@clawos-dev/clawd 0.2.477 → 0.2.479

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21344,12 +21344,9 @@ var EnvEvidenceSchema = external_exports.object({
 });
 
 // ../protocol/src/deploy-schemas.ts
-var FulfillmentSchema = external_exports.enum(["deployer", "user"]);
 var DeployFileSchema = external_exports.object({
   version: external_exports.literal(1),
-  manifest: EnvironmentManifestSchema,
-  /** secret name → 谁提供。缺席 = 还没定 */
-  fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).default({})
+  manifest: EnvironmentManifestSchema
 }).strict();
 var DeployScanStatusSchema = external_exports.enum(["scanning", "done", "failed"]);
 var DeployScanSchema = external_exports.object({
@@ -21400,7 +21397,6 @@ var DeployPersonaArgsSchema = external_exports.object({
 var DeployPatchArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   patch: external_exports.object({
-    fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).optional(),
     // 人工补依赖；整份替换 manifest
     manifest: EnvironmentManifestSchema.optional()
   }).strict()
@@ -23884,7 +23880,7 @@ var METHOD_DOCS = {
   },
   // ---- deploy:*（persona 上云：persona 目录 = git 仓库工作树，发布 = 推送触发仓库流水线）----
   "deploy:start": {
-    summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u6E05\u5355 + \u5C65\u7EA6\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
+    summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u73AF\u5883\u6E05\u5355\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
     args: DeployPersonaArgsSchema
   },
   "deploy:get": {
@@ -23892,7 +23888,7 @@ var METHOD_DOCS = {
     args: DeployPersonaArgsSchema
   },
   "deploy:patch": {
-    summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u9009\u5C65\u7EA6\uFF08\u8C01\u51FA\u8FD9\u6761\u51ED\u636E\uFF09/ \u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1B\u5C65\u7EA6\u540D\u5FC5\u987B\u662F\u6E05\u5355\u91CC\u58F0\u660E\u8FC7\u7684\u51ED\u636E\uFF1Bowner-only",
+    summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1Bowner-only",
     args: DeployPatchArgsSchema
   },
   "deploy:putSecret": {
@@ -23908,7 +23904,7 @@ var METHOD_DOCS = {
     args: DeployFinishScanArgsSchema
   },
   "deploy:release": {
-    summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u6761\u51ED\u636E\u90FD\u5B9A\u4E86\u5C65\u7EA6\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
+    summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
     args: DeployPersonaArgsSchema
   },
   "shift:list": {

package/dist/cli.cjs

@@ -6025,18 +6025,15 @@ var init_environment_schemas = __esm({
 function repoSlug(url) {
   return url.trim().replace(/^git@[^:]+:/, "").replace(/^https?:\/\/[^/]+\//, "").replace(/\.git$/, "");
 }
-var FulfillmentSchema, DeployFileSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeploySecretPresenceSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
+var DeployFileSchema, DeployScanStatusSchema, DeployScanSchema, DeployRepoSchema, DeploySecretPresenceSchema, DeployStateSchema, DeployReleaseResultSchema, DeployPersonaArgsSchema, DeployPatchArgsSchema, DeployPutSecretArgsSchema, DeployReportFindingArgsSchema, DeployFinishScanArgsSchema, PERSONA_REPO_ORG;
 var init_deploy_schemas = __esm({
   "../protocol/src/deploy-schemas.ts"() {
     "use strict";
     init_zod();
     init_environment_schemas();
-    FulfillmentSchema = external_exports.enum(["deployer", "user"]);
     DeployFileSchema = external_exports.object({
       version: external_exports.literal(1),
-      manifest: EnvironmentManifestSchema,
-      /** secret name → 谁提供。缺席 = 还没定 */
-      fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).default({})
+      manifest: EnvironmentManifestSchema
     }).strict();
     DeployScanStatusSchema = external_exports.enum(["scanning", "done", "failed"]);
     DeployScanSchema = external_exports.object({
@@ -6087,7 +6084,6 @@ var init_deploy_schemas = __esm({
     DeployPatchArgsSchema = external_exports.object({
       personaId: external_exports.string().min(1),
       patch: external_exports.object({
-        fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).optional(),
         // 人工补依赖；整份替换 manifest
         manifest: EnvironmentManifestSchema.optional()
       }).strict()
@@ -8836,7 +8832,7 @@ var init_methods = __esm({
       },
       // ---- deploy:*（persona 上云：persona 目录 = git 仓库工作树，发布 = 推送触发仓库流水线）----
       "deploy:start": {
-        summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u6E05\u5355 + \u5C65\u7EA6\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
+        summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u73AF\u5883\u6E05\u5355\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
         args: DeployPersonaArgsSchema
       },
       "deploy:get": {
@@ -8844,7 +8840,7 @@ var init_methods = __esm({
         args: DeployPersonaArgsSchema
       },
       "deploy:patch": {
-        summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u9009\u5C65\u7EA6\uFF08\u8C01\u51FA\u8FD9\u6761\u51ED\u636E\uFF09/ \u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1B\u5C65\u7EA6\u540D\u5FC5\u987B\u662F\u6E05\u5355\u91CC\u58F0\u660E\u8FC7\u7684\u51ED\u636E\uFF1Bowner-only",
+        summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1Bowner-only",
         args: DeployPatchArgsSchema
       },
       "deploy:putSecret": {
@@ -8860,7 +8856,7 @@ var init_methods = __esm({
         args: DeployFinishScanArgsSchema
       },
       "deploy:release": {
-        summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u6761\u51ED\u636E\u90FD\u5B9A\u4E86\u5C65\u7EA6\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
+        summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
         args: DeployPersonaArgsSchema
       },
       "shift:list": {
@@ -54676,7 +54672,7 @@ async function writeScan(dir, scan) {
   await writeJson(import_node_path30.default.join(dir, SCAN_FILE), DeployScanSchema.parse(scan));
 }
 function emptyDeployFile() {
-  return { version: 1, manifest: { version: 1, clis: [], secrets: [], assets: [] }, fulfillment: {} };
+  return { version: 1, manifest: { version: 1, clis: [], secrets: [], assets: [] } };
 }
 function parseFinding(kind, item) {
   const schema = kind === "cli" ? EnvCliSchema : kind === "secret" ? EnvSecretSchema : EnvAssetSchema;
@@ -54766,11 +54762,8 @@ var L = [
   "    outputs:",
   "      tag: ${{ steps.plan.outputs.tag }}",
   "      image: ${{ steps.plan.outputs.image }}",
-  "      deploy_id: ${{ steps.plan.outputs.deploy_id }}",
   "      persona_id: ${{ steps.plan.outputs.persona_id }}",
   "      env_names: ${{ steps.plan.outputs.env_names }}",
-  "      deployer_env_names: ${{ steps.plan.outputs.deployer_env_names }}",
-  "      user_secrets: ${{ steps.plan.outputs.user_secrets }}",
   "    steps:",
   "      - name: Checkout persona",
   "        uses: actions/checkout@v4",
@@ -54891,7 +54884,6 @@ var L = [
   "        run: |",
   "          node clawos/cloud-host/pipeline/smoke.mjs \\",
   "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --deploy-id '${{ needs.build.outputs.deploy_id }}' \\",
   "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
   "            --run-number '${{ github.run_number }}'",
   "",
@@ -54916,12 +54908,10 @@ var L = [
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
-  "          CLAWD_DEPLOYER_ENV_NAMES: ${{ needs.build.outputs.deployer_env_names }}",
-  "          CLAWD_USER_SECRETS: ${{ needs.build.outputs.user_secrets }}",
+  "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/register.mjs \\",
   "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --deploy-id '${{ needs.build.outputs.deploy_id }}' \\",
   "            --persona-id '${{ needs.build.outputs.persona_id }}'",
   ""
 ];
@@ -55242,7 +55232,7 @@ function buildDeployHandlers(deps) {
       secretsCache.delete(personaId2);
     }
     const prev = await readDeployFile(dir).catch(() => void 0);
-    await writeDeployFile(dir, { ...emptyDeployFile(), fulfillment: prev?.fulfillment ?? {} });
+    await writeDeployFile(dir, emptyDeployFile());
     const startedAt = deps.now();
     await writeScan(dir, { status: "scanning", evidence: [], notes: [], scannedAssets: [], startedAt });
     const started = deps.startScan(personaId2);
@@ -55272,16 +55262,9 @@ function buildDeployHandlers(deps) {
     const args = parseArgs2(DeployPatchArgsSchema, frame, "deploy:patch");
     const dir = mustPersona(args.personaId);
     const file = await readDeployFile(dir) ?? emptyDeployFile();
-    if (args.patch.fulfillment) {
-      const declared = new Set((args.patch.manifest ?? file.manifest).secrets.map((s) => s.name));
-      for (const name of Object.keys(args.patch.fulfillment)) {
-        if (!declared.has(name)) throw invalid(`\u6E05\u5355\u91CC\u6CA1\u6709\u53EB\u300C${name}\u300D\u7684\u51ED\u636E`);
-      }
-    }
     const next = {
       ...file,
-      ...args.patch.manifest ? { manifest: args.patch.manifest } : {},
-      ...args.patch.fulfillment ? { fulfillment: { ...file.fulfillment, ...args.patch.fulfillment } } : {}
+      ...args.patch.manifest ? { manifest: args.patch.manifest } : {}
     };
     await writeDeployFile(dir, next);
     return view(args.personaId);
@@ -55358,8 +55341,6 @@ function buildDeployHandlers(deps) {
     if (scan?.status === "scanning") throw invalid("\u626B\u63CF\u8FD8\u6CA1\u7ED3\u675F");
     if (scan?.status !== "done") throw invalid(scan?.status === "failed" ? "\u4E0A\u6B21\u626B\u63CF\u5931\u8D25\u4E86\uFF0C\u5148\u91CD\u65B0\u626B\u63CF" : "\u8FD8\u6CA1\u626B\u63CF\u8FC7\uFF0C\u5148\u626B\u63CF");
     const blockers = [];
-    const undecided = file.manifest.secrets.filter((s) => !file.fulfillment[s.name]).map((s) => `\u300C${s.name}\u300D\u8FD8\u6CA1\u5B9A\u8C01\u51FA`);
-    blockers.push(...undecided);
     let present;
     try {
       present = new Set((await cachedSecrets(personaId2, dir, true)).filter((p2) => p2.setAt).map((p2) => p2.env));
@@ -64066,7 +64047,7 @@ var METHOD_GRANT_MAP = {
   // ---- visitor:* (访客名单，owner-only) ----
   // owner 看完整访客名单（含没开会话的）；guest 不可调（handler 内再 assertOwner 兜底）。
   "visitor:list": ADMIN_ANY,
-  // deploy:*（persona 上云）：全部 owner-only。里面有履约决策、凭据录入口、建仓和推送，
+  // deploy:*（persona 上云）：全部 owner-only。里面有凭据录入口、建仓和推送，
   // guest 不该看见更不该动。
   "deploy:start": ADMIN_ANY,
   "deploy:get": ADMIN_ANY,
@@ -64320,7 +64301,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.477".length > 0 ? "0.2.477" : "dev";
+var version = "0.2.479".length > 0 ? "0.2.479" : "dev";
 
 // src/cli-probe/probe.ts
 var fs70 = __toESM(require("fs"), 1);

package/dist/dispatch/mcp-server.cjs

@@ -21337,12 +21337,9 @@ var EnvEvidenceSchema = external_exports.object({
 });
 
 // ../protocol/src/deploy-schemas.ts
-var FulfillmentSchema = external_exports.enum(["deployer", "user"]);
 var DeployFileSchema = external_exports.object({
   version: external_exports.literal(1),
-  manifest: EnvironmentManifestSchema,
-  /** secret name → 谁提供。缺席 = 还没定 */
-  fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).default({})
+  manifest: EnvironmentManifestSchema
 }).strict();
 var DeployScanStatusSchema = external_exports.enum(["scanning", "done", "failed"]);
 var DeployScanSchema = external_exports.object({
@@ -21393,7 +21390,6 @@ var DeployPersonaArgsSchema = external_exports.object({
 var DeployPatchArgsSchema = external_exports.object({
   personaId: external_exports.string().min(1),
   patch: external_exports.object({
-    fulfillment: external_exports.record(external_exports.string(), FulfillmentSchema).optional(),
     // 人工补依赖；整份替换 manifest
     manifest: EnvironmentManifestSchema.optional()
   }).strict()
@@ -23876,7 +23872,7 @@ var METHOD_DOCS = {
   },
   // ---- deploy:*（persona 上云：persona 目录 = git 仓库工作树，发布 = 推送触发仓库流水线）----
   "deploy:start": {
-    summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u6E05\u5355 + \u5C65\u7EA6\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
+    summary: "\u5BF9\u67D0\u4E2A persona \u8D77\u4E00\u6B21\u4E0A\u4E91\u626B\u63CF\u3002**\u6CA1\u4ED3\u5E93\u5148\u5EFA\u4ED3**\uFF08gh repo create\uFF0C\u5EFA\u5728\u7EC4\u7EC7\u4E0B\u3001\u79C1\u6709\u3001\u63A8\u9996\u4E2A\u63D0\u4EA4\uFF09\uFF0C\u518D\u8D77 persona-butler \u7684\u626B\u63CF\u4F1A\u8BDD\uFF0C\u7ED3\u679C\u5199\u8FDB persona \u76EE\u5F55\u7684 .clawd/deploy.json \uFF08\u73AF\u5883\u6E05\u5355\uFF0C\u8FDB\u4ED3\u5E93\uFF09\u4E0E .clawd/deploy-scan.json\uFF08\u8BC1\u636E\uFF0C\u4E0D\u8FDB\u4ED3\u5E93\uFF09\u3002\u5DF2\u7ECF\u5728\u626B\u7684\u8BDD\u539F\u6837\u8FD4\u56DE\u3001\u4E0D\u8D77\u7B2C\u4E8C\u4E2A\u626B\u63CF\u4F1A\u8BDD\uFF1Bowner-only",
     args: DeployPersonaArgsSchema
   },
   "deploy:get": {
@@ -23884,7 +23880,7 @@ var METHOD_DOCS = {
     args: DeployPersonaArgsSchema
   },
   "deploy:patch": {
-    summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u9009\u5C65\u7EA6\uFF08\u8C01\u51FA\u8FD9\u6761\u51ED\u636E\uFF09/ \u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1B\u5C65\u7EA6\u540D\u5FC5\u987B\u662F\u6E05\u5355\u91CC\u58F0\u660E\u8FC7\u7684\u51ED\u636E\uFF1Bowner-only",
+    summary: "\u7F16\u8F91\u90E8\u7F72\u6587\u4EF6\uFF1A\u624B\u5DE5\u8865\u4F9D\u8D56\u3002**\u4E0D\u80FD\u4ECE\u8FD9\u91CC\u4F20\u51ED\u636E\u7684\u503C**\uFF08\u503C\u8D70 deploy:putSecret\uFF09\uFF1Bowner-only",
     args: DeployPatchArgsSchema
   },
   "deploy:putSecret": {
@@ -23900,7 +23896,7 @@ var METHOD_DOCS = {
     args: DeployFinishScanArgsSchema
   },
   "deploy:release": {
-    summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u6761\u51ED\u636E\u90FD\u5B9A\u4E86\u5C65\u7EA6\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
+    summary: "\u53D1\u5E03 = \u63D0\u4EA4\u5E76\u63A8\u9001\u5230\u4ED3\u5E93\uFF1A\u91CD\u5199 workflow \u6A21\u677F \u2192 git add -A \u2192 \u7A7A\u63D0\u4EA4\u4E5F\u5141\u8BB8 \u2192 push\u3002\u4ED3\u5E93\u91CC\u7684\u6D41\u6C34\u7EBF\u63A5\u7740\u6784\u955C\u50CF\u3001\u5728\u96C6\u7FA4\u4E0A\u771F\u8D77\u4E00\u6B21\u3001\u767B\u8BB0\u6210\u6B63\u5F0F\uFF0C\u8FDB\u5EA6\u5728 GitHub Actions \u770B\u3002\u524D\u7F6E\uFF1A\u5DF2\u7ED1\u5B9A\u4ED3\u5E93\u3001\u6709\u6E05\u5355\u3001\u6BCF\u4E2A\u53D8\u91CF\u540D\u90FD\u5728 Secrets \u91CC\uFF1Bowner-only",
     args: DeployPersonaArgsSchema
   },
   "shift:list": {

package/dist/persona-defaults/persona-clawd-butler/.claude/skills/scan-persona-for-deploy/SKILL.md

@@ -82,7 +82,7 @@ call({ method: "deploy:reportFinding", args: {
 - 一份凭据含多个字段就把多个环境变量都列进 `env`（AK 是 id+secret 两个，supabase 是四个）
 - **绝对不要把凭据的值写进来**，哪怕你在文件里看到了明文的 key。你只报告「这里需要一份
   supabase 凭据」，值由老板另外填进仓库的 GitHub Secrets。看到明文 key 也不要复述它的内容。
-- **不要判断这条凭据该谁出**（部署者出还是使用者自带）。那是老板的决定，不是你能扫出来的。
+- **不要判断这条凭据该谁出**。凭据全部由部署者提供，清单只说需要什么。
 
 ### kind: "asset" —— persona 目录之外的共享资产