@clawos-dev/clawd 0.2.437 → 0.2.439

package/dist/cli.cjs

@@ -6944,13 +6944,14 @@ var init_github = __esm({
 });
 
 // ../protocol/src/lark-bot-schemas.ts
-var LarkBotPersonaArgs, LarkBotUnbindArgs, LarkBotStatusArgs, LarkBotProvisionArgs, LarkBotProvisionCancelArgs, LARK_BOT_PROVISION_ERROR_REASONS, LarkBotProvisionErrorReasonSchema, LarkBotBindManualArgs, LarkBotGroupSchema, LarkBotStatusResultSchema, LarkBotStateFrameSchema;
+var LarkBotPersonaArgs, LarkBotUnbindArgs, LarkBotUpgradeArgs, LarkBotStatusArgs, LarkBotProvisionArgs, LarkBotProvisionCancelArgs, LARK_BOT_PROVISION_ERROR_REASONS, LarkBotProvisionErrorReasonSchema, LarkBotBindManualArgs, LarkBotGroupSchema, LarkBotStatusResultSchema, LarkBotStateFrameSchema;
 var init_lark_bot_schemas = __esm({
   "../protocol/src/lark-bot-schemas.ts"() {
     "use strict";
     init_zod();
     LarkBotPersonaArgs = external_exports.object({ personaId: external_exports.string().min(1) });
     LarkBotUnbindArgs = LarkBotPersonaArgs;
+    LarkBotUpgradeArgs = external_exports.object({ personaId: external_exports.string().min(1) });
     LarkBotStatusArgs = LarkBotPersonaArgs;
     LarkBotProvisionArgs = LarkBotPersonaArgs;
     LarkBotProvisionCancelArgs = LarkBotPersonaArgs;
@@ -6984,7 +6985,21 @@ var init_lark_bot_schemas = __esm({
       qrUrl: external_exports.string().optional(),
       /** provision 失败后的 unbound 帧携带；正常 unbound 无此字段 */
       errorReason: LarkBotProvisionErrorReasonSchema.optional(),
-      groups: external_exports.array(LarkBotGroupSchema)
+      groups: external_exports.array(LarkBotGroupSchema),
+      /**
+       * bound 态：该 bot 实际授予的 scope 缺了 LARK_PROVISION_ADDONS 里声明的项
+       * （spec 2026-09-01）——addons 是扫码时一次性写进飞书应用配置的，后来新增的
+       * scope / 事件对存量 bot 不生效，不提示的话用户只会觉得「功能没生效」。
+       * 判定真源是飞书回读的 granted scopes，不落库任何版本号。
+       */
+      needsUpgrade: external_exports.boolean().optional(),
+      /**
+       * bound 态叠加：正在扫码更新授权（spec 2026-09-01）。
+       * **不复用 provisioning 态**——升级期间 bot 仍在正常服务（长连接不断、群照常响应），
+       * 降级成 provisioning 会丢掉 botName / groups，UI 上像是断了。
+       * 有值即渲染二维码弹层；升级结束（成功或取消）该字段消失。
+       */
+      upgradeQrUrl: external_exports.string().optional()
     });
     LarkBotStateFrameSchema = LarkBotStatusResultSchema.extend({
       personaId: external_exports.string().min(1)
@@ -7036,7 +7051,7 @@ var init_onboarding_schemas = __esm({
 });
 
 // ../protocol/src/persona-schemas.ts
-var PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, CodexSandboxSettingsSchema;
+var PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, CodexSandboxSettingsSchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
@@ -7069,6 +7084,17 @@ var init_persona_schemas = __esm({
       // settings.json 中 enabledPlugins 的 key，例如 'superpowers@claude-plugins-official'
       id: external_exports.string().min(1)
     });
+    CodexSandboxSettingsSchema = external_exports.object({
+      // 额外可写的绝对路径或 ~ 路径（pnpm 工具链等）；workspace(cwd) 和 userWorkDir 由 daemon 自动加，不用列。
+      writableRoots: external_exports.array(external_exports.string()).optional(),
+      // 禁读 glob（相对 workspace root 或绝对），如 ".secrets/**"、"**/*.env"。
+      denyRead: external_exports.array(external_exports.string()).optional(),
+      // true → 网络全放(*)；false → 断网。**缺省等于联网**：daemon 写入的默认值是 network:true
+      // （对齐 claude guest 一贯的域名全放，见 spec 2026-09-01-codex-guest-network §1.3），
+      // 且 manager / UI 读到 undefined 时都回落 true —— 两侧必须同向，否则出现
+      // 「卡片显示开、实际断网」的幽灵态。
+      network: external_exports.boolean().optional()
+    }).strict();
     PersonaSandboxSettingsSchema = external_exports.object({
       permissions: external_exports.object({
         defaultMode: external_exports.string().optional(),
@@ -7117,7 +7143,10 @@ var init_persona_schemas = __esm({
       skills: external_exports.array(PersonaSkillSummarySchema).optional(),
       // 仅 'persona:get' 携带；空数组 = 没启用任何插件 / settings.json 不存在；undefined = 不在该响应类型上
       plugins: external_exports.array(PersonaPluginSummarySchema).optional(),
-      sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional()
+      sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional(),
+      // 仅 'persona:get' 携带；null = codex-sandbox.json 不存在 / parse 失败。
+      // UI 的「访客联网」开关读它（见 PersonaCardSettings）。
+      codexSandbox: CodexSandboxSettingsSchema.nullable().optional()
     });
     PersonaCreateArgsSchema = external_exports.object({
       // persona 身份。daemon 拼成 personaId = `persona-<slug>`——前缀由 daemon 拥有，调用方只给后半段，
@@ -7149,17 +7178,13 @@ var init_persona_schemas = __esm({
         personalityLocal: external_exports.string().optional(),
         public: external_exports.boolean().optional(),
         // pass `null` to clear; daemon strips the field from PersonaFile on null
-        iconKey: external_exports.string().nullable().optional()
+        iconKey: external_exports.string().nullable().optional(),
+        // codex guest 沙箱（落盘 .clawd/codex-sandbox.json，不在 PersonaFile 里）。与 personality
+        // 同款分层写：handler 剥出来单独落盘，且**局部合并**——只带 network 的 patch 不能抹掉
+        // owner 手配的 writableRoots / denyRead。
+        codexSandbox: CodexSandboxSettingsSchema.optional()
       }).strict()
     }).strict();
-    CodexSandboxSettingsSchema = external_exports.object({
-      // 额外可写的绝对路径或 ~ 路径（pnpm 工具链等）；workspace(cwd) 和 userWorkDir 由 daemon 自动加，不用列。
-      writableRoots: external_exports.array(external_exports.string()).optional(),
-      // 禁读 glob（相对 workspace root 或绝对），如 ".secrets/**"、"**/*.env"。
-      denyRead: external_exports.array(external_exports.string()).optional(),
-      // true → 网络全放(*)；缺省/false → 断网。
-      network: external_exports.boolean().optional()
-    }).strict();
   }
 });
 
@@ -8712,6 +8737,10 @@ var init_methods = __esm({
         summary: "\u89E3\u7ED1 persona \u7684\u98DE\u4E66 bot\uFF08\u5220\u4E91\u7AEF\u7ED1\u5B9A + \u65AD\u957F\u8FDE\u63A5\uFF0C\u98DE\u4E66\u4FA7 app \u4FDD\u7559\uFF09\uFF1Bowner-only",
         args: LarkBotUnbindArgs
       },
+      "larkBot:upgrade": {
+        summary: "\u626B\u7801\u66F4\u65B0\u5DF2\u7ED1\u5B9A bot \u7684\u6388\u6743\uFF08\u8865\u540E\u6765\u65B0\u589E\u7684 scope / \u4E8B\u4EF6\uFF09\uFF1B\u5168\u7A0B\u4FDD\u6301 bound\uFF0Cbot \u4E0D\u65AD\u8FDE\uFF1Bowner-only",
+        args: LarkBotUpgradeArgs
+      },
       "larkBot:status": {
         summary: "\u67E5 persona \u7684\u98DE\u4E66 bot \u72B6\u6001\uFF08unbound/bound/broken + \u670D\u52A1\u4E2D\u7FA4\u6E05\u5355\uFF09\uFF1Bowner-only",
         args: LarkBotStatusArgs
@@ -47040,7 +47069,7 @@ var SessionManager = class {
       subSessionMeta.codexSandbox = {
         writableRoots: [subSessionMeta.userWorkDir, ...(codexCfg?.writableRoots ?? []).map(expand)],
         denyRead: codexCfg?.denyRead ?? [],
-        network: codexCfg?.network ?? false
+        network: codexCfg?.network ?? true
       };
     }
     if (subSessionMeta?.personaMode === "owner" && file.projectPath) {
@@ -49778,6 +49807,24 @@ var PersonaManager = class {
     return this.deps.store.readEnabledPlugins(personaId2);
   }
   /** 读 sandbox-settings.json；不存在 / 损坏返回 null。供 persona:get handler 拼响应。 */
+  /** 读 codex guest 沙箱配置（`.clawd/codex-sandbox.json`）；缺失 / 坏 → null。透传给 handler 拼响应。 */
+  readCodexSandboxSettings(personaId2) {
+    return this.deps.store.readCodexSandboxSettings(personaId2);
+  }
+  /**
+   * 局部合并写 codex guest 沙箱配置，返回合并后的全量。
+   *
+   * **必须是合并不是覆盖**：UI 的「访客联网」开关只发 `{network}`，整体覆盖会静默抹掉 owner
+   * 手配的 writableRoots / denyRead（丢的是安全边界，且用户不会立刻发现）。
+   * 不走 PersonaManager.update 是因为它管的是 PersonaFile meta + 人格两层文本，
+   * 而这份配置是另一个文件、另一套 schema。
+   */
+  mergeCodexSandbox(personaId2, patch) {
+    if (!this.deps.registry.get(personaId2)) throw new Error(`persona not found: ${personaId2}`);
+    const merged = { ...this.deps.store.readCodexSandboxSettings(personaId2) ?? {}, ...patch };
+    this.deps.store.writeCodexSandboxSettings(personaId2, merged);
+    return merged;
+  }
   readSandboxSettings(personaId2) {
     return this.deps.store.readSandboxSettings(personaId2);
   }
@@ -50179,13 +50226,15 @@ function migrateAgentsMirror(args) {
   }
   if (mirrored > 0) args.logger.info("persona.agents-mirror.done", { mirrored });
 }
+var PKG_CACHE_ROOTS = ["~/Library/pnpm", "~/.local/share/pnpm", "~/.local/state/pnpm", "~/.npm", "~/.pnpm-store"];
+var CODEX_SANDBOX_DEFAULT = { writableRoots: [...PKG_CACHE_ROOTS], denyRead: [], network: true };
 function migrateCodexSandbox(args) {
   const entries = args.entries ?? DEFAULT_PERSONAS;
   let n = 0;
   for (const personaId2 of args.store.list()) {
     if (args.store.readCodexSandboxSettings(personaId2)) continue;
     try {
-      const def = entries.find((e) => e.personaId === personaId2)?.codexSandbox ?? { writableRoots: [], denyRead: [], network: false };
+      const def = entries.find((e) => e.personaId === personaId2)?.codexSandbox ?? CODEX_SANDBOX_DEFAULT;
       args.store.writeCodexSandboxSettings(personaId2, def);
       n++;
       args.logger.info("persona.codex-sandbox.synced", { personaId: personaId2 });
@@ -54030,6 +54079,7 @@ function buildShiftInternalHandlers(deps) {
 init_protocol();
 var PROVISION_ERROR_SET = new Set(LARK_BOT_PROVISION_ERROR_REASONS);
 var PROVISION_POLL_INTERVAL_MS = 2e3;
+var UPGRADE_POLL_MAX_FAILURES = 5;
 var PROVISION_MAX_CONSECUTIVE_FAILURES = 5;
 var PROVISION_POLL_MAX_MS = 60 * 60 * 1e3;
 function normalizeProvisionReason(reason) {
@@ -54043,6 +54093,7 @@ function buildLarkBotHandlers(deps) {
   const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const pollIntervalMs = deps.pollIntervalMs ?? PROVISION_POLL_INTERVAL_MS;
   const inFlight = /* @__PURE__ */ new Map();
+  const upgradeInFlight = /* @__PURE__ */ new Map();
   const groupsOf = (personaId2) => {
     const removed = new Set(deps.store.read(personaId2)?.removedChatIds ?? []);
     return deps.listLarkSessions(personaId2).filter((g2) => !removed.has(g2.chatId));
@@ -54141,8 +54192,121 @@ function buildLarkBotHandlers(deps) {
     void runProvisionPolling(personaId2, provisionId);
     return { response: { type: "larkBot:provision:ok" } };
   };
+  const runUpgradePolling = async (personaId2) => {
+    const backToBound = (needsUpgrade) => {
+      upgradeInFlight.delete(personaId2);
+      const fresh = deps.store.read(personaId2);
+      if (!fresh) {
+        emit(personaId2, { state: "unbound", groups: [] });
+        return;
+      }
+      emit(personaId2, {
+        state: "bound",
+        appId: fresh.appId,
+        botName: fresh.botName,
+        ...needsUpgrade ? { needsUpgrade: true } : {},
+        groups: groupsOf(personaId2)
+      });
+    };
+    const startedAt = now();
+    let failures = 0;
+    for (; ; ) {
+      await sleep2(pollIntervalMs);
+      const entry = upgradeInFlight.get(personaId2);
+      if (!entry || entry.cancelled) return;
+      if (now() - startedAt >= PROVISION_POLL_MAX_MS) {
+        deps.logger?.warn(`larkBot upgrade poll deadline exceeded: ${personaId2}`);
+        backToBound(true);
+        return;
+      }
+      let stillNeeds;
+      try {
+        const binding = (await deps.cloud.listBindings()).find((b2) => b2.personaId === personaId2);
+        if (!binding) {
+          backToBound(false);
+          return;
+        }
+        stillNeeds = binding.needsUpgrade !== false;
+        failures = 0;
+        if (!upgradeInFlight.get(personaId2) || upgradeInFlight.get(personaId2)?.cancelled) return;
+      } catch (err) {
+        failures += 1;
+        deps.logger?.warn(`larkBot upgrade poll failed (${failures}): ${err.message}`);
+        if (failures >= UPGRADE_POLL_MAX_FAILURES) {
+          backToBound(true);
+          return;
+        }
+        await sleep2(pollIntervalMs * 2 ** failures);
+        continue;
+      }
+      if (!stillNeeds) {
+        backToBound(false);
+        return;
+      }
+    }
+  };
+  const upgrade = async (frame) => {
+    const { personaId: personaId2 } = parseArgs2(LarkBotUpgradeArgs, frame, "larkBot:upgrade");
+    const meta = deps.store.read(personaId2);
+    if (!meta) throw new Error(`larkBot not bound: ${personaId2}`);
+    if (inFlight.has(personaId2) || upgradeInFlight.has(personaId2)) {
+      throw new Error(`larkBot provision already in flight: ${personaId2}`);
+    }
+    upgradeInFlight.set(personaId2, { provisionId: "", qrUrl: "", cancelled: false });
+    let provisionId;
+    let qrUrl;
+    try {
+      ;
+      ({ provisionId, qrUrl } = await deps.cloud.provisionUpgrade({ personaId: personaId2 }));
+    } catch (err) {
+      upgradeInFlight.delete(personaId2);
+      throw err;
+    }
+    const placeholder = upgradeInFlight.get(personaId2);
+    if (!placeholder || placeholder.cancelled) {
+      upgradeInFlight.delete(personaId2);
+      void deps.cloud.provisionCancel(provisionId).catch(
+        (err) => deps.logger?.warn(`larkBot upgrade cancel-during-begin: ${err.message}`)
+      );
+      return { response: { type: "larkBot:upgrade:ok" } };
+    }
+    upgradeInFlight.set(personaId2, { provisionId, qrUrl, cancelled: false });
+    emit(personaId2, {
+      state: "bound",
+      appId: meta.appId,
+      botName: meta.botName,
+      needsUpgrade: true,
+      upgradeQrUrl: qrUrl,
+      groups: groupsOf(personaId2)
+    });
+    void runUpgradePolling(personaId2);
+    return { response: { type: "larkBot:upgrade:ok" } };
+  };
   const provisionCancel = async (frame) => {
     const { personaId: personaId2 } = parseArgs2(LarkBotProvisionCancelArgs, frame, "larkBot:provisionCancel");
+    const upgrading = upgradeInFlight.get(personaId2);
+    if (upgrading) {
+      upgrading.cancelled = true;
+      upgradeInFlight.delete(personaId2);
+      if (upgrading.provisionId) {
+        await deps.cloud.provisionCancel(upgrading.provisionId).catch(
+          (err) => deps.logger?.warn(`larkBot upgrade cancel cloud failed: ${err.message}`)
+        );
+      }
+      const meta = deps.store.read(personaId2);
+      emit(
+        personaId2,
+        meta ? {
+          state: "bound",
+          appId: meta.appId,
+          botName: meta.botName,
+          // 取消了就是没升成，提示条留着
+          needsUpgrade: true,
+          groups: groupsOf(personaId2)
+        } : { state: "unbound", groups: [] }
+      );
+      return { response: { type: "larkBot:provisionCancel:ok" } };
+    }
     const entry = inFlight.get(personaId2);
     if (!entry) throw new Error(`larkBot provision not in flight: ${personaId2}`);
     entry.cancelled = true;
@@ -54182,6 +54346,7 @@ function buildLarkBotHandlers(deps) {
     const ownerId = deps.getOwnerId();
     if (!ownerId) throw new Error("larkBot bind requires feishu login (owner identity)");
     const name = botName ?? deps.getPersonaName(personaId2) ?? personaId2;
+    upgradeInFlight.delete(personaId2);
     await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl, ownerId });
     deps.store.write(personaId2, { appId, botName: name, boundAt: now() });
     emit(personaId2, { state: "bound", appId, botName: name, groups: groupsOf(personaId2) });
@@ -54189,6 +54354,7 @@ function buildLarkBotHandlers(deps) {
   };
   const unbind = async (frame) => {
     const { personaId: personaId2 } = parseArgs2(LarkBotUnbindArgs, frame, "larkBot:unbind");
+    upgradeInFlight.delete(personaId2);
     const meta = deps.store.read(personaId2);
     if (!meta) throw new Error(`larkBot not bound: ${personaId2}`);
     try {
@@ -54214,6 +54380,8 @@ function buildLarkBotHandlers(deps) {
         }
       };
     }
+    const upgrading = upgradeInFlight.get(personaId2);
+    const upgradingQr = upgrading && !upgrading.cancelled ? upgrading.qrUrl : void 0;
     const meta = deps.store.read(personaId2);
     let cloudReachable = false;
     let cloudBinding;
@@ -54235,7 +54403,10 @@ function buildLarkBotHandlers(deps) {
           state: broken2 ? "broken" : "bound",
           appId: cloudBinding.appId,
           botName: cloudBinding.botName,
+          ...upgradingQr ? { needsUpgrade: true, upgradeQrUrl: upgradingQr } : {},
           ...broken2 ? { brokenReason: cloudBinding.brokenReason ?? "unknown" } : {},
+          // 云端判定（它持有飞书回读的 granted scopes），daemon 只透传（spec 2026-09-01）
+          ...cloudBinding.needsUpgrade ? { needsUpgrade: true } : {},
           groups: groupsOf(personaId2)
         };
         return { response: { type: "larkBot:status:ok", ...result2 } };
@@ -54262,7 +54433,10 @@ function buildLarkBotHandlers(deps) {
       state: broken ? "broken" : "bound",
       appId: cloudBinding?.appId ?? meta.appId,
       botName: cloudBinding?.botName ?? meta.botName,
+      ...upgradingQr ? { needsUpgrade: true, upgradeQrUrl: upgradingQr } : {},
       ...broken ? { brokenReason: cloudBinding?.brokenReason ?? "unknown" } : {},
+      // 云端不可达时 cloudBinding 为空 → 不提示升级（宁可不提示也不误报）
+      ...cloudBinding?.needsUpgrade ? { needsUpgrade: true } : {},
       groups: groupsOf(personaId2)
     };
     return { response: { type: "larkBot:status:ok", ...result } };
@@ -54272,7 +54446,8 @@ function buildLarkBotHandlers(deps) {
     "larkBot:provisionCancel": provisionCancel,
     "larkBot:bindManual": bindManual,
     "larkBot:unbind": unbind,
-    "larkBot:status": status
+    "larkBot:status": status,
+    "larkBot:upgrade": upgrade
   };
 }
 async function refreshTunnelUrlOnStartup(deps) {
@@ -54392,6 +54567,10 @@ function createLarkBotCloudClient(opts) {
       const json = await request("POST", "/api/lark-bot/provision", { ...args });
       return { provisionId: String(json.provisionId), qrUrl: String(json.qrUrl) };
     },
+    async provisionUpgrade(args) {
+      const json = await request("POST", "/api/lark-bot/upgrade", { ...args });
+      return { provisionId: String(json.provisionId), qrUrl: String(json.qrUrl) };
+    },
     async provisionStatus(provisionId) {
       const json = await request("GET", `/api/lark-bot/provision/${encodeURIComponent(provisionId)}`);
       if (json.state === "success") {
@@ -62521,6 +62700,7 @@ var METHOD_GRANT_MAP = {
   "larkBot:bindManual": ADMIN_ANY,
   "larkBot:unbind": ADMIN_ANY,
   "larkBot:status": ADMIN_ANY,
+  "larkBot:upgrade": ADMIN_ANY,
   // ---- onboarding:* / tools:probe / session:externalScan（首启 wizard，owner-only）----
   "onboarding:complete": ADMIN_ANY,
   "onboarding:iosInterest": ADMIN_ANY,
@@ -62657,7 +62837,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.437".length > 0 ? "0.2.437" : "dev";
+var version = "0.2.439".length > 0 ? "0.2.439" : "dev";
 
 // src/cli-probe/probe.ts
 var fs65 = __toESM(require("fs"), 1);
@@ -62821,6 +63001,7 @@ function buildPersonaHandlers(deps) {
     const skills = personaManager.listSkills(args.personaId);
     const plugins = personaManager.listEnabledPlugins(args.personaId);
     const sandboxSettings = personaManager.readSandboxSettings(args.personaId);
+    const codexSandbox = personaManager.readCodexSandboxSettings(args.personaId);
     return {
       response: {
         type: "persona:info",
@@ -62830,16 +63011,26 @@ function buildPersonaHandlers(deps) {
         personalityManaged,
         skills,
         plugins,
-        sandboxSettings
+        sandboxSettings,
+        codexSandbox
       }
     };
   };
   const update = async (frame) => {
     const { type: _type, requestId: _requestId, ...rest } = frame;
     const args = parseArgs2(PersonaUpdateArgsSchema, frame, "persona:update");
-    const { personality, personalityLocal, ...metaPatch } = args.patch;
+    const { personality, personalityLocal, codexSandbox, ...metaPatch } = args.patch;
     const persona = personaManager.update(args.personaId, metaPatch, { personality, personalityLocal });
-    return { response: { type: "persona:info", ...persona } };
+    const mergedCodexSandbox = codexSandbox ? personaManager.mergeCodexSandbox(args.personaId, codexSandbox) : void 0;
+    return {
+      response: {
+        type: "persona:info",
+        ...persona,
+        // 只在本次确实动过时回带，让调用方拿到合并后的真值而不用再 get 一次；
+        // 没动就不带（与 personality 等分层字段同口径：persona:update 的响应是 meta 视图）。
+        ...mergedCodexSandbox ? { codexSandbox: mergedCodexSandbox } : {}
+      }
+    };
   };
   const del = async (frame) => {
     const args = parseArgs2(PersonaIdArgsSchema, frame, "persona:delete");

package/dist/dispatch/mcp-server.cjs

@@ -22118,6 +22118,7 @@ var GithubPrRequestReviewersArgs = external_exports.object({
 // ../protocol/src/lark-bot-schemas.ts
 var LarkBotPersonaArgs = external_exports.object({ personaId: external_exports.string().min(1) });
 var LarkBotUnbindArgs = LarkBotPersonaArgs;
+var LarkBotUpgradeArgs = external_exports.object({ personaId: external_exports.string().min(1) });
 var LarkBotStatusArgs = LarkBotPersonaArgs;
 var LarkBotProvisionArgs = LarkBotPersonaArgs;
 var LarkBotProvisionCancelArgs = LarkBotPersonaArgs;
@@ -22151,7 +22152,21 @@ var LarkBotStatusResultSchema = external_exports.object({
   qrUrl: external_exports.string().optional(),
   /** provision 失败后的 unbound 帧携带；正常 unbound 无此字段 */
   errorReason: LarkBotProvisionErrorReasonSchema.optional(),
-  groups: external_exports.array(LarkBotGroupSchema)
+  groups: external_exports.array(LarkBotGroupSchema),
+  /**
+   * bound 态：该 bot 实际授予的 scope 缺了 LARK_PROVISION_ADDONS 里声明的项
+   * （spec 2026-09-01）——addons 是扫码时一次性写进飞书应用配置的，后来新增的
+   * scope / 事件对存量 bot 不生效，不提示的话用户只会觉得「功能没生效」。
+   * 判定真源是飞书回读的 granted scopes，不落库任何版本号。
+   */
+  needsUpgrade: external_exports.boolean().optional(),
+  /**
+   * bound 态叠加：正在扫码更新授权（spec 2026-09-01）。
+   * **不复用 provisioning 态**——升级期间 bot 仍在正常服务（长连接不断、群照常响应），
+   * 降级成 provisioning 会丢掉 botName / groups，UI 上像是断了。
+   * 有值即渲染二维码弹层；升级结束（成功或取消）该字段消失。
+   */
+  upgradeQrUrl: external_exports.string().optional()
 });
 var LarkBotStateFrameSchema = LarkBotStatusResultSchema.extend({
   personaId: external_exports.string().min(1)
@@ -22222,6 +22237,17 @@ var PersonaPluginSummarySchema = external_exports.object({
   // settings.json 中 enabledPlugins 的 key，例如 'superpowers@claude-plugins-official'
   id: external_exports.string().min(1)
 });
+var CodexSandboxSettingsSchema = external_exports.object({
+  // 额外可写的绝对路径或 ~ 路径（pnpm 工具链等）；workspace(cwd) 和 userWorkDir 由 daemon 自动加，不用列。
+  writableRoots: external_exports.array(external_exports.string()).optional(),
+  // 禁读 glob（相对 workspace root 或绝对），如 ".secrets/**"、"**/*.env"。
+  denyRead: external_exports.array(external_exports.string()).optional(),
+  // true → 网络全放(*)；false → 断网。**缺省等于联网**：daemon 写入的默认值是 network:true
+  // （对齐 claude guest 一贯的域名全放，见 spec 2026-09-01-codex-guest-network §1.3），
+  // 且 manager / UI 读到 undefined 时都回落 true —— 两侧必须同向，否则出现
+  // 「卡片显示开、实际断网」的幽灵态。
+  network: external_exports.boolean().optional()
+}).strict();
 var PersonaSandboxSettingsSchema = external_exports.object({
   permissions: external_exports.object({
     defaultMode: external_exports.string().optional(),
@@ -22270,7 +22296,10 @@ var PersonaInfoResponseSchema = PersonaFileSchema.extend({
   skills: external_exports.array(PersonaSkillSummarySchema).optional(),
   // 仅 'persona:get' 携带；空数组 = 没启用任何插件 / settings.json 不存在；undefined = 不在该响应类型上
   plugins: external_exports.array(PersonaPluginSummarySchema).optional(),
-  sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional()
+  sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional(),
+  // 仅 'persona:get' 携带；null = codex-sandbox.json 不存在 / parse 失败。
+  // UI 的「访客联网」开关读它（见 PersonaCardSettings）。
+  codexSandbox: CodexSandboxSettingsSchema.nullable().optional()
 });
 var PersonaCreateArgsSchema = external_exports.object({
   // persona 身份。daemon 拼成 personaId = `persona-<slug>`——前缀由 daemon 拥有，调用方只给后半段，
@@ -22302,17 +22331,13 @@ var PersonaUpdateArgsSchema = external_exports.object({
     personalityLocal: external_exports.string().optional(),
     public: external_exports.boolean().optional(),
     // pass `null` to clear; daemon strips the field from PersonaFile on null
-    iconKey: external_exports.string().nullable().optional()
+    iconKey: external_exports.string().nullable().optional(),
+    // codex guest 沙箱（落盘 .clawd/codex-sandbox.json，不在 PersonaFile 里）。与 personality
+    // 同款分层写：handler 剥出来单独落盘，且**局部合并**——只带 network 的 patch 不能抹掉
+    // owner 手配的 writableRoots / denyRead。
+    codexSandbox: CodexSandboxSettingsSchema.optional()
   }).strict()
 }).strict();
-var CodexSandboxSettingsSchema = external_exports.object({
-  // 额外可写的绝对路径或 ~ 路径（pnpm 工具链等）；workspace(cwd) 和 userWorkDir 由 daemon 自动加，不用列。
-  writableRoots: external_exports.array(external_exports.string()).optional(),
-  // 禁读 glob（相对 workspace root 或绝对），如 ".secrets/**"、"**/*.env"。
-  denyRead: external_exports.array(external_exports.string()).optional(),
-  // true → 网络全放(*)；缺省/false → 断网。
-  network: external_exports.boolean().optional()
-}).strict();
 
 // ../protocol/src/events.ts
 var SESSION_STATUS_VALUES = [
@@ -23772,6 +23797,10 @@ var METHOD_DOCS = {
     summary: "\u89E3\u7ED1 persona \u7684\u98DE\u4E66 bot\uFF08\u5220\u4E91\u7AEF\u7ED1\u5B9A + \u65AD\u957F\u8FDE\u63A5\uFF0C\u98DE\u4E66\u4FA7 app \u4FDD\u7559\uFF09\uFF1Bowner-only",
     args: LarkBotUnbindArgs
   },
+  "larkBot:upgrade": {
+    summary: "\u626B\u7801\u66F4\u65B0\u5DF2\u7ED1\u5B9A bot \u7684\u6388\u6743\uFF08\u8865\u540E\u6765\u65B0\u589E\u7684 scope / \u4E8B\u4EF6\uFF09\uFF1B\u5168\u7A0B\u4FDD\u6301 bound\uFF0Cbot \u4E0D\u65AD\u8FDE\uFF1Bowner-only",
+    args: LarkBotUpgradeArgs
+  },
   "larkBot:status": {
     summary: "\u67E5 persona \u7684\u98DE\u4E66 bot \u72B6\u6001\uFF08unbound/bound/broken + \u670D\u52A1\u4E2D\u7FA4\u6E05\u5355\uFF09\uFF1Bowner-only",
     args: LarkBotStatusArgs