@clawos-dev/clawd 0.2.479 → 0.2.481

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21609,6 +21609,22 @@ var AuthGetIdentityResponseSchema = external_exports.object({
 var AuthLogoutResponseSchema = external_exports.object({
   type: external_exports.literal("auth:logout:ok")
 });
+var GatewayUrl = external_exports.string().nullable();
+var AuthApiKeyGetResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:get:ok"),
+  /** null = 还没发过。**发过就能一直看到** —— 中心存的是明文，设置页据此展示 */
+  apiKey: external_exports.string().nullable(),
+  /** ISO 时间；apiKey 为 null 时同为 null */
+  createdAt: external_exports.string().nullable(),
+  gatewayUrl: GatewayUrl
+});
+var AuthApiKeyRegenerateResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:regenerate:ok"),
+  /** 新发的那把。**旧的当场失效** —— 一人一把，按 union_id 覆盖 */
+  apiKey: external_exports.string().min(1),
+  createdAt: external_exports.string().min(1),
+  gatewayUrl: GatewayUrl
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24283,6 +24299,14 @@ var METHOD_DOCS = {
     summary: "\u767B\u51FA\u98DE\u4E66\u8EAB\u4EFD\uFF08\u6E05 owner-identity \u843D\u76D8\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:get": {
+    summary: "\u8BFB\u56DE\u81EA\u5DF1\u90A3\u628A\u4E91 persona \u8C03\u7528 key\uFF08\u6CA1\u53D1\u8FC7 \u2192 apiKey:null\uFF09\u3002daemon \u62FF\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u4EE3\u53D6\uFF0C\u51ED\u8BC1\u4E0D\u51FA ws\u3002owner-only",
+    args: NO_ARGS
+  },
+  "auth:apiKey:regenerate": {
+    summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS

package/dist/cli.cjs

@@ -6240,7 +6240,7 @@ var init_contact = __esm({
 });
 
 // ../protocol/src/feishu-auth.ts
-var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
+var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, GatewayUrl, AuthApiKeyGetResponseSchema, AuthApiKeyRegenerateResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
 var init_feishu_auth = __esm({
   "../protocol/src/feishu-auth.ts"() {
     "use strict";
@@ -6337,6 +6337,22 @@ var init_feishu_auth = __esm({
     AuthLogoutResponseSchema = external_exports.object({
       type: external_exports.literal("auth:logout:ok")
     });
+    GatewayUrl = external_exports.string().nullable();
+    AuthApiKeyGetResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:apiKey:get:ok"),
+      /** null = 还没发过。**发过就能一直看到** —— 中心存的是明文，设置页据此展示 */
+      apiKey: external_exports.string().nullable(),
+      /** ISO 时间；apiKey 为 null 时同为 null */
+      createdAt: external_exports.string().nullable(),
+      gatewayUrl: GatewayUrl
+    });
+    AuthApiKeyRegenerateResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:apiKey:regenerate:ok"),
+      /** 新发的那把。**旧的当场失效** —— 一人一把，按 union_id 覆盖 */
+      apiKey: external_exports.string().min(1),
+      createdAt: external_exports.string().min(1),
+      gatewayUrl: GatewayUrl
+    });
     AuthLoginDoneEventSchema = external_exports.object({
       type: external_exports.literal("auth:login:done"),
       identity: FeishuIdentitySchema
@@ -9235,6 +9251,14 @@ var init_methods = __esm({
         summary: "\u767B\u51FA\u98DE\u4E66\u8EAB\u4EFD\uFF08\u6E05 owner-identity \u843D\u76D8\uFF09\u3002owner-only",
         args: NO_ARGS
       },
+      "auth:apiKey:get": {
+        summary: "\u8BFB\u56DE\u81EA\u5DF1\u90A3\u628A\u4E91 persona \u8C03\u7528 key\uFF08\u6CA1\u53D1\u8FC7 \u2192 apiKey:null\uFF09\u3002daemon \u62FF\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u4EE3\u53D6\uFF0C\u51ED\u8BC1\u4E0D\u51FA ws\u3002owner-only",
+        args: NO_ARGS
+      },
+      "auth:apiKey:regenerate": {
+        summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
+        args: NO_ARGS
+      },
       "device:list": {
         summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
         args: NO_ARGS
@@ -54732,7 +54756,7 @@ var L = [
   "# \u6784\u5EFA\u5668 / \u6D41\u6C34\u7EBF\u811A\u672C / \u968F\u884C\u8D44\u4EA7\u5728 ottin4ttc/clawos \u4ED3\u5E93\u91CC\uFF0C\u8FD9\u91CC checkout \u4E00\u4EFD\u6765\u7528\u3002",
   "#",
   "# \u8981\u7684\u7EC4\u7EC7\u7EA7 Secrets\uFF1AALI_DOCKER_USERNAME / ALI_DOCKER_PASSWORD\uFF08\u63A8 ACR\uFF09\u3001CLAWOS_READ_TOKEN",
-  "#\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY / CLAWD_GATEWAY_API_KEY\uFF1B\u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
+  "#\uFF08\u8BFB clawos \u4ED3\u5E93\uFF09\u3001CLAWD_GATEWAY_ADMIN_KEY\uFF1B\u7EC4\u7EC7\u7EA7 Variable\uFF1ACLAWD_GATEWAY_URL\u3002",
   "# \u4ED3\u5E93\u7EA7\u540C\u540D\u914D\u7F6E\u4F1A\u76D6\u8FC7\u7EC4\u7EC7\u7EA7\u2014\u2014\u67D0\u4E2A persona \u8981\u6307\u5230\u53E6\u4E00\u53F0 gateway\uFF0C\u5728\u81EA\u5DF1\u4ED3\u5E93\u91CC\u914D\u5373\u53EF\u3002",
   "",
   "on:",
@@ -54764,6 +54788,10 @@ var L = [
   "      image: ${{ steps.plan.outputs.image }}",
   "      persona_id: ${{ steps.plan.outputs.persona_id }}",
   "      env_names: ${{ steps.plan.outputs.env_names }}",
+  // 云上跑哪个模型 = 发布这一刻 persona 配的（build 段从仓库里的 .clawd/persona.json 读）。
+  // smoke 与 deploy 都要：smoke 得用正式那份模型探活，否则验的不是将要上线的东西。
+  "      model: ${{ steps.plan.outputs.model }}",
+  "      effort: ${{ steps.plan.outputs.effort }}",
   "    steps:",
   "      - name: Checkout persona",
   "        uses: actions/checkout@v4",
@@ -54878,13 +54906,14 @@ var L = [
   "        env:",
   "          CLAWD_GATEWAY_URL: ${{ vars.CLAWD_GATEWAY_URL }}",
   "          CLAWD_GATEWAY_ADMIN_KEY: ${{ secrets.CLAWD_GATEWAY_ADMIN_KEY }}",
-  "          CLAWD_GATEWAY_API_KEY: ${{ secrets.CLAWD_GATEWAY_API_KEY }}",
   "          CLAWD_SECRETS_JSON: ${{ toJSON(secrets) }}",
   "          CLAWD_ENV_NAMES: ${{ needs.build.outputs.env_names }}",
   "        run: |",
   "          node clawos/cloud-host/pipeline/smoke.mjs \\",
   "            --image '${{ needs.build.outputs.image }}' \\",
   "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
+  "            --model '${{ needs.build.outputs.model }}' \\",
+  "            --effort '${{ needs.build.outputs.effort }}' \\",
   "            --run-number '${{ github.run_number }}'",
   "",
   "  deploy:",
@@ -54912,7 +54941,9 @@ var L = [
   "        run: |",
   "          node clawos/cloud-host/pipeline/register.mjs \\",
   "            --image '${{ needs.build.outputs.image }}' \\",
-  "            --persona-id '${{ needs.build.outputs.persona_id }}'",
+  "            --persona-id '${{ needs.build.outputs.persona_id }}' \\",
+  "            --model '${{ needs.build.outputs.model }}' \\",
+  "            --effort '${{ needs.build.outputs.effort }}'",
   ""
 ];
 var WORKFLOW_TEMPLATE = L.join("\n");
@@ -55349,6 +55380,13 @@ function buildDeployHandlers(deps) {
     }
     const missing = requiredEnvNames(file).filter((e) => !present.has(e));
     if (missing.length > 0) blockers.push(`${missing.join(" / ")} \u8FD8\u6CA1\u586B`);
+    const engine = deps.personaEngine(personaId2);
+    const tool = engine?.tool || "claude";
+    if (tool !== "codex") {
+      blockers.push(`\u5F15\u64CE\u662F ${tool}\uFF0C\u4E91\u4E0A\u53EA\u8DD1 Codex\u2014\u2014\u53BB persona \u8BBE\u7F6E\u91CC\u628A\u5F15\u64CE\u5207\u6210 Codex\uFF0C\u518D\u9009\u4E2A\u6A21\u578B`);
+    } else if (!engine?.model) {
+      blockers.push("\u8FD8\u6CA1\u9009\u6A21\u578B\uFF08\u5207\u5F15\u64CE\u65F6\u4F1A\u6E05\u7A7A\uFF09\u2014\u2014\u53BB persona \u8BBE\u7F6E\u91CC\u9009\u4E00\u4E2A");
+    }
     if (blockers.length > 0) throw invalid(`\u8FD8\u5DEE\uFF1A${blockers.join("\uFF1B")}`);
     try {
       const result = await release(deps.exec, { dir, now: deps.now });
@@ -61556,6 +61594,40 @@ async function centralPrincipalStatus(opts) {
   }
   return { active: body.active };
 }
+async function centralGetApiKey(opts) {
+  const body = await centralRequest(
+    opts,
+    `/api/persona-cloud/api-key?provider=${encodeURIComponent(opts.provider)}`,
+    { method: "GET", bearer: opts.ttcJwt }
+  );
+  if (body.apiKey !== null && typeof body.apiKey !== "string") {
+    throw new CentralClientError("BAD_RESPONSE", "api-key: apiKey must be string or null");
+  }
+  return {
+    apiKey: body.apiKey,
+    createdAt: typeof body.createdAt === "string" ? body.createdAt : null,
+    // 中心没配就是 null —— 不当成错误，key 本身照样有效
+    gatewayUrl: typeof body.gatewayUrl === "string" ? body.gatewayUrl : null
+  };
+}
+async function centralIssueApiKey(opts) {
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "POST",
+    bearer: opts.ttcJwt,
+    body: { provider: opts.provider }
+  });
+  if (typeof body.apiKey !== "string" || body.apiKey.length === 0) {
+    throw new CentralClientError("BAD_RESPONSE", "api-key: missing apiKey");
+  }
+  if (typeof body.createdAt !== "string" || body.createdAt.length === 0) {
+    throw new CentralClientError("BAD_RESPONSE", "api-key: missing createdAt");
+  }
+  return {
+    apiKey: body.apiKey,
+    createdAt: body.createdAt,
+    gatewayUrl: typeof body.gatewayUrl === "string" ? body.gatewayUrl : null
+  };
+}
 async function centralListDevices(opts) {
   const body = await centralRequest(
     opts,
@@ -63966,6 +64038,7 @@ function buildWhoamiHandler(deps) {
 }
 
 // src/handlers/feishu-auth.ts
+init_protocol();
 function buildFeishuAuthHandlers(deps) {
   const loginStart = async () => {
     const { authUrl, state } = deps.loginFlow.start();
@@ -63994,10 +64067,34 @@ function buildFeishuAuthHandlers(deps) {
       response: { type: "auth:logout:ok" }
     };
   };
+  function requireLogin() {
+    const record3 = deps.ownerIdentityStore.read();
+    if (!record3) {
+      throw new ClawdError(
+        ERROR_CODES.FEISHU_LOGIN_REQUIRED,
+        "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u62FF\u4E0D\u5230\u4E91 persona \u7684\u8C03\u7528 key"
+      );
+    }
+    return { ttcJwt: record3.ttcToken, provider: record3.identity.provider };
+  }
+  const apiKeyGet = async () => {
+    const { apiKey, createdAt, gatewayUrl } = await deps.apiKeyClient.get(requireLogin());
+    return {
+      response: { type: "auth:apiKey:get:ok", apiKey, createdAt, gatewayUrl }
+    };
+  };
+  const apiKeyRegenerate = async () => {
+    const { apiKey, createdAt, gatewayUrl } = await deps.apiKeyClient.issue(requireLogin());
+    return {
+      response: { type: "auth:apiKey:regenerate:ok", apiKey, createdAt, gatewayUrl }
+    };
+  };
   return {
     "auth:login:start": loginStart,
     "auth:getIdentity": getIdentity,
-    "auth:logout": logout
+    "auth:logout": logout,
+    "auth:apiKey:get": apiKeyGet,
+    "auth:apiKey:regenerate": apiKeyRegenerate
   };
 }
 
@@ -64238,6 +64335,9 @@ var METHOD_GRANT_MAP = {
   "auth:login:start": ADMIN_ANY,
   "auth:getIdentity": ADMIN_ANY,
   "auth:logout": ADMIN_ANY,
+  // 云 persona 调用 key：本机主人自己的东西，guest 一律够不着
+  "auth:apiKey:get": ADMIN_ANY,
+  "auth:apiKey:regenerate": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
   // 设备目录 / 连接都是 owner 本机操作（用 owner 的 ttcJwt 找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
@@ -64301,7 +64401,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.479".length > 0 ? "0.2.479" : "dev";
+var version = "0.2.481".length > 0 ? "0.2.481" : "dev";
 
 // src/cli-probe/probe.ts
 var fs70 = __toESM(require("fs"), 1);
@@ -69302,6 +69402,12 @@ async function startDaemon(config) {
           ownerId = "";
           ownerProvider = "";
           ownerDisplayName = loadOwnerDisplayName(config.dataDir);
+        },
+        // 云 persona 调用 key（design 2026-09-08）：daemon 拿本机登录凭证向中心代取。
+        // 凭证不出 ws —— UI 只拿到 key 本身，跟 exchange / listDevices 同一条纪律。
+        apiKeyClient: {
+          get: (args) => centralGetApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
+          issue: (args) => centralIssueApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 设备目录 + 连接（决策 #15：daemon 代理中心 server）。
@@ -69469,6 +69575,11 @@ async function startDaemon(config) {
   const deployHandlers = buildDeployHandlers({
     hasPersona: (personaId2) => personaStore.has(personaId2),
     personaDir: (personaId2) => personaStore.personaDirPath(personaId2),
+    // 发布前落闸要看它现在配的引擎和模型（云上只跑 codex，且模型跟着这次发布走）
+    personaEngine: (personaId2) => {
+      const p2 = personaRegistry.get(personaId2);
+      return p2 ? { ...p2.tool ? { tool: p2.tool } : {}, ...p2.model ? { model: p2.model } : {} } : void 0;
+    },
     exec: runCommand,
     org: PERSONA_REPO_ORG,
     now: () => Date.now(),

package/dist/dispatch/mcp-server.cjs

@@ -21602,6 +21602,22 @@ var AuthGetIdentityResponseSchema = external_exports.object({
 var AuthLogoutResponseSchema = external_exports.object({
   type: external_exports.literal("auth:logout:ok")
 });
+var GatewayUrl = external_exports.string().nullable();
+var AuthApiKeyGetResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:get:ok"),
+  /** null = 还没发过。**发过就能一直看到** —— 中心存的是明文，设置页据此展示 */
+  apiKey: external_exports.string().nullable(),
+  /** ISO 时间；apiKey 为 null 时同为 null */
+  createdAt: external_exports.string().nullable(),
+  gatewayUrl: GatewayUrl
+});
+var AuthApiKeyRegenerateResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:regenerate:ok"),
+  /** 新发的那把。**旧的当场失效** —— 一人一把，按 union_id 覆盖 */
+  apiKey: external_exports.string().min(1),
+  createdAt: external_exports.string().min(1),
+  gatewayUrl: GatewayUrl
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24275,6 +24291,14 @@ var METHOD_DOCS = {
     summary: "\u767B\u51FA\u98DE\u4E66\u8EAB\u4EFD\uFF08\u6E05 owner-identity \u843D\u76D8\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:get": {
+    summary: "\u8BFB\u56DE\u81EA\u5DF1\u90A3\u628A\u4E91 persona \u8C03\u7528 key\uFF08\u6CA1\u53D1\u8FC7 \u2192 apiKey:null\uFF09\u3002daemon \u62FF\u672C\u673A\u767B\u5F55\u51ED\u8BC1\u5411\u4E2D\u5FC3\u4EE3\u53D6\uFF0C\u51ED\u8BC1\u4E0D\u51FA ws\u3002owner-only",
+    args: NO_ARGS
+  },
+  "auth:apiKey:regenerate": {
+    summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS