-    fs52.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
+    fs53.mkdirSync(this.dataDir, { recursive: true });
+    fs53.writeFileSync(this.filePath(), JSON.stringify(content, null, 2), { mode: 384 });
   }
   clear() {
     try {
-      fs52.unlinkSync(this.filePath());
+      fs53.unlinkSync(this.filePath());
     } catch {
     }
   }
@@ -57017,12 +57171,12 @@ init_protocol();
 init_protocol();
 // src/session/fork.ts
-var import_node_fs43 = __toESM(require("fs"), 1);
+var import_node_fs44 = __toESM(require("fs"), 1);
 var import_node_os16 = __toESM(require("os"), 1);
-var import_node_path48 = __toESM(require("path"), 1);
+var import_node_path49 = __toESM(require("path"), 1);
 init_claude_history();
 function readJsonlEntries(file) {
-  const raw = import_node_fs43.default.readFileSync(file, "utf8");
+  const raw = import_node_fs44.default.readFileSync(file, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -57035,19 +57189,19 @@ function readJsonlEntries(file) {
   return out;
 }
 function forkSession(input) {
-  const baseDir = input.baseDir ?? import_node_path48.default.join(import_node_os16.default.homedir(), ".claude");
-  let projectDir = import_node_path48.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
-  let sourceFile = import_node_path48.default.join(projectDir, `${input.toolSessionId}.jsonl`);
-  if (!import_node_fs43.default.existsSync(sourceFile)) {
+  const baseDir = input.baseDir ?? import_node_path49.default.join(import_node_os16.default.homedir(), ".claude");
+  let projectDir = import_node_path49.default.join(baseDir, "projects", cwdToHashDir(input.cwd));
+  let sourceFile = import_node_path49.default.join(projectDir, `${input.toolSessionId}.jsonl`);
+  if (!import_node_fs44.default.existsSync(sourceFile)) {
     const found = findTranscriptByToolSessionId(
-      import_node_path48.default.join(baseDir, "projects"),
+      import_node_path49.default.join(baseDir, "projects"),
       input.toolSessionId
     );
     if (!found) {
       throw new Error(`fork: source transcript not found: ${sourceFile}`);
     }
     sourceFile = found;
-    projectDir = import_node_path48.default.dirname(found);
+    projectDir = import_node_path49.default.dirname(found);
   }
   const entries = readJsonlEntries(sourceFile);
   const mainEntries = entries.filter((e) => e.isSidechain !== true);
@@ -57076,10 +57230,10 @@ function forkSession(input) {
     }
     forkedLines.push(JSON.stringify(forked));
   }
-  const outDir = input.targetCwd ? import_node_path48.default.join(baseDir, "projects", cwdToHashDir(input.targetCwd)) : projectDir;
-  const forkedFilePath = import_node_path48.default.join(outDir, `${forkedToolSessionId}.jsonl`);
-  import_node_fs43.default.mkdirSync(outDir, { recursive: true });
-  import_node_fs43.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
+  const outDir = input.targetCwd ? import_node_path49.default.join(baseDir, "projects", cwdToHashDir(input.targetCwd)) : projectDir;
+  const forkedFilePath = import_node_path49.default.join(outDir, `${forkedToolSessionId}.jsonl`);
+  import_node_fs44.default.mkdirSync(outDir, { recursive: true });
+  import_node_fs44.default.writeFileSync(forkedFilePath, forkedLines.join("\n") + "\n", { mode: 384 });
   return { forkedToolSessionId, forkedFilePath };
 }
@@ -57538,7 +57692,7 @@ function buildPermissionHandlers(deps) {
 }
 // src/handlers/history.ts
-var path59 = __toESM(require("path"), 1);
+var path60 = __toESM(require("path"), 1);
 init_protocol();
 // src/session/recent-dirs.ts
@@ -57556,7 +57710,7 @@ function listRecentDirs(store, limit = 50) {
 }
 // src/permission/persona-paths.ts
-var path58 = __toESM(require("path"), 1);
+var path59 = __toESM(require("path"), 1);
 function getAllowedPersonaIds(grants, action) {
   const ids = /* @__PURE__ */ new Set();
   for (const g2 of grants) {
@@ -57569,42 +57723,42 @@ function getAllowedPersonaIds(grants, action) {
   return ids;
 }
 function isGuestPathAllowed(grants, absPath, personaRoot, action = "read", userWorkDir) {
-  const target = path58.resolve(absPath);
+  const target = path59.resolve(absPath);
   if (userWorkDir) {
-    const u = path58.resolve(userWorkDir);
-    const usep = u.endsWith(path58.sep) ? "" : path58.sep;
+    const u = path59.resolve(userWorkDir);
+    const usep = u.endsWith(path59.sep) ? "" : path59.sep;
     if (target === u || target.startsWith(u + usep)) return true;
   }
-  const root = path58.resolve(personaRoot);
-  const sep3 = root.endsWith(path58.sep) ? "" : path58.sep;
+  const root = path59.resolve(personaRoot);
+  const sep3 = root.endsWith(path59.sep) ? "" : path59.sep;
   if (!target.startsWith(root + sep3)) return false;
-  const rel = path58.relative(root, target);
+  const rel = path59.relative(root, target);
   if (!rel || rel.startsWith("..")) return false;
-  const personaId2 = rel.split(path58.sep)[0];
+  const personaId2 = rel.split(path59.sep)[0];
   if (!personaId2) return false;
   const allowed = getAllowedPersonaIds(grants, action);
   if (allowed === "*") return true;
   return allowed.has(personaId2);
 }
 function personaIdFromPath(absPath, personaRoot) {
-  const root = path58.resolve(personaRoot);
-  const target = path58.resolve(absPath);
-  const sep3 = root.endsWith(path58.sep) ? "" : path58.sep;
+  const root = path59.resolve(personaRoot);
+  const target = path59.resolve(absPath);
+  const sep3 = root.endsWith(path59.sep) ? "" : path59.sep;
   if (!target.startsWith(root + sep3)) return null;
-  const rel = path58.relative(root, target);
+  const rel = path59.relative(root, target);
   if (!rel || rel.startsWith("..")) return null;
-  const id = rel.split(path58.sep)[0];
+  const id = rel.split(path59.sep)[0];
   return id || null;
 }
 function isPathWithin(dir, absPath) {
-  const d = path58.resolve(dir);
-  const t = path58.resolve(absPath);
-  const sep3 = d.endsWith(path58.sep) ? "" : path58.sep;
+  const d = path59.resolve(dir);
+  const t = path59.resolve(absPath);
+  const sep3 = d.endsWith(path59.sep) ? "" : path59.sep;
   return t === d || t.startsWith(d + sep3);
 }
 function isPathInGuestBoundary(personaRoot, personaId2, userWorkDir, absPath) {
   if (userWorkDir && isPathWithin(userWorkDir, absPath)) return true;
-  return personaIdFromPath(path58.resolve(absPath), personaRoot) === personaId2;
+  return personaIdFromPath(path59.resolve(absPath), personaRoot) === personaId2;
 }
 // src/handlers/history.ts
@@ -57656,7 +57810,7 @@ function buildHistoryHandlers(deps) {
         if (!pid) return false;
         return isGuestPathAllowed(
           ctx.grants,
-          path59.join(personaRoot, pid),
+          path60.join(personaRoot, pid),
           personaRoot,
           "read",
           userWorkDir
@@ -57668,7 +57822,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path59.resolve(args.projectPath), personaRoot, "history:list", usersRoot);
+    assertGuestPath(ctx, path60.resolve(args.projectPath), personaRoot, "history:list", usersRoot);
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -57712,14 +57866,14 @@ function buildHistoryHandlers(deps) {
   };
   const subagents = async (frame, _client, ctx) => {
     const args = HistorySubagentsArgs.parse(frame);
-    assertGuestPath(ctx, path59.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
+    assertGuestPath(ctx, path60.resolve(args.cwd), personaRoot, "history:subagents", usersRoot);
     assertGuestOwnsToolSession(ctx, args.toolSessionId, "history:subagents");
     const subs = await history.listSubagents(args);
     return { response: { type: "history:subagents", subagents: subs } };
   };
   const subagentRead = async (frame, _client, ctx) => {
     const args = HistorySubagentReadArgs.parse(frame);
-    assertGuestPath(ctx, path59.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
+    assertGuestPath(ctx, path60.resolve(args.cwd), personaRoot, "history:subagent-read", usersRoot);
     assertGuestOwnsToolSession(ctx, args.toolSessionId, "history:subagent-read");
     const res = await history.readSubagent(args);
     return { response: { type: "history:subagent-read", ...res } };
@@ -57729,7 +57883,7 @@ function buildHistoryHandlers(deps) {
     if (ctx?.principal.kind === "guest" && personaRoot) {
       const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
       const filtered = dirs.filter(
-        (d) => isGuestPathAllowed(ctx.grants, path59.resolve(d.cwd), personaRoot, "read", userWorkDir)
+        (d) => isGuestPathAllowed(ctx.grants, path60.resolve(d.cwd), personaRoot, "read", userWorkDir)
       );
       return { response: { type: "history:recentDirs", dirs: filtered } };
     }
@@ -57746,7 +57900,7 @@ function buildHistoryHandlers(deps) {
 }
 // src/handlers/workspace.ts
-var path60 = __toESM(require("path"), 1);
+var path61 = __toESM(require("path"), 1);
 var os16 = __toESM(require("os"), 1);
 init_protocol();
 init_protocol();
@@ -57788,22 +57942,22 @@ function buildWorkspaceHandlers(deps) {
     const args = WorkspaceListArgs.parse(frame);
     const isGuest = ctx?.principal.kind === "guest";
     const fallbackCwd = isGuest && personaRoot ? personaRoot : os16.homedir();
-    const resolvedCwd = path60.resolve(args.cwd ?? fallbackCwd);
-    const target = args.path ? path60.resolve(resolvedCwd, args.path) : resolvedCwd;
+    const resolvedCwd = path61.resolve(args.cwd ?? fallbackCwd);
+    const target = args.path ? path61.resolve(resolvedCwd, args.path) : resolvedCwd;
     assertGuestPath2(ctx, target, personaRoot, "workspace:list", usersRoot);
     const res = workspace.list({ ...args, cwd: resolvedCwd });
     return { response: { type: "workspace:list", ...res } };
   };
   const read = async (frame, _client, ctx) => {
     const args = WorkspaceReadArgs.parse(frame);
-    const target = path60.isAbsolute(args.path) ? path60.resolve(args.path) : path60.resolve(args.cwd, args.path);
+    const target = path61.isAbsolute(args.path) ? path61.resolve(args.path) : path61.resolve(args.cwd, args.path);
     assertGuestPath2(ctx, target, personaRoot, "workspace:read", usersRoot);
     const res = workspace.read(args);
     return { response: { type: "workspace:read", ...res } };
   };
   const skillsList = async (frame, _client, ctx) => {
     const args = SkillsListArgs.parse(frame);
-    const cwdAbs = path60.resolve(args.cwd);
+    const cwdAbs = path61.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "skills:list", usersRoot);
     const list2 = await getSkillsForTool(args.tool ?? "claude", cwdAbs);
     if (ctx?.principal.kind === "guest" && personaRoot) {
@@ -57815,7 +57969,7 @@ function buildWorkspaceHandlers(deps) {
   };
   const agentsList = async (frame, _client, ctx) => {
     const args = AgentsListArgs.parse(frame);
-    const cwdAbs = path60.resolve(args.cwd);
+    const cwdAbs = path61.resolve(args.cwd);
     assertGuestPath2(ctx, cwdAbs, personaRoot, "agents:list", usersRoot);
     if (args.tool === "codex") {
       return { response: { type: "agents:list", agents: [] } };
@@ -57837,20 +57991,20 @@ function buildWorkspaceHandlers(deps) {
 }
 // src/handlers/git.ts
-var path62 = __toESM(require("path"), 1);
+var path63 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 // src/workspace/git.ts
 var import_node_child_process10 = require("child_process");
-var import_node_fs44 = __toESM(require("fs"), 1);
-var import_node_path49 = __toESM(require("path"), 1);
+var import_node_fs45 = __toESM(require("fs"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
 var import_node_util = require("util");
 var pexec = (0, import_node_util.promisify)(import_node_child_process10.execFile);
 function normalizePath(p2) {
-  const resolved = import_node_path49.default.resolve(p2);
+  const resolved = import_node_path50.default.resolve(p2);
   try {
-    return import_node_fs44.default.realpathSync(resolved);
+    return import_node_fs45.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -57924,7 +58078,7 @@ async function listGitBranches(cwd) {
 function assertGuestCwd(ctx, cwd, personaRoot, method, usersRoot) {
   if (!ctx || ctx.principal.kind !== "guest" || !personaRoot) return;
   const userWorkDir = usersRoot ? deriveUserWorkDir(ctx.principal.id, usersRoot) : void 0;
-  if (!isGuestPathAllowed(ctx.grants, path62.resolve(cwd), personaRoot, "read", userWorkDir)) {
+  if (!isGuestPathAllowed(ctx.grants, path63.resolve(cwd), personaRoot, "read", userWorkDir)) {
     throw new ClawdError(
       ERROR_CODES.UNAUTHORIZED,
       `guest ${ctx.principal.id} cannot ${method} cwd ${cwd}`
@@ -58789,21 +58943,21 @@ function computeMethodAccess(args) {
 }
 // src/version.ts
-var version = "0.2.292".length > 0 ? "0.2.292" : "dev";
+var version = "0.2.294".length > 0 ? "0.2.294" : "dev";
 // src/cli-probe/probe.ts
-var fs55 = __toESM(require("fs"), 1);
-var path63 = __toESM(require("path"), 1);
+var fs56 = __toESM(require("fs"), 1);
+var path64 = __toESM(require("path"), 1);
 var PKG_NAME = "@clawos-dev/clawd";
 var BIN_NAME = "clawd";
 var MAX_PARENT_HOPS = 5;
 function probeGlobalCli(pathEnv) {
   if (!pathEnv) return null;
-  for (const dir of pathEnv.split(path63.delimiter)) {
+  for (const dir of pathEnv.split(path64.delimiter)) {
     if (!dir) continue;
     let real;
     try {
-      real = fs55.realpathSync(path63.join(dir, BIN_NAME));
+      real = fs56.realpathSync(path64.join(dir, BIN_NAME));
     } catch {
       continue;
     }
@@ -58813,15 +58967,15 @@ function probeGlobalCli(pathEnv) {
   return null;
 }
 function readOwnPackageVersion(entryPath) {
-  let dir = path63.dirname(entryPath);
+  let dir = path64.dirname(entryPath);
   for (let i = 0; i < MAX_PARENT_HOPS; i++) {
     try {
-      const raw = fs55.readFileSync(path63.join(dir, "package.json"), "utf8");
+      const raw = fs56.readFileSync(path64.join(dir, "package.json"), "utf8");
       const pkg = JSON.parse(raw);
       if (pkg.name !== PKG_NAME) return null;
       return typeof pkg.version === "string" && pkg.version ? pkg.version : null;
     } catch {
-      const parent = path63.dirname(dir);
+      const parent = path64.dirname(dir);
       if (parent === dir) return null;
       dir = parent;
     }
@@ -58979,7 +59133,7 @@ function buildPersonaHandlers(deps) {
 }
 // src/handlers/attachment.ts
-var import_node_path50 = __toESM(require("path"), 1);
+var import_node_path51 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -59059,12 +59213,12 @@ function buildAttachmentHandlers(deps) {
         `session ${args.sessionId} scope unresolved`
       );
     }
-    const cwdAbs = import_node_path50.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path50.default.isAbsolute(args.relPath) ? import_node_path50.default.resolve(args.relPath) : import_node_path50.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path51.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path51.default.isAbsolute(args.relPath) ? import_node_path51.default.resolve(args.relPath) : import_node_path51.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.signUrl", "group-acl");
     const entries = deps.groupFileStore.list(scope, args.sessionId);
     const entry = entries.find((e) => {
-      const storedAbs = import_node_path50.default.isAbsolute(e.relPath) ? import_node_path50.default.resolve(e.relPath) : import_node_path50.default.resolve(cwdAbs, e.relPath);
+      const storedAbs = import_node_path51.default.isAbsolute(e.relPath) ? import_node_path51.default.resolve(e.relPath) : import_node_path51.default.resolve(cwdAbs, e.relPath);
       return storedAbs === candidateAbs && !e.stale;
     });
     if (!entry) {
@@ -59089,7 +59243,7 @@ function buildAttachmentHandlers(deps) {
     if (!ctx || ctx.principal.kind !== "guest" || !deps.personaRoot || !deps.sessionStore) return;
     const f = deps.sessionStore.read(sessionId);
     if (!f) return;
-    assertGuestAttachmentPath(ctx, import_node_path50.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
+    assertGuestAttachmentPath(ctx, import_node_path51.default.resolve(f.cwd), deps.personaRoot, method, deps.usersRoot);
   }
   const groupAdd = async (frame, _client, ctx) => {
     if (!deps.groupFileStore || !deps.getSessionScope) {
@@ -59104,8 +59258,8 @@ function buildAttachmentHandlers(deps) {
     if (!scope) {
       throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `session ${args.sessionId} not found`);
     }
-    const cwdAbs = import_node_path50.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
-    const candidateAbs = import_node_path50.default.isAbsolute(args.relPath) ? import_node_path50.default.resolve(args.relPath) : import_node_path50.default.resolve(cwdAbs, args.relPath);
+    const cwdAbs = import_node_path51.default.resolve(deps.sessionStore?.read(args.sessionId)?.cwd ?? ".");
+    const candidateAbs = import_node_path51.default.isAbsolute(args.relPath) ? import_node_path51.default.resolve(args.relPath) : import_node_path51.default.resolve(cwdAbs, args.relPath);
     guardAttachmentPath(ctx, args.sessionId, candidateAbs, "attachment.groupAdd", "cwd-subtree");
     const from = args.origin === "agent" ? "agent" : ctx?.principal.kind === "owner" ? "owner" : "agent";
     const size = 0;
@@ -59164,19 +59318,19 @@ function buildAttachmentHandlers(deps) {
 // src/handlers/extension.ts
 var import_promises9 = __toESM(require("fs/promises"), 1);
-var import_node_path55 = __toESM(require("path"), 1);
+var import_node_path56 = __toESM(require("path"), 1);
 init_protocol();
 // src/extension/bundle-zip.ts
 var import_promises6 = __toESM(require("fs/promises"), 1);
-var import_node_path51 = __toESM(require("path"), 1);
+var import_node_path52 = __toESM(require("path"), 1);
 var import_node_crypto14 = __toESM(require("crypto"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 async function bundleExtensionDir(dir) {
   const entries = await listFilesSorted(dir);
   const zip = new import_jszip2.default();
   for (const rel of entries) {
-    const abs = import_node_path51.default.join(dir, rel);
+    const abs = import_node_path52.default.join(dir, rel);
     const content = await import_promises6.default.readFile(abs);
     zip.file(rel, content, { date: FIXED_DATE });
   }
@@ -59197,7 +59351,7 @@ async function listFilesSorted(rootDir) {
   return out;
 }
 async function walk(absRoot, relPrefix, out) {
-  const dirAbs = import_node_path51.default.join(absRoot, relPrefix);
+  const dirAbs = import_node_path52.default.join(absRoot, relPrefix);
   const entries = await import_promises6.default.readdir(dirAbs, { withFileTypes: true });
   for (const e of entries) {
     if (IGNORE_BASENAMES.has(e.name)) continue;
@@ -59251,25 +59405,25 @@ function computePublishCheck(args) {
 // src/extension/install-flow.ts
 var import_promises7 = __toESM(require("fs/promises"), 1);
-var import_node_path53 = __toESM(require("path"), 1);
+var import_node_path54 = __toESM(require("path"), 1);
 var import_node_os19 = __toESM(require("os"), 1);
 var import_node_crypto15 = __toESM(require("crypto"), 1);
 var import_jszip3 = __toESM(require_lib3(), 1);
 // src/extension/paths.ts
 var import_node_os18 = __toESM(require("os"), 1);
-var import_node_path52 = __toESM(require("path"), 1);
+var import_node_path53 = __toESM(require("path"), 1);
 function clawdHomeRoot(override) {
-  return override ?? process.env.CLAWD_HOME ?? import_node_path52.default.join(import_node_os18.default.homedir(), ".clawd");
+  return override ?? process.env.CLAWD_HOME ?? import_node_path53.default.join(import_node_os18.default.homedir(), ".clawd");
 }
 function extensionsRoot(override) {
-  return import_node_path52.default.join(clawdHomeRoot(override), "extensions");
+  return import_node_path53.default.join(clawdHomeRoot(override), "extensions");
 }
 function publishedChannelsFile(override) {
-  return import_node_path52.default.join(clawdHomeRoot(override), "extensions-published.json");
+  return import_node_path53.default.join(clawdHomeRoot(override), "extensions-published.json");
 }
 function bundleCacheRoot(override) {
-  return import_node_path52.default.join(clawdHomeRoot(override), "extension-bundles");
+  return import_node_path53.default.join(clawdHomeRoot(override), "extension-bundles");
 }
 // src/extension/install-flow.ts
@@ -59296,7 +59450,7 @@ async function installFromChannel(args, deps) {
     throw new InstallError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path53.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path54.default.isAbsolute(name)) {
       throw new InstallError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -59328,7 +59482,7 @@ async function installFromChannel(args, deps) {
     );
   }
   const localExtId = namespacedExtId(ownerSlug, channelRef.ownerPrincipalId);
-  const destDir = import_node_path53.default.join(deps.extensionsRoot, localExtId);
+  const destDir = import_node_path54.default.join(deps.extensionsRoot, localExtId);
   let destExists = false;
   try {
     await import_promises7.default.access(destDir);
@@ -59342,16 +59496,16 @@ async function installFromChannel(args, deps) {
     );
   }
   const stage = await import_promises7.default.mkdtemp(
-    import_node_path53.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
+    import_node_path54.default.join(import_node_os19.default.tmpdir(), `clawd-ext-install-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path53.default.join(stage, name);
+      const dest = import_node_path54.default.join(stage, name);
       if (entry.dir) {
         await import_promises7.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises7.default.mkdir(import_node_path53.default.dirname(dest), { recursive: true });
+      await import_promises7.default.mkdir(import_node_path54.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises7.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -59372,7 +59526,7 @@ async function installFromChannel(args, deps) {
 // src/extension/update-flow.ts
 var import_promises8 = __toESM(require("fs/promises"), 1);
-var import_node_path54 = __toESM(require("path"), 1);
+var import_node_path55 = __toESM(require("path"), 1);
 var import_node_os20 = __toESM(require("os"), 1);
 var import_node_crypto16 = __toESM(require("crypto"), 1);
 var import_jszip4 = __toESM(require_lib3(), 1);
@@ -59389,11 +59543,11 @@ async function updateFromChannel(args, deps) {
     channelRef.extId,
     channelRef.ownerPrincipalId
   );
-  const liveDir = import_node_path54.default.join(deps.extensionsRoot, localExtId);
+  const liveDir = import_node_path55.default.join(deps.extensionsRoot, localExtId);
   const prevDir = `${liveDir}.prev`;
   let existingVersion;
   try {
-    const raw = await import_promises8.default.readFile(import_node_path54.default.join(liveDir, "manifest.json"), "utf8");
+    const raw = await import_promises8.default.readFile(import_node_path55.default.join(liveDir, "manifest.json"), "utf8");
     const parsed2 = ExtensionManifestSchema.safeParse(JSON.parse(raw));
     if (!parsed2.success) {
       throw new UpdateError(
@@ -59426,7 +59580,7 @@ async function updateFromChannel(args, deps) {
     throw new UpdateError("ZIP_INVALID", `failed to load zip: ${e.message}`);
   }
   for (const name of Object.keys(zip.files)) {
-    if (name.includes("..") || name.startsWith("/") || import_node_path54.default.isAbsolute(name)) {
+    if (name.includes("..") || name.startsWith("/") || import_node_path55.default.isAbsolute(name)) {
       throw new UpdateError("ZIP_INVALID", `unsafe zip entry: ${name}`);
     }
   }
@@ -59461,16 +59615,16 @@ async function updateFromChannel(args, deps) {
   await import_promises8.default.rm(prevDir, { recursive: true, force: true });
   await import_promises8.default.rename(liveDir, prevDir);
   const stage = await import_promises8.default.mkdtemp(
-    import_node_path54.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
+    import_node_path55.default.join(import_node_os20.default.tmpdir(), `clawd-ext-update-${localExtId}-`)
   );
   try {
     for (const [name, entry] of Object.entries(zip.files)) {
-      const dest = import_node_path54.default.join(stage, name);
+      const dest = import_node_path55.default.join(stage, name);
       if (entry.dir) {
         await import_promises8.default.mkdir(dest, { recursive: true });
         continue;
       }
-      await import_promises8.default.mkdir(import_node_path54.default.dirname(dest), { recursive: true });
+      await import_promises8.default.mkdir(import_node_path55.default.dirname(dest), { recursive: true });
       if (name === "manifest.json") {
         const rewritten = { ...parsed.data, id: localExtId };
         await import_promises8.default.writeFile(dest, JSON.stringify(rewritten, null, 2));
@@ -59537,7 +59691,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
       );
     }
   }
-  const manifestPath = import_node_path55.default.join(root, extId, "manifest.json");
+  const manifestPath = import_node_path56.default.join(root, extId, "manifest.json");
   const manifest = await readManifest(root, extId);
   const next = { ...manifest, version: newVersion };
   const tmp = `${manifestPath}.tmp`;
@@ -59545,7 +59699,7 @@ async function rewriteManifestVersion(root, extId, newVersion, previousPublished
   await import_promises9.default.rename(tmp, manifestPath);
 }
 async function readManifest(root, extId) {
-  const file = import_node_path55.default.join(root, extId, "manifest.json");
+  const file = import_node_path56.default.join(root, extId, "manifest.json");
   let raw;
   try {
     raw = await import_promises9.default.readFile(file, "utf8");
@@ -59629,7 +59783,7 @@ function buildExtensionHandlers(deps) {
   };
   async function buildSnapshotMeta(extId) {
     const manifest = await readManifest(deps.root, extId);
-    const { sha256, buffer } = await bundleExtensionDir(import_node_path55.default.join(deps.root, extId));
+    const { sha256, buffer } = await bundleExtensionDir(import_node_path56.default.join(deps.root, extId));
     return { manifest, contentHash: sha256, buffer };
   }
   const publish = async (frame, _client, ctx) => {
@@ -59804,9 +59958,9 @@ function buildExtensionHandlers(deps) {
 }
 // src/app-builder/project-store.ts
-var import_node_fs45 = require("fs");
+var import_node_fs46 = require("fs");
 var import_node_child_process11 = require("child_process");
-var import_node_path56 = require("path");
+var import_node_path57 = require("path");
 init_protocol();
 var PROJECTS_DIR = "projects";
 var META_FILE = ".clawd-project.json";
@@ -59820,19 +59974,19 @@ var ProjectStore = class {
   root;
   /** projects/<name>/.clawd-project.json 路径 */
   metaPath(name) {
-    return (0, import_node_path56.join)(this.projectsRoot(), name, META_FILE);
+    return (0, import_node_path57.join)(this.projectsRoot(), name, META_FILE);
   }
   /** projects/<name>/ 目录路径（cwd 用） */
   projectDir(name) {
-    return (0, import_node_path56.join)(this.projectsRoot(), name);
+    return (0, import_node_path57.join)(this.projectsRoot(), name);
   }
   projectsRoot() {
-    return (0, import_node_path56.join)(this.root, PROJECTS_DIR);
+    return (0, import_node_path57.join)(this.root, PROJECTS_DIR);
   }
   async list() {
     let entries;
     try {
-      entries = await import_node_fs45.promises.readdir(this.projectsRoot());
+      entries = await import_node_fs46.promises.readdir(this.projectsRoot());
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
@@ -59840,7 +59994,7 @@ var ProjectStore = class {
     const out = [];
     for (const name of entries) {
       try {
-        const raw = await import_node_fs45.promises.readFile(this.metaPath(name), "utf8");
+        const raw = await import_node_fs46.promises.readFile(this.metaPath(name), "utf8");
         const json = JSON.parse(raw);
         let migrated = false;
         if (typeof json.devCommand !== "string" || json.devCommand.length === 0) {
@@ -59851,7 +60005,7 @@ var ProjectStore = class {
         if (parsed.success) {
           out.push(parsed.data);
           if (migrated) {
-            void import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
+            void import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(parsed.data, null, 2) + "\n", "utf8").catch(() => {
             });
           }
         }
@@ -59895,8 +60049,8 @@ var ProjectStore = class {
       throw new Error(`invalid name "${name}": ${validated.error.message}`);
     }
     const dir = this.projectDir(name);
-    await import_node_fs45.promises.mkdir(dir, { recursive: true });
-    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.mkdir(dir, { recursive: true });
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(meta, null, 2) + "\n", "utf8");
     return meta;
   }
   /**
@@ -59939,7 +60093,7 @@ var ProjectStore = class {
   }
   async delete(name) {
     const dir = this.projectDir(name);
-    await import_node_fs45.promises.rm(dir, { recursive: true, force: true });
+    await import_node_fs46.promises.rm(dir, { recursive: true, force: true });
   }
   async updatePort(name, newPort) {
     if (newPort < PROJECT_PORT_MIN || newPort > PROJECT_PORT_MAX) {
@@ -59955,7 +60109,7 @@ var ProjectStore = class {
       throw new Error(`port ${newPort} already used / \u5DF2\u88AB project "${conflict.name}" \u5360\u7528`);
     }
     const updated = { ...target, port: newPort };
-    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(updated, null, 2) + "\n", "utf8");
     return updated;
   }
   /**
@@ -59972,7 +60126,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid prodUrl "${url}": ${validated.error.message}`);
     }
-    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /**
@@ -59993,7 +60147,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`invalid publishJob: ${validated.error.message}`);
     }
-    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
   /** 清掉 .clawd-project.json.publishJob 字段。其他字段保持原样。 */
@@ -60008,7 +60162,7 @@ var ProjectStore = class {
     if (!validated.success) {
       throw new Error(`failed to clear publishJob: ${validated.error.message}`);
     }
-    await import_node_fs45.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
+    await import_node_fs46.promises.writeFile(this.metaPath(name), JSON.stringify(validated.data, null, 2) + "\n", "utf8");
     return validated.data;
   }
 };
@@ -60129,8 +60283,8 @@ var PublishJobRegistry = class {
 // src/app-builder/publish-job-runner.ts
 var import_node_child_process13 = require("child_process");
-var import_node_fs46 = require("fs");
-var import_node_path57 = require("path");
+var import_node_fs47 = require("fs");
+var import_node_path58 = require("path");
 // src/app-builder/publish-stage-parser.ts
 var STAGE_RE = /^\s*::stage::(build|deploy|verify)\s*$/;
@@ -60162,10 +60316,10 @@ async function startPublishJob(deps, args) {
     return { jobId: registry2.get(args.name).jobId, status: "already-publishing" };
   }
   const projDir = projectDir(args.name);
-  const logPath = (0, import_node_path57.join)(projDir, ".publish.log");
+  const logPath = (0, import_node_path58.join)(projDir, ".publish.log");
   let logStream = null;
   try {
-    logStream = (0, import_node_fs46.createWriteStream)(logPath, { flags: "w" });
+    logStream = (0, import_node_fs47.createWriteStream)(logPath, { flags: "w" });
   } catch {
     logStream = null;
   }
@@ -60422,8 +60576,8 @@ async function recoverInterruptedJobs(deps) {
 // src/handlers/app-builder.ts
 init_protocol();
-var import_node_path58 = require("path");
-var import_node_fs47 = require("fs");
+var import_node_path59 = require("path");
+var import_node_fs48 = require("fs");
 var APP_BUILDER_PERSONAS = ["persona-app-builder", "persona-dataclaw-builder"];
 var DEV_SERVER_READY_TIMEOUT_MS = 3e4;
 async function recoverInterruptedPublishJobs(store, logger) {
@@ -60504,7 +60658,7 @@ function buildAppBuilderHandlers(deps) {
   async function listAllUsersProjects() {
     if (!deps.usersRoot || !deps.getStore) return [];
     const getStore = deps.getStore;
-    const userIds = await import_node_fs47.promises.readdir(deps.usersRoot).catch(() => []);
+    const userIds = await import_node_fs48.promises.readdir(deps.usersRoot).catch(() => []);
     const perUser = await Promise.all(
       userIds.map((uid) => getStore(uid).list().catch(() => []))
     );
@@ -60573,8 +60727,8 @@ function buildAppBuilderHandlers(deps) {
     const project = await userStore.create(f.name, reservedPorts);
     try {
       const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(session.ownerPersonaId ?? "") : deps.personaRoot;
-      const templateSrcDir = (0, import_node_path58.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
-      const scaffoldScript = (0, import_node_path58.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
+      const templateSrcDir = (0, import_node_path59.join)(personaRoot, "extension-kit", "examples", DEFAULT_TEMPLATE);
+      const scaffoldScript = (0, import_node_path59.join)(deps.deployKitRoot, "scripts", "new-extension.sh");
       const scaffoldResult = await userStore.scaffold(project.name, templateSrcDir, scaffoldScript);
       deps.logger?.info("app-builder.scaffold.done", {
         name: project.name,
@@ -60778,7 +60932,7 @@ function buildAppBuilderHandlers(deps) {
       await userStore.clearPublishJob(args.name);
     }
     const personaRoot = deps.resolvePersonaRoot ? deps.resolvePersonaRoot(boundSession.ownerPersonaId ?? "") : deps.personaRoot;
-    const scriptPath = (0, import_node_path58.join)(deps.deployKitRoot, "scripts", "publish.sh");
+    const scriptPath = (0, import_node_path59.join)(deps.deployKitRoot, "scripts", "publish.sh");
     deps.logger?.info("app-builder.publish.start", {
       name: args.name,
       sessionId: boundSession.sessionId,
@@ -60954,7 +61108,7 @@ function buildVisitorHandlers(deps) {
 // src/extension/registry.ts
 var import_promises10 = __toESM(require("fs/promises"), 1);
-var import_node_path59 = __toESM(require("path"), 1);
+var import_node_path60 = __toESM(require("path"), 1);
 async function loadAll(root) {
   let entries;
   try {
@@ -60967,13 +61121,13 @@ async function loadAll(root) {
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
     if (ent.name.startsWith(".")) continue;
-    records.push(await loadOne(import_node_path59.default.join(root, ent.name), ent.name));
+    records.push(await loadOne(import_node_path60.default.join(root, ent.name), ent.name));
   }
   records.sort((a, b2) => a.extId < b2.extId ? -1 : a.extId > b2.extId ? 1 : 0);
   return records;
 }
 async function loadOne(dir, dirName) {
-  const manifestPath = import_node_path59.default.join(dir, "manifest.json");
+  const manifestPath = import_node_path60.default.join(dir, "manifest.json");
   let raw;
   try {
     raw = await import_promises10.default.readFile(manifestPath, "utf8");
@@ -61018,7 +61172,7 @@ async function loadOne(dir, dirName) {
 // src/extension/uninstall.ts
 var import_promises11 = __toESM(require("fs/promises"), 1);
-var import_node_path60 = __toESM(require("path"), 1);
+var import_node_path61 = __toESM(require("path"), 1);
 var UninstallError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -61027,7 +61181,7 @@ var UninstallError = class extends Error {
   code;
 };
 async function uninstall(deps) {
-  const dir = import_node_path60.default.join(deps.root, deps.extId);
+  const dir = import_node_path61.default.join(deps.root, deps.extId);
   try {
     await import_promises11.default.access(dir);
   } catch {
@@ -61557,7 +61711,7 @@ async function dispatchRpc(method, frame, client, ctx, deps) {
 // src/extension/runtime.ts
 var import_node_child_process16 = require("child_process");
-var import_node_path61 = __toESM(require("path"), 1);
+var import_node_path62 = __toESM(require("path"), 1);
 var import_promises12 = require("timers/promises");
 // src/extension/port-allocator.ts
@@ -61658,7 +61812,7 @@ var Runtime = class {
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
-    const dir = import_node_path61.default.join(this.root, extId);
+    const dir = import_node_path62.default.join(this.root, extId);
     const env = {
       ...process.env,
       CLAWOS_EXT_PORT: String(port),
@@ -61770,7 +61924,7 @@ ${handle.stderrTail}`
 // src/extension/published-channels.ts
 var import_promises13 = __toESM(require("fs/promises"), 1);
-var import_node_path62 = __toESM(require("path"), 1);
+var import_node_path63 = __toESM(require("path"), 1);
 init_zod();
 var PublishedChannelsError = class extends Error {
   constructor(code, message) {
@@ -61869,7 +62023,7 @@ var PublishedChannelStore = class {
       )
     };
     const tmp = `${this.filePath}.tmp`;
-    await import_promises13.default.mkdir(import_node_path62.default.dirname(this.filePath), { recursive: true });
+    await import_promises13.default.mkdir(import_node_path63.default.dirname(this.filePath), { recursive: true });
     await import_promises13.default.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
     await import_promises13.default.rename(tmp, this.filePath);
   }
@@ -61877,7 +62031,7 @@ var PublishedChannelStore = class {
 // src/extension/bundle-cache.ts
 var import_promises14 = __toESM(require("fs/promises"), 1);
-var import_node_path63 = __toESM(require("path"), 1);
+var import_node_path64 = __toESM(require("path"), 1);
 var BundleCache = class {
   constructor(rootDir) {
     this.rootDir = rootDir;
@@ -61886,14 +62040,14 @@ var BundleCache = class {
   /** Atomic write: stage tmp → rename. Caller passes the hex sha256. */
   async write(snapshotHash, buffer) {
     await import_promises14.default.mkdir(this.rootDir, { recursive: true });
-    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path64.default.join(this.rootDir, `${snapshotHash}.zip`);
     const tmp = `${file}.tmp`;
     await import_promises14.default.writeFile(tmp, buffer, { mode: 384 });
     await import_promises14.default.rename(tmp, file);
   }
   /** Returns the bundle bytes, or null when the file doesn't exist. */
   async read(snapshotHash) {
-    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path64.default.join(this.rootDir, `${snapshotHash}.zip`);
     try {
       return await import_promises14.default.readFile(file);
     } catch (e) {
@@ -61903,7 +62057,7 @@ var BundleCache = class {
   }
   /** Idempotent — missing file is not an error. */
   async delete(snapshotHash) {
-    const file = import_node_path63.default.join(this.rootDir, `${snapshotHash}.zip`);
+    const file = import_node_path64.default.join(this.rootDir, `${snapshotHash}.zip`);
     await import_promises14.default.rm(file, { force: true });
   }
 };
@@ -61926,24 +62080,24 @@ async function startDaemon(config) {
     sampling: logShippingCfg.sampling,
     homeDir: import_node_os22.default.homedir()
   });
-  const logDir = import_node_path64.default.join(config.dataDir, "log");
-  import_node_fs48.default.mkdirSync(logDir, { recursive: true });
+  const logDir = import_node_path65.default.join(config.dataDir, "log");
+  import_node_fs49.default.mkdirSync(logDir, { recursive: true });
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path64.default.join(logDir, "clawd.log"),
+    file: import_node_path65.default.join(logDir, "clawd.log"),
     logClient
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const screenIdleProbeLogger = createFileOnlyLogger({
-    file: import_node_path64.default.join(logDir, "screen-idle-probe.log"),
+    file: import_node_path65.default.join(logDir, "screen-idle-probe.log"),
     level: "debug"
   });
   logger.info("screen-idle probe logger enabled", {
-    file: import_node_path64.default.join(logDir, "screen-idle-probe.log")
+    file: import_node_path65.default.join(logDir, "screen-idle-probe.log")
   });
   const CAP_TARGETS = [
-    import_node_path64.default.join(logDir, "clawd.log"),
-    import_node_path64.default.join(logDir, "screen-idle-probe.log")
+    import_node_path65.default.join(logDir, "clawd.log"),
+    import_node_path65.default.join(logDir, "screen-idle-probe.log")
   ];
   const LOG_CAP_MAX_BYTES = 10 * 1024 * 1024;
   const LOG_CAP_KEEP_BYTES = 5 * 1024 * 1024;
@@ -62039,8 +62193,8 @@ async function startDaemon(config) {
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path64.default.join(config.dataDir, "personas"));
-  const usersRoot = import_node_path64.default.join(config.dataDir, "users");
+  const personaStore = new PersonaStore(import_node_path65.default.join(config.dataDir, "personas"));
+  const usersRoot = import_node_path65.default.join(config.dataDir, "users");
   const defaultsRoot = findDefaultsRoot(logger);
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
@@ -62058,10 +62212,11 @@ async function startDaemon(config) {
   refreshSandboxSettings({ store: personaStore, logger });
   migrateAgentsMirror({ store: personaStore, logger });
   migrateCodexSandbox({ store: personaStore, logger });
+  migrateSandboxAllowRead({ store: personaStore, logger });
   retirePersonaBuilder({ store: personaStore, logger });
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const dispatchStore = createDispatchStore({
-    filePath: import_node_path64.default.join(config.dataDir, "dispatch.json"),
+    filePath: import_node_path65.default.join(config.dataDir, "dispatch.json"),
     now: () => Date.now(),
     onFlushError: (err) => logger.error("dispatch store flush failed", {
       reason: err instanceof Error ? err.message : String(err)
@@ -62076,18 +62231,18 @@ async function startDaemon(config) {
     now: () => Date.now(),
     onCompleted: (sid) => deliverPendingRef?.(sid)
   });
-  const here = typeof __dirname === "string" ? __dirname : import_node_path64.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
+  const here = typeof __dirname === "string" ? __dirname : import_node_path65.default.dirname((0, import_node_url4.fileURLToPath)(import_meta6.url));
   const mcpConfigs = [];
   const mcpDaemonUrl = `http://127.0.0.1:${config.port}`;
   const dispatchServerCandidates = [
-    import_node_path64.default.join(here, "dispatch", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "dispatch", "mcp-server.cjs"),
     // 生产 dist/index → dist/dispatch/mcp-server.cjs
-    import_node_path64.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
+    import_node_path65.default.join(here, "..", "dist", "dispatch", "mcp-server.cjs")
     // dev tsx src/index → ../dist/dispatch/mcp-server.cjs
   ];
-  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const dispatchServerScriptPath = dispatchServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (dispatchServerScriptPath) {
-    const dispatchLogPath = import_node_path64.default.join(logDir, "dispatch-mcp-server.log");
+    const dispatchLogPath = import_node_path65.default.join(logDir, "dispatch-mcp-server.log");
     const dispatchCfgPath = writeDispatchMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: dispatchServerScriptPath,
@@ -62107,12 +62262,12 @@ async function startDaemon(config) {
     });
   }
   const ticketServerCandidates = [
-    import_node_path64.default.join(here, "ticket", "mcp-server.cjs"),
-    import_node_path64.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
+    import_node_path65.default.join(here, "ticket", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "..", "dist", "ticket", "mcp-server.cjs")
   ];
-  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const ticketServerScriptPath = ticketServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (ticketServerScriptPath) {
-    const ticketLogPath = import_node_path64.default.join(logDir, "ticket-mcp-server.log");
+    const ticketLogPath = import_node_path65.default.join(logDir, "ticket-mcp-server.log");
     const ticketCfgPath = writeTicketMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: ticketServerScriptPath,
@@ -62134,12 +62289,12 @@ async function startDaemon(config) {
     });
   }
   const shiftServerCandidates = [
-    import_node_path64.default.join(here, "shift", "mcp-server.cjs"),
-    import_node_path64.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
+    import_node_path65.default.join(here, "shift", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "..", "dist", "shift", "mcp-server.cjs")
   ];
-  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const shiftServerScriptPath = shiftServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (shiftServerScriptPath) {
-    const shiftLogPath = import_node_path64.default.join(logDir, "shift-mcp-server.log");
+    const shiftLogPath = import_node_path65.default.join(logDir, "shift-mcp-server.log");
     const shiftCfgPath = await writeShiftMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: shiftServerScriptPath,
@@ -62160,12 +62315,12 @@ async function startDaemon(config) {
     );
   }
   const inboxServerCandidates = [
-    import_node_path64.default.join(here, "inbox", "mcp-server.cjs"),
-    import_node_path64.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
+    import_node_path65.default.join(here, "inbox", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "..", "dist", "inbox", "mcp-server.cjs")
   ];
-  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const inboxServerScriptPath = inboxServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (inboxServerScriptPath) {
-    const inboxLogPath = import_node_path64.default.join(logDir, "inbox-mcp-server.log");
+    const inboxLogPath = import_node_path65.default.join(logDir, "inbox-mcp-server.log");
     const inboxCfgPath = await writeInboxMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: inboxServerScriptPath,
@@ -62186,10 +62341,10 @@ async function startDaemon(config) {
     );
   }
   const peerOpsServerCandidates = [
-    import_node_path64.default.join(here, "peer-ops", "mcp-server.cjs"),
-    import_node_path64.default.join(here, "..", "dist", "peer-ops", "mcp-server.cjs")
+    import_node_path65.default.join(here, "peer-ops", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "..", "dist", "peer-ops", "mcp-server.cjs")
   ];
-  const peerOpsServerScriptPath = peerOpsServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const peerOpsServerScriptPath = peerOpsServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (peerOpsServerScriptPath) {
     const peerOpsCfgPath = writePeerOpsMcpConfig({
       dataDir: config.dataDir,
@@ -62209,12 +62364,12 @@ async function startDaemon(config) {
     );
   }
   const rpcToolServerCandidates = [
-    import_node_path64.default.join(here, "rpc-tool", "mcp-server.cjs"),
-    import_node_path64.default.join(here, "..", "dist", "rpc-tool", "mcp-server.cjs")
+    import_node_path65.default.join(here, "rpc-tool", "mcp-server.cjs"),
+    import_node_path65.default.join(here, "..", "dist", "rpc-tool", "mcp-server.cjs")
   ];
-  const rpcToolServerScriptPath = rpcToolServerCandidates.find((p2) => import_node_fs48.default.existsSync(p2));
+  const rpcToolServerScriptPath = rpcToolServerCandidates.find((p2) => import_node_fs49.default.existsSync(p2));
   if (rpcToolServerScriptPath) {
-    const rpcToolLogPath = import_node_path64.default.join(logDir, "rpc-tool-mcp-server.log");
+    const rpcToolLogPath = import_node_path65.default.join(logDir, "rpc-tool-mcp-server.log");
     const rpcToolCfgPath = writeRpcToolMcpConfig({
       dataDir: config.dataDir,
       serverScriptPath: rpcToolServerScriptPath,
@@ -62235,7 +62390,7 @@ async function startDaemon(config) {
     );
   }
   const shiftStore = createShiftStore({
-    filePath: import_node_path64.default.join(config.dataDir, "shift.json"),
+    filePath: import_node_path65.default.join(config.dataDir, "shift.json"),
     ownerIdProvider: () => ownerPrincipalId,
     now: () => Date.now()
   });
@@ -62257,7 +62412,7 @@ async function startDaemon(config) {
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path65.default.join(config.dataDir, "personas"),
     // dispatch / shift 自动化 spawn 按 persona 绑定 tool 起 B session（codex persona 用 codex）。
     // personaRegistry 声明在 manager 之后（同作用域 const，调用时机在启动完成后，无 TDZ 风险）。
     getPersonaTool: (personaId2) => personaRegistry.get(personaId2)?.tool,
@@ -62308,10 +62463,10 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path64.default.isAbsolute(input.relPath) ? input.relPath : import_node_path64.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path65.default.isAbsolute(input.relPath) ? input.relPath : import_node_path65.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
-          size = import_node_fs48.default.statSync(absPath).size;
+          size = import_node_fs49.default.statSync(absPath).size;
         } catch (err) {
           logger.warn("attachment.onFileEdit stat failed", {
             sessionId: input.sessionId,
@@ -62487,6 +62642,12 @@ async function startDaemon(config) {
   });
   const getProjectStore = (userId) => new ProjectStore(deriveUserWorkDir(userId, usersRoot));
   const appBuilderStore = getProjectStore(ownerPrincipalId);
+  const attachmentUserWorkDir = (sid) => {
+    const scope = manager.findOwnedSessionScope(sid);
+    if (scope?.kind !== "persona") return null;
+    const userId = scope.mode === "owner" ? ownerPrincipalId : scope.capId;
+    return deriveUserWorkDir(userId, usersRoot);
+  };
   recoverInterruptedPublishJobs(appBuilderStore, logger).catch((err) => {
     logger.warn("app-builder.publish.recover-startup-failed", {
       error: err instanceof Error ? err.message : String(err)
@@ -62552,11 +62713,11 @@ async function startDaemon(config) {
         // 'persona/<pid>/owner'，default 走 'default'。
         getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
         // guest path guard：candidate 必须在 personaRoot 子树或调用者自己的 user-dir 下
-        personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
+        personaRoot: import_node_path65.default.join(config.dataDir, "personas"),
         usersRoot
       },
       // workspace/git/history/skills/agents handler 共用的 guest path guard 锚点
-      personaRoot: import_node_path64.default.join(config.dataDir, "personas"),
+      personaRoot: import_node_path65.default.join(config.dataDir, "personas"),
       // v2 多人 persona 隔离：handler 派生 guest user-dir 放行
       usersRoot,
       // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
@@ -62682,11 +62843,11 @@ async function startDaemon(config) {
       // 发布上线脚手架化 (spec 2026-06-03 §5.2):
       // appBuilderPersonaRoot 用于拼 publish.sh 绝对路径（persona-app-builder 安装在
       // dataDir/personas/persona-app-builder 之下，extension-kit/scripts/publish.sh 是相对路径）。
-      appBuilderPersonaRoot: import_node_path64.default.join(config.dataDir, "personas", "persona-app-builder"),
+      appBuilderPersonaRoot: import_node_path65.default.join(config.dataDir, "personas", "persona-app-builder"),
       // 共享 deploy-kit 根：scaffold/publish 脚本骨架 + 阿里云凭证单一真源。
-      deployKitRoot: import_node_path64.default.join(config.dataDir, "deploy-kit"),
+      deployKitRoot: import_node_path65.default.join(config.dataDir, "deploy-kit"),
       // scaffold/publish 按当前 session 的 persona 解析其安装根，让每个 persona 用自己的模板/注入配置。
-      resolvePersonaRoot: (personaId2) => import_node_path64.default.join(config.dataDir, "personas", personaId2),
+      resolvePersonaRoot: (personaId2) => import_node_path65.default.join(config.dataDir, "personas", personaId2),
       // 发布上线脚手架化 (spec 2026-06-03 §5.2.2):
       // 复用 SessionManagerDeps.broadcastFrame 同款 dispatch 逻辑 —— runner 调 manager.send
       // 取回 broadcast 帧后逐帧 push 到 transport，跟 manager 自身的 deps 一致。
@@ -62789,7 +62950,7 @@ async function startDaemon(config) {
   });
   shiftScheduler.start();
   logger.info("shift scheduler started", { shiftCount: shiftStore.list().length });
-  const larkBotStore = createLarkBotBindingStore(import_node_path64.default.join(config.dataDir, "personas"));
+  const larkBotStore = createLarkBotBindingStore(import_node_path65.default.join(config.dataDir, "personas"));
   const larkBotCloud = createLarkBotCloudClient({
     api: config.clawosApi ?? DEFAULT_CLAWOS_API,
     apiKey: resolveClawdTicketsApiKey(),
@@ -62800,6 +62961,9 @@ async function startDaemon(config) {
     manager,
     cloud: larkBotCloud,
     store: larkBotStore,
+    fetchResource: (appId, messageId, fileKey, maxBytes) => larkBotCloud.fetchResource(appId, messageId, fileKey, maxBytes),
+    // 图片落 guest userWorkDir 下（capId = lark-<chat_id>）：CC 经 --add-dir + allowRead carve 可 Read
+    mediaRootFor: (chatId) => import_node_path65.default.join(deriveUserWorkDir(`lark-${chatId}`, usersRoot), "lark-media"),
     logger: {
       warn: (msg) => logger.warn(msg),
       info: (msg) => logger.info(msg)
@@ -62879,15 +63043,17 @@ async function startDaemon(config) {
     larkBotEvent: larkBotEventEndpoint,
     // /files HMAC verify 用 auth.json token（与 attachment.signUrl 同源）。
     getSignSecret: () => authFile.token,
-    // chatinput 附件上传（POST /attachments/upload，spec §6.1）。upload pipeline
-    // 在 session.cwd 下的 .attachments/ 落盘；签名 secret 与 /files HMAC 同源；
-    // tunnel 未启时返 503 TUNNEL_NOT_READY 让前端显式提示。
+    // chatinput 附件上传（POST /attachments/upload，spec §6.1 + 2026-08-06 §5）。落盘根按
+    // scope 切换：persona 会话 → 连接者 userWorkDir（与 connection-prompt 宣称的工作目录一致，
+    // guest 对 persona 目录的读权不再连带看到 owner 上传的附件）；非 persona 会话 → session.cwd
+    // （项目目录本就是用户地盘）。签名 secret 与 /files HMAC 同源；tunnel 未启时返 503。
     attachmentUpload: {
       groupFileStore,
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
-      getSessionDir: (sid) => {
+      getAttachmentBaseDir: (sid) => {
         const f = manager.findOwnedSession(sid);
-        return f ? f.cwd : null;
+        if (!f) return null;
+        return attachmentUserWorkDir(sid) ?? f.cwd;
       },
       getHttpBaseUrl: () => currentTunnelUrl ? getHttpBaseUrl() : null
     },
@@ -63080,8 +63246,8 @@ async function startDaemon(config) {
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path64.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path64.default.join(logDir, "frpc.log")}`
+        `Frpc config: ${import_node_path65.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path65.default.join(logDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -63094,8 +63260,8 @@ ${bar}
 `);
       try {
-        const connectPath = import_node_path64.default.join(config.dataDir, "connect.txt");
-        import_node_fs48.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
+        const connectPath = import_node_path65.default.join(config.dataDir, "connect.txt");
+        import_node_fs49.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
@@ -63131,8 +63297,10 @@ ${bar}
           scope,
           sessionId
         })),
-        // 注入 cwd 让 GC 直接定位 .attachments 目录（与 upload 落盘点一致）
+        // 双根扫描（spec 2026-08-06 §5）：legacy cwd 根（迁移前落盘点，30 天自然老化）+
+        // userWorkDir 根（迁移后 upload 落盘点，与 getAttachmentBaseDir 同源派生）
         getSessionCwd: (sid) => manager.findOwnedSession(sid)?.cwd ?? null,
+        getUserWorkDir: attachmentUserWorkDir,
         logger
       });
     } catch (err) {
@@ -63167,9 +63335,9 @@ ${bar}
   };
 }
 function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path64.default.join(dataDir, "persons");
+  const dir = import_node_path65.default.join(dataDir, "persons");
   try {
-    import_node_fs48.default.rmSync(dir, { recursive: true, force: true });
+    import_node_fs49.default.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }